- Freeradius-Users - lists.freeradius.org

Semi-OT: Mime type for CA certificates on Android (landing page browser)
by Mathieu Simon (Lists) 01 May '19

01 May '19

Hi It's partially off-topic to FreeRADIUS specifically, however it's related to provisioning and configuration so I give it a shot: I've been sending users through a open setup-only SSID to an informational page where I'd either forward them to enterprise-wifi.net (previously 802.1x-config.org) for platforms supported there. For others like Android I'd provide instructions on how to get connected manually. On that page we'd link a download to the CA certificate the Android supplicant should trust for the encrypted SSID and I'd show the users how to get it loaded. I remember this having worked over a couple of Android vendors. I've come to realize that more recent Android's landing page browsers would request the certificate (according to the Webserver logs) but then wouldn't do anything on the user side. - Users can't even download it. Back then I remember that I had to tweak the MIME type for Apple's .mobileconfig and certificate files (application/x-apple-aspen-config) files on the webserver. Also some Androids required to set application/x-x509-ca-cert for PEM encoded CA certificates to be downloaded correctly but that doesn't seem to work anymore. (wget --verbose shows the type) Is there something Android / Chrome has changed that I need to take care of in order to fix certificate downloads? Maybe people related to eduroam have experience? (Though eduroam can use an Android app, even if it's not perfect yet) Regards Mathieu

1 0

Bootstrap overwrite my certs
by Rafael Leiva-Ochoa 30 Apr '19

30 Apr '19

Hi Everyone, I recently upgraded to 3.0.19-1 and I noticed after I restarted the service I was getting the following errors: Apr 29 22:01:29 freeradius systemd[1]: Starting FreeRADIUS high performance RADIUS server.... Apr 29 22:01:30 freeradius sh[1970]: make: *** No rule to make target 'server.cnf', needed by 'passwords.mk'. Stop. Apr 29 22:01:30 freeradius systemd[1]: radiusd.service: Control process exited, code=exited status=2 Apr 29 22:01:30 freeradius systemd[1]: radiusd.service: Failed with result 'exit-code'. Apr 29 22:01:30 freeradius systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. Apr 29 22:01:30 freeradius audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=radiusd comm="systemd " exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' After a lot of digging, I found that a "bootstrap" script on the /etc/raddb/certs/ directory was being called on the /usr/lib/systemd/system/radiusd.service. This script overwrote my current certificate files. I had to comment out the ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap to fix the problem. I am not sure if anyone else encountered this problem before. Is this being addressed on future releases? Thanks, Rafael

2 4

freeradius monitoring
by Satish Patel 30 Apr '19

30 Apr '19

Folks, I am reading this page https://wiki.freeradius.org/config/Status and trying to configure freeradius monitoring, seems like i am missing something. somehow i don't have /etc/raddb/mods-available/status file because i have install freeradius using yum install finally after google i found sample status file and i put that in mods-enabled directory and now i am getting this error Failed to link to module 'rlm_server': /usr/lib64/freeradius/rlm_server.so: cannot open shared object file: No such file or directory Now my question is by default radiusd.conf has status_server = yes so any client can query so i have try following and i got this reply. [root@radius]# echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 1, Response-Packet-Type = Access-Accept" | radclient -x localhost:1812 status testing123 Sent Status-Server Id 62 from 0.0.0.0:57892 to 127.0.0.1:18120 length 50 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = Authentication Response-Packet-Type = Access-Accept Received Access-Accept Id 62 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 getting no other data back from radius

3 5

Re: SQL not a variable
by Nicolas Breuer 30 Apr '19

30 Apr '19

Hello, It's not working... allocate-find = "SELECT ip_address FROM radippool WHERE (pool_name like '%{reply:Pool-Suffix}*%%' and pool_name not like '%%STATx%%') AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE" [IP-POOLING-01] expand: SELECT ip_address FROM radippool WHERE (pool_name like '%{reply:Pool-Suffix}*%' and pool_name not like '%STATx%') AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE -> SELECT ip_address FROM radippool WHERE (pool_name like 'BC*%' and pool_name not like '2019-04-30 17:55:08TATx%') AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE What I'm doing wrong?

2 1

SQL not a variable
by Nicolas Breuer 30 Apr '19

30 Apr '19

Hello, In the module IP POOL, I'm trying to use the "%" SQL chars. allocate-find = "SELECT ip_address FROM radippool WHERE (pool_name like '%{reply:Pool-Suffix}*\%' and pool_name not like '\%STAT\%')..... The issue is that the module expand the %S as a variable. (Time) What can I do to avoid that ? Thanks

3 2

RE: redis_ippool module doesnot process lease_time in ack
by Chinnapaiyan, Nagamani 30 Apr '19

30 Apr '19

Hi, We are blocked here. Can you please give some suggestions? Regards, Nagamani Chinnapaiyan

2 1

Failed retrieving values required to evaluate condition
by Christoph Litauer 30 Apr '19

30 Apr '19

Dear Freeradius-Users, I am not an experienced radius admin, so maybe you can give me a hint. I read the manuals, the logs and google, but without success. My wlan users authenticate themselves against eap/ldap. But for guests I generate a file with credentials. This worked for some years now. Because of changing root certificates I had to introduce two different eap-configurations (eap and eapoldca). These are used in the default site and inner-tunnel site via switch that decides on the outer User-Name which certificates are used. So I changed eap { ok = return } to if (&User-Name == "eduroam(a)uni-koblenz.de") { eap { ok = return } } else { eapoldca { ok = return } } This works for all wlan users except guests. If a guest tries to authenticate, at the end I get (8) if (&Called-Station-SSID == "ubnt") { (8) ERROR: Failed retrieving values required to evaluate condition This is because Called-Station-SSID is unset at this point. I don't think this is the root cause, instead the reason seems to be, that the "ok = return" statements exit the if ()-clause but not the authorize section. But as I said, I am not an expert ... You will find sites-enabled/{default,inner-tunnel}, mods-enabled/eap und a log file here: https://cloud.uni-koblenz-landau.de/s/cBrpcCgCAp9JjTr The radius log was generated while trying to connect to SSID ubnt using test/test as authentication. Any help is greatly appreciated. -- Kind regards Christoph _________________________________________ Uni Koblenz, Computing Centre, Office A 022 Postfach 201602, 56016 Koblenz Fon: +49 261 287-1311, Fax: -100 1311

2 1

Re: The Unix Radius attributes
by Full Name 30 Apr '19

30 Apr '19

On Apr 29, 2019, at 1:06 PM, Full Name <nuncestbibendum(a)excite.com> wrote: >> >> Freeradius ships with a dictionary file named dictionary.unix, that contains the following attributes: > > Yes, we know. There's no need to post configuration files to the list. Sorry - I just wanted to illustrate what I mean. >> Is the goal of this set of attributes to enable a Radius server to send back UID, GID, etc. information for a user that has been authenticated by the >> RADIUS server? If so, why use FTP in the name of the attributes? I mean, a Radius server will not be able to know whether the users being >> authenticated is accessing the target system via FTP, or some other service, right? > > IIRC, the dictionary was used by some FTP server ~20 years ago. I don't think it's been used for anything since. OK, thanks. What makes this interesting to me is that such attributes are meant to convey UID, GID, home directory and shell name information for the authenticated user to the system on whose behalf the authentication is carried out. > And no, the *name* of the attribute is irrelevant. It doesn't mean anything. I am aware of that. I was just thinking that, without the FTP, using them for purposes other than FTP would be more elegant. They can, of course, be used with the FTP string just the same. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.htm

2 1

Freeradius captive protal with Freeipa or ldap
by mustafa taha 29 Apr '19

29 Apr '19

Hi all , I am trying to limit user WiFi time , for example "1 hour a day for a client" . I read many documents about that , but they all use MySQL as database , so I want ask if I can make this in freeradius with Freeipa as database. i think if we can use *Password expiration or *Kerberos principal expiration attribute to make limit of the user time . can anybody help ? <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> Virus-free. www.avg.com <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> <#m_7906311293261143546_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

2 1

Simultaneous-Use
by Sudheer Satyanarayana 29 Apr '19

29 Apr '19

Hello, I am trying to use the Simultaneous-Use feature of FreeRADIUS. I have some questions regarding https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configurati… I am using SQL and I have set Simultaneous-Use to 1 with the := operator. I can see this in debug output. Is the implementation notes regarding radutmp valid for SQL too? I have verified that simul_count_query and simul_verify_query are syntactically correct. When I execute them manually, I see some SQL results in PostgreSQL console. I tried to run radcheck like this: checkrad -d other 192.168.3.5 0 testuser01 'ACA31EB30AD1-70BBE9363CBC-5CC2A65E-8DAD3' Returning 1 (double detected) I am using Aruba NAS. I do not know what NAS-Type to use. I tried 'other' and it doesn't seem to have any effect. Should I be looking at getting checkrad to work first before doing anything else? If so, any tips to get this to work with Aruba NAS would be appreciated. At the moment, FreeRADIUS allows login from two devices at the same time for the same user. I am not sure what approach to take here. Some guidance would be appreciated. - Sudheer S

3 5