- Freeradius-Users - lists.freeradius.org

rlm_perl
by Bassem Mettichi 06 Feb '18

06 Feb '18

Hello, i have compiled perl latest version from source then i have compiled freeradius in order to make rlm_perl work. But i have an issue when i execute the ld command: ldd /opt/freeradius/current/lib/rlm_perl.so i get this: linux-vdso.so.1 => (0x00007ffe5fc4d000) libperl.so => /usr/local/lib/perl5/5.26.1/x86_64-linux/CORE/libperl.so (0x00007f2e20b15000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2e208ec000) libnsl.so.1 => /lib64/libnsl.so.1 (0x00007f2e206d3000) libdl.so.2 => /lib64/libdl.so.2 (0x00007f2e204cf000) libm.so.6 => /lib64/libm.so.6 (0x00007f2e201cc000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007f2e1ff95000) libutil.so.1 => /lib64/libutil.so.1 (0x00007f2e1fd92000) libc.so.6 => /lib64/libc.so.6 (0x00007f2e1f9ce000) /lib64/ld-linux-x86-64.so.2 (0x000055bfb2e85000) libfreebl3.so => /lib64/libfreebl3.so (0x00007f2e1f7cb000) my problem is that i don't see this module: libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f028153b000) how can i compile lib_perl with this module please or must i compile perl with this module in order to make rlm_perl see this module? someone could help me please? Best Regards Mettichi Bassem

3 7

Updated documentation, list etiquette, and radiusd -X
by Alan DeKok 05 Feb '18

05 Feb '18

Matthew Newton has written some excellent documentation on how to use the mailing list: http://wiki.freeradius.org/list-help Topics include how to ask good questions, why the debug output is important, etc. I suspect that from now on, answers to bad questions will simply be a link to that page. Since the debug output can be long, opaque, and intimidating, I've also written a guide. The guide explains what the various messages mean, and what the server is doing: http://wiki.freeradius.org/radiusd-X I hope these two guides are useful. Alan DeKok.

4 4

different user file for virtual server
by Matus UHLAR - fantomas 05 Feb '18

05 Feb '18

Hello, I'm configuring freeradius 2.2.5 (debian 8) I need to define two different user files for two virtual hosts - different types of users for different types of services. I have tried to follow docs and set up: modules/files: files files_netdev { usersfile = ${confdir}/users_netdev } from default and example virtual host I have created: sites-enabled/virtual_netdev: listen { type = auth port = 1822 virtual_server = virtual_netdev } server virtual_netdev { authorize { preprocess files_netdev chap mschap digest netdev expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest } } however the log file tells me: Thu Jan 25 13:48:54 2018 : Error: /etc/freeradius/sites-enabled/virtual_netdev[10]: Failed to find "files_netdev" in the "modules" section. Thu Jan 25 13:48:54 2018 : Error: /etc/freeradius/sites-enabled/virtual_netdev[8]: Errors parsing authorize section. Thu Jan 25 13:48:54 2018 : Error: Failed to load virtual server virtual_netdev any hint what is the mistake I did? Thank you -- Matus UHLAR - fantomas, uhlar(a)fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Fighting for peace is like fucking for virginity...

2 4

Freeradius dhcp module configuration
by Daniel Ryšlink 05 Feb '18

05 Feb '18

Hello, First of all, I apologize for anything wrong in my approach or method (there is probably plenty), but my time is running short and so I come here to ask for advice. I am trying to setup a Freeradius server with a DHCP virtual server. An example from my users file: Gi0/19:10.010B465454582D535749544348 Cleartext-Password := "juniper-bng1" ERX-Ingress-Policy-Name := FF-1M, ERX-CoS-Shaping-Pmt-Type = "T02 2m", ERX-Cos-Scheduler-Pmt-Type = "VOIP-SCH T10 100k", Framed-IP-Address := 10.10.100.150 Gi0/20:10.010b465454582d535749544348 Cleartext-Password := "juniper-bng1", Pool-Name := "hohola" ERX-Ingress-Policy-Name := FF-1M, ERX-CoS-Shaping-Pmt-Type = "T02 2m", ERX-Cos-Scheduler-Pmt-Type = "VOIP-SCH T10 100k" There are two types of users - those who have a static IP set via the Framed-IP-Address as shown in the example above, and those who get their IP from the pool called "hohola" - for this purpose, I set up the ippool module: ippool hohola { filename = ${db_dir}/db.ippool range_start = 10.10.100.5 range_stop = 10.10.100.254 netmask = 255.255.255.0 cache_size = 800 ip_index = ${db_dir}/db.ipindex override = no maximum_timeout = 0 key = "%{ADSL-Agent-Circuit-Id}%{DHCP-Relay-Circuit-Id}%{ADSL-Agent-Remote-Id}%{DHCP-Relay-Remote-Id}" } The idea behind the "key" line is that the user should be identified by both the combination of Circuit-ID and Remote-ID (Option 82), and ADSL-Agent-Circuit-Id and ADSL-Agent-Remote-Id are present in the Radius packet but absent from the DHCP packet, but DHCP-Relay-Circuit-Id and DHCP-Relay-Remote-Id are present in the DHCP packet and absent from the Radius packet. Thus, no matter if the pool is called by the Radius or the DHCP virtual server, this line always expand to the same key for a given user. I have read in the docs that there is the DHCP configuration (mods-available/dhcp) file that allows to "decode the Option 82 values", but I did not manage to get it working since there is no working example in the documentation, and I could not even google one up. My questions: 1) If the address is in the static Framed-IP-Address in the users (files/authorize) file, how do I tell the DHCP server to use it for the given user via the ippool module when the DHCP request comes? 2) When assigning a dynamic address from the 'hohola' pool, I managed to get it working, but the Radius assigns one address and creates an entry in the ippool database, and then the DHCP server discovers that for a given key there is already an entry, but decides it is "stale", and assigns another IP address. Any advice would be most welcome, thank you in advance. -- S pozdravem, Daniel Ryšlink System Administrator Dial Telecom a. s. Křižíkova 36a/237 186 00 Praha 3, Česká Republika Tel.:+420.226204627 daniel.ryslink(a)dialtelecom.cz ----------------------------------------------- www.dialtelecom.cz Dial Telecom, a.s. Jednoduše se připojte -----------------------------------------------

3 3

Re: Freeradius dhcp module configuration
by Alan Buxey 05 Feb '18

05 Feb '18

files files_dhcp { } The named module directive is documented alan On 5 Feb 2018 3:57 am, "Daniel Ryšlink" <ryslink(a)dialtelecom.cz> wrote: Hello, You mention that I should "create a "files_dhcp" which is a variant of the "files" module for DHCP users." I have tried several times, but if I just define it as files { } Freeradius will report that Duplicate module "files files", in file /etc/freeradius/3.0/mods-enabled/files:9 and file /etc/freeradius/3.0/mods-enabled/files_dhcp:9 If I try to define it as files_dhcp { } then the result is: /etc/freeradius/3.0/mods-enabled/files_dhcp[9]: Failed to link to module 'rlm_files_dhcp': /usr/lib/freeradius/rlm_files_dhcp.so: cannot open shared object file: No such file or directory Let's say that I would just have a file that uses as key the string "%{DHCP-Relay-Circuit-Id}%{DHCP-Relay-Remote-Id}" (Option 82 user identification) as a key, then some kind of delimiter, then the IP address that should be statically assigned to this user. If the user is not found in the list, he should be assigned an IP address from a single, simple pool. That's all I need from the DHCP Virtual Server. Could you please, please perhaps hint about how the syntax of the relevant dhcp configuration files should look like? I am really stuck, I have read every file in mods-available/, sites-available/, I have read all the wiki on http://networkradius.com/doc/current/ , but I am still stuck. I would be extremely grateful for any advice. Thank you in advance. -- S pozdravem, Daniel Ryšlink System Administrator Dial Telecom a. s. Křižíkova 36a <https://maps.google.com/?q=K%C5%99i%C5%BE%C3%ADkova+36a&entry=gmail&source=g> /237 186 00 Praha 3, Česká Republika Tel.:+420.226204627 daniel.ryslink(a)dialtelecom.cz ----------------------------------------------- www.dialtelecom.cz Dial Telecom, a.s. Jednoduše se připojte ----------------------------------------------- On 29.1.2018 14:54, Alan DeKok wrote: > On Jan 29, 2018, at 7:23 AM, Daniel Ryšlink <ryslink(a)dialtelecom.cz> > wrote: > >> First of all, I apologize for anything wrong in my approach or method >> (there is probably plenty), but my time is running short and so I come here >> to ask for advice. >> >> I am trying to setup a Freeradius server with a DHCP virtual server. An >> example from my users file: >> >> Gi0/19:10.010B465454582D535749544348 Cleartext-Password := >> "juniper-bng1" >> > You don't need passwords for DCHCP. > > ERX-Ingress-Policy-Name := FF-1M, >> ERX-CoS-Shaping-Pmt-Type = "T02 2m", >> ERX-Cos-Scheduler-Pmt-Type = "VOIP-SCH T10 100k", >> > These attributes don't go into DHCP packets/ > > The idea behind the "key" line is that the user should be identified by >> both the combination of Circuit-ID and Remote-ID (Option 82), and >> ADSL-Agent-Circuit-Id and ADSL-Agent-Remote-Id are present in the Radius >> packet but absent from the DHCP packet, but DHCP-Relay-Circuit-Id and >> DHCP-Relay-Remote-Id are present in the DHCP packet and absent from the >> Radius packet. Thus, no matter if the pool is called by the Radius or the >> DHCP virtual server, this line always expand to the same key for a given >> user. >> > OK. > > I have read in the docs that there is the DHCP configuration >> (mods-available/dhcp) file that allows to "decode the Option 82 values", >> but I did not manage to get it working since there is no working example in >> the documentation, and I could not even google one up. >> >> My questions: >> >> 1) If the address is in the static Framed-IP-Address in the users >> (files/authorize) file, how do I tell the DHCP server to use it for the >> given user via the ippool module when the DHCP request comes? >> > Read raddb/sites-available/dhcp. Just list "ippool" in the virtual > server. And also, create a "files_dhcp" which is a variant of the "files" > module for DHCP users. > > 2) When assigning a dynamic address from the 'hohola' pool, I managed to >> get it working, but the Radius assigns one address and creates an entry in >> the ippool database, and then the DHCP server discovers that for a given >> key there is already an entry, but decides it is "stale", and assigns >> another IP address. >> > Because it hasn't been updated with the appropriate DHCP information. > > You can't just create one set of policies / modules, and have them work > for *both* DHCP and RADIUS. The protocols are different, and need > different management. > > Alan DeKok. > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html

1 0

rlm_eap: SSL error error:0D07209B:asn1 encoding routines:ASN1_get_object:too long
by Michael Duckett 04 Feb '18

04 Feb '18

Can someone help me understand what I'm doing wrong? I would be so appreciative! Tried freeradius on both ubuntu and mac o/s. Getting rlm_eap: SSL error error:0D07209B:asn1 encoding routines:ASN1_get_object:too long error. Verified certificates with openssl. Ubuntu freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Jul 26 2017 at 15:27:21 openssl version OpenSSL 1.0.2g 1 Mar 2016 Here's info from the log: [tls] --> verify return:1 [tls] TLS_accept: unknown state [tls] <<< Unknown TLS version [length 0005] [tls] <<< Unknown TLS version [length 0106] [tls] TLS_accept: unknown state [tls] <<< Unknown TLS version [length 0005] [tls] <<< Unknown TLS version [length 0088] [tls] >>> Unknown TLS version [length 0005] [tls] >>> Unknown TLS version [length 0002] *TLS Alert write:fatal:decrypt error* * TLS_accept: failed in error* *rlm_eap: SSL error error:0D07209B:asn1 encoding routines:ASN1_get_object:too long* *SSL: SSL_read failed inside of TLS (-1), TLS session fails.* *TLS receive handshake failed during operation* [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type Reject Thanks in advance for any help you can provide. Mike

3 3

debug: memory access issue when running with -Xxxx
by Isaac Boukris 04 Feb '18

04 Feb '18

Hi, I was trying to debug move verbosely, with -Xxxx (wish I hadn't) and encountered the error below (sometimes it crashes sometimes it just hangs): *** Error in `/usr/local/sbin/radiusd': malloc(): memory corruption: 0x000000000096c690 *** When using valgrind it doesn't crash but does give some insights, see attached both gdb and valgrind logs (with -Xxxx). I spent a couple of hours on this today, but only managed to somehow prevent the mschap crash but then there is another one, it is probably wrong but might give an idea. [admin@kdc freeradius-server]$ git diff diff --git a/src/lib/value.c b/src/lib/value.c index ca18327af..442d81e47 100644 --- a/src/lib/value.c +++ b/src/lib/value.c @@ -1381,8 +1381,8 @@ ssize_t value_data_cast(TALLOC_CTX *ctx, value_data_t *dst, if (src_type == PW_TYPE_OCTETS) { do_octets: - value_data_hton(dst, dst_type, src->octets, src_len); - return src_len; + value_data_hton(dst, dst_type, src, sizeof(value_data_t)); + return sizeof(value_data_t);; } Thanks, Isaac

1 0

Encrypting connections to the DB (SSL/TLS to MySQL)
by Timofei C 04 Feb '18

04 Feb '18

Hi all, After looking through the documentation, I cannot see how to implement SSL/TLS connections to MySQL on FreeRADIUS 2/3. There's lots of information on EAP-TLS, but not on the sql module. Any help would be greatly appreciated? Even if it's to RTFM. TIA

2 1

Deny /Allow Users from Access some websites
by Muhammed Buvaydani 03 Feb '18

03 Feb '18

Hello I working on freeradius management system and every thing go fine . But I wish to know if I can deny /allow users from accessing some websites ie (can I deny users from access facebook or twitter ) Can I do this using freeradius?

2 1

Freeradius users ldap
by Tsirkas Georgios 02 Feb '18

02 Feb '18

Hello, I have connected ldap with freeradius. I want to define clients hardcoded in configuration file. Where i will define them? In ldap configuration file or in /etc/freeradius/3.0/users ? Someone who can help me about the configuration files priorities? Thank you

2 4