- Freeradius-Users - lists.freeradius.org

Simple questiona about RadSec - Freeradius 3.0.10
by Neuton Martins 19 Feb '16

19 Feb '16

Hello Guys, I have a simple question about RadSec, but after a lot of research on the web i cant't figure out the solution. I have a federated FreeRADIUS scenario, where one central server answer requests and N other server who sent them requests. Everything is working fine without RadSec. But for security reasons i'm trying to configure RadSec. In my central server i have setup the RadSec sites-avaiable properly, but at my distributed clients i can't figure out what and where i have to change for client FreeRADIUS to proxy request as RadSec. In my research i found about radsecproxy, but i Think FreeRADIUS 3.0.X don't need that right? I'm using FreeRADIUS 3.0.10 compiled from source. My proxy config is like: realm central { type = auth authhost = centralradius.my.domain secret = secrect nostrip } So guys, what and where i have to change to this scenario works? With regards, Neuton Martins Costa

3 3

Freeradius + mysql in OpenSUSE
by Daniel Lopez 18 Feb '16

18 Feb '16

Here goes a dumb question: After building freeradius 3.0.11 in OpenSUSE 13.1, four .RPM files was created in /usr/src/packages/RPMS/x86_64/ I installed those files: freeradius-server-3.0.11-0.x86_64.rpm freeradius-server-devel-3.0.11-0.x86_64.rpm freeradius-server-libs-3.0.11-0.x86_64.rpm freeradius-server-utils-3.0.11-0.x86_64.rpm I noticed there isn't a freeradius-server-mysql... package. I've readed that SUSE already includes the rlm_sql_mysql module as part of the freeradius-server package. But I'm new in SUSE (and relatively in freeradius too -:)) and maybe there may be differences configuring mysql module in suse and ubuntu, for instance: there isn't an "$INCLUDE sql.conf " line in radius.com file. In short: I need some help with mysql module configuration in SUSE, maybe i'm missing something obvious. Thanks in advance

2 1

Why do some module call have a 'minus' sign in front in the config file ?
by Sylvain Munaut 18 Feb '16

18 Feb '16

Hi, Some of the modules sometimes have a "minus" (-) sign in front of them in config files like -sql -ldap What purpose does it serve ? Can't really find this mentioned anywhere. Cheers, Sylvain

3 3

linelog oddity on 3.1.x
by Jonathan Gazeley 18 Feb '16

18 Feb '16

Yesterday I built 3.1.x from git and today I'm tidying up the rough edges in my config. I spotted that my instantiation of linelog is not behaving quite as I'd expect, as it appears not to tag the syslog_facility, and then rsyslog makes up whatever it feels like. This behaviour has changed since 3.0.11 on the same box. Here's my linelog module: linelog logtosyslog { destination = syslog syslog { syslog_facility = local5 } # Default log message format = "" # Match packet type to blocks below reference = "logtosyslog.%{%{reply:Packet-Type}:-format}" logtosyslog { Access-Accept = "%{Virtual-Server}: Login OK: [%{User-Name}] (from client %S cli %{Calling-Station-Id})" Access-Reject = "%{Virtual-Server}: Login incorrect: [%{User-Name}] (from client %S cli %{Calling-Station-Id})" } } And here's what the server prints when run in -X: # Loading module "logtosyslog" from file /etc/raddb/mods-enabled/logtosyslog linelog logtosyslog { destination = "syslog" delimiter = " " file { permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } Looks like it's just not picking up on the syslog_facility config item. Any pointers for beating it into submission? Thanks, Jonathan

2 1

Migrate "Steel-Belted Radius" to FreeRADIUS.
by Meike Stone 18 Feb '16

18 Feb '16

Hello dear list, I like to migrate from "Steel-Belted Radius" to FreeRADIUS. I've seen, that the user base can exported via XML, but the passwords are encoded. Does anyone did this already and can give any recommendations? ( ..or usable scripts, to convert the User-Database?) Many thanks Meike!

2 1

hints file based rewrite does not work (migration from freeradius 1.1.x to 3.0.x)
by Bernd 18 Feb '16

18 Feb '16

Hi list, we're about to move from a freeradius (freeradius-1.1.3-1.6.el5 on CentOS 5) to a HA freeradius (freeradius-3.0.4-6.el7.x86_64 on CentOS 7) environment. We're almost there, however, I ran into an issue: I have to rewrite an "%" character to "@". My 'hints' file on the old installation did this perfectly well: DEFAULT User-Name =~ "bla\-bla\/([^%]+)%kroenchenstadt.de" User-Name := "%{1}(a)kroenchenstadt.de" However, freeradius BLA throws an error (running as 'radius -X' for debugging purposes): (0) ERROR: preprocess : bla\-bla\/(^%)%kroenchenstadt.de (0) ERROR: preprocess : ^ Invalid variable expansion Any idea what goes possibly wrong here? How could I circumvent the problem? Thanks, Bernd

4 14

users configuration and certs
by gahn 18 Feb '16

18 Feb '16

hello: would you please advice how to proceed this issue? here is what i am trying to do after authenticated with certs (compiled per "http://deployingradius.com/documents/configuration/certificates.html"): * radius will assign a vlan id* and IP address here is the configuration: user1 User-Password == "user1" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-ID = "vlan1", Framed-IP-Address = 10.0.0.101, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP user2 User-Password == "user2" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-ID = "vlan2", Framed-IP-Address = 10.0.4.101, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP i tested md5 first and it works (i think) but not able to bring up tunnel, so not able to get vlan id and ip addresses: Ready to process requests (0) Received Access-Request Id 148 from 100.64.8.3:51157 to 10.85.19.162:1812 length 170 (0) User-Name = "tester4" (0) NAS-Port = 82 (0) EAP-Message = 0x0200000c0174657374657234 (0) Message-Authenticator = 0xb19c034e8325fa37e7c8555a7323de40 (0) Acct-Session-Id = "8O2.1x81310900000b65a7" (0) NAS-Port-Id = "ge-0/0/16.0" (0) Calling-Station-Id = "08-ed-2a-81-00-00" (0) Called-Station-Id = "00-26-88-7c-c4-00" (0) NAS-Identifier = "jtac-EX4200-48T-r064" (0) NAS-Port-Type = Ethernet (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "tester4", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 0 length 12 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 1 length 22 (0) eap: EAP session adding &reply:State = 0x221d73df221c7755 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Sent Access-Challenge Id 148 from 10.85.19.162:1812 to 100.64.8.3:51157 length 0 (0) EAP-Message = 0x0101001604104f25d10e53221ba2241dc31da1154f5c (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x221d73df221c7755f69b930716c7d1dc (0) Finished request Waking up in 4.9 seconds. Waking up in 6.9 seconds. Waking up in 13.9 seconds. Waking up in 30.9 seconds. (0) Cleaning up request packet ID 148 with timestamp +14 i copied "client.pem" from the server to client side and tried "tls". this time i don't see any outputs from "radiusd -sX" (i think because of failed certs and 802.1x didn't even finish its process) the client side showed failed message: "Validated, Test cannot continue, a fatal error encountered when working with certificates" how could i troubleshoot this? is it an issue of certs? thanks _dave

2 1

extending mysql accounting for IPv6
by Blake Hudson 17 Feb '16

17 Feb '16

We are deploying IPv6 capable CPE devices on a Cisco ASR9k BRAS. The ASR provides the following attributes in its accounting packets: Framed-IPv6-Address and Delegated-IPv6-Prefix. These are present in the freeradius dictionary, however, the current MySQL schema has no way to store these. I'd like to extend the existing schema to handle these additional attributes. Is it as simple as modifying the existing accounting table and accounting mysql queries? Any guidance or advice would be appreciated (freeradius-2.2.6-6.el6_7.x86_64). Thanks, --Blake

2 1

FreeRADIUS 3.1 estimated release date
by Jonathan Gazeley 17 Feb '16

17 Feb '16

Is there an estimated date for the release of FreeRADIUS 3.1.x? We're interested in the new caching features. Thanks, Jonathan

4 7

3.0.11 update broke my PEAP
by Stefan Winter 17 Feb '16

17 Feb '16

Hi, this looks suspiciously like a bug to me. I updated from 3.0.10 to 3.0.11 with a perfectly working and unchanged configuration. In 3.0.11, all PEAP is broken with a slightly enigmatic error message which suggests my config may be sub-par; I can't really determine what should be wrong with it. Here's -X, the end of authorize and beginning of authenticate inside inner-tunnel: (484) sql-commonauth: User found in radcheck table (484) sql-commonauth: Conditional check items matched, merging assignment check items (484) sql-commonauth: NT-Password := 0xREALLYITISTHEPASSWORDBUTIREDACTEDIT rlm_sql (sql-commonauth): Released connection (0) (484) [sql-commonauth] = ok (484) } # redundant = ok (484) [mschap] = noop (484) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes (484) pap: WARNING: Auth-Type already set. Not setting to PAP (484) [pap] = noop (484) } # authorize = updated (484) Found Auth-Type = eap (484) # Executing group from file /usr/local/freeradius/config/raddb/sites-enabled/inner-tunnel (484) authenticate { (484) eap: Expiring EAP session with state 0x3a79dfac3a78c68e (484) eap: Finished EAP session with state 0x4db614dc4dbc0e2d (484) eap: Previous EAP request found for state 0x4db614dc4dbc0e2d, released from the list (484) eap: Peer sent packet with method EAP MSCHAPv2 (26) (484) eap: Calling submodule eap_mschapv2 to process data (484) eap_mschapv2: Auth-Type sub-section not found. Ignoring. (484) eap_mschapv2: # Executing group from file /usr/local/freeradius/config/raddb/sites-enabled/inner-tunnel (484) eap: Sending EAP Failure (code 4) ID 10 length 4 (484) eap: Freeing handler (484) [eap] = reject (484) } # authenticate = reject (484) Failed to authenticate the user (484) Using Post-Auth-Type Reject So... the inner-tunnel eap comes as far as realising it should call the eap_mschapv2 sub-module; but that one bails out claiming it can't find its own config? Well mods-enabled/eap has a mschapv2 EAP type configuration just fine: eap { default_eap_type = peap [...] peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } mschapv2 { } } So which sub-section would be missing here? Strange. I've rolled back with the exact same config to 3.0.10 and things started working again like a charm. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 9