- Freeradius-Users - lists.freeradius.org

installing freeradius error
by Doug Berman 27 Feb '16

27 Feb '16

Hello There is an error towards the bottom. I previously had an older version which I installed. Now I'm running into this. Thank you! /doug doug@db-dell:/etc$ sudo apt-get install freeradius make Reading package lists... Done Building dependency tree Reading state information... Done make is already the newest version. The following package was automatically installed and is no longer required: libfreeradius2 Use 'apt-get autoremove' to remove it. The following extra packages will be installed: freeradius-common freeradius-config freeradius-utils Suggested packages: freeradius-ldap freeradius-postgresql freeradius-mysql freeradius-krb5 snmp The following NEW packages will be installed: freeradius freeradius-common freeradius-config freeradius-utils 0 upgraded, 4 newly installed, 0 to remove and 114 not upgraded. Need to get 105 kB/2,069 kB of archives. After this operation, 5,233 kB of additional disk space will be used. Do you want to continue? [Y/n] y WARNING: The following packages cannot be authenticated! freeradius-common freeradius-config freeradius freeradius-utils Install these packages without verification? [y/N] y Get:1 http://ppa.launchpad.net/freeradius/stable-3.0/ubuntu/ trusty/main freeradius-utils amd64 3.0.10-ppa2~trusty [105 kB] Fetched 105 kB in 0s (144 kB/s) dpkg: unrecoverable fatal error, aborting: syntax error: unknown user 'freerad' in statoverride file E: Sub-process /usr/bin/dpkg returned an error code (2)

4 14

How to enable the "Session-Timeout" attribute?
by zhengfish 26 Feb '16

26 Feb '16

Hello, I want to enable the Session-Timeout attribute, and add it into /etc/freeradius/users as below: friends Cleartext-Password := "12343333" Service-Type = Framed-User, Session-timeout = 80, Reply-Message = "Welcome, %{User-Name}" Then I can test it with radeapclient and got a result with Session-Timeout value. Next I want to connect hostapd to freeradius as a radius client, however I cannot get a result with Session-Timeout value. I do some tcpdump to parse the RADIUS udp packet, I found that there is a Session-Timeout attribute in early "Access-Challenge" packets, however in later "Access-Challenge" packets and the last "Access-Accept", the Session-Timeout attribute disappear. Why? I want to know how to enable Session-Timeout attribute in last "Access-Accept" packet. ------------------------------------ Here is the decoded UDP-1812 packets ----------------------------------------------------- /////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////// There is a AVP: Session-Timeout: 80 RADIUS Protocol Code: Access-Challenge (11) Packet identifier: 0x65 (101) Length: 110 Authenticator: 513ca93d5b2fe694852edad5796e873f [This is a response to a request in frame 1] [Time from request: 0.000964000 seconds] Attribute Value Pairs AVP: l=6 t=Service-Type(6): Framed(2) Service-Type: Framed (2) AVP: l=6 t=Session-Timeout(27): 80 Session-Timeout: 80 AVP: l=18 t=Reply-Message(18): Welcome, friends Reply-Message: Welcome, friends AVP: l=24 t=EAP-Message(79) Last Segment[1] EAP fragment: 019a00160410aa40b4b2c24e6e447f48c1de9530e45c Extensible Authentication Protocol Code: Request (1) Id: 154 Length: 22 Type: MD5-Challenge EAP (EAP-MD5-CHALLENGE) (4) [Expert Info (Warn/Security): Vulnerable to MITM attacks. If possible, change EAP type.] [Vulnerable to MITM attacks. If possible, change EAP type.] [Severity level: Warn] [Group: Security] EAP-MD5 Value-Size: 16 EAP-MD5 Value: aa40b4b2c24e6e447f48c1de9530e45c AVP: l=18 t=Message-Authenticator(80): eb392ef543cf61e13c6e58bcaed46577 Message-Authenticator: eb392ef543cf61e13c6e58bcaed46577 AVP: l=18 t=State(24): b5d32c27b54928e8e6f7137e05697f5e State: b5d32c27b54928e8e6f7137e05697f5e /////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////// There is no AVP: Session-Timeout, and why it disappear? RADIUS Protocol Code: Access-Challenge (11) Packet identifier: 0x67 (103) Length: 1090 Authenticator: cb2585fb656ee2f714fb5425ec4e6527 [This is a response to a request in frame 5] [Time from request: 0.004675000 seconds] Attribute Value Pairs AVP: l=255 t=EAP-Message(79) Segment[1] EAP fragment: 019c040019c00000045c1603010039020000350301e7a203... AVP: l=255 t=EAP-Message(79) Segment[2] EAP fragment: f8536db5bc4ebf41cdcdbdaf51935045343680b0104d1b8f... AVP: l=255 t=EAP-Message(79) Segment[3] EAP fragment: 0d06092a864886f70d01010b05000382010100daebd2a23e... AVP: l=255 t=EAP-Message(79) Segment[4] EAP fragment: f93c85f6c573803c63a809ed50872b35472336d5b30f1603... AVP: l=14 t=EAP-Message(79) Last Segment[5] EAP fragment: f46d3040cff8f0ac356b4d90 Extensible Authentication Protocol Code: Request (1) Id: 156 Length: 1024 Type: Protected EAP (EAP-PEAP) (25) EAP-TLS Flags: 0xc0 1... .... = Length Included: True .1.. .... = More Fragments: True ..0. .... = Start: False .... .000 = Version: 0 EAP-TLS Length: 1116 [2 EAP-TLS Fragments (1116 bytes): #6(1014), #8(102)] [Frame: 6, payload: 0-1013 (1014 bytes)] [Frame: 8, payload: 1014-1115 (102 bytes)] [Fragment Count: 2] [Reassembled EAP-TLS Length: 1116] Secure Sockets Layer TLSv1 Record Layer: Handshake Protocol: Server Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 57 Handshake Protocol: Server Hello Handshake Type: Server Hello (2) Length: 53 Version: TLS 1.0 (0x0301) Random GMT Unix Time: Feb 22, 2093 23:22:25.000000000 China Standard Time Random Bytes: 608ccc8b12dc4d965050630f0f439ea9bdae18141a97a288... Session ID Length: 0 Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Compression Method: null (0) Extensions Length: 13 Extension: renegotiation_info Type: renegotiation_info (0xff01) Length: 1 Renegotiation Info extension Renegotiation info extension length: 0 Extension: ec_point_formats Type: ec_point_formats (0x000b) Length: 4 EC point formats Length: 3 Elliptic curves point formats (3) EC point format: uncompressed (0) EC point format: ansiX962_compressed_prime (1) EC point format: ansiX962_compressed_char2 (2) TLSv1 Record Layer: Handshake Protocol: Certificate Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 704 Handshake Protocol: Certificate Handshake Type: Certificate (11) Length: 700 Certificates Length: 697 Certificates (697 bytes) Certificate Length: 694 Certificate: 308202b23082019aa003020102020900dcb8917524af35a0... (id-at-commonName=ubuntu) signedCertificate version: v3 (2) serialNumber: -2542122057337981536 signature (sha256WithRSAEncryption) Algorithm Id: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) issuer: rdnSequence (0) rdnSequence: 1 item (id-at-commonName=ubuntu) RDNSequence item: 1 item (id-at-commonName=ubuntu) RelativeDistinguishedName item (id-at-commonName=ubuntu) Id: 2.5.4.3 (id-at-commonName) DirectoryString: printableString (1) printableString: ubuntu validity notBefore: utcTime (0) utcTime: 14-07-24 08:10:04 (UTC) notAfter: utcTime (0) utcTime: 24-07-21 08:10:04 (UTC) subject: rdnSequence (0) rdnSequence: 1 item (id-at-commonName=ubuntu) RDNSequence item: 1 item (id-at-commonName=ubuntu) RelativeDistinguishedName item (id-at-commonName=ubuntu) Id: 2.5.4.3 (id-at-commonName) DirectoryString: printableString (1) printableString: ubuntu subjectPublicKeyInfo algorithm (rsaEncryption) Algorithm Id: 1.2.840.113549.1.1.1 (rsaEncryption) Padding: 0 subjectPublicKey: 3082010a0282010100e856b7f9bb7b62f9392a07c95cf88c... extensions: 1 item Extension (id-ce-basicConstraints) Extension Id: 2.5.29.19 (id-ce-basicConstraints) BasicConstraintsSyntax [0 length] algorithmIdentifier (sha256WithRSAEncryption) Algorithm Id: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) Padding: 0 encrypted: daebd2a23ef9eaa63ddbcc2e15c6e989d0cdeeca59b9284d... TLSv1 Record Layer: Handshake Protocol: Server Key Exchange Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 331 Handshake Protocol: Server Key Exchange Handshake Type: Server Key Exchange (12) Length: 327 EC Diffie-Hellman Server Params Curve Type: named_curve (0x03) Named Curve: secp256r1 (0x0017) Pubkey Length: 65 Pubkey: 04c14aa367d5908392067e94509943044f585b4fb6f5f114... Signature Length: 256 Signature: 2282fe1506f827e574054f7faea4830bf6cc651c598e070e... TLSv1 Record Layer: Handshake Protocol: Server Hello Done Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 4 Handshake Protocol: Server Hello Done Handshake Type: Server Hello Done (14) Length: 0 AVP: l=18 t=Message-Authenticator(80): f6c1655b8f0daf6211be63b8512e3674 Message-Authenticator: f6c1655b8f0daf6211be63b8512e3674 AVP: l=18 t=State(24): b5d32c27b74f35e8e6f7137e05697f5e State: b5d32c27b74f35e8e6f7137e05697f5e /////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////// This is the last Access-Accept Packet, no "Session-Timeout" RADIUS Protocol Code: Access-Accept (2) Packet identifier: 0x6e (110) Length: 169 Authenticator: d91a7b3eb51f9603cb77c7b4ec81a9c8 [This is a response to a request in frame 19] [Time from request: 0.000736000 seconds] Attribute Value Pairs AVP: l=58 t=Vendor-Specific(26) v=Microsoft(311) VSA: l=52 t=MS-MPPE-Recv-Key(17): 825135d40982501e28a6937e32a17dd647d73ed1e6da099f... MS-MPPE-Recv-Key: 825135d40982501e28a6937e32a17dd647d73ed1e6da099f... AVP: l=58 t=Vendor-Specific(26) v=Microsoft(311) VSA: l=52 t=MS-MPPE-Send-Key(16): 8f794639cd3defeb9d0528fb98a5e8c4ea98b7bab29a7eb7... MS-MPPE-Send-Key: 8f794639cd3defeb9d0528fb98a5e8c4ea98b7bab29a7eb7... AVP: l=6 t=EAP-Message(79) Last Segment[1] EAP fragment: 03a20004 Extensible Authentication Protocol Code: Success (3) Id: 162 Length: 4 AVP: l=18 t=Message-Authenticator(80): a8628059998e6599571d318fc1db6d9f Message-Authenticator: a8628059998e6599571d318fc1db6d9f AVP: l=9 t=User-Name(1): friends User-Name: friends

2 3

Link to 2-3 migration on download page is wrong?
by Phil Mayers 26 Feb '16

26 Feb '16

The download page says: """ A basic 2.2.x to 3.0.x migration guide is available here """ ...but that link leads to a file that says: """ If you're upgrading from v2.2.x you should read the v3.0.x version of this file. It describes changed from v2 to v3.0. This file describes only the changes from v3.0 to v3.1 """

2 1

freeradius3, rlm_preprocess changed defaults without notice
by Boris Lytochkin 26 Feb '16

26 Feb '16

Hi. I am struggling moving our RADIUS server from freeradius 2.1 to freeradius 3 and found a (yet another) snag: rlm_preprocess in 2.1 does load huntgroups/users even they are not specified in configuration because it has defaults compiled in. Version 3, instead, needs them to be specified directly as have NULLs instead of default location: version 2: static const CONF_PARSER module_config[] = { { "huntgroups", PW_TYPE_FILENAME, offsetof(rlm_preprocess_t,huntgroup_file), NULL, "${raddbdir}/huntgroups" }, { "hints", PW_TYPE_FILENAME, offsetof(rlm_preprocess_t,hints_file), NULL, "${raddbdir}/hints" }, version 3: static const CONF_PARSER module_config[] = { { "huntgroups", FR_CONF_OFFSET(PW_TYPE_FILE_INPUT, rlm_preprocess_t, huntgroup_file), NULL }, { "hints", FR_CONF_OFFSET(PW_TYPE_FILE_INPUT, rlm_preprocess_t, hints_file), NULL }, This is not mentioned in "Changed modules" here: http://networkradius.com/doc/3.0.10/upgrading/changed-modules.html and adds a cherry on the top of migrating hell pie. Please find a way to fix it properly. -- Boris Lytochkin Yandex NOC +7 (495) 739 70 00 ext. 7671

3 8

Freeradius+CMTS
by Suporte2 - TVC Tubarão 26 Feb '16

26 Feb '16

Hello! I created a new server to work with Centos installed 7. freeradius 3.0.4 repositories by the yum command. This server will authenticate the CM MAC address with NAS as one CMTS. I have a mysql-proxy server with two clusters for authentication. With the command radiusxd -X, I realize you're doing the research in the database, returning the settings. But could not deliver the NAS (CMTS). I I disabled the firewall, the necessary routes were created. The message appears in the log CMTS is dhcp (d). Can someone help me? --- Este email foi escaneado pelo Avast antivírus. https://www.avast.com/antivirus

2 1

Post-Proxy Accept/Reject checking
by Peter Lambrechtsen 25 Feb '16

25 Feb '16

Hello I've got FR3.0.10 working happily and now I am testing some edge cases with post-proxy accepts and rejects. When the proxy returns Reject, which VSA would I need to query to pick that up, as it doesn't seem to be in control:Auth-Type So where could it be?

2 3

Code of Conduct
by Alan DeKok 25 Feb '16

25 Feb '16

Given the increase in banned people in the last few months, I thought an explanation was necessary. This list is for technical discussions about FreeRADIUS. People should be helpful. Name-calling and cursing are not allowed. Conduct should be goal-oriented, and that goal should be getting FreeRADIUS to do something. That's really it. I've seen other groups use a code of conduct like: http://todogroup.org/opencodeofconduct/ While that text is largely OK, it will never be adopted here. It is too broad, and not technically focussed. The sections on "harassment" and "diversity" issues are entirely unnecessary for an on-line list such as this. Any harassment is wrong not only because the behaviour is wrong, but because the discussion is not technical, and not related to FreeRADIUS. Similarly, discussions of "diversity" are irrelevant on a list dedicated to technical FreeRADIUS issues. Even worse, there is text which raised red flags for me. Specifically, the text on "we will not act on complaints regarding...Refusal to explain or debate social justice concepts" is a deal breaker for me. Again, this is because a technical list is *not* the place to discuss social justice, religion, politics, or gender theory. The implicit assumption in the "Code of Conduct" document is that those subjects are suitable topic for a technical list. I disagree rather fundamentally. If people want to discuss non-FreeRADIUS issues, there are hundreds of thousands of other places to do so. When people demand that the conduct here satisfy their personal sense of propriety, the answer will be an emphatic "No". We assume that people here are adults, and have enough maturity to see that disagreement with them isn't a personal attack. People who can't take such disagreement should go somewhere else. Discussing codes of conduct is not an appropriate topic for this list. If I continue to complain about it, I will have to ban myself. Alan DeKok.

2 1

Cached attributes
by Jonathan Gazeley 25 Feb '16

25 Feb '16

We're still struggling with an ongoing problem to get the caching behaviour we want with FreeRADIUS 3.1.x. With a resumed session, we want to know the User-Name from the inner tunnel. What's the recommended way to do this? With the config we're running (based on the sample config files in the 3.1.x branch in git to enable the tls-cache server) and various calls to stuff attributes in session-state, the session-state can't be grabbed back in the outer post-auth, which is where the decision about user VLAN is made. In packet 13 you can see the inner User-Name is undefined. Any help figuring out our probably-simple mistake would be greatly appreciated. Full debug including server startup and two authentications - the first not resumed, the second is resumed: http://pastebin.com/Ey0PAVBY Sorry about the pastebin - I know that this debug log will be too big to be accepted by the mailing list server. Thanks, Jonathan

6 24

FreeRADIUS with Cassandra
by Paul Devins 25 Feb '16

25 Feb '16

We are trying to get FreeRADIUS 3.1 (On Ubuntu 14.04) working with a Cassandra backend but keep encountering the issue below. We have installed the Cassandra CPP driver as advised by a previous thread. "/usr/local/etc/raddb/mods-enabled/sql_cassandra[9]: Failed to link to module "rlm_cassandra": /usr/local/lib/rlm_cassandra.so: cannot open shared object file: No such file or directory : rlm_cassandra.so: cannot open shared object file: No such file or directory" Even if we manually link to or create the library file required we get unknown symbol error. Has anyone had this running with Cassandra successfully and if so any installation advice would be appreciated.

4 3

radwtmp doesn't exist
by Michael Martinez 25 Feb '16

25 Feb '16

Hi, I installed 3.0.11 from source and it works fine, but the radwtmp file does not exist and I'm not sure why. * the unix module is uncommented in the accounting section of the default virtual server * the debug output shows that the module is being loaded when the server starts: # Loading module "unix" from file /usr/local/freeradius/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/freeradius/var/log/radius/radwtmp" } But: root@stand-2-rpi:/usr/local/freeradius/etc/raddb# radlast last: /usr/local/freeradius/var/log/radius/radwtmp: No such file or directory It's not critical or urgent, but just wondering why this file isn't being created. -- --- Michael Martinez http://www.michael--martinez.com

4 9