- Freeradius-Users - lists.freeradius.org

Framed-IP-Address to Proxy acct
by Elton Machado 05 Feb '16

05 Feb '16

Hi There, How can I sent the Framed-IP-Address to a acct remote proxy? My authentication is being done in a Remote Radius, and I need to send back the accounting from Freeradius to another radius accounting server or at least duplicate accounting to there (Sonicwall) Since my Dell switch are not able to send the attribute 8 but only the mac address. Freeradius is responsible for the DHCP and I can see the Framed-IP-Address being there and being set to the DHCP Client IP, but on my proxy acct server I don't see on the AVP the attr 8. Cheers, Elton

2 1

freeradius fail redundant
by Дмитрий 05 Feb '16

05 Feb '16

Freeradius Version: 2.1.12+dfsg-1.2ubuntu8.1 /etc/freeradius/radiusd.conf accounting { switch "%{Hint}" { case "session" { redundant { module-sql-session write-backlog ok } } case "service" { redundant { module-sql-service write-backlog ok } } } } In debug sql returns "noop" Mon Feb 1 13:12:58 2016 : Debug: rlm_sql (module-sql-session): Reserving sql socket id: 14 Mon Feb 1 13:12:58 2016 : Debug: rlm_sql_mysql: query: call freeradius_session_sql('2016-02-01 13:12:58', '7c4d32221312f4c7', '', 'test-user', '172.12.12.5', '172.1.1.52', 0, 0, 0, 0, 0, 0, 0); Mon Feb 1 13:12:58 2016 : Debug: rlm_sql (module-sql-session): Released sql socket id: 14 Mon Feb 1 13:12:58 2016 : Info: +++++[module-sql-session] returns noop Mon Feb 1 13:12:58 2016 : Info: [write-backlog] expand: /var/log/freeradius/radacct/backlog/write-backlog-%Y-%m-%d-%H.log -> /var/log/freeradius/radacct/backlog/write-backlog-2016-02-01-13.log Mon Feb 1 13:12:58 2016 : Info: [write-backlog] /var/log/freeradius/radacct/backlog/write-backlog-%Y-%m-%d-%H.log expands to /var/log/freeradius/radacct/backlog/write-backlog-2016-02-01-13.log Mon Feb 1 13:12:58 2016 : Info: [write-backlog] Acquired filelock, tried 1 time(s) Mon Feb 1 13:12:58 2016 : Info: [write-backlog] expand: %t -> Mon Feb 1 13:12:58 2016 Mon Feb 1 13:12:58 2016 : Info: +++++[write-backlog] returns ok Mon Feb 1 13:12:58 2016 : Info: ++++- group safe-module-sql-session returns ok Mon Feb 1 13:12:58 2016 : Info: +++- case session returns ok Mon Feb 1 13:12:58 2016 : Info: ++- switch %{Hint} returns ok BUT in tcpdump Mysql Response OK

5 12

RE: [freeRADIUS 2.2.9 : fail building the rlm_sql_oracle module : make: *** No rule to make target `../../../../../Make.inc'. Stop
by Vincent MARCEL 05 Feb '16

05 Feb '16

Hello, I have followed your advice and got freeradius 3.0.11 tarball and followed new instructions here : http://wiki.freeradius.org/modules/Rlm_sql_oracle Top level configure script => OK make => OK cd src/modules/rlm_sql/drivers/rlm_sql_oracle => OK make install => KO : [radiusrec@radiusa1r1 rlm_sql_oracle]$ make install make: *** No rule to make target `install'. Stop. Indeed, there is no Makefile in this directory. I tried "make install" on top level (freeradius-server-3.0.11 directory) : [radiusrec@radiusa1r1 freeradius-server-3.0.11]$ make install mkdir: cannot create directory `/usr/local/include/freeradius': Permission denied make: *** [/usr/local/include/freeradius] Error 1 What do I have to do to install properly this freeradius WITH rlm_sql_oracle driver ? Best regards, Vincent MARCEL -----Message d'origine----- De : Alan DeKok [mailto:aland@deployingradius.com] Envoyé : jeudi 4 février 2016 16:04 À : Vincent MARCEL Objet : Re: [freeRADIUS 2.2.9 : fail building the rlm_sql_oracle module : make: *** No rule to make target `../../../../../Make.inc'. Stop On Feb 4, 2016, at 6:20 AM, vincent.marcel(a)monext.net wrote: > > Hi, > > Thank you for your answer. > The top level configure + make commands are successful and I now get 2 problems : > > 1/ if I use in the new binary freeradius-server-2.2.9/src/main/radius instead of /usr/sbin/radius (2.2.6 version) in /etc/init.d/radius script (in order to keep same version for server and rlm_sql module), I get this error at launch : > Thu Feb 4 10:34:02 2016 : Error: Refusing to start with libssl > version OpenSSL 1.0.1e-fips 11 Feb 2013 (in range 1.0.1 - 1.0.1f). > Security advisory CVE-2014-0160 (Heartbleed) Thu Feb 4 10:34:02 2016 > : Error: For more information see http://heartbleed.com Read raddb/radiusd.conf from the 2.2.9 distribution. Look for "openssl". > But my CentOS is up to date with a 1.0.1e openssl version that include all security patches. So, heartbleed is fixed and radius should not refuse to start. Is it possible de disable this check at launch ? Yes. And this is documented. > 2/ When I want to install the rlm_sql_oracle library, I get this error : > [radiusrec@radiusa1r1 rlm_sql_oracle]$ make install if [ > "xrlm_sql_oracle" != "x" ]; then \ > /USR/radiusrec/freeradius-server-2.2.9/libtool --mode=install /USR/radiusrec/freeradius-server-2.2.9/install-sh -c -c \ > rlm_sql_oracle.la /usr/local/lib/rlm_sql_oracle.la || exit $?; \ > rm -f /usr/local/lib/rlm_sql_oracle-2.2.9.la; \ > ln -s rlm_sql_oracle.la /usr/local/lib/rlm_sql_oracle-2.2.9.la || exit $?; \ > fi > /USR/radiusrec/freeradius-server-2.2.9/install-sh -c -c > .libs/rlm_sql_oracle-2.2.9.so /usr/local/lib/rlm_sql_oracle-2.2.9.so > cp: cannot create regular file `/usr/local/lib/_inst.50844_': > Permission denied > make: *** [install] Error 1 Weird. I've never seen that happen. > I have found where /usr/local/lib is configured (rlm_sql_oracle.la) but may I change the install path for my home directory for example : will it work ? I doubt that radiusd will find rlm_sql_oracle module at launch. > What should I do ? Try 3.0.11. We've updated the build system so that it doesn't use the crappy GNU libtool / libltdl. That should help. Alan DeKok.

3 2

RadPerf failed requests explanation
by Jim 05 Feb '16

05 Feb '16

I'm using RadPerf to test our servers for 10k auth requests in 10 requests in parallel. The server used python module and sql, and performs around 285 packets/s accepting all the 10k requests but there are times when there are several failed requests around 5 to 20. Why are there failed requests? From RadPerf README file, Performance testing ------------------- To see the maximum accepted load that a RADIUS server can handle, use: $ radperf -p 100 -s -f test.csv ... Using larger values for -p will not change the maximum accepted load, but will change the delay between a request and response. > "Using larger values for -p will not change the maximum accepted load, but will change the delay between a request and response" Why is that?

2 1

OpenLDAP+FreeRadius Encryption
by Greg Mischel Smith 05 Feb '16

05 Feb '16

We're using currently using freeradius 2.x and migrating to a new server where we will be using 3.0.4. Our OpenLDAP server has plaintext passwords currently, but as I migrate the server over, I would like to encrypt and salt them (something like SSHA). Both the LDAP and Radius servers will be on the same box. The problem devices is our wireless clients made up of Macs and phones (Android and iPhone) and the traffic passes through a Cisco WLC. If I want to encrypt, then it seems I would have to use EAP-GTC along with PAP. The Macs seem to only want to authenticate with MSCHAPv2. I found on Android phones if I don't set the Phase 2 authentication, it only checks MSCHAPv2, however if I force it to use GTC, then it authenticates correctly. I did notice in the logs using GTC, it has the ability to display the encrypted password in the clear. Didn't do this with MSCHAPv2. So here are my questions: 1. Is there something I'm missing from what I've trying and seeing above? 2. Is GTC and PAP with encrypted passwords less secure than using MSCHAPv2 with Plain text passwords in LDAP (even though they are on the same box)? 3. Should Mac's be able to use GTC? I've read that with Cisco ISE, this can be force, but beyond that I couldn't come across any article discussing it. I'm having trouble finding the article or thread, but I had read before the best solution with OpenLDAP and FreeRadius is plain-text passwords in LDAP, MSCHAPv2 for authentication and ACL's on the ldap OU's. Is this the recommendation? I would also like to prevent the ability to sniff the passwords in whichever scenario is used.

6 21

rest modules JSON replies format and types
by Louis Munro 05 Feb '16

05 Feb '16

Hello all, I am having a bit of fun playing around with the rest module in 3.0.10 to replace a custom coded perl module. I got it working and everything seem to work nicely but for one thing. The documentation says that the JSON payload in the request and in the reply should be in the same format. I have no problem with the request (since FR is encoding it anyway), and I have been able to hack a reply in the right format which is accepted by the module and sets the attributes I want, but I must concede that I am cheating a little at this point. I am returning every attribute with the type set to “string”. That is to say, if I get a request that looks like the following: { "Called-Station-SSID": { "value": [ "IofStuff" ], "type": "string" }, "EAP-Type": { "value": [ 26 ], "type": "integer" }, "FreeRADIUS-Proxied-To": { "value": [ "127.0.0.1" ], "type": "ipaddr" }, "Location-Capable": { "value": [ 1 ], "type": "integer" }, "Tunnel-Medium-Type": { "value": [ "IEEE-802" ], "type": "integer" }, } My reply will actually look like: { "Tunnel-Medium-Type": { "type": "string", "value": [ 6 ] }, "Tunnel-Type": { "type": "string", "value": [ 13 ] }, "Tunnel-Private-Group-ID": { "type": "string", "value": [ 2 ] } } And yet it seems to work. So, does FreeRADIUS actually look at those types in the JSON reply? Should I be looking into parsing the dictionary files in my REST service to populate the reply with the correct types? Not that it would be that hard, but if it does not matter I can find better ways of keeping myself entertained... Much obliged for any help, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 5

Example process flow?
by Alan Batie 04 Feb '16

04 Feb '16

I was wondering if there was an example of typical radius process flow and interactions with the config file and modules anywhere? That is: Connection setup: Access-Request processed through in this way (generating either Access-Accept or Access-Reject when this or that happens) Accounting records Accounting-Start Interim-Update Accounting-Stop etc It is just not clear to me what happens when... Thanks...

4 5

Freeradius MYSQL Multiuser Access-Accept
by Adem Darguner 04 Feb '16

04 Feb '16

Hi Everyone, I want to accept multiple password on the same user on MYSQL. Do you have any solutions? Please tell me a solutions.Please. Thank you Regards. mysql> select * from radcheck; +--------+-----------+-----------+----+----------+------------+ | id | username | attribute | op | value | unixtime | +--------+-----------+-----------+----+----------+------------+ | 1 | mahmut | Password | := | 53159248 | 1454429830 | | 2 | erdem | Password | := | 712388 | 1454429830 | | 3 | test_1 | Password | := | 679374 | 1454429830 | | 4 | test_1 | Password | := | 955897 | 1454429830 | | 5 | test_1 | Password | := | 740793 | 1454429830 | | 6 | test_1 | Password | := | 571155 | 1454429830 | | 7 | test_1 | Password | := | 924218 | 1454429830 | | 8 | test_1 | Password | := | 496653 | 1454429830 | | 9 | test_1 | Password | := | 886088 | 1454429830 | | 10 | test_1 | Password | := | 195173 | 1454429830 | | 11 | test_1 | Password | := | 410097 | 1454429830 | | 12 | test_1 | Password | := | 778656 | 1454429830 | -- Adem DARGÜNER Network Engineer

4 3

TLS Version 1.2 Protocol
by Danielle Fratto 04 Feb '16

04 Feb '16

We have a FreeRadius version 2.1 implemented which we have inherited to support. The person who installed this on our servers has separated from the company and we have limited knowledge with the configuration and setup. The version release information that we found online does not reference the version we are running currently : V2.1.1-7.18.1. Can you confirm if TLSV1.2 Protocol is supported for our version of FreeRadius? Thank you for any help you can offer.

4 3

dhcp_sqlippool: IP address could not be allocated
by Elton Machado 04 Feb '16

04 Feb '16

Hi Guys, No matter what I do I always get this error: Executing select query: SELECT id FROM radippool WHERE pool_name='my_pool' LIMIT 1 (17) dhcp_sqlippool: ERROR: SQL query did not return any results if I do the same query on my database server it always retrieve a line. so I got no ip for my clients. Does anyone can help me? Regards, Elton *_____________________________________* Elton Machado System Administrator phone: +32 (0) 16 36 02 19 mobile: +32 (0) 476 56 08 32 email: elton.machado(a)tenforce.com Havenkant 38, 3000 Leuven www.tenforce.com *_____________________________________*

2 1