- Freeradius-Users - lists.freeradius.org

clients in SQL DB
by Cornelius Kölbel 13 Jan '16

13 Jan '16

Hello, I was looking into using MySQL with FreeRADIUS and took a look at http://wiki.freeradius.org/guide/SQL%20HOWTO I was wondering, if it is possible to also put the clients with the RADIUS secrets to the SQL database? From what I was reading I understand: No? Thanks a lot and kind regards Cornelius -- Cornelius Kölbel cornelius.koelbel(a)netknights.it +49 151 2960 1417 NetKnights GmbH http://www.netknights.it Landgraf-Karl-Str. 19, 34131 Kassel, Germany Tel: +49 561 3166797, Fax: +49 561 3166798 Amtsgericht Kassel, HRB 16405 Geschäftsführer: Cornelius Kölbel

3 3

Plain Mac-Auth - server accepts but client does not connect
by Michael Linder 12 Jan '16

12 Jan '16

Hello everyone, I am following the instructions on the wiki (http://wiki.freeradius.org/guide/Mac%20Auth) to configure our freeradius server for "Plain Mac-Auth" and the server is not responding how I expect. I have the server configured and an "authorized_macs" file created that contains the mac address of an android phone that I would like accepted onto the network. When I attempt to join the network from the phone, I am prompted for 802.1X credentials. If I type no credentials, the server won't handle the request at all. If I type something into one or both of the credentials fields, the server handles the request and displays "Auth-Type = Accept, accepting the user" and "Sending Access-Accept of id 7 to 216.54.247.198 port 58063", but my phone does not join the network. It simply times out. The Ubiquiti UniFi AP is in rental office space with a managed network, and the freeradius server is in the ec2 cloud. Does anyone have any ideas how to troubleshoot this? I don't think the UDP return traffic is being blocked, because the same thing happens if I move the AP to my house network with a COTS router. Thanks, Mike [root@freeradius2 ~]# radiusd -X radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Aug 14 2015 at 16:36:35 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 0.0.0.0/0 { require_message_authenticator = no secret = "<scrubbed>" shortname = "XMDAP" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ▒▒▒? modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Loading virtual module rewrite_calling_station_id Module: Linked to module rlm_always Module: Instantiating module "noop" from file /etc/raddb/modules/always always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Linked to module rlm_files Module: Instantiating module "authorized_macs" from file /etc/raddb/modules/files files authorized_macs { usersfile = "/etc/raddb/authorized_macs" compat = "no" key = "%{Calling-Station-ID}" } reading pairlist file /etc/raddb/authorized_macs Module: Instantiating module "reject" from file /etc/raddb/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 38386 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 216.54.247.198 port 10027, id=4, length=163 User-Name = "a" NAS-IP-Address = 192.168.0.137 NAS-Identifier = "0418d6cee172" NAS-Port = 0 Called-Station-Id = "0A-18-D6-CF-E1-72:xmd-authorized" Calling-Station-Id = "00-02-71-D3-44-2B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02cd00060161 Message-Authenticator = 0xcb2f355e41f81c5808fb38890f50e2e9 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++policy rewrite_calling_station_id { +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) ? Evaluating (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { ++++update request { expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-02-71-D3-44-2B expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> 00-02-71-d3-44-2b ++++} # update request = noop +++} # if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) = noop +++ ... skipping else for request 0: Preceding "if" was taken ++} # policy rewrite_calling_station_id = noop [authorized_macs] expand: %{Calling-Station-ID} -> 00-02-71-d3-44-2b [authorized_macs] users: Matched entry 00-02-71-d3-44-2b at line 1 [authorized_macs] expand: Mike's Android phone with MAC %{Calling-Station-Id} authorized for network access -> Mike's Android phone with MAC 00-02-71-d3-44-2b authorized for network access ++[authorized_macs] = ok ++? if (!ok) ? Evaluating !(ok) -> FALSE ++? if (!ok) -> FALSE ++else else { +++update control { +++} # update control = noop ++} # else else = noop +} # group authorize = ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/raddb/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 4 to 216.54.247.198 port 10027 Reply-Message = "Mike's Android phone with MAC 00-02-71-d3-44-2b authorized for network access" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 4 with timestamp +207 Ready to process requests. ------------------------------------------------- Join the XstremeMD email list.<http://visitor.r20.constantcontact.com/d.jsp?llr=strsmmvab&p=oi&m=112247605…> ------------------------------------------------- XstremeMD EMAIL NOTICE - This transmission may be strictly confidential. If you are not the intended recipient of this message, you may not disclose, print, copy, or disseminate this information. If you have received this in error, please reply and notify the sender (only) and delete the message. Unauthorized interception of this e-mail is a violation of federal criminal law. This communication does not reflect an intention by the sender or the sender's principal to conduct a transaction or make any agreement by electronic means. Nothing contained in this message or in any attachment shall satisfy the requirements for a writing, and nothing contained herein shall constitute a contract or electronic signature under the Electronic Signatures in Global and National Commerce Act, any version of the Uniform Electronic Transactions Act, or any other statute governing electronic transactions.

7 9

Issues with Cached-Session-Policy in versions of FR after 3.0.8.
by Palmer J.D.F. 12 Jan '16

12 Jan '16

Hello, I've issues with fast-reauth using Cached-Session-Policy in FR3.0.9 and above. In the post-auth section of site-enabled/inner-tunnel I update the reply as below... post-auth { ... update reply { &Cached-Session-Policy = &Stripped-User-Name } ... } I then have the code below in site-enabled/default to recover the username from the stored Cached-Session-Policy for use on a fast-reauth, this is then used to run a few scripts to check the user's status and assign VLAN. post-auth { ... if ("%{Realm}" != "jrs") { #don't need to do this for JRS users update control { &Tmp-String-1 := &reply:Cached-Session-Policy } $INCLUDE ${raddbdir}/scripts/dosomestuff.conf $INCLUDE ${raddbdir}/scripts/poolacc.conf } ... } This works in V3.0.8, Tmp-String-1 is set to the stripped username from the saved session, but not in versions after this. Is there a better/another way to recover the username for use within site-enabled/default during fast re-auth / session resumption? Many thanks, Jezz. Jezz Palmer Information Services and Systems Swansea University Singleton Park Swansea SA2 8PP

3 2

question about logging levels, using syslog facility.
by koch＠inbox.lv 12 Jan '16

12 Jan '16

Good day! I'm using freeradius3.0.10. Here is my log configuration from radiusd.cong: log { destination = syslog syslog_facility = local1 stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } Here is line from /etc/rsyslog.conf : local1.info -/var/log/radius/radius.log And I use my own perl module for auth-tion, where a lot of debug, info, error and so on information. use constant L_DBG => 1; use constant L_AUTH => 2; use constant L_INFO => 3; use constant L_ERR => 4; use constant L_PROXY => 5; use constant L_ACCT => 6; I've finished my test, so I want to turn off debug info, but it still exist in the /var/log/radius/radius.log file (&radiusd::radlog(L_DBG, "Auth: Calling-Station-Id: ".$RAD_REQUEST{'Calling-Station-Id'}); ). I've restarted rsyslog, radiusd daemon was started without any params. Why debugging information doesn't want to disappear? Any ideas? Log exampe with debug info Jan 12 15:25:36 radiusn-test1 radiusd[11284]: (27673) Login OK: [12345/<via Auth-Type = Perl>] (from client localhost port 0 cli 12345) Jan 12 15:25:36 radiusn-test1 radiusd[11284]: rlm_perl: Auth: Calling-Station-Id: 12345

4 6

RadSec Dynamic Server Discovery
by Sebastian Hagedorn 12 Jan '16

12 Jan '16

Hi, just as information, we explored using the RadSec module of Freeradius 3.0.10 for Eduroam, but while we got it to work locally after the recent fix, the German Eduroam hub insists we use radsecproxy instead. The main reason they give is that Freeradius lacks support for Dynamic Server Discovery. While that feature isn't yet actively used, it's on the roadmap, so that institutions won't have to proxy via central hubs anymore, but can discover the right proxy for each realm dynamically via NAPTR/SRV records. They also claim that it's less secure to expose the RADIUS servers directly, but I don't really buy that argument. We will go forward with radsecproxy for the time being, but if Freeradius gains support for Dynamic Server Discovery in the future, we will definitely look into that. -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

3 3

FreeRadius exec module not working
by Arash Shams 12 Jan '16

12 Jan '16

Hello i have a simple curl command get 2 arguments and send sms with them so i create a bash script "sendsms.sh" and create a exec module with that exec sendwelsms { wait = no program = "/root/sendsms.sh '%{User-Name} %{Huntgroup-Name}'" input_pairs = request shell_escape = yes output = file } i passed %{User-Name} as $1 and %{Huntgroup-Name} as $2 to that script . i put sendwelsms to end of postscript at accounting section and i want to every time a user logged this script executed now its not working any suggestion ?

3 3

Sql log
by Lucas Diaz 11 Jan '16

11 Jan '16

I'm trying to enable sql queries to a log file. I'm using freeradius 3.10 and the only thing I read I need to do is to uncomment the line "logfile = ${logdir}/sqllog.sql" on the file "/usr/local/etc/raddb/mods-enabled/sql", but it's not working. Is that OK? Thanks. -- *LUCAS DIAZ | DPTO. REDES* _______________________________________________________ Istilart 255 | Tel.: 02983 513040 C.P. B7500EGE | Tres Arroyos | Bs As | Argentina * *www.eternet.cc <http://www.eternet.cc/> | *ETERNET SISTEMAS *

9 14

How is radius.seq file used?
by dev 11 Jan '16

11 Jan '16

Hi all, I'm trying to debug a custom openLDAP module I forked based on the pw-radius contrib module (Ubuntu 14.04 recently migrated from 12.04). I'm using libfreeradius-client2 (v1.1.6-7). What seems to be happening is the ldap daemon creates the radius.seq file without read/write permissions by the freeradius daemon. I suspect this is causing slapd to segfault: slapd[13868]: segfault at 0 ip 00007fc6f521dcd2 sp 00007fc6eeff6e38 error 4 in libfreeradius-client.so.2.0.0[7fc6f5216000+c000] From what I've read, this file is only needed for Radius Accounting. I'm using RADIUS for authenticating One Time Passwords generated on a software token so would like to try disabling radius.seq to see fi the problem goes away. How can I disable radius.seq? Thanks!

2 1

ldap_mac config in 3.x
by Anthony Cheng 11 Jan '16

11 Jan '16

Hi all, Currently looking to migrate a FreeRADIUS from 2.1.12 to 3.0.10. Does 3.x still support ldap_mac config. in the ldap configuration? I see no reference to it or mention that it was removed.

2 1

3.0.10: decrypting RSA private key failure
by Stefan Winter 11 Jan '16

11 Jan '16

Hi, now this is strange. I'm in the middle of a certificate rollover. I have protected the old (1024 bit RSA) and new (4096 bit RSA) key with the same passphrase. Using "openssl rsa" on the FreeRADIUS box, I can decrypt both keys. When starting FreeRADIUS with the old cert+key, it starts up. When trying with the new cert+key: # Instantiating module "eap-staff" from file /usr/local/freeradius/config/raddb/mods-enabled/eap-staff # Linked to sub-module rlm_eap_tls tls { tls = "tls-staff" } tls-config tls-staff { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/usr/local/freeradius/config/raddb/certs/STAFF-CA/" pem_file_type = yes private_key_file = "/usr/local/freeradius/config/raddb/staff/cert-srv.key" certificate_file = "/usr/local/freeradius/config/raddb/staff/cert-srv.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/freeradius/config/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1300 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 name = "eduroam-staff" max_entries = 128 persist_dir = "/var/log/radius/tlscache-eduroam-staff" } verify { } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } } tls: Failed reading private key file /usr/local/freeradius/config/raddb/staff/cert-srv.key:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch rlm_eap_tls: Failed initializing SSL context rlm_eap (eap-staff): Failed to initialise rlm_eap_tls /usr/local/freeradius/config/raddb/mods-enabled/eap-staff[1]: Instantiation failed for module "eap-staff" Huh? The passphrase is identical, I'm pointing it to the correct filename, openssl can decode it - but FreeRADIUS can't? Looking at the encrypted private keys, I do see a small difference: OLD: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,EC24580B720DE947 [...] -----END RSA PRIVATE KEY----- NEW: -----BEGIN ENCRYPTED PRIVATE KEY----- [...] -----END ENCRYPTED PRIVATE KEY----- Both decode into: -----BEGIN RSA PRIVATE KEY----- [...] -----END RSA PRIVATE KEY----- openssl can handle both. Any clue why FreeRADIUS doesn't? This is a 3.0.10 installation. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 4