- Freeradius-Users - lists.freeradius.org

Radius, Database and integrated Captive-Portal. Appliance Hotspot BreldoItalia
by bruno d'ambrosio 23 Jan '18

23 Jan '18

Dear users, round to the internet I noticed this wonderful company the "BreldoItalia Engieering Wireless" that deals with the engineering and development of Stand-Alone Hotspot Appliances, Wi-Fi indoor/outdoor products and Appliance Firewall for data network security. The main part that I could not take my eyes off is their firmware "Breldo O.S", a simple firmware where used as a hotspot system integrates a radius server, database and captive-portal. In fact, their Hotspot Appliances do not use any external server or cloud, the whole hotspot system works locally on their appliances. For more information visit their website: www.breldoitalia.it<http://www.breldoitalia.it> Best Regard Bruno D'Ambrosio

5 7

Re: Radius, Database and integrated Captive-Portal. Appliance Hotspot BreldoItalia
by Nathan Ward 23 Jan '18

23 Jan '18

> On 23/01/2018, at 11:55 PM, bruno d'ambrosio <brunodambrosio2011(a)hotmail.it <mailto:brunodambrosio2011@hotmail.it>> wrote: > > Hello Dear User > As I understand it, first the project was called BreldoItalia Wi-Fi Hotspot, now called BreldoItalia Engineering Wireless. > They have designed a nice stand-alone hotspot system to be tried absolutely. > I'm just saying that if you can use their product to see how their system works it's not bad. > I'm not advertising even I know them to BreldoItalia. You say here “It’s not bad” - which means you must have used it. But you also say: > On 23/01/2018, at 11:04 PM, bruno d'ambrosio <brunodambrosio2011(a)hotmail.it <mailto:brunodambrosio2011@hotmail.it>> wrote: > > I've never tried the BreldoItalia Hotspot system In English there is an idiom, “digging yourself in to a hole”. It refers to when you get stuck in a story or a lie or some sort of bad situation (a “hole”) and you keep talking trying to talk your way out of it, when you are actually making it worse for yourself. I don’t know if it’s a common phrase, but a friend of mine says “dig up” as a joke, referring to this. It means: “you’re in a hole, keep talking/digging out of it” - obviously if you’re in a hole, keeping digging/talking doesn’t get you out, it just gets you deeper in to it! We all know what it means, we accept that we’ve made a mistake or similar, and we all have a laugh about how silly we were to think we could explain our way out of it. We would also *stop* trying to “dig” our way out of the hole. So, to you I say: “dig up”. I won’t say anything more. -- Nathan Ward

1 0

Web Access Logs
by Muhammed Buvaydani 23 Jan '18

23 Jan '18

Hello I working in freeradius management system and every things go fine. my boss asked me to get all websites that every users who connected to our WiFi has visited . I searched about that for many days without result . I think freeradius does not supports this feature . any way How can I solve this problem .

1 0

Sending accounting and interim usage to couchbase.
by Mike Lopes 22 Jan '18

22 Jan '18

Hi guys, I've been progressing on the modernisation of our radius infrastructure but I'm stumped, once again. I am trying to migrate configurations from an older Freeradius 3.0.3 to 3.0.15. During this time I discovered that this: # Configuration items are in the format: # <element name> = '<radius attribute>' Was changed to this: # Configuration items are in the format: # <radius attribute> = '<element name>' In mods-available/couchbase.. Thanks to Alan DeKok for pointing that out to me :) But now I am left wondering if some other things changed. I reviewed the changelogs from 3.0.3 to 3.0.15 and couldn't spot anything in regards to my issue with couchbase as well as the change above. In our production setup we have the following in our /etc/raddb/mods-enabled/couchbase: map { sessionId = 'Acct-Session-Id' uniqueId = 'Acct-Unique-Session-Id' lastStatus = 'Acct-Status-Type' userName = 'User-Name' lowercaseUser = 'Stripped-User-Name' userDomain = 'Stripped-User-Domain' nasIpAddress = 'NAS-IP-Address' nasIdentifier = 'NAS-Identifier' nasPort = 'NAS-Port-Id' calledStationId = 'Called-Station-Id' callingStationId = 'Calling-Station-Id' framedIpAddress = 'Framed-IP-Address' framedRoute = 'Framed-Route' framedIpv6Address = 'Framed-IPv6-Prefix' framedIpv6Id = 'Framed-Interface-Id' framedV6Route = 'Delegated-IPv6-Prefix' multiSessionId = 'Acct-Multi-Session-Id' multiSessionCount = 'Acct-Link-Count' TerminateCause = 'Acct-Terminate-Cause' sessionTime = 'Acct-Session-Time' lastUpdated = 'Event-Timestamp' } usage { lastStatus = 'Acct-Status-Type' timeStamp = 'Event-Timestamp' download = 'Acct-Output-Octets64' upload = 'Acct-Input-Octets64' } On the new servers, I am using the following: update { Acct-Session-Id = 'sessionId' Acct-Unique-Session-Id = 'uniqueId' Acct-Status-Type = 'lastStatus' User-Name = 'userName' Stripped-User-Name = 'lowercaseUser' Stripped-User-Domain = 'userDomain' NAS-IP-Address = 'nasIpAddress' NAS-Identifier = 'nasIdentifier' NAS-Port-Id = 'nasPort' Called-Station-Id = 'calledStationId' Calling-Station-Id = 'callingStationId' Framed-IP-Address = 'framedIpAddress' Framed-Route = 'framedRoute' Framed-IPv6-Prefix = 'framedIpv6Address' Framed-Interface-Id = 'framedIpv6Id' Delegated-IPv6-Prefix = 'framedV6Route' Acct-Multi-Session-Id = 'multiSessionId' Acct-Link-Count = 'multiSessionCount' Acct-Terminate-Cause = 'TerminateCause' Acct-Session-Time = 'sessionTime' Event-Timestamp = 'lastUpdated' } usage { Acct-Status-Type = 'lastStatus' Event-Timestamp = 'timeStamp' Acct-Output-Octets64 = 'download' Acct-Input-Octets64 = 'upload' Now on my new server, it completely skips over the usage part and I'm no longer getting the interim updates into our couchbase server. I'm assuming that what used to work, no longer works. So it may have moved or remove. Or probably, it I missed something in another file, possibly in mods-config. Could someone point me in the right direction? Thanks! -Mike

2 9

Version 3.0.16 has been released
by Alan DeKok 22 Jan '18

22 Jan '18

Lots of fixes! FreeRADIUS 3.0.16 Thu 11 Jan 2018 12:00:00 EST urgency=low Feature improvements * rlm_python now supports multiple lists. From #2031. * Add trust router re-keying. From #2007. * Add support for Samba / AD LDAP schema. See doc/schemas/ldap/samba/README.txt and doc/schemas/ldap/samba/ * Add "tls_min_version" and "tls_max_version" to EAP module for Debian OpenSSL issues. * Better documentation for client certificates in PEAP and TTLS: it usually doesn't work. Fixes #2068. * Distinguish login failure from AD unavailable. Fixes #2069. * Update RH spec files. Fixes #2070. * Run Post-Proxy-Type if all home servers are dead. Fixes #2072. * Print offending IP addresses when EAP sessions come from two upstream home servers, and rate-limit the messages. * Minor packaging updates. * Better documentation for rlm_rest. * EAP-FAST now has it's own "cipher_list", so that it is easier to configure. * EAP-FAST now forcibly disables TLS1.2, until such time as we implement the new keying mechanism from TLS1.2. * Add documentation for allow_expired_crl. * Update Debian logrotation. #2093 and #2101. * DHCP relay can now drop responses. #2095. * rlm_sqlippool can now assign Delegated-IPv6-Prefix. It also now can assign any IPv4 or IPv6 address. Based on patches from maximumG. #2094. See raddb/mods-available/sqlippool for changes. * radeapclient can now use EAP-SIM-Ki to dynamically create the necessary triplets. * Explain why many LDAP connections are closed. Fixes #1969. * Debian build / package issues fixed by Matthew Newton. * dictionary.patton updates from Brice Schaffner. Fixes #2137. * Added scripts to build "inner-server.pem", and updated mods-config/inner-eap and certs/README to match. * Added provisions for using an external CA. See raddb/certs/ * Include dhcpclient binary in freeradius-dhcp debian packge. Bug fixes * Bind the lifetime of program name and python path to the module FR-AD-002 (redone) * Pass correct statement length into sqlite3_prepare[_v2] FR-AD-003 (redone) * Allow 100-Continue responses with additional headers in rlm_rest. * fix corner case where detail files were not being locked correctly. * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group. Fixes #1947 * Clean up exfile code. Which should help to avoid issues with reading / writing 100's of detail files. * Fix build for winbind. Patch from Alex Clouter. * Fix checkrad for Mikrotik. Patch from Muchael Ducharme. * Fix home server stats lookup. Patch from Phil Mayers. * Add libjson-c3 as an optional dependency. * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking against NSS, which breaks the server. Fixes #2040. * rlm_python fixes. Fixes #2041 * Typos in "man" pages. Fixes #2045 * Expand "next" in %{%{...}:-%{...}}. Fixes #2048 * Don't add TLS attributes twice. Fixes #2050. * Fix memory allocation in rlm_rest. Fixes #2051. * Update trustrouter for new API. Fixes #2059. * Fix SQLite issues on FreeBSD. Fixes #2060 * Don't do debug logging of bad passwords. Fixes #2064. * More graceful handling of "die" in rlm_perl. Fixes #2073. * Fix occasional crash when using cisco_accounting_username_bug = yes * EAP-FAST fixes from Isaac Boukris. #2078, #2076, and #2082, #2126. * DHCP fixes, relay, #2092, add run-time check, #2028 * Decode multiple RADIUS packets at a time in highly loaded RadSec connections. Patch from Jan Tomasek. #2106. * TunnelPassword is not "single value" in LDAP schema. Fixes #2061. * sql log now opens the expanded filename, not the input one. This was a regression introduced in 3.0.15. * Remove unnecessary UNIQUE constrain in Oracle schemas. * Fix SSL thread and locking issues when modules also use SSL. Fixes #2125 and #2129. * Re-add dhcpclient "raw packet" changes. Patches from Nicolas Chaigne and Matthew Newton. Fixes #2155.

8 16

Custom module to handle LDAP query returning multiple results?
by Nicolas Reich 20 Jan '18

20 Jan '18

Hello, The system looks like this: the users are each affiliated to one or more organisations. For each affiliation to an organisation, there's an entry in LDAP. So there can be several entries for the same user, each one with a different organisation. Now, granted the rest of the authentication process goes well, the user is accepted if he or she is affiliated to one of the whitelisted organisations, i.e. there is at least one entry with their name and a whitelisted organisation. This should be pretty straightforward to check: get all entries for the user, and check if at least one is for a whitelisted organisation. Except the ldap module throws an error if the search returns more than one result, and I can't use server-side sorting because it is an openldap server, which doesn't implement the ldap_create_sort_control function. (I think, I might have gotten that wrong though.) Is it possible to write a custom module to handle an LDAP query returning potentially multiple results? Or is there another solution you can think of? The obvious one is to serially query ldap for each organisation, but that's really ineffective. Final note to take into account: I cannot modify anything on the ldap side, it is used for other projects as well. Best regards, and thanks in advance Nicolas PS: Thanks Alan for your answer to my other question yesterday.

3 3

AW: AW: AW: After Upgrade from freeradius 2 to 3 (Debian 8 - 9): TLS Alert write:fatal:unsupported certificate
by Gladewitz, Robert 19 Jan '18

19 Jan '18

If I understand this logs rights, the error happening on ca certificate? ... Mon Dec 18 14:41:44 2017 : Debug: (2) eap_tls: TLS-Cert-Subject := "/C=DE/O=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH/OU=IT/CN=CAPF-1b0db5b4/ST=Sachsen/L=Leipzig" Mon Dec 18 14:41:44 2017 : Debug: (2) eap_tls: TLS-Cert-Issuer := "/C=DE/O=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH/OU=IT/CN=CAPF-1b0db5b4/ST=Sachsen/L=Leipzig" Mon Dec 18 14:41:44 2017 : Debug: (2) eap_tls: TLS-Cert-Common-Name := "CAPF-1b0db5b4" Mon Dec 18 14:41:44 2017 : ERROR: (2) eap_tls: SSL says error 26 : unsupported certificate purpose Mon Dec 18 14:41:44 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Mon Dec 18 14:41:44 2017 : Debug: (2) eap_tls: >>> send TLS 1.0 Alert [length 0002], fatal unsupported_certificate Mon Dec 18 14:41:44 2017 : ERROR: (2) eap_tls: TLS Alert write:fatal:unsupported certificate Mon Dec 18 14:41:44 2017 : Error: tls: TLS_accept: Error in error Mon Dec 18 14:41:44 2017 : ERROR: (2) eap_tls: Failed in __FUNCTION__ (SSL_read): ../ssl/statem/statem_srvr.c[2896]:error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed Mon Dec 18 14:41:44 2017 : ERROR: (2) eap_tls: System call (I/O) error (-1) ... Robert

4 19

Multiply CA and CA-Chain not working in Freeradius2
by Gladewitz, Robert 18 Jan '18

18 Jan '18

Hello List-Users, i try to use tls with two ca. One ca have a CA chain and i concat all in one pem file. Then the following error can be found on authentification: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x6e039e3b6c07932c did not finish! WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! If I use both certiface in a own file, it will work fine for the configuring certificate. Is thre same rules about ordering. Or are certificate with different SHA hashes not compatible? Regards Robert

2 1

freeradius high cpu load
by Bassem Mettichi 18 Jan '18

18 Jan '18

Hello, iam using freeradius version 3.0.15 with rlm_redis and rlm_perl. on this server i have 4 VCPU, when i start a becnh test with 6000 accounting start / sec i see that all my 4 VCPU are used 97% for every vcpu any advise please to minimize the use of vcpu on freeradius? Best Regards Mettichi Bassem

5 9

ldap filter from an external file
by Nicolas Reich 18 Jan '18

18 Jan '18

Hello, I want to accept or deny a request depending, among other things, on the value of one ldap attribute. There are several possible values that should be accepted, and the rest should be refused. This list is quite long, and might change; so I'd prefer not to have to change it manually in the freeradius configuration. Is this possible? Either configure freeradius to read the list and generate the filter, or just read the filter from a file? Thanks! nicolas

2 1