- Freeradius-Users - lists.freeradius.org

Username OR Serial Number
by David Teston 29 Nov '16

29 Nov '16

Hi All, I'd like to enable users to enter their username OR serial number as the &User-Name variable, then let /policy.d/filter determine how to process it. This would also require that I add an attribute in the radcheck table and restructure my SQL queries. The serial number is stored as text. All users know their serial numbers, but not all users have a username which is how this issue arose. Any advice would be helpful. Thanks in advance, David -- David Teston PINES System Administrator http://georgialibraries.org

3 9

Logging when radius is live
by Poltorak, Paul (CT DD DS EVO O BFD TM&ISEC 1) 29 Nov '16

29 Nov '16

Hi all, Question about logging. At development time normally we use radiusd -X to have an idea which module fail and see the exact error message. What about if radius is live how should I found out if a client cannot access? Best way it will be to check a log and see what's happened or not. I've tried with sql but at radpostauth table there only id, username, pass, reply, authdate. I've expanded to see vlan assignment but ok always expand sql table and the querie takes time so I switched to module linelog for testing. At Accept now get same as at sql logging with reply vlan. Access-Accept = "%t: Accepted user: %{User-Name} MAC: %{Calling-Station-Id} VLAN: %{reply:Tunnel-Private-Group-Id}" But if reject I would like to see User-Name (computer), MAC and which module fail and why Access-Reject = "%t: Rejected user: %{User-Name} MAC: %{Calling-Station-Id} module and error message " Is there a possibility? Or how did you check afterward if a client cannot access? Gruß, Best Regards, Paul

3 5

3GPP Dictionary
by Eve Lennie 29 Nov '16

29 Nov '16

Hi all, Just a quick question. Is it possible to check which version or release of a dictionary FreeRADIUS version 3 is using? One of our vendors requires us to use the 3GPP release 8. I know this was the dictionary used in previous versions of FreeRADIUS, but I want to make sure the dictionary we are using is either release 8 or is backward compatible with release 8. We are using FreeRADIUS 3.0.4 Thanks for your help. Kind regards, Eve Lennie Graduate Systems Administrator t: 01234 867250 e: eve.lennie(a)comms365.com<mailto:eve.lennie@comms365.com> Comms365 Limited South House 3, Bond Avenue, Milton Keynes, MK1 1SW w: www.comms365.com<applewebdata://C036AF1A-DD9C-45FE-8F04-95FE6681EC18/www.comms365.com> Linked In: Comms365 Limited<https://www.linkedin.com/company/comms365-limited?trk=biz-companies-cym> Twitter: www.twitter.com/Comms365<http://www.twitter.com/Comms365> [cid:image001.png@01D22BB5.0CA9B850] [cid:image002.png@01D22BB5.0CA9B850] No contract may be entered into on behalf of Comms365 Limited by means of email communication. Any pricing given is subject to E&OE at all times. Company Reg No. 06662688 / Registered in England VAT Reg No. 936428405 ______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud ______________________________________________________________________

2 3

RE: No TLS 1.2 [Solved]
by David Ward 29 Nov '16

29 Nov '16

Thank you. That steered me in the right direction. Here are the entries to make in the TLS section of eap: disable_tlsv1_0 = no disable_tlsv1_1 = yes disable_tlsv1_2 = yes Verified with trace like this: TLSv1 Record Layer: Handshake Protocol: Server Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 81 Handshake Protocol: Server Hello Handshake Type: Server Hello (2) Length: 77 Version: TLS 1.0 (0x0301) -David -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+daward=brocade.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, November 17, 2016 5:23 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: No TLS 1.2 On Nov 17, 2016, at 5:08 PM, David Ward <daward(a)Brocade.COM> wrote: > > We are looking into how to change TLS behavior on radiusd. This is for > testing purpose, so I want to intentionally only allow TLS 1.0. > Currently > running: FreeRADIUS Version 3.0.12. > > Is there a way to make this version only accept TLS 1.0, right now we > are using older 2.x version to test this. In version 3, see "disable_tls" in raddb/mods-available/eap. There are flags for each TLS version. Alan DeKok. - List info/subscribe/unsubscribe? See https://urldefense.proofpoint.com/v2/url?u=http-3A__www.freeradius.org_list…

1 0

Error: Program returend code (98) and output ''
by Skrebetz, Pete 28 Nov '16

28 Nov '16

Not sure what happened, but I walked away from my freeradius and MOTP deployment for a month or so, when I came back I can't authenticate from my client. I can do it locally, but can't do it remotely. The log throws another message 'warning: rlm_sql (sql): you probably need to lower "min" '. Not sure where to start on this. Thanks, Pete

2 3

FreeRADIUS server: Error in testing user access!
by Pedro García Teodoro 28 Nov '16

28 Nov '16

Dear all, Ive installed and configured FreeRADIUS 3.0.12 on Ubuntu 16.04 LTS. In the file /usr/local/etc/raddb/mods-available/eap Ive specified: - default_eap_type = peap in the general eap section, and - default_eap_type = mschapv2 in the peap section. After running the server with radiusd X, I test it with the default user bob defined in /usr/local/etc/raddb/users: radtest bob hello localhost 0 testing123 Regretfully, the authentication fails, the debugger saying: } # server radiusd: #### Opening IP addresses and Ports #### Listening on auth address 127.0.0.1 port 1812 Listening on acct address 127.0.0.1 port 1813 Listening on proxy address * port 39814 Ready to process requests (0) Received Access-Request Id 239 from 127.0.0.1:39509 to 127.0.0.1:1812 length 73 (0) User-Name = "bob" (0) User-Password = "hello" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0x5456ab996d2c7087d14a1529bd8c950d (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 239 from 127.0.0.1:1812 to 127.0.0.1:39509 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 239 with timestamp +32 Ready to process requests Ive tried radtest with other auth methods (-t pap/chap/mschap) but it always fails! Whats wrong? Can someone help me, please? Thanks in advance, Pedro

5 8

[FreeRadius 2.2.8] Error: ASSERT FAILED event.c[164]: request->thread_id == NO_CHILD_THREAD
by Santi Pérez Fernández 28 Nov '16

28 Nov '16

Hi, I configured freeradius 2.2.8 with the coa update options according to the documentation. /etc/freeradius/sites-enabled Auth-Type MS-CHAP { mschap update coa { Packet-Dst-IP-Address = 10.0.1.80 Packet-Dst-Port = 4141 Alc-SLA-Prof-Str = "%{reply:Alc-Subsc-Prof-Str}" } } /etc/freeradius/sites-available/originate-coa home_server localhost-coa { type = coa # # Note that a home server of type "coa" MUST be a real NAS, # with an ipaddr or ipv6addr. It CANNOT point to a virtual # server. # ipaddr = 10.0.1.80 port = 4141 # This secret SHOULD NOT be the same as the shared # secret in a "client" section. secret = testing1234 # CoA specific parameters. See raddb/proxy.conf for details. coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } This is the output from the logs: Mon Nov 28 18:45:38 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #30 Mon Nov 28 18:45:38 2016 : Info: rlm_sql (sql): Connected new DB handle, #30 Mon Nov 28 18:45:38 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 Mon Nov 28 18:45:38 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #31 Mon Nov 28 18:45:38 2016 : Info: rlm_sql (sql): Connected new DB handle, #31 Mon Nov 28 18:45:38 2016 : Info: Loaded virtual server <default> Mon Nov 28 18:45:38 2016 : Info: Loaded virtual server inner-tunnel Mon Nov 28 18:45:38 2016 : Info: Ready to process requests. Mon Nov 28 18:45:42 2016 : Auth: Login OK: [H-VPORT-CPE-LITE-i2cat-2/<via Auth-Type = MSCHAP>] (from client localhost port 0) Mon Nov 28 18:45:42 2016 : Error: ASSERT FAILED event.c[164]: request->thread_id == NO_CHILD_THREAD It only works for the first request. Then I got the following error: Mon Nov 28 18:45:42 2016 : Error: ASSERT FAILED event.c[164]: request->thread_id == NO_CHILD_THREAD What i'm doing wrong? Am I missing something? I am also not been capable of returning the custom attribute. Thanks for your help.

2 1

rlm_ldap TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user..
by Reyor, William F. 28 Nov '16

28 Nov '16

Has anyone run into this issue on rhel 7? If I test unencrypted I can authenticate against ldap without issue. However if I set /etc/raddb/mods-enabled/ldap to use port 636 (encrypted) I receive the following certificate error. rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to authdir.fairfield.edu:636 TLS: certificate [CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user.. TLS: error: connect - force handshake failure: errno 21 - moznss error -8172 TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.. Thanks, Bill

2 3

radsqlrelay: incorrect datetime error reading sql-relay file
by I Want Wireless 28 Nov '16

28 Nov '16

FreeRadius 2.2.8 running on Ubuntu 14.04 LTS sql_log is enabled in the accounting section of /sites-enabled/default When I execute radsqlrelay it repeatedly dumps the following error to the screen and no records are created on the target server /usr/bin/radsqlrelay -x -1 -b radius -d mysql -h xxx.xxx.xxx.xxx -u radrelay_user -p somepassword /var/log/freeradius/radacct/sql-relay Incorrect datetime value: '0' for column 'acctstarttime' at row 1 Incorrect datetime value: '0' for column 'acctstarttime' at row 1 Incorrect datetime value: '0' for column 'acctstarttime' at row 1 And indeed the file shows this: head /var/log/freeradius/radacct/sql-relay INSERT INTO radacct (AcctSessionId, UserName, NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctTerminateCause) VALUES ('810001a7', 'acct203', 'xxx.xxx.37.1', 'xxx.xxx.3.50', '0', '0', '4801',''); INSERT INTO radacct (AcctSessionId, UserName, NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctTerminateCause) VALUES ('810001a6', 'acct2150', 'xxx.xxx.37.1', 'xxx.xxx.3.16', '0', '0', '5400',''); But I am also logging to a local sql database and I see account start times there acctsessionid acctuniqueid username nasipaddress nasportid nasporttype acctstarttime acctstoptime acctsessiontime 810001a7 b051e93c387cc6be acct2203 xxx.xxx.37.1 15729080 Ethernet 2016-11-27 11:09:51 *NULL* 4801 810001a6 830d03bc3cbe59de acct2150 xxx.xxx.37.1 15729079 Ethernet 2016-11-27 11:03:00 *NULL* 5400 I must be missing something but I can find very little info on radsqlrelay other than the man Thanks, Ian

2 1

freeradius in debian stable (jessie)
by Julian Scharrenbach 28 Nov '16

28 Nov '16

Hi List! I'm wondering if anyone is using the freeradius-version in Debian Stable that currently installs via apt (it's version 2.2.5+dfsg-0.2 ). So, clearly this is a pretty old version (as so often in debian stable) but if you use freeradius with jessie: what version do you use and did you compile it from scratch or is there a source of precompiled packages I'm not aware of yet? -- Mit freundlichen Grüßen / Kind regards Julian Scharrenbach - Informatik Betriebswirt (VWA)

7 9