- Freeradius-Users - lists.freeradius.org

Re: Freeradius 3.0.14 - Enable SQLite
by Stabla, Daniel 08 Jun '17

08 Jun '17

The directory is not the problem, the value is: libdir = /usr/local/lib64:/usr/local/lib The problem is, that the lib is called /usr/local/lib64/rlm_sql_sqlite.so and we don't know why. An installation with these steps leads us to this error: - ./configure --without-rlm_rediswho --with-rlm_sql_sqlite=yes - make - make install And all the other libs are in /usr/local/lib64: testsystem:~ # ls -l /usr/local/lib64 -rwxr-xr-x 1 root root 86936 Jun 8 10:02 libfreeradius-dhcp.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 libfreeradius-dhcp.la -rwxr-xr-x 1 root root 69328 Jun 8 10:02 libfreeradius-dhcp.so -rwxr-xr-x 1 root root 558930 Jun 8 10:02 libfreeradius-eap.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 libfreeradius-eap.la -rwxr-xr-x 1 root root 268656 Jun 8 10:02 libfreeradius-eap.so -rwxr-xr-x 1 root root 1577750 Jun 8 10:02 libfreeradius-radius.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 libfreeradius-radius.la -rwxr-xr-x 1 root root 957200 Jun 8 10:02 libfreeradius-radius.so -rwxr-xr-x 1 root root 1867662 Jun 8 10:02 libfreeradius-server.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 libfreeradius-server.la -rwxr-xr-x 1 root root 924680 Jun 8 10:02 libfreeradius-server.so -rwxr-xr-x 1 root root 127628 Jun 8 10:02 proto_dhcp.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 proto_dhcp.la -rwxr-xr-x 1 root root 84096 Jun 8 10:02 proto_dhcp.so -rwxr-xr-x 1 root root 140424 Jun 8 10:02 proto_vmps.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 proto_vmps.la -rwxr-xr-x 1 root root 87800 Jun 8 10:02 proto_vmps.so -rwxr-xr-x 1 root root 95228 Jun 8 10:02 rlm_always.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_always.la -rwxr-xr-x 1 root root 61248 Jun 8 10:02 rlm_always.so -rwxr-xr-x 1 root root 112584 Jun 8 10:02 rlm_attr_filter.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_attr_filter.la -rwxr-xr-x 1 root root 74328 Jun 8 10:02 rlm_attr_filter.so -rwxr-xr-x 1 root root 142538 Jun 8 10:02 rlm_cache.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_cache.la -rwxr-xr-x 1 root root 96800 Jun 8 10:02 rlm_cache.so -rwxr-xr-x 1 root root 113962 Jun 8 10:02 rlm_cache_rbtree.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_cache_rbtree.la -rwxr-xr-x 1 root root 75344 Jun 8 10:02 rlm_cache_rbtree.so -rwxr-xr-x 1 root root 100210 Jun 8 10:02 rlm_chap.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_chap.la -rwxr-xr-x 1 root root 62360 Jun 8 10:02 rlm_chap.so -rwxr-xr-x 1 root root 140700 Jun 8 10:02 rlm_counter.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_counter.la -rwxr-xr-x 1 root root 91904 Jun 8 10:02 rlm_counter.so -rwxr-xr-x 1 root root 103778 Jun 8 10:02 rlm_cram.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_cram.la -rwxr-xr-x 1 root root 65528 Jun 8 10:02 rlm_cram.so -rwxr-xr-x 1 root root 97522 Jun 8 10:02 rlm_date.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_date.la -rwxr-xr-x 1 root root 62808 Jun 8 10:02 rlm_date.so -rwxr-xr-x 1 root root 125236 Jun 8 10:02 rlm_detail.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_detail.la -rwxr-xr-x 1 root root 84552 Jun 8 10:02 rlm_detail.so -rwxr-xr-x 1 root root 107682 Jun 8 10:02 rlm_dhcp.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_dhcp.la -rwxr-xr-x 1 root root 71672 Jun 8 10:02 rlm_dhcp.so -rwxr-xr-x 1 root root 115468 Jun 8 10:02 rlm_digest.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_digest.la -rwxr-xr-x 1 root root 72960 Jun 8 10:02 rlm_digest.so -rwxr-xr-x 1 root root 93784 Jun 8 10:02 rlm_dynamic_clients.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_dynamic_clients.la -rwxr-xr-x 1 root root 60696 Jun 8 10:02 rlm_dynamic_clients.so -rwxr-xr-x 1 root root 407566 Jun 8 10:02 rlm_eap.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap.la -rwxr-xr-x 1 root root 205200 Jun 8 10:02 rlm_eap.so -rwxr-xr-x 1 root root 336842 Jun 8 10:02 rlm_eap_fast.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap_fast.la -rwxr-xr-x 1 root root 185120 Jun 8 10:02 rlm_eap_fast.so -rwxr-xr-x 1 root root 103380 Jun 8 10:02 rlm_eap_gtc.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap_gtc.la -rwxr-xr-x 1 root root 65264 Jun 8 10:02 rlm_eap_gtc.so -rwxr-xr-x 1 root root 245596 Jun 8 10:02 rlm_eap_leap.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap_leap.la -rwxr-xr-x 1 root root 126904 Jun 8 10:02 rlm_eap_leap.so -rwxr-xr-x 1 root root 131352 Jun 8 10:02 rlm_eap_md5.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap_md5.la -rwxr-xr-x 1 root root 76864 Jun 8 10:02 rlm_eap_md5.so -rwxr-xr-x 1 root root 128330 Jun 8 10:02 rlm_eap_mschapv2.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap_mschapv2.la -rwxr-xr-x 1 root root 83960 Jun 8 10:02 rlm_eap_mschapv2.so -rwxr-xr-x 1 root root 279094 Jun 8 10:02 rlm_eap_peap.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap_peap.la -rwxr-xr-x 1 root root 150152 Jun 8 10:02 rlm_eap_peap.so -rwxr-xr-x 1 root root 223726 Jun 8 10:02 rlm_eap_pwd.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap_pwd.la -rwxr-xr-x 1 root root 139712 Jun 8 10:02 rlm_eap_pwd.so -rwxr-xr-x 1 root root 126932 Jun 8 10:02 rlm_eap_sim.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap_sim.la -rwxr-xr-x 1 root root 81016 Jun 8 10:02 rlm_eap_sim.so -rwxr-xr-x 1 root root 111236 Jun 8 10:02 rlm_eap_tls.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap_tls.la -rwxr-xr-x 1 root root 69216 Jun 8 10:02 rlm_eap_tls.so -rwxr-xr-x 1 root root 264774 Jun 8 10:02 rlm_eap_ttls.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_eap_ttls.la -rwxr-xr-x 1 root root 142056 Jun 8 10:02 rlm_eap_ttls.so -rwxr-xr-x 1 root root 114554 Jun 8 10:02 rlm_exec.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_exec.la -rwxr-xr-x 1 root root 75616 Jun 8 10:02 rlm_exec.so -rwxr-xr-x 1 root root 94726 Jun 8 10:02 rlm_expiration.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_expiration.la -rwxr-xr-x 1 root root 61584 Jun 8 10:02 rlm_expiration.so -rwxr-xr-x 1 root root 295066 Jun 8 10:02 rlm_expr.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_expr.la -rwxr-xr-x 1 root root 171200 Jun 8 10:02 rlm_expr.so -rwxr-xr-x 1 root root 115258 Jun 8 10:02 rlm_files.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_files.la -rwxr-xr-x 1 root root 74928 Jun 8 10:02 rlm_files.so -rwxr-xr-x 1 root root 131708 Jun 8 10:02 rlm_ippool.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_ippool.la -rwxr-xr-x 1 root root 85864 Jun 8 10:02 rlm_ippool.so -rwxr-xr-x 1 root root 144484 Jun 8 10:02 rlm_krb5.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_krb5.la -rwxr-xr-x 1 root root 88840 Jun 8 10:02 rlm_krb5.so -rwxr-xr-x 1 root root 793630 Jun 8 10:02 rlm_ldap.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_ldap.la -rwxr-xr-x 1 root root 390472 Jun 8 10:02 rlm_ldap.so -rwxr-xr-x 1 root root 105612 Jun 8 10:02 rlm_linelog.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_linelog.la -rwxr-xr-x 1 root root 70256 Jun 8 10:02 rlm_linelog.so -rwxr-xr-x 1 root root 129060 Jun 8 10:02 rlm_logintime.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_logintime.la -rwxr-xr-x 1 root root 80304 Jun 8 10:02 rlm_logintime.so -rwxr-xr-x 1 root root 295300 Jun 8 10:02 rlm_mschap.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_mschap.la -rwxr-xr-x 1 root root 158864 Jun 8 10:02 rlm_mschap.so -rwxr-xr-x 1 root root 461756 Jun 8 10:02 rlm_otp.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_otp.la -rwxr-xr-x 1 root root 209232 Jun 8 10:02 rlm_otp.so -rwxr-xr-x 1 root root 100880 Jun 8 10:02 rlm_pam.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_pam.la -rwxr-xr-x 1 root root 64160 Jun 8 10:02 rlm_pam.so -rwxr-xr-x 1 root root 154256 Jun 8 10:02 rlm_pap.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_pap.la -rwxr-xr-x 1 root root 102760 Jun 8 10:02 rlm_pap.so -rwxr-xr-x 1 root root 124596 Jun 8 10:02 rlm_passwd.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_passwd.la -rwxr-xr-x 1 root root 84536 Jun 8 10:02 rlm_passwd.so -rwxr-xr-x 1 root root 273394 Jun 8 10:02 rlm_perl.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_perl.la -rwxr-xr-x 1 root root 164352 Jun 8 10:02 rlm_perl.so -rwxr-xr-x 1 root root 118582 Jun 8 10:02 rlm_preprocess.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_preprocess.la -rwxr-xr-x 1 root root 76992 Jun 8 10:02 rlm_preprocess.so -rwxr-xr-x 1 root root 189492 Jun 8 10:02 rlm_python.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_python.la -rwxr-xr-x 1 root root 128632 Jun 8 10:02 rlm_python.so -rwxr-xr-x 1 root root 122732 Jun 8 10:02 rlm_radutmp.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_radutmp.la -rwxr-xr-x 1 root root 80880 Jun 8 10:02 rlm_radutmp.so -rwxr-xr-x 1 root root 112666 Jun 8 10:02 rlm_realm.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_realm.la -rwxr-xr-x 1 root root 72768 Jun 8 10:02 rlm_realm.so -rwxr-xr-x 1 root root 104862 Jun 8 10:02 rlm_replicate.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_replicate.la -rwxr-xr-x 1 root root 66200 Jun 8 10:02 rlm_replicate.so -rwxr-xr-x 1 root root 102680 Jun 8 10:02 rlm_soh.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_soh.la -rwxr-xr-x 1 root root 65528 Jun 8 10:02 rlm_soh.so -rwxr-xr-x 1 root root 97742 Jun 8 10:02 rlm_sometimes.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_sometimes.la -rwxr-xr-x 1 root root 62656 Jun 8 10:02 rlm_sometimes.so -rwxr-xr-x 1 root root 311762 Jun 8 10:02 rlm_sql.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_sql.la -rwxr-xr-x 1 root root 180096 Jun 8 10:02 rlm_sql.so -rwxr-xr-x 1 root root 148086 Jun 8 10:02 rlm_sql_mysql.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_sql_mysql.la -rwxr-xr-x 1 root root 96240 Jun 8 10:02 rlm_sql_mysql.so -rwxr-xr-x 1 root root 96366 Jun 8 10:02 rlm_sql_null.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_sql_null.la -rwxr-xr-x 1 root root 61608 Jun 8 10:02 rlm_sql_null.so -rwxr-xr-x 1 root root 151614 Jun 8 10:02 rlm_sql_sqlite.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_sql_sqlite.la -rwxr-xr-x 1 root root 100416 Jun 8 10:02 rlm_sql_sqlite.so -rwxr-xr-x 1 root root 125814 Jun 8 10:02 rlm_sqlcounter.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_sqlcounter.la -rwxr-xr-x 1 root root 82344 Jun 8 10:02 rlm_sqlcounter.so -rwxr-xr-x 1 root root 138222 Jun 27 2016 rlm_sqlhpwippool.a -rwxr-xr-x 1 root root 17 Jun 27 2016 rlm_sqlhpwippool.la -rwxr-xr-x 1 root root 88416 Jun 27 2016 rlm_sqlhpwippool.so -rwxr-xr-x 1 root root 132998 Jun 8 10:02 rlm_sqlippool.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_sqlippool.la -rwxr-xr-x 1 root root 88104 Jun 8 10:02 rlm_sqlippool.so -rwxr-xr-x 1 root root 102282 Jun 8 10:02 rlm_test.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_test.la -rwxr-xr-x 1 root root 63272 Jun 8 10:02 rlm_test.so -rwxr-xr-x 1 root root 115418 Jun 8 10:02 rlm_unix.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_unix.la -rwxr-xr-x 1 root root 74688 Jun 8 10:02 rlm_unix.so -rwxr-xr-x 1 root root 101092 Jun 8 10:02 rlm_unpack.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_unpack.la -rwxr-xr-x 1 root root 64104 Jun 8 10:02 rlm_unpack.so -rwxr-xr-x 1 root root 90770 Jun 8 10:02 rlm_utf8.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_utf8.la -rwxr-xr-x 1 root root 59296 Jun 8 10:02 rlm_utf8.so -rwxr-xr-x 1 root root 112242 Jun 8 10:02 rlm_wimax.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_wimax.la -rwxr-xr-x 1 root root 71896 Jun 8 10:02 rlm_wimax.so -rwxr-xr-x 1 root root 136580 Jun 8 10:02 rlm_yubikey.a -rwxr-xr-x 1 root root 17 Jun 8 10:02 rlm_yubikey.la -rwxr-xr-x 1 root root 84464 Jun 8 10:02 rlm_yubikey.so

3 2

Freeradius 3.0.14 - Enable SQLite
by Stabla, Daniel 08 Jun '17

08 Jun '17

Hello, we try to enable SQLite for accounting. We configured mods-enabled/sql , so that it should use SQLite. But if we try to start radiusd , we get this error: /etc/radiusd-acct/mods-enabled/sql[26]: Failed to link to module 'rlm_sqlite': /usr/local/lib64/rlm_sqlite.so: cannot open shared object file: No such file or directory /usr/local/lib/rlm_sqlite.so: cannot open shared object file: No such file or directory Which is true, because the module is had been installed as /usr/local/lib64/rlm_sql_sqlite.so . Our compiler option: ./configure --without-rlm_rediswho --with-rlm_sql_sqlite=yes What did we wrong? The configuration of mods-enabled/sql: # -*- text -*- ## ## sql.conf -- SQL modules ## ##$Id: 4997a802dfd8660f622d06f577a787bf30895e3e $ ###################################################################### # #Configuration for the SQL module # #The database schemas and queries are located in subdirectories: # #sql/<DB>/main/schema.sqlSchema #sql/<DB>/main/queries.confAuthorisation and Accounting queries # #Where "DB" is mysql, mssql, oracle, or postgresql. # # # #Several drivers accept specific options, to set them a config section #matching the name of the driver should be added to the sql instance. # #Driver specific options are: # sqlite { # Path to the sqlite database filename = "/tmp/database.db" # If the file above does not exist and bootstrap is set # a new database file will be created, and the SQL statements # contained within the file will be executed. bootstrap = "/etc/radiusd-acct/sql/main/sqlite/schema.sql" } # #mysql { ## If any of the below files are set tls encryption is enabled #tls { #ca_file = "/etc/ssl/certs/my_ca.crt" #ca_path = "/etc/ssl/certs/" #certificate_file = "/etc/ssl/certs/private/client.crt" #private_key_file = "/etc/ssl/certs/private/client.key" #cipher = "DHE-RSA-AES256-SHA:AES128-SHA" #} #} sql { # The sub-module to use to execute queries. This should match # the database you're attempting to connect to. # #* rlm_sql_mysql #* rlm_sql_mssql #* rlm_sql_oracle #* rlm_sql_postgresql #* rlm_sql_sqlite #* rlm_sql_null (log queries to disk) # driver = "rlm_sql_sqlite" # The dialect of SQL you want to use, this should usually match # the driver you selected above. # # If you're using rlm_sql_null, then it should be the type of # database the logged queries are going to be executed against. dialect = "sqlite" # Database table configuration for everything except Oracle radius_db = "radius" # If you want both stop and start records logged to the # same SQL table, leave this as is.If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct" # Allow for storing data after authentication postauth_table = "radpostauth" # Tables containing 'check' items authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" # Tables containing 'reply' items authreply_table = "radreply" groupreply_table = "radgroupreply" # Table to keep group info usergroup_table = "radusergroup" # If set to 'yes' (default) we read the group tables # If set to 'no' the user MUST have Fall-Through = Yes in the radreply table read_groups = yes # Remove stale session if checkrad does not see a double login delete_stale_sessions = yes # Write SQL queries to a logfile. This is potentially useful for tracing # issues with authorization queries. #logfile = ${logdir}/sqllog.sql #As of version 3.0, the "pool" section has replaced the #following configuration items: # #num_sql_socks #connect_failure_retry_delay #lifetime #max_queries # #The connection pool is new for 3.0, and will be used in many #modules, for all kinds of connection-related activity. # pool { # Number of connections to start start = 5 # Minimum number of connections to keep open min = 4 # Maximum number of connections # # If these connections are all in use and a new one # is requested, the request will NOT get a connection. max = 10 # Spare connections to be left idle # # NOTE: Idle connections WILL be closed if "idle_timeout" # is set. spare = 3 # Number of uses before the connection is closed # # 0 means "infinite" uses = 0 # The lifetime (in seconds) of the connection lifetime = 0 # idle timeout (in seconds).A connection which is # unused for this length of time will be closed. idle_timeout = 60 # NOTE: All configuration settings are enforced.If a # connection is closed because of "idle_timeout", # "uses", or "lifetime", then the total number of # connections MAY fall below "min".When that # happens, it will open a new connection.It will # also log a WARNING message. # # The solution is to either lower the "min" connections, # or increase lifetime/idle_timeout. } # Set to 'yes' to read radius clients from the database ('nas' table) # Clients will ONLY be read on server startup. #read_clients = yes # Table to keep radius client info client_table = "nas" # Read database-specific queries $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } Kind regards. D. Stabla

2 1

FreeRADIUS + Microsoft Active Directory
by Amir Kalhori 08 Jun '17

08 Jun '17

Hi, Is it possible integrate FreeRADIUS 3.x and Microsoft Active Directory without any active directory credential ? Best Regards,

3 4

Authentication Against Active Directory
by Amir Kalhori 08 Jun '17

08 Jun '17

Hi, As I searched on the Internet there are some ways for configuring FreeRADIUS 3 for authentication against Active Directory. Can someone kindly explain what is difference between LDAP , SAMBA , Winbind ? Thanks.

2 1

3.0.14 TLS Session Cache
by Wussler, Doug 07 Jun '17

07 Jun '17

If I set the “name” and “persist_dir” parameters in the “cache” section of the “tls-config” in mods-enabled/eap, the TLS Session cache works as expected and users can perform a fast reconnect. But if I don’t care about the TLS cache persisting across a server reboot, am I supposed to be able to comment out the “persist_dir” parameter? If I don’t set the “persist_dir” parameter, I cannot get the TLS session cache to work. If I don’t care about preserving this cache across a server reboot, I’m thinking it will be more efficient and less maintenance to use only an in-memory TLS cache. Is an in-memory-only TLS cache an option or is it a requirement that it get written to and read from disk? Doug Wussler Florida State University

3 2

Overriding a Crypt-Password with a Cleartext-Password in FR 3.x
by Bjørn Mork 06 Jun '17

06 Jun '17

I recently upgraded from FR 2.2.5 to FR 3.0.12 as part of an upgrade from Debian jessie to stretch. The config had to be migrated manually, which went mostly without problems. But there was one config pattern I have been unable to figure out how to handle in FR 3.x: I use the unix module to load crypt passwords for a few system users. But there are also some unix users without any Unix password, which should exist as RADIUS users. "no Unix password" means that the users have a /etc/shadow entry which cannot be matched. So I need to ignore the Crypt-Password attribute for these users. In FR 2.x I explicitly set the Auth-Type to foribly ignore the invalid Crypt-Password, like this: luser Cleartext-Password := "foo", Auth-Type := Local But FR 3.x refused to accept Auth-Type "Local". So I tried to modify the entry to luser Cleartext-Password := "foo" in the hope that the pap module would be smart enough to figure out that the Cleartext-Password should override the invalid Crypt-Password. It was not. Being unable to figure out the smart way, I just took the simple route out by doing luser User-Password == "foo", Auth-Type := Accept But this is a bit ugly and rightfully cause warnings like Tue Jun 6 15:05:03 2017 : Warning: Found User-Password == "..." Tue Jun 6 15:05:03 2017 : Warning: Are you sure you don't mean Cleartext-Password? Tue Jun 6 15:05:03 2017 : Warning: See "man rlm_pap" for more information so I'd really like to figure out a better way. Is there a smart way to override a Crypt-Password per user in FR 3.x? I guess I could generate crypted passwords from the cleartext passwords and simply override Crypt-Password in the users file. But that does not seem much nicer than the current User-Password match to me. What I really want is to be able to say "use this Cleartext-Password no matter what". Bjørn

2 2

add attribute with radsecproxy => wrong value@freeradius
by Michael Baye 06 Jun '17

06 Jun '17

Hello, - within radsecproxy.conf you can add simple rewrite rules with "addVendorAttribute <vendor>:<attribute>:<value>" with all numerical values just like with the other attribute configuration options. e.g.: rewrite miktest { addVendorAttribute 14988:27:2000 addVendorAttribute 14988:26:0 } - When I radtest with a client, I get: Received Access-Accept : Mikrotik_Wireless_VLANIDtype = 842018864 Attr-26.14988.26 = 0x30 => So, the number 2000 is transformed into 842018864 and 0 is transformed into 0x30. => My question is: Why is it transformed and how can I stop this? Looking at /usr/share/freeradius/dictionary.mikrotik: ATTRIBUTE Mikrotik_Wireless_VLANID 26 integer ATTRIBUTE Mikrotik_Wireless_VLANIDtype 27 integer If would be great if someone could give some hints Regards Michael

2 1

FR 3.0.12 exec_perl: ERROR: Failed to create pair &request:EAP-Message
by Thor Spruyt 06 Jun '17

06 Jun '17

Hi, I have a problem with FR 3.0.12 as a proxy with a perl modules in the authorize section which does not include the EAP-Message attributes from the incoming request into the outgoing proxy request. When I disable the perl module, the EAP-Message is proxied correctly and the problem only occurs with multiple EAP-Message attributes. I found this conversation from 11/2016 which seems to be related: http://freeradius.1045715.n5.nabble.com/PERL-and-EAL-TLS-Modul-gt-Failed-to… However, the conversation seems to have stopped without a solution or fix and I don't see anything in the release notes of 3.0.13 or 3.0.14 either... so I guess the issue has not been taken care of yet. Here's some debugging output: (1255) Received Access-Request Id 41 ... length 804 (1255) User-Name = "x" ... (1255) EAP-Message = 0x0276024819800000023e16030302061000020202006288d372a198ab690b34793275ed4eb9b448611f3cf207b5321e147bd85ce371e5d95b9f43572fab73517455ef1b3fe3eca0232825c5feb7e7233c3b08cd9d77205d49a157afa734730496f7a2b9b284654486313cc104e5f70fbd0ff2b5478549a5 ... (1255) session-state: No cached attributes (1255) # Executing section authorize from file server.conf (1255) authorize { (1255) [preprocess] = ok (1255) exec_perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'x' ... (1255) exec_perl: $RAD_REQUEST{'EAP-Message'} = &request:EAP-Message -> '0x0276024819800000023e16030302061000020202006288d372a198ab690b34793275ed4eb9b448611f3cf207b5321e147bd85ce371e5d95b9f43572fab73517455ef1b3fe3eca0232825c5feb7e7233c3b08cd9d77205d49a157afa734730496f7a2b9b284654486313cc104e5f70fbd0ff2b5478549a5d992778059693e3857f542e79b6bcca778b991167120b479ac90efc8508af066f6e600720b1f43130963f9f9299b91736210d6e3ad28eaed792800c9dff95c7df1eeae1a2bd5f18394c41476d38e8a348f2f0093890dd192695840f6e681ccc6cdb79b95fba1cd6a479d9ff8bc57312454d9203e9d19e4544650374e4f632bbb2cac4dfa501401862b3eb2152d7dc96b2d30a736233ba77600009a7ca4702d76ddd4f5e5afd9f00426ff88b8fb07902e7aacdfd76ec86847600c764177b435f8cdf2c4b44a6b62154c60640ff21ccac1105a8f0088a6e6582d7e70f525829b90a2961348e569fc71be3347280381c7d8b58d0c3a502042539092d31e73e0f44ffdfb01b618c4b0be79df064e3584c62e9374ddba8301e7afa9fcca4f286b8463b2b6d885088db0c1275873714904141ab79b62f5a8f363466c33c659d58f139cbaaf6db5b3aa7b6eececc1224c626b22bb529fba206d8816fa9da708cf223e3c50079e3378cfd37890b331f0092ad5ae62e218c3dde18d974ff24318bb16639702399448d62b92' ... (1255) exec_perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'x' (1255) exec_perl: ERROR: Failed to create pair &request:EAP-Message = $RAD_REQUEST{'EAP-Message'} -> '0x0276024819800000023e16030302061000020202006288d372a198ab690b34793275ed4eb9b448611f3cf207b5321e147bd85ce371e5d95b9f43572fab73517455ef1b3fe3eca0232825c5feb7e7233c3b08cd9d77205d49a157afa734730496f7a2b9b284654486313cc104e5f70fbd0ff2b5478549a5d992778059693e3857f542e79b6bcca778b991167120b479ac90efc8508af066f6e600720b1f43130963f9f9299b91736210d6e3ad28eaed792800c9dff95c7df1eeae1a2bd5f18394c41476d38e8a348f2f0093890dd192695840f6e681ccc6cdb79b95fba1cd6a479d9ff8bc57312454d9203e9d19e4544650374e4f632bbb2cac4dfa501401862b3eb2152d7dc96b2d30a736233ba77600009a7ca4702d76ddd4f5e5afd9f00426ff88b8fb07902e7aacdfd76ec86847600c764177b435f8cdf2c4b44a6b62154c60640ff21ccac1105a8f0088a6e6582d7e70f525829b90a2961348e569fc71be3347280381c7d8b58d0c3a502042539092d31e73e0f44ffdfb01b618c4b0be79df064e3584c62e9374ddba8301e7afa9fcca4f286b8463b2b6d885088db0c1275873714904141ab79b62f5a8f363466c33c659d58f139cbaaf6db5b3aa7b6eececc1224c626b22bb529fba206d8816fa9da708cf223e3c50079e3378cfd37890b331f0092ad5ae62e218c3dde18d974ff24318bb16639702399448d62b92' ... (1255) [exec_perl] = noop ... (1255) } # authorize = ok (1255) Starting proxy to home server ... port 1812 (1255) # Executing section pre-proxy from file server.conf (1255) pre-proxy { (1255) } # pre-proxy = noop (1255) Proxying request to home server ... port 1812 timeout 5.000000 (1255) Sent Access-Request Id 130 from ... length 273 ... (1255) User-Name = "x" (1255) EAP-Message = 0x ... Waking up in 0.1 seconds. Kind regards, Thor

3 8

Version 3.0.14 has been released
by Alan DeKok 05 Jun '17

05 Jun '17

I try not to do releases on a Friday, but this one may be useful. https://freeradius.org/press/index.html#3.0.14 This release fixes a crash in session resumption seen by a few people. It also fixes an issue where it was possible to convince the server to do session resumption, even if the underlying session had not finished authentication. Everyone should either upgrade, or set "enable = no" in the EAP "cache" section. Alan DeKok.

5 8

Post Auth and Logging Multiple MSCHAP modules
by Arnab Roy 05 Jun '17

05 Jun '17

Hi , I have multiple MSCHAP definitions in my setup each pointing to different ad domains and all is working well. The authenticate section is defined as such Auth-Type MS-CHAP { mschap-a { reject =2 } if(reject) { mschap-b reject=2 } } Now I am trying to check in post auth if user authenticated via mschap-a go to VLAN A(vsa) else goto VLAN B(vsa). What I cant figure out is how do I reference these in the post auth block as if I try looking for return code from the modules mschap-a ===> this always seems to return a noop ? if(ok){ } Also I need to log in linelog which mschap module authenticated the user ? Is this possible somehow... Many Thanks Arnab

3 8