- Freeradius-Users - lists.freeradius.org

Problem with Local variable especially when its negative
by Mrinal K 05 May '16

05 May '16

Hello members of the freeradius email list, I have added some unlang code in the authorize section of my configuration, however I am having some trouble with the values in my variables. My server is running Version 2.1.12. The snippet is as follows and is intended to check how much of data user has downloaded till now, My-Local-Int-2 has the maximum data allowed to the user and My-Local-Int-1 is the start timestamp. The idea is to get the difference of maximum allowed octets and octets used till now and if comes out to be less than zero we reject the user else user is allowed. #### Section 1 Start update control { My-Local-Int-3 = "%{sql: select ('%{control:My-Local-Int-2}' - ifnull(sum(acctinputoctets) + sum(acctoutputoctets),0)) from radacct where calledstationid='%{Called-Station-Id}' and callingstationid='%{Calling-Station-Id}' and sessionstarttimestamp > '%{control:My-Local-Int-1}'}" } #### Section 1 End #### Section 2 Start if("%{control:My-Local-Int-3}" > 0){ update reply { ChilliSpot-Max-Total-Octets := "%{control:My-Local-Int-3}" Idle-Timeout = 600 Acct-Interim-Interval = 180 } } else{ update control { Auth-Type := reject } } #### Section 2 End Its pretty straight forward and work well till My-Local-Int-3 has value which is greater than 0. However when value of My-Local_Int-3 is in negative "if("%{control:My-Local-Int-3}" > 0) " still returns true and ChilliSpot-Max-Total-Octets is assigned an unknown positive value. Concerned debug output is as follows, expand: %{sql: select ('%{control:My-Local-Int-2}' - ifnull(sum(acctinputoctets) + sum(acctoutputoctets),0)) from radacct where calledstationid='%{Called-Station-Id}' and callingstationid='%{Calling-Station-Id}' and sessionstarttime > '%{control:My-Local-Int-1}'} -> -500017 expand: %{sql: select ('%{control:My-Local-Int-2}' - ifnull(sum(acctinputoctets) + sum(acctoutputoctets),0)) from radacct where calledstationid='%{Called-Station-Id}' and callingstationid='%{Calling-Station-Id}' and sessionstarttime > '%{control:My-Local-Int-1}'} -> -500017 +++[control] returns noop +++? if ("%{control:My-Local-Int-3}" > 0) expand: %{control:My-Local-Int-3} -> 4294467279 ? Evaluating ("%{control:My-Local-Int-3}" > 0) -> TRUE +++? if ("%{control:My-Local-Int-3}" > 0) -> TRUE +++- entering if ("%{control:My-Local-Int-3}" > 0) {...} At first when sql query is expanded the value is -500017 but later same My-Local-Int-3 expands to 4294467279. Regards, Kumar Mrinal Splash Networks http://splashwifi.net

4 4

unlang to customize error message
by Stefano Zanmarchi 05 May '16

05 May '16

According to MS-CHAP-V2 standard in case of authentication failure the Failure Packet should contain the following text in the Message field: "E=691 R=... ..." . Freeradius does send "E=691" if send_error is set to yes in mods-enabled/eap, but this may cause (as stated in the comments) some clients not to work. This is sadly the case with iOS 9.3.1 supplicants. Luckily we have a table relating MACs and OSs of the devices of our users. Is it possible via unlang to have Freeradius conditionally send "E=691" (in case authentication failure) based on a sql query? I believe this is quite tricky, but it'd really help us a lot. Thank you, Stefano

3 4

rlm_python in v3.0.x
by Arran Cudbard-Bell 05 May '16

05 May '16

rlm_python from v3.1.x has been backported to the v3.0.x branch. This addresses all but 1 of the ~7 rlm_python issues that had accumulated in the issue tracker. Namely: - Instantiation and destruction with multiple instances is always clean, and should never result in a SEGV. - The module is 'threaded', without any side effects (race conditions or crashes). - Thread Local Storage is now distinct between instances of rlm_python - Multiple sub interpreters can be used, but this is disabled by default in v3.0.x because of compatibility issues with some C extensions to python. - Double quotes are no longer escaped. - Constants are synced with the server constants. In v3.1.x I also added conversion to proper Python types, i.e. unsigned/signed integers get converted to Python Long numbers, floats get converted to decimals, strings get converted from UTF-8 to UTF-16 (and are binary safe), octet strings are left in their original form (not converted to hex). Conversion back to C types is still done with string parsing. That can be addressed by someone sufficiently motivated. I don't think it's significantly more difficult than conversion to Python types. Encourage anyone that depends on Python in v3.0.x to test *before* 3.0.12 is released and report any issues. Thanks to Guillaume Pannatier for all the recent testing and automated test cases, and to all those that opened issues against rlm_python. No thanks to the Python team for creating an extraordinarily obtuse C API. My favourite, lease favourite part is this: /* * Initialise a new module, with our default methods */ inst->module = Py_InitModule3("radiusd", module_methods, "FreeRADIUS python module"); if (!inst->module) { error: python_error_log(); PyEval_SaveThread(); return -1; } /* * Py_InitModule3 returns a borrowed ref, the actual * module is owned by sys.modules, so we also need * to own the module to prevent it being freed early. */ Py_IncRef(inst->module); Just wow... -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Re: 802.1X Extra Miles
by 3＠D4rkn3ss DuMb 05 May '16

05 May '16

Thank you all, I think it's time for me to give back to the community now ... I m planning to add something on the how-to if the admins allow me to :) Regards On 5 May 2016 at 07:41, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE: LDAP CONFIGURATION IN FreeRadius (WINANT, KEVIN) > 2. RE: LDAP CONFIGURATION IN FreeRadius (Alan Buxey) > 3. Re: Problem with multiple LDAP servers (Alan Buxey) > 4. RE: LDAP CONFIGURATION IN FreeRadius (WINANT, KEVIN) > 5. Re: Problem with multiple LDAP servers (Arran Cudbard-Bell) > 6. Re: 802.1X Extra Miles (Johnny R) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 4 May 2016 22:20:56 +0000 > From: "WINANT, KEVIN" <KW517G(a)att.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: LDAP CONFIGURATION IN FreeRadius > Message-ID: > < > 751C2B6C8900694381C6D7090C243EA3216019E5(a)MISOUT7MSGUSRCB.ITServices.sbc.com > > > > Content-Type: text/plain; charset="us-ascii" > > Sorry am not trying to move/upgrade anything to v3 at this time. > I am trying to see my LDAP configuration for our External LDAP server. > I am trying to see which port LDAP is using. > If port 389 I will have no issue when the EXTERNAL LDAP server begins > using SHA256 certs. > If configured to use 636, I then need to identify the ROOT CA and serial > number being used by FreeRadius and verify it is the SAME Root CA and > serial number the External LDAP server is using. > Apologies for the original looooooooong sentence. > > > > On 4 May 2016, at 12:43, WINANT, KEVIN <KW517G(a)att.com> wrote: > > > > Version is 2.1.1 which we found is EOL and looking to go to V3. > > Did the debug and looks like it loads up > "including configuration > file /etc/raddb/modules/ldap" > > Looking in there do not find the hostname or IP of the external LDAP > server in there. > > Uh nope, don't try and use your v2.x.x config with v3.0.x. Just rebuild > it using a stock v3.0.x config. > > > Reason trying to see LDAP settings is Company in installing SHA256 certs > on the External LDAP server soon. > > I am trying to determine if LDAP is configured to use port 389 > (unsecure) and there will be NO IMPACT to our servers communicating to > External LDAP server or IF LDAP is configured to use port 636 (secure) > then I would then need to find out if ROOT CA freeradius is using is same > ROOT CA External LDAP server is using along with the same serial number. > > Wow it may be the altitude but that extremely long sentence made > absolutely no sense to me. Could you try rephrasing? > > -Arran > > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > > > ------------------------------ > > Message: 2 > Date: Wed, 4 May 2016 23:43:01 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org>, "WINANT, KEVIN" > <KW517G(a)att.com> > Subject: RE: LDAP CONFIGURATION IN FreeRadius > Message-ID: <13EA1E61-38A4-4E5B-82C4-DB4C8CD2077E(a)lboro.ac.uk> > Content-Type: text/plain; charset="UTF-8" > > Ummmm. Surely you want to use protection if its out in the cloud anyway?? > > You can view connecting to ldap using eg netstat and tcpdump > > However, regarding the root CA for ldap. Its entirely different (or can > be!) To that used by freeradius for clients (PEAP etc). So, grab the > required root CA of the ldap server and is server cert and use those in > your config. PS ldap stuff is very much refreshed in v3 - many more > options etc and a far better connection pool (could be ideal for WAN based > ldap servers) > > alan > > ------------------------------ > > Message: 3 > Date: Wed, 4 May 2016 23:50:04 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org>, Arran Cudbard-Bell > <a.cudbardb(a)freeradius.org> > Subject: Re: Problem with multiple LDAP servers > Message-ID: <87238DE7-BEAA-4CD8-BB2F-E5016A86901F(a)lboro.ac.uk> > Content-Type: text/plain; charset="UTF-8" > > Ah! > > Of course, now I'm using multiple ldap configs I've now hit the too many > files open issue. > > Which causes all sorts of interesting failure modes. Obvious when sql > connection can't work - the cause is printed out. ... but it was failing in > reading the root cert used for ldap instance 5 and claimed it couldn't read > the file, x509 issue. Given that using ulimit fixed this. ...... i guess > if the failure is when spawning some Ssl stuff you can't do anything about > it? > > I've updated /etc/security/limits.conf - giving radius user more > soft/hard files... but that didn't work .. even though the server is using > radius/radius the limits seem to require root limits to be modified . > Looking at adjusting the systemd script right now but it'll catch out any > local admins trying to do eg radiusd -X ;) > > > alan > > ------------------------------ > > Message: 4 > Date: Wed, 4 May 2016 22:57:22 +0000 > From: "WINANT, KEVIN" <KW517G(a)att.com> > To: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk>, FreeRadius users mailing > list <freeradius-users(a)lists.freeradius.org> > Subject: RE: LDAP CONFIGURATION IN FreeRadius > Message-ID: > < > 751C2B6C8900694381C6D7090C243EA321601A4C(a)MISOUT7MSGUSRCB.ITServices.sbc.com > > > > Content-Type: text/plain; charset="utf-8" > > Thanks Alan, This is all on the companies INTRANET. No > connectivity/access to Internet/Cloud. > The LDAP config and Cert I am trying to verify is for the ssl connection > between the FreeRadius servers and the LDAP server itself when queries sent > to the LDAP server. > Someplace in Free Radius I am thinking it would tell us which ROOT CA > (Certificate Authority) cert and serial number it is using and via what > port. (although if using port 389 for LDAP,,I figure it is not using a > cert at all) Once I can locate that info I can compare to the ROOT CA and > serial the LDAP server uses. If the same we’re good to go when External > LDAP server installs SHA256 certs shortly. > Original FreeRadius SME is no longer with us, hence the queries. > > > From: Alan Buxey [mailto:A.L.M.Buxey@lboro.ac.uk] > Sent: Wednesday, May 04, 2016 6:43 PM > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>; > WINANT, KEVIN <KW517G(a)att.com> > Subject: RE: LDAP CONFIGURATION IN FreeRadius > > Ummmm. Surely you want to use protection if its out in the cloud anyway?? > > You can view connecting to ldap using eg netstat and tcpdump > > However, regarding the root CA for ldap. Its entirely different (or can > be!) To that used by freeradius for clients (PEAP etc). So, grab the > required root CA of the ldap server and is server cert and use those in > your config. PS ldap stuff is very much refreshed in v3 - many more options > etc and a far better connection pool (could be ideal for WAN based ldap > servers) > > alan > > ------------------------------ > > Message: 5 > Date: Wed, 4 May 2016 18:08:14 -0600 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Problem with multiple LDAP servers > Message-ID: <218D846B-D921-47AD-AD96-0D316D580E56(a)freeradius.org> > Content-Type: text/plain; charset="utf-8" > > > > On 4 May 2016, at 15:50, Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> wrote: > > > > Ah! > > > > Of course, now I'm using multiple ldap configs I've now hit the too many > files open issue. > > You hit a file descriptor limit? How many connections are you opening? How > many servers are you talking to? > > Unfortunately from a long term architecture point of view, having one > connection per working thread is desirable, so there's not much we can do > to fix that. > > > Which causes all sorts of interesting failure modes. Obvious when sql > connection can't work - the cause is printed out. ... but it was failing in > reading the root cert used for ldap instance 5 and claimed it couldn't read > the file, x509 issue. > > Heh. Yeah that's far outside of our control, deep inside whatever libldap > happens to be using for TLS. > > > Given that using ulimit fixed this. ...... i guess if the failure is > when spawning some Ssl stuff you can't do anything about it? > > It failed when instantiating the module, right? Not when opening a > connection? > > That'll be when it creates the new SSL_CTX. > > > I've updated /etc/security/limits.conf - giving radius user more > soft/hard files... but that didn't work .. even though the server is using > radius/radius the limits seem to require root limits to be modified . > Looking at adjusting the systemd script right now but it'll catch out any > local admins trying to do eg radiusd -X ;) > > If you do sudo radiusd -X it'll change to the correct user IIRC. > > Only when you run it with usual user privs, will it stick to that user. > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > >

2 1

802.1X Extra Miles
by 3＠D4rkn3ss DuMb 05 May '16

05 May '16

Dear List, I hope you are all doing fine. I know that the following question might be 'out of scope' of the user's list but still, I would like to ask some user's experience. I successfully implemented '802.1x or MAC-Auth' as described on the how-to: the 802.1x is PEAP based (server's certificate deployed on all client) with Computer authentication (instead of user authentication) + Mac verification (in a specific table in radius db), and for all non-capable 802.1x end-points (such as pointers) just a mac verification. However, I m still confused about the following issues: - since the above are just only deployed in my testing environment, and I m supposed to deploy the same for 1k users, how much memory (RAM,HD,Processor) should I allocate to radius server! The DB is also on the same server as Freeradius. - what kind of extra-layer could I add to the authentication layer (PC authentication PEAP + MSCHAP v2, against AD 2008, + MAC Verification) to make it even 'more secure'? Thank you, Regards, KEN

6 10

Problem with multiple LDAP servers
by Jonathan Gazeley 05 May '16

05 May '16

Don't worry folks - this isn't a repeat of the same question about multiple LDAP servers. I've read the docs and I know how it's *supposed* to work, but I think I've found a discrepancy in the messages printed by the server. I'm running FreeRADIUS 3.0.11. I started off with an instantiation of the ldap module configured with multiple server names comma-separated on the same line, like this: server = 'ldap1.bris.ac.uk,ldap2.bris.ac.uk,ldap3.bris.ac.uk' This appears to work but on startup the server prints this warning: Warning: Listing multiple LDAP servers in the 'server' configuration item is deprecated and will be removed in a future release. Use multiple 'server' configuration items instead So, I tried that suggestion and ran with a config like this: server = 'ldap1.bris.ac.uk' server = 'ldap2.bris.ac.uk' server = 'ldap3.bris.ac.uk' But this yields a warning: Warning: /etc/raddb/mods-enabled/uobldap[22]: Ignoring duplicate configuration item 'server' For now I'm sticking with the old syntax which seems to do the right thing, but the spurious warning should probably be addressed in the server. Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

4 11

TLS: assigning certificates to username
by dump＠gmx.info 04 May '16

04 May '16

Dear list. I'm running freeradius 2.2.5 on Debian jessie. The system is configured to work in TLS and TTLS mode parallel and almost everything is running as expected. One thing is: In TLS-mode the dial-in user has to choose certificates and a username. My problem is now that the username can be chosen freely, as the username sent by the dial-in client is written only into the postauth and acct tables. Due to this the user is able to bypass any user specific regulations. I'm sure it is already documented, how to assign certificates to a dedicated username. But I so far didn't find it. Maybe somebody may give me a hint, where to look? Many thanks in advance and best regards Jens

1 0

"Unknown action 'rlm_sql_mysql'" in v3 unoffical ubuntu build
by Dustin S 04 May '16

04 May '16

I tried installing freeradius 3 using the ppa at: https://launchpad.net/~freeradius/+archive/ubuntu/stable-3.0 Everything works fine (passed all the tests for using the various types of authentication) but when I try to get it to use mysql, I get the following from "freeradius -X": Unknown action 'rlm_sql_mysql' The only idea I have is from http://wiki.freeradius.org/modules/Rlm_sql_mysql which says you should install mysql first so the libmysqlclient* libraries are automatically detected during compile. Dustin p.s.: here is more of the output: # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} /etc/freeradius/sites-enabled/sql[31]: Unknown action 'rlm_sql_mysql'. /etc/freeradius/sites-enabled/inner-tunnel[48]: Errors parsing authorize section.

3 2

Re: 802.1X Extra Miles
by 3＠D4rkn3ss DuMb 04 May '16

04 May '16

Dear all, @Alan Buxey <https://plus.google.com/u/1/111643914785537954652?prsrc=4> Actually, I just implemented a simple SQL select count(*) to my MAC table in radius db. There is no OS fingerprint or something similar! would be really great if you could give a hint about how to implement that :) @ Matthew Newton I will for sure move to EAP-TLS ... But before I think I need to have some 'respectable' PKI framework integrated in my current AD. The thing, the AD engineers don't really want to deploy 1k certificates :( (GPO), so i will have to find a way to convince the management. Thank you all for your input! This is ONE of the GREATEST open source project I have encountered till now, and I really LOVE (I eat it, drink it, and sleep on it) FreeRadius. Will for sure drop some cents out there for the support :) Regards On 4 May 2016 at 19:41, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Problem with multiple LDAP servers (A.L.M.Buxey(a)lboro.ac.uk) > 2. Re: Problem with multiple LDAP servers (A.L.M.Buxey(a)lboro.ac.uk) > 3. Re: 802.1X Extra Miles (Matthew Newton) > 4. Re: 802.1X Extra Miles (A.L.M.Buxey(a)lboro.ac.uk) > 5. Re: 802.1X Extra Miles (A.L.M.Buxey(a)lboro.ac.uk) > 6. Re: 802.1X Extra Miles (Igor Novgorodov) > 7. LDAP CONFIGURATION IN FreeRadius (WINANT, KEVIN) > 8. Re: LDAP CONFIGURATION IN FreeRadius (Matthew Newton) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 4 May 2016 16:19:02 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Problem with multiple LDAP servers > Message-ID: <20160504161902.GC19648(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I think the multi instance validation was added after the rlm_ldap code > was changed. I've pushed a fix for v3.0.x. > > > > I'm going to drop the legacy support from v3.1.x. > > ....so long as it can support > > server = > server = > server = > > !!! :) > > alan > > > ------------------------------ > > Message: 2 > Date: Wed, 4 May 2016 16:25:06 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Problem with multiple LDAP servers > Message-ID: <20160504162506.GD19648(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > If you want visibility into what's going on, it's better to use a > template section to configure rlm_ldap, and have one instance per server, > referencing them in a redundant-load-balance block. > > ldap ldap1 {} > ldap ldap2 {} > > etc - could all be in one file.... > > and then use the redundancy load balance block to use them: > > redundant-load-balance { > ldap1 > ldap2 > ldap3 > } > > instead of just calling ldap ? interesting....might give that a go (our > current problem is that > we set the lifetime/timeout to 0 and it appears that after *seme time* (to > be found out) and/or *some event* > the server will not connect to the LDAP anymore... it shouldnt have closed > connections....) > > 1) maybe need some kind of keepalive thing going on in the server (to > ensure firewalls or linux kernel > TCP stuff doesnt play in this?) > > 2) more connection info with eg radmin ? > > by the way, we are using OpenLDAP compiled against OpenSSL rather than NSS > - which was the default stuff.... > when we did that (use our own LDAP compiled against OpenSSL) the > reconnection after deliberately breaking > connectivity worked a treat! :) > > > alan > > > ------------------------------ > > Message: 3 > Date: Wed, 4 May 2016 17:25:43 +0100 > From: Matthew Newton <mcn4(a)leicester.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: 802.1X Extra Miles > Message-ID: <20160504162543.GL39562(a)rootmail.cc.le.ac.uk> > Content-Type: text/plain; charset=us-ascii > > On Wed, May 04, 2016 at 07:12:53PM +0300, 3@D4rkn3ss DuMb wrote: > > - since the above are just only deployed in my testing environment, and > I > > m supposed to deploy the same for 1k users, how much memory > > (RAM,HD,Processor) should I allocate to radius server! > > Until recently I was running a RADIUS server here for 10k users > mostly doing PEAP/MSCHAPv2 with Samba on 384Mb RAM and a couple of > virtual CPUs. Now has 2Gb RAM because the host has 64Gb and I > didn't know what to do with it. > > 1k users is nothing really, unless they are authenticating > excessively. > > > The DB is also on the same server as Freeradius. > > This is what you need to care about more than FR. Talk to a DBA to > size that. IMO you still won't need much for that number of users. > > Just spin up a small VM and try it. It's 2016. Hardware is cheap > and plentiful. > > > - what kind of extra-layer could I add to the authentication layer (PC > > authentication PEAP + MSCHAP v2, against AD 2008, + MAC Verification) to > > make it even 'more secure'? > > Move to EAP-TLS and check certificates instead. As added bonuses, > authentications will be quicker and the load on your RADIUS server > will likely drop. > > Matthew > > > -- > Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> > > Systems Specialist, Infrastructure Services, > I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom > > For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> > > > ------------------------------ > > Message: 4 > Date: Wed, 4 May 2016 16:30:13 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: 802.1X Extra Miles > Message-ID: <20160504163013.GF19648(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > - since the above are just only deployed in my testing environment, and > I > > m supposed to deploy the same for 1k users, how much memory > > (RAM,HD,Processor) should I allocate to radius server! The DB is also on > > the same server as Freeradius. > > a quite basic server for 1000 devices. 2GHz, 4Gb RAM, 120G HD. thats > probably overkill. > > > - what kind of extra-layer could I add to the authentication layer (PC > > authentication PEAP + MSCHAP v2, against AD 2008, + MAC Verification) to > > make it even 'more secure'? > > its pretty strong stuff so long as the client is correctly configured..... > next step up > would be to run your own PKI and use EAP-TLS instead. the Mac auth is > your weak point... > whats stopping someone borrowing a known/valid MAC address? are you suing > some kind of system/OS/fingerprint > in conjunction with MacAuth ? > > alan > > > ------------------------------ > > Message: 5 > Date: Wed, 4 May 2016 16:31:47 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: 802.1X Extra Miles > Message-ID: <20160504163147.GH19648(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > authentications will be quicker and the load on your RADIUS server > > will likely drop. > > *will* drop - and auths are faster and less NTLM/AD stuff to worry about > :-) > > > alan > > > ------------------------------ > > Message: 6 > Date: Wed, 4 May 2016 19:33:56 +0300 > From: Igor Novgorodov <igor(a)novg.net> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: 802.1X Extra Miles > Message-ID: <572A2474.8050009(a)novg.net> > Content-Type: text/plain; charset=utf-8; format=flowed > > We're running FreeRADIUS that authenticates 5-6 *million* users per day > (with peaks about 1000 requests per second) on a small VM with 4 vCPU. > Memory usage is negligible (200-300MBytes) even with > max_queue_size=1048576, cleanup_delay=30, max_requests=262144 > > The database is what's loaded more, but it depends on complexity and > number of requests per authentication event. > > So your case should not be a problem at all. > > On 04/05/16 19:12, 3@D4rkn3ss DuMb wrote: > > Dear List, > > > > I hope you are all doing fine. I know that the following question might > be > > 'out of scope' of the user's list but still, I would like to ask some > > user's experience. I successfully implemented '802.1x or MAC-Auth' as > > described on the how-to: the 802.1x is PEAP based (server's certificate > > deployed on all client) with Computer authentication (instead of user > > authentication) + Mac verification (in a specific table in radius db), > and > > for all non-capable 802.1x end-points (such as pointers) just a mac > > verification. However, I m still confused about the following issues: > > - since the above are just only deployed in my testing environment, > and I > > m supposed to deploy the same for 1k users, how much memory > > (RAM,HD,Processor) should I allocate to radius server! The DB is also on > > the same server as Freeradius. > > - what kind of extra-layer could I add to the authentication layer (PC > > authentication PEAP + MSCHAP v2, against AD 2008, + MAC Verification) to > > make it even 'more secure'? > > > > Thank you, > > > > Regards, > > > > KEN > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Message: 7 > Date: Wed, 4 May 2016 16:34:04 +0000 > From: "WINANT, KEVIN" <KW517G(a)att.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: LDAP CONFIGURATION IN FreeRadius > Message-ID: > < > 751C2B6C8900694381C6D7090C243EA3216016AD(a)MISOUT7MSGUSRCB.ITServices.sbc.com > > > > Content-Type: text/plain; charset="us-ascii" > > Hi Folks, On the FreeRadius servers we have inherited, I am trying to > locate where LDAP is configured. > Our Servers communicate with an External Authentication server (companies > phone directory for user id/pswd verification) so I know someplace in there > the LDAP server is specified and should indicate which port (389 or 636) > it is using. > FreeRadius doc indicates this is defined in radiusd.conf > In checking radiusd.conf I do not see anything specifying LDAP. > Was thinking would see something similar to this in radiusd.conf: > > server = "ldap" > port = 636 > #port = 389 > > SO my question is, is there someplace else where the LDAP server may be > configured? Or radius.conf is the place.?? > I have poked around in etc/raddb but unable to locate these settings. > > Appreciate any information anyone may be able to provide. > Thanks in Advance > > > > ------------------------------ > > Message: 8 > Date: Wed, 4 May 2016 17:41:32 +0100 > From: Matthew Newton <mcn4(a)leicester.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: LDAP CONFIGURATION IN FreeRadius > Message-ID: <20160504164132.GO39562(a)rootmail.cc.le.ac.uk> > Content-Type: text/plain; charset=us-ascii > > On Wed, May 04, 2016 at 04:34:04PM +0000, WINANT, KEVIN wrote: > > Hi Folks, On the FreeRadius servers we have inherited, I am trying to > locate where LDAP is configured. > > What version? > > > SO my question is, is there someplace else where the LDAP server may be > configured? Or radius.conf is the place.?? > > I have poked around in etc/raddb but unable to locate these settings. > > Probably > > /etc/raddb/modules/ldap for v2 > /etc/raddb/mods-{enabled,available}/ldap for v3 > > or just "grep -lr ldap /etc/raddb/*" will get you in the right > direction, as will running FreeRADIUS in debug mode (radiusd -X) > and reading the output at the start. > > Matthew > > > -- > Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> > > Systems Specialist, Infrastructure Services, > I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom > > For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 133, Issue 8 > ************************************************ >

1 0

Disabling ntlmv1 usage in FR 3.0.12
by Alex Sharaz 04 May '16

04 May '16

... try again Hi, I've built a couple of 3.0.12 (ish) FR servers that I use as our outward facing ORPS servers. York users authenticate against these 2 when visiting other eduroam sites. in smb.conf I've got .... ntlm auth = no lanman auth = no client ntlmv2 auth = yes winbind max domain connections = 1024 restrict anonymous = 2 and in /etc/freeradius/mods-enabled/mschap I've got # An alternative to using ntlm_auth is to connect to the # winbind daemon directly for authentication. This option # is likely to be faster and may be useful on busy systems, # but is less well tested. # # Using this option requires libwbclient from Samba 4.2.1 # or later to be installed. Make sure that ntlm_auth above is # commented out. # winbind_username = "%{Stripped-User-Name}" winbind_domain = "ITS.YORK.AC.UK" ... and auths work quite happily Our systems people are always grumbling about our FR servers being the only boxes that use NTLMv1. Will the above config keep them happy and stop these servers from using it? Rgds Alex

2 3