- Freeradius-Users - lists.freeradius.org

Post-Auth-Type Accept vs Post-Auth-Type Reject 3.0.14
by Wussler, Doug 19 Jun '17

19 Jun '17

I’m using 3.0.14. For a successful authentication, the log shows the Post-Auth routine executing BEFORE the log record expansion and output. This is handy because the Post-Auth routine sets some variables used by the log message (as set in radius.conf). For an unsuccessful authentication, the log shows the Post-Auth-Type “Reject” executing AFTER the log record expansion and output, which seems inconsistent and prevents the setting of the variables used in the log. Is this a bug or correct behavior? If it is correct behavior, what is the reason that we want Post-Auth to run BEFORE the log expansion but Post-Auth-Type Reject to run AFTER the log expansion? Doug Wussler Florida State University

2 1

Using NAS identifier instead of IP address
by Yusuf 19 Jun '17

19 Jun '17

The default method of freeradius identifying the source Access-Request packets requests is using IP addresses. But as many of you know, A lot of people don't have IP static addresses. IMHO, A workaround this problem could be to modify freeradius source code to use the NAS identifier + radius secret to authenticate (instead of source ip address+ radius secret) However, As per 1) https://www.dialogic.com/webhelp/BorderNet2020/1.1.0/WebHelp/radatt_nasiden… 2) https://community.arubanetworks.com/t5/Controller-Based-WLANs/What-is-NAS-i… They say : Code: [Select] NAS-Identifier MUST NOT be used to select the shared secret used to authenticate the request. The source IP address of the Access-Request packet MUST be used to select the shared secret. Can anyone tell me why not? what are the security implications (if any). Quick search on google mentions why NOT to do it, but does not explain the "WHY" of it. Thanks!

2 1

getting compilation error for freeradius 3.0.14
by Arvind Gupta 18 Jun '17

18 Jun '17

Hi All while compiling freeradius 3.0.14 server in linux I am getting following error during sudo make install command. Log file is attached for full compilation info INSTALL raddb/mods-available/yubikey INSTALL raddb/clients.conf make: *** No rule to make target `/scratch/arvindg/build/server/radius-agent/etc/raddb/dictionary', needed by `install.raddb'. Stop. Notifying upstream projects of job completion [DEBUG] Skipping watched dependency update for build: radius_agent-master #54 due to result: FAILURE Any help in this regard is highly appreciated. Thanks Arvind Kumar Gupta

2 1

SQL insert in rlm_expr
by Marius Booysen 16 Jun '17

16 Jun '17

I am fairly new to Radius, so please forgive me if this question is very basic. I am using version 3.0.14 and I know you can use the sql module in rlm_expr e.g %{sql:SELECT.....WHERE...} Now I am wondering if this is limited to select statements only or can I insert a row into a custom table like this: %{sql:INSERT INTO mytab (id) values (100)} I tried this in a policy and the policy executes fine (debugging shows that it is executing the insert) and returns ok, but the mytab table stays empty. Am I doing something wrong or is it just not supported? Thanks! Koos

3 6

EAP SSL Cert "Not Trusted"
by Trevor Jennings 15 Jun '17

15 Jun '17

Hello, We have several freeradius servers with a valid certificate for EAP. When the clients first log in via wifi, they are presented with a certificate "Not Trusted" warning, even though that certificate is signed by a trusted CA. Is this the expected behavior? Is this because we are missing a piece that is required by the client to trust this certificate? Awhile ago someone said that this should happen that the user should get the cert warning, thus this would occur every time the certificate is renewed. Cheers, - Trevor

6 9

radiusd.service watchdog timeout
by Philipp Trenz 15 Jun '17

15 Jun '17

Hey, I’m using FR 3.0.12 on a CentOS 7 and while running as service the process runs into watchdog timeout: ——> systemd: radiusd.service watchdog timeout (limit 1min)! systemd: radiusd.service: main process exited, code=killed, status=6/ABRT systemd: Unit radiusd.service entered failed state. systemd: radiusd.service failed. <—— Here’s my Unit-File: ——> [Unit] Description=FreeRADIUS multi-protocol policy server After=network.target Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ <http://wiki.freeradius.org/> http://networkradius.com/doc/ <http://networkradius.com/doc/> [Service] Type=simple WatchdogSec=60 NotifyAccess=all PIDFile=/usr/local/var/run/radiusd/radiusd.pid EnvironmentFile=-/etc/sysconfig/radiusd RuntimeDirectory=/usr/local/var/run/radiusd RuntimeDirectoryMode=0775 ExecStartPre=/usr/local/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout ExecStartPre=/usr/bin/chown radiusd:radiusd /usr/local/var/run/radiusd ExecStart=/usr/local/sbin/radiusd $FREERADIUS_OPTIONS Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target <—— Any suggestions what could be wrong? Is more information for an analysis needed? Thanks a lot! Philipp —

2 2

RE: Freeradius-Users Digest, Vol 146, Issue 27
by Peter Hutchison 15 Jun '17

15 Jun '17

Is there anything in the radius log file? See /var/log/freeradius/radius.log (path may be different on Centos)? Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Networks Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+p.j.hutchison=hud.ac.uk@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: 15 June 2017 11:00 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 146, Issue 27 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. radiusd.service watchdog timeout (Philipp Trenz) ---------------------------------------------------------------------- Message: 1 Date: Thu, 15 Jun 2017 09:34:14 +0200 From: Philipp Trenz <mail(a)philipptrenz.de> To: freeradius-users(a)lists.freeradius.org Subject: radiusd.service watchdog timeout Message-ID: <B298202F-003D-4194-82FC-9499E9E6376E(a)philipptrenz.de> Content-Type: text/plain; charset="utf-8" Hey, I’m using FR 3.0.12 on a CentOS 7 and while running as service the process runs into watchdog timeout: ——> systemd: radiusd.service watchdog timeout (limit 1min)! systemd: radiusd.service: main process exited, code=killed, status=6/ABRT systemd: Unit radiusd.service entered failed state. systemd: radiusd.service failed. <—— Here’s my Unit-File: ——> [Unit] Description=FreeRADIUS multi-protocol policy server After=network.target Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ <http://wiki.freeradius.org/> http://networkradius.com/doc/ <http://networkradius.com/doc/> [Service] Type=simple WatchdogSec=60 NotifyAccess=all PIDFile=/usr/local/var/run/radiusd/radiusd.pid EnvironmentFile=-/etc/sysconfig/radiusd RuntimeDirectory=/usr/local/var/run/radiusd RuntimeDirectoryMode=0775 ExecStartPre=/usr/local/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout ExecStartPre=/usr/bin/chown radiusd:radiusd /usr/local/var/run/radiusd ExecStart=/usr/local/sbin/radiusd $FREERADIUS_OPTIONS Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target <—— Any suggestions what could be wrong? Is more information for an analysis needed? Thanks a lot! Philipp —

1 0

sql failover
by Abram Lawendy 14 Jun '17

14 Jun '17

Hello, I was wondering if there is a way to make the FR start even if the database connection is unavailable and if this a good thing to do? I configured 3 sql sub-module in ''/mods-availabe/sql'' and configured them as a redundant section in ''radiusd.conf.in''. However, when the first defined database in ''/mods-availabe/sql'' is unreachable the server refuses to start. Thanks in advance. Abram

2 1

Active Directory and Calling-Station-Id
by Ethariel 13 Jun '17

13 Jun '17

Hello, I'm running Freeradius : freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 I've configurated Active Directory integration, and it's working fine for authentication. Local users in users file are also ok. In the local users file I can specify a calling station id like : customer Cleartext-Password := "password",Calling-Station-Id == "AA-AA-AA-AA-AA-AA" How can I use a local file (or sql table) to link a user authenticated in Active Directory with one or several calling-station-id ? If possible I'd really prefer not to use the ActiveDirectory to store the Mac addresses. The goal is to limit each login to a few devices (I know it's possible to mask mac address, this is not the point here). I've tried to insert in the users file : customer2 Calling-Station-Id := "BB-BB-BB-BB-BB-BB" but with correct password customer2 is always authenticated using the BB-....-BB mac adress or not. Thks a lot for any help, Ethariel

2 4

Nulls embedded in Cisco-AVPairs
by Brian Weis (bew) 12 Jun '17

12 Jun '17

Hi folks, I'm trying to do a regular expression match on a Cisco-AVPair value that is sent by the NAD in an Accounting-Request message. He’s a sample of the configuration using the suggested “foreach” method. I’ve added it to the accounting{} section of sites-available/default. foreach &Cisco-AVPair { if (Foreach-Variable-0 =~ /raspberrypi/) { update { &Url-Name := "getaclname" &Url-DataType := "MAC_ADDR" &Url-Data := "%{Foreach-Variable-0}" } rest } However, some of the Cisco-AVPairs we’re wanting to parse contain zeros in the value, such as Cisco-AVPair = "lldp-tlv=\000\005\000\013raspberrypi" Note that the print function above is translating the bytes to an octal format, so \000 is really 0x00 in memory. The zeros in the attribute interfere with the regular expression processing.The line proceeded with a hash prints the entire value representing non-printable octets with octal representations (as above), but the regular expression processing stops at the first zero (e.g., following 'lldp-tlv=’ in the example string), obviously interpreting the zero as the string termination null. This is shown in this log. Note that following EXPAND X that the reported string has been truncated. foreach &Cisco-AVPair { # Foreach-Variable-0 = "lldp-tlv=\000\005\000\013raspberrypi" { EXPAND %{Foreach-Variable-0} %{Foreach-Variable-0} Parsed xlat tree: virtual --> Foreach-Variable-0 EXPAND X Foreach-Variable-0 --> lldp-tlv= --> lldp-tlv= ... } Looking in the code, I see that both the full and trunctated log entries are the output of fr_pair_value_snprint(). The call that display the full value specifies ‘“‘ as a quote value, which results in it representing the non-printable characters as octal values. But the call that creates a string for regular expression processing (the EXPAND X string) specifies no quote value, which results in a string truncated at the first zero byte. Note that not only is the value shorted in the log above, but the regular expression processing uses this string as well. This effectively doesn’t allow regular expression processing matching strings following the zero in the value. This truncation seems to be because some regular expression libraries do not safely process nulls. These are messages I received when changing the quote variable to ‘“' for debugging purposes: ERROR : (57) regex failed: Found null in subject at offset 9. String unsafe for evaluation ERROR : (57) Condition evaluation failed because the value of an operand could not be determined I’ve tried many different string representations in the code snippet above and nothing changes this behavior. But I also can’t find a way to transform Foreach-Variable-0 such that it can be given to another module for processing … always the fr_pair_value_snprint() call with a zero quote value in is used, which truncates the string. This is the call in in xlat_foreach(). There is a FreeRADIUS compile option to use regex code where nulls are safe within the value (i.e., regnexec), which would seem to avoid the message above. But that does not seem sufficient as the current code in xlat_foreach() would still provide a truncated string to the regex library. Suggestions for a workaround? I’m using FreeRADIUS 3.1.0. Thanks, Brian -- Brian Weis Security, CSG, Cisco Systems Telephone: +1 408 526 4796 Email: bew(a)cisco.com

3 3