- Freeradius-Users - lists.freeradius.org

question about FR 3.1.x config
by Alex Sharaz 28 Jan '16

28 Jan '16

Hi, Been running a radsec config in 3.0.11 and works fine. Just built the latest git 3.1.x code on same server and using same config I get *Starting - reading configuration files .../usr/local/etc/freeradius/sites-enabled/eduroam-radsec[720]: Only 'status_check = none' is allowed for home servers with 'proto = tcp'* but my config is home_server eduroam2 { ipaddr = 144.32.126.85 port = 2083 type = auth secret = radsec *status_check = none* proto = tcp tls { certdir = ${confdir}/radsec cadir = ${confdir}/radsec ...... A

2 2

More than one ip address in client
by Angel L. Mateo 28 Jan '16

28 Jan '16

Hello, Is there any way to specify more than one ip address in the ipaddr option of a client. I would like to use something like: client myclientname { ipaddr = 192.168.1.1,192.168.1.2 ... } Using CIDR option is not an option because IPs does not match the same network. The comma notation above is accepted by freeradius, but I'm getting the error: Ignoring request to auth address * port 1812 from unknown client 192.168.1.2 port 49833 proto udp Waking up in 1.8 seconds. (although 192.168.1.1 is still accepted as a client) -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

2 1

Debian: Unofficial FreeRADIUS 3 packages for the adventurous
by Mathieu Simon (Lists) 28 Jan '16

28 Jan '16

Dear list With Fajar A. Nugraha maintaining a PPA for Ubuntu packages there is someone who has stepped up on the Ubuntu side who provides up-to-date builds of 3.x release versions there. Thank you for that! However the systems I use FreeRADIUS on are running Debian and I was looking for a similar offer, but couldn't find one for this distribution. Now that I have been dog-fooding my packages for roughly 2 months I though I could give it a try and upload to a public location. The repository contains packages of point releases for wheezy and jessie. It also contains snapshot builds of 3.0 and 3.1 development branches which I'll try updating bi-weekly to monthly basis. I'd like to thank those who have fixed bugs in the debian folder in the last couple of months which made building packages for Debian a breeze. You can find details and instructions on https://pkg.1labs.ch/ If I stop this service, I'll beat myself to a heads-up notice as this is done in my spare time. Feedback is welcome! -- Mathieu

1 0

How to assign IPs from different pools (sqlippool) depending on which NAS the request comes from
by aquilinux 28 Jan '16

28 Jan '16

Hi all, I need to assign IPs from different subnets (pools) depending on which NAS the request comes from. Right now i'm using sqlippool with only one pool (main_pool) populated with one subnet, 172.20.174.0/23. I need to split this subnet in 2 (ie. 172.20.174.0/24 and 172.20.175.0/24) assigning different pool names (ie. pool_A for 172.20.174.0/24 and pool_B for 172.20.175.0/24) in radippool. What i want to do is: - if a user comes from NAS-A then he should be assigned an IP from pool_A - if a user comes from NAS-B then he should be assigned an IP from pool_B How can this be done? Thanks for help. aqx -- "Madness, like small fish, runs in hosts, in vast numbers of instances." Nessuno mi pettina bene come il vento.

2 2

Issue with Attr-26
by Vyacheslav Gubin 27 Jan '16

27 Jan '16

Dear all, II do have an issue with Attr-26 = 0x483D342C20493D34, with version 3.0.10: Radius fault to start with that kind of error : Parse error (check) for entry Attr-26: Invalid attribute name Failed reading /etc/raddb/mods-config/files/authorize /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" cat /etc/raddb/users ipmiadmin Auth-Type :=Local, User-Password == "1234567" Attr-26 = 0x483D342C20493D34 I wonder if this is the issue of this version of freeradius? As far as I know all was fine in version 3.0.4

3 3

UserPrincipalName with ntlm_auth, trying to get it "right"
by Mathieu Simon (Lists) 27 Jan '16

27 Jan '16

Dear List I have a setup where users should move to using their UserPrincipalName which conveniently matches their mail adddress. (something they tend to remember easily) Now ntlm_auth doesn't quite like UPNs, it wants a sAMAccountName, I found about that. If sAMAccountName was equal the first part of the UPN, i found the following in proxy.conf would give me the first part of the given UPN as Stripped-User-Name (since no nostrip option) and continue to process things locally. realm "thissuffix.tld" { authhost = LOCAL accthost = LOCAL } However in this directory the *prefix in the UPN doesn't match with the sAMAccountname* (for $anyreason). ntlm_auth obviously fails there. I came across a thread on UPN usage from early 2015 (and couple others), yet I couldn't come across something giving me a clearer idea.* My current impression is that at some point, if given a UPN, an LDAP search should be done first to return the samaccountname. Then use that with the ntlm_auth binary in modules/mschap to check credentials and do the MSCHAP challenge. Am I on the right track? - I saw something on stackoverflow using a bash script that is executed via mods-available/mschap**, but not sure about that yet if that's the right place. I'm thankful for any pointer into the right direction. Let alone that AD domain computers should be able to still authenticate with their own format that Windows clients use instead of the UPN when they are part of a domain... -- Mathieu * http://lists.freeradius.org/pipermail/freeradius-users/2015-January/075376.… ** https://serverfault.com/questions/686470/active-directory-freeradius-ntlm-a…

3 8

Cisco-AVPair multiply attribute
by Mehdi Ravanbakhsh 27 Jan '16

27 Jan '16

Hi All I use FreeRadius 2 in authorize section I can separate multiply Cisco-AVPair attribute ( Cisco-AVPair[x] ) but in preacct section I use that way but it not working . I am confuse is something different in preacct section ? BR

3 2

Re: Sql log
by Lucas Diaz 27 Jan '16

27 Jan '16

Below is my "/usr/local/etc/raddb/mods-enabled/sql" file. I'm using freeradius 3.0.11 now, the server works very well, but still can't log queries to a file. I would appreciate any thoughts. Thanks. # -*- text -*- ## ## sql.conf -- SQL modules ## ## $Id: e1431d634a28f20a0e5deaeedd66a161deb88eb7 $ ###################################################################### # # Configuration for the SQL module # # The database schemas and queries are located in subdirectories: # # sql/<DB>/main/schema.sql Schema # sql/<DB>/main/queries.conf Authorisation and Accounting queries # # Where "DB" is mysql, mssql, oracle, or postgresql. # # sql { # The sub-module to use to execute queries. This should match # the database you're attempting to connect to. # # * rlm_sql_mysql # * rlm_sql_mssql # * rlm_sql_oracle # * rlm_sql_postgresql # * rlm_sql_sqlite # * rlm_sql_null (log queries to disk) # driver = "rlm_sql_firebird" # # Several drivers accept specific options, to set them, a # config section with the the name as the driver should be added # to the sql instance. # # Driver specific options are: # # sqlite { # # Path to the sqlite database # filename = "/my/sqlite/database.db" # # # If the file above does not exist and bootstrap is set # # a new database file will be created, and the SQL statements # # contained within the file will be executed. # bootstrap = "/my/sqlite/schema.sql" # } # # mysql { # # If any of the below files are set tls encryption is enabled # tls { # ca_file = "/etc/ssl/certs/my_ca.crt" # ca_path = "/etc/ssl/certs/" # certificate_file = "/etc/ssl/certs/private/client.crt" # private_key_file = "/etc/ssl/certs/private/client.key" # cipher = "DHE-RSA-AES256-SHA:AES128-SHA" # } # } # # The dialect of SQL you want to use, this should usually match # the driver you selected above. # # If you're using rlm_sql_null, then it should be the type of # database the logged queries are going to be executed against. dialect = "firebird" # Connection info: # server = "localhost" port = 3050 login = "sysdba" password = "passdbq" # Database table configuration for everything except Oracle radius_db = "/eternet/DB/RADIUS.FDB" # If you are using Oracle then use this instead # radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))" # If you're using postgresql this can also be used instead of the connection info parameters # radius_db = "dbname=radius host=localhost user=radius password=raddpass" # If you want both stop and start records logged to the # same SQL table, leave this as is. If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct" # Allow for storing data after authentication postauth_table = "radpostauth" # Tables containing 'check' items authcheck_table = "radius_check" groupcheck_table = "radgroupcheck" # Tables containing 'reply' items authreply_table = "radius_reply" groupreply_table = "radgroupreply" # Table to keep group info usergroup_table = "radusergroup" # If set to 'yes' (default) we read the group tables # If set to 'no' the user MUST have Fall-Through = Yes in the radreply table read_groups = no # Remove stale session if checkrad does not see a double login delete_stale_sessions = yes # Write SQL queries to a logfile. This is potentially useful for tracing # issues with authorization queries. logfile = ${logdir}/sqllog.sql #logfile = /usr/local/var/log/radius/sqllog.sql # As of version 3.0, the "pool" section has replaced the # following configuration items: # # num_sql_socks # connect_failure_retry_delay # lifetime # max_queries # # The connection pool is new for 3.0, and will be used in many # modules, for all kinds of connection-related activity. # # When the server is not threaded, the connection pool # limits are ignored, and only one connection is used. # pool { # Number of connections to start start = 20 # Minimum number of connections to keep open min = 3 # Maximum number of connections # # If these connections are all in use and a new one # is requested, the request will NOT get a connection. # # Setting 'max' to LESS than the number of threads means # that some threads may starve, and you will see errors # like "No connections available and at max connection limit" # # Setting 'max' to MORE than the number of threads means # that there are more connections than necessary. # max = ${thread[pool].max_servers} # Spare connections to be left idle # # NOTE: Idle connections WILL be closed if "idle_timeout" # is set. spare = 6 # Number of uses before the connection is closed # # 0 means "infinite" uses = 0 # The lifetime (in seconds) of the connection lifetime = 0 # idle timeout (in seconds). A connection which is # unused for this length of time will be closed. idle_timeout = 300 # NOTE: All configuration settings are enforced. If a # connection is closed because of "idle_timeout", # "uses", or "lifetime", then the total number of # connections MAY fall below "min". When that # happens, it will open a new connection. It will # also log a WARNING message. # # The solution is to either lower the "min" connections, # or increase lifetime/idle_timeout. } # Set to 'yes' to read radius clients from the database ('nas' table) # Clients will ONLY be read on server startup. read_clients = yes # Table to keep radius client info client_table = "get_svr_nas" # Read database-specific queries $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } LUCAS DIAZ | DPTO. REDES _______________________________________________________ Istilart 255 | Tel.: 02983 513040 C.P. B7500EGE | Tres Arroyos | Bs As | Argentina www.eternet.cc | ETERNET SISTEMAS -- *LUCAS DIAZ | DPTO. REDES* _______________________________________________________ Istilart 255 | Tel.: 02983 513040 C.P. B7500EGE | Tres Arroyos | Bs As | Argentina * *www.eternet.cc <http://www.eternet.cc/> | *ETERNET SISTEMAS *

3 4

Using cui with freeradius
by Arash Shams 27 Jan '16

27 Jan '16

Hello I want to use cui in freeradius i searched wiki but there is no documentation about that ( or icant find it) in google i find some topics but they are all talk about eduroam . Is cui available in core package or i need to install it manually ? how can i find a good toturial about that ? i tell about my problem before in mailing list but again : i have 4 device authenticate with 1 username to get daily 4G bandwidth but each device get 4G bandwidth means 16G daily i think cui maybe solve my problem

2 2

Version 3.0.11 has been released
by Alan DeKok 26 Jan '16

26 Jan '16

Full release notes are available at http://freeradius.org/press/index.html It has lots of work-arounds for OpenSSL problems. :( People using TTLS and/or PEAP may notice new WARNING messages in debug mode. The server will now check for compatibility of inner/outer user identities. If the identities are problematic (i.e. someone is spoofing), a WARNING will be printed. We now allow setting Response-Packet-Type in "Post-Proxy-Type Fail", which is useful when the home server does not respond. Alan DeKok.

2 4