- Freeradius-Users - lists.freeradius.org

Is vulnerabe the process of sending credentials to a NAS ?
by Daniel Lopez 22 Jan '16

22 Jan '16

Hello. I've got a doubt about the security in authentication process. Suppose we have our Freeradius server configured to authenticate a certain user via password (Cleartext-Password) and MAC address (Calling-Station-Id). When this user tries to authenticate via a NAS (wireless router), and sends it its credentials, is it possible that an attacker could obtain those credentials by sniffing the comunication? And then gain access by mac address spoofing? And if so, How could this be avoided? How to protect this first step? Thanks you very much.

2 1

Why is the upgrade documentation is missing from the website??
by Adamn Schmidth 22 Jan '16

22 Jan '16

Hello list, First of all I wonder why is the upgrade documentation missing from the site: http://networkradius.com/doc/current/upgrading/ I have found a copy of it here but not all pages: https://web.archive.org/web/20150608212504/http://networkradius.com/doc/cur… Right now I still trying to rewrite old Freeradius 2.X configs to work with Radius 3. I didn no start from scratch because in my case there are bunch of configs, sql statements etc which was not written by me and it is not feasible to rewrite them from scratch. I stuck with this error for example: # Loaded module rlm_sqlcounter # Loading module "dailycounter" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter dailycounter { /etc/freeradius/sql/mysql/counter.conf[48]: Configuration item "sql_module_instance" must have a value /etc/freeradius/sql/mysql/counter.conf[48]: Invalid configuration for module "dailycounter" Any ideas what's the problem here? Why did you need to change the syntax at all in version 3? What I would like to know the most is: Will it be require to change anything in the database schema or I can just use the old databases what I used with freeradius 2??? Thank you!

3 2

AW: Local user or DB?
by Cornelius Kölbel 22 Jan '16

22 Jan '16

Basically freeradius does not care where they are located if the users are in the same default privacyidea realm. Kind regardsCornelius Cornelius KölbelCornelius.koelbel(a)netknights.it+49 151 2960 1417 NetKnights GmbHhttp://netknights.itLandgraf-Karl-Str. 19, 34131 Kassel, GermanyTel: +49 561 3166797, Fax: +49 561 3166798 Amtsgericht Kassel, HRB 16405Geschäftsführer: Cornelius Kölbel -------- Ursprüngliche Nachricht -------- Von: Tevfik Ceydeliler <tevfik.ceydeliler(a)astron.yasar.com.tr> Datum: 22.01.2016 07:59 (GMT+01:00) An: freeradius-users(a)lists.freeradius.org Betreff: Local user or DB? Hi, I want to use both local files and mySQL DB to authenticate my user. But How can I tell to freeradius which user is located where local files or DB. Is there any way to do this? Realm can use for this aim? Have you any hint? Regards.. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz. The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

Accounting errors.
by Andrés Gómez 22 Jan '16

22 Jan '16

Dear List. I have a Freeradius 2 installed, using a MySQL database to store all accounting data. Usually It works fine, but now I can see that the count of AcctSessionTime is being wrong calculated in SOME cases, not all caases. Check it out these records. "AcctStartTime";"AcctStopTime";"AcctSessionTime" "2016-01-20 18:08:54";"2016-01-20 18:22:10";"337444" "2016-01-20 18:13:26";"2016-01-20 18:22:25";"337172" ""2016-01-20 18:15:24";"2016-01-20 18:22:10";"337054" "2016-01-20 18:15:44";"2016-01-20 18:22:10";"337034" "2016-01-20 18:16:00";"2016-01-20 18:22:10";"337018" "2016-01-20 18:16:34";"2016-01-20 18:22:10";"336984" As you can see each session takes less to 15 minutes (900 seconds) But its calculated about 93 hours (224800 second). What Can I do? My statistics are being damaged!! Regards -- *C. Andrés Gómez R.*

2 2

Local user or DB?
by Tevfik Ceydeliler 22 Jan '16

22 Jan '16

Hi, I want to use both local files and mySQL DB to authenticate my user. But How can I tell to freeradius which user is located where local files or DB. Is there any way to do this? Realm can use for this aim? Have you any hint? Regards.. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz. The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

Virtual server Depending on a radius server
by Andrés Gómez 21 Jan '16

21 Jan '16

Dear List, I'm reading the documentation about virtual server ( http://freeradius.org/features/virtual_servers.html) and the methods to configure them (server and client ip address, home server pool and TLS tunnel), but I don't undestand what method can be useful in this case: - My clients have dymanic Ip address. - My server only have one public IP address. - I can't do TLS tunnels with my client's NAS. I can distinguish my clients by: - NAS ID - NAS MAC address - Radius secret. I think the best way, would be to use the NAS secret to determine the virtual server. It is possible? What do you advice? Regards -- *C. Andrés Gómez R.*

2 2

Accept via calling-station value
by Munroe Sollog 20 Jan '16

20 Jan '16

I have an aruba wireless network where I am trying to get free-radius to auth a device based on calling-station id. Line 35 confirms my re-writing is working, but line 46 looks like it is rejecting the match even though it is listed in the authorized_macs file. Any help would be appreciated. Thanks. Here is my config: sites-enabled/default: http://paste.debian.net/hidden/059033f6/ policy.d/macauth: http://paste.debian.net/hidden/cefd55aa/ authorized_macs: http://paste.debian.net/hidden/992be562/ radius -X output: http://paste.debian.net/hidden/8492e2fd/ -- Munroe Sollog LTS - Network Analyst x85002

3 4

Re: freeradius 3.0.4 can't contact LDAP server
by Blangille Denis 20 Jan '16

20 Jan '16

> Michael Ströder wrote: >> Are you using LDAPS or LDAP with StartTLS? If yes, is the CA cert for validating >> the LDAP server cert properly configured? > Actually i'm work with ldap, i'm not working on security part, the ldaps server is not running. Anirudh Malhotra wrote : > Can you paste the ldap config? I'm using ApacheDS as ldap server, its config is divided in several file. Denis Blangille

2 1

EAP-TLS CRL problem - a PKIX guru around?
by tsouk 20 Jan '16

20 Jan '16

Hi Stefan, Had some CRL problems back in the day, with Apache 2.2 and Apache 2.4 behaving differently (I believe the change is in Apache 2.3, and I will have a whole blog post about this in the BBC internet blog soon). Have a look at the RFC (), under "6.3.3. CRL Processing", specifically: (b) Verify the issuer and scope of the complete CRL as follows: ... (2) If the complete CRL includes an issuing distribution point (IDP) CRL extension, check the following: (i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP. If the distribution point name is present in the IDP CRL extension and the distribution field is omitted from the DP, then verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP. So I think this, in your CRL: X509v3 Issuing Distrubution Point: Full Name: URI:https://www.restena.lu/restena-staffauth.crl ...and this in your Cert... X509v3 CRL Distribution Points: Full Name: URI:https://www.restena.lu/ca/restena-root.crl ...might have to match. Let me know if this helps! Nikos

1 0

Re: EAP-TLS CRL problem - a PKIX guru around?
by tsouk 20 Jan '16

20 Jan '16

Hi Stefan, Had some CRL problems back in the day, with Apache 2.2 and Apache 2.4 behaving differently (I believe the change is in Apache 2.3, and I will have a whole blog post about this in the BBC internet blog soon). Have a look at the RFC (), under "6.3.3. CRL Processing", specifically: (b) Verify the issuer and scope of the complete CRL as follows: ... (2) If the complete CRL includes an issuing distribution point (IDP) CRL extension, check the following: (i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP. If the distribution point name is present in the IDP CRL extension and the distribution field is omitted from the DP, then verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP. So I think this, in your CRL: X509v3 Issuing Distrubution Point: Full Name: URI:https://www.restena.lu/restena-staffauth.crl ...and this in your Cert... X509v3 CRL Distribution Points: Full Name: URI:https://www.restena.lu/ca/restena-root.crl ...might have to match. Let me know if this helps! Nikos

1 0