- Freeradius-Users - lists.freeradius.org

EAP-TLS suddenly broken
by John Mok 14 Feb '16

14 Feb '16

Hi, I had been using EAP-TLS authentication with FreeRADIUS 2.1.12 on Debian Wheezy (OpenSSL 1.0.1e) and it worked fine, until I upgraded the Debian Wheezy packages (using apt-get dist-upgrade) several weeks ago. Then, the EAP-TLS authentication suddenly failed and became broken (see attached log). Is there anyone knows what go wrong ? Thanks a lot. John Mok

2 1

Linelog and \n escaping.
by Peter Lambrechtsen 13 Feb '16

13 Feb '16

I've used linelog in 2.x for a while where I set a number of temp VSAs and have in my mod config format="%{MSG1}\n{MSG2}" I see now in 3 that they get escaped. Any thoughts about supporting escape characters in config but not in VSAs. I saw a thread from December 2014 but checking the code in 3.0.10 it seems nothing has made its way into the code. I'm tempted to just comment out the code. But understand the reasons for it being there and unintended consequences. Any thoughts about an effective logging module that supports logging multi line messages?

2 1

Freeradius doesn't find libssl-dev
by LUCA 13 Feb '16

13 Feb '16

Hello, I've installed freeradius v2.1.12 and then libssl-dev. When I try to start the server in debug mode here's what I see: Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. ... ... rlm_eap: No such sub-type for default EAP type peap I've also tried to re-install freeradius, as suggested in the FAQ, by doing ./configure; make; make install. But the problem still remains. So, what's missing? Maybe libssl-dev path has changed and freeradius needs to be linked? Thank you for your support and your time. Best Regards, Luca

4 9

redirecting REJECTed users
by Alan Batie 12 Feb '16

12 Feb '16

I would like to send otherwise REJECTed users to a "suspended" ip pool and pass them. When things get rejected, it seems to abort processing (e.g. if I stick a perl module after pap, it doesn't get called if pap rejects), and it doesn't look like you can make them OK in the Post-Auth-Type REJECT section. Recommendations?

3 6

freeradius 3 and "#" sign in configuration files
by gahn 12 Feb '16

12 Feb '16

hello: for those configurations files, i noticed those "#" in front of a lot of pre-set values such as those: # psk_identity = "test" # psk_hexphrase = "036363823" does that mean those values are default values being used or they would be ignored? thanks _dave

2 2

freeradius 3 and certs
by gahn 12 Feb '16

12 Feb '16

hello all: i am learning radius3 for 802.1x authentication. i have followed the web site "http://deployingradius.com/documents/configuration/eap.html" and tried to get basic 802.1x tests going. at the first step, it failed me on "snake oil"certificates creation: root@lab:/usr/local/etc/raddb/certs # radiusd -v radiusd: FreeRADIUS Version 3.0.11, for host amd64-portbld-freebsd10.1, built on Jan 31 2016 at 14:36:06 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT root@lab:/usr/local/etc/raddb/certs # make /usr/bin/openssl req -new -out server.csr -keyout server.key -config ./server.cnf Generating a 2048 bit RSA private key ..........+++ ..................................................................+++ writing new private key to 'server.key' ----- /usr/bin/openssl req -new -x509 -keyout ca.key -out ca.pem -days '60' -config ./ca.cnf Generating a 2048 bit RSA private key .....+++ .......................+++ writing new private key to 'ca.key' ----- /usr/bin/openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key 'whatever' -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 3 (0x3) Validity Not Before: Feb 12 16:09:37 2016 GMT Not After : Apr 12 16:09:37 2016 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.org X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 CRL Distribution Points: Full Name: URI:http://www.example.com/example_ca.crl Certificate is to be certified until Apr 12 16:09:37 2016 GMT (60 days) failed to update database TXT_DB error number 2 *** Error code 1 Stop. make: stopped in /usr/local/etc/raddb/certs it seemed to have passed compilation but failed on database, is it something wrong with the code? thanks _dave

2 2

Deduplication of accounting requests
by apopov＠cybervisiontech.com 12 Feb '16

12 Feb '16

>From RFC: "The RADIUS server can detect a duplicate request if it has the same client source IP address and source UDP port and Identifier within a short span of time." Does it mean, if my application send accounting requests from one port, I can send only 256 request in short span of time, next request will be handled as duplicate regardless of attributes in it? How freeradius detect that package is duplicated? What fields used for this purposes ? Where and how it configured? Thanks, --Artem

2 3

If you need to set "synchronous = no"
by apopov＠cybervisiontech.com 12 Feb '16

12 Feb '16

We want to use radius for transferring CDR records. Expected about 5000 accounting requests per second. Our plan: App(requests generator) -> Local FreeRadius proxy -> Remote FreeRadius servers. Local instance of freeradius proxy should store requests if remote server unavailable and also care about retransmissions. If proxy support only synchronous mode, I don't think it is possible to transfer 5K requests per second because of response delay. Looks like asynchronous mode can help in this case. >From my understanding synchronous mode mean - proxy does not handle next request before response on first one. Is it correct understanding? Can FreeRadius Proxy be used for my case? Thanks, --Artem

2 3

REG: module load problem
by Anirudh Malhotra 12 Feb '16

12 Feb '16

Hi, I am using v3.0.11 and sqlcounter is getting included before sql and that is creating problems i tried doing instantiate sql sqlcounter no help! including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/sqlcounter /usr/local/etc/raddb/mods-enabled/sqlcounter[43]: Reference "${modules.sql.dialect}" not found /usr/local/etc/raddb/mods-enabled/sqlcounter[52]: Reference "${modconfdir}/sql/counter/${dialect}/${.:instance}.conf" points to a variable which has not been expanded. please suggest a solution

2 2

RE: sql: ERROR: rlm_sql_oracle: ORA-01403: no data found
by Vincent MARCEL 12 Feb '16

12 Feb '16

No, sorry. There is no connection problem and radius server get the same connection string as with sqlplus : rlm_sql (sql): Attempting to connect to database "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.22.97.147)(PORT=1533))(CONNECT_DATA=(SID=MEMAD)))" rlm_sql (sql): Initialising connection pool pool { start = 4 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } If radius server really got no data, how do you want it accepts known users in my authcheck_table and rejects unknown users from my authcheck_table ? Sql is my only authorization method : authorize { filter_username preprocess sql if(ok) { update control { Auth-Type := Accept } } else { update control { Auth-Type := Reject } } expiration logintime } And here is the result in debug mode : (0) sql: EXPAND SELECT distinct 1,NUM_SERIE,'Cleartext-Password',NUM_SERIE,':=' FROM E_MEMA_TPE WHERE NUM_SERIE = '%{User-Name}' (0) sql: --> SELECT distinct 1,NUM_SERIE,'Cleartext-Password',NUM_SERIE,':=' FROM E_MEMA_TPE WHERE NUM_SERIE = 'FT10895748' (0) sql: Executing select query: SELECT distinct 1,NUM_SERIE,'Cleartext-Password',NUM_SERIE,':=' FROM E_MEMA_TPE WHERE NUM_SERIE = 'FT10895748' (0) sql: ERROR: Error fetching row (0) sql: ERROR: rlm_sql_oracle: ORA-01403: no data found (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "FT10895748" rlm_sql (sql): Released connection (4) rlm_sql (sql): Need 2 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 31 pending slots used (0) [sql] = ok (0) if (ok) { (0) if (ok) -> TRUE (0) if (ok) { (0) update control { (0) Auth-Type := Accept (0) } # update control = noop (0) } # if (ok) = noop (0) ... skipping else for request 0: Preceding "if" was taken (0) [expiration] = noop (0) [logintime] = noop (0) } # authorize = ok (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user Anyway : - this error appear whatever query I put in authorize_check_query, for example "SELECT 1,'FT10895748','User-Password','FT10895748',':=' FROM DUAL" that returns a fixed row - even in the case where data is not found (unkown user), it is not normal that radius provokes this Oracle ORA-01403 error since it is not forbidden to retrieve no data from authorize_check_query. It may say "no data found" for information but not produce an error... Cordialement, Vincent. De : Alan Buxey [mailto:A.L.M.Buxey@lboro.ac.uk] Envoyé : jeudi 11 février 2016 23:29 À : FreeRadius users mailing list; Vincent MARCEL Objet : RE: sql: ERROR: rlm_sql_oracle: ORA-01403: no data found >>Your query doesn't return data from >>the database >False : here is the query (debug mode) >for an accepted user : No. Sorry. It's true. Look: (1) sql: ERROR: Error fetching row (1) sql: ERROR: rlm_sql_oracle: ORA-01403: no data found See. Error fetching row and no data found. Ensure your sql config had suitable access user/pass and host has required access alan

1 0