- Freeradius-Users - lists.freeradius.org

checking errcode in the sql_snprint_error function of rlm_sql_oracle.c
by Kyuyoung Kim 27 Nov '15

27 Nov '15

Hello, First, I want to say that I don't know well OCI programming. I'm trying to make interface between FreeRADIUS and Oracle. I found this code in the rlm_sql_oracle module. This part seems a bit strange. If there are errors, errcode variable is larger than 0. but, the function returns -1. I think if errcode is large than 0, function should return 0 not -1. Can you tell me what is correct? static int sql_snprint_error(char *out, size_t outlen, rlm_sql_handle_t *handle, UNUSED rlm_sql_config_t *config) { sb4 errcode = 0; rlm_sql_oracle_conn_t *conn = handle->conn; rad_assert(conn); out[0] = ''; OCIErrorGet((dvoid *) conn->error, 1, (OraText *) NULL, &errcode, (OraText *) out, outlen, OCI_HTYPE_ERROR); if (!errcode) return -1; return 0; }

2 1

doubts about the best way to collect and handle the Status-*
by Jorge Pereira 26 Nov '15

26 Nov '15

Hi, has someone used the Status packets to generate graphics? if 'yes', what has used to collect and plot the graphs? e.g: $ cat ../pack-stats.txt Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = All Response-Packet-Type = Access-Accept $ $ radclient -x localhost:18121 status adminsecret -f ../pack-stats.txt Sent Status-Server Id 203 from 0.0.0.0:52687 to 127.0.0.1:18121 length 50 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = All Response-Packet-Type = Access-Accept Received Access-Accept Id 203 from 127.0.0.1:18121 to 0.0.0.0:0 length 536 FreeRADIUS-Total-Access-Requests = 10 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 0 FreeRADIUS-Total-Accounting-Responses = 0 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Proxy-Access-Requests = 0 FreeRADIUS-Total-Proxy-Access-Accepts = 0 FreeRADIUS-Total-Proxy-Access-Rejects = 0 FreeRADIUS-Total-Proxy-Access-Challenges = 0 FreeRADIUS-Total-Proxy-Auth-Responses = 0 FreeRADIUS-Total-Proxy-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Unknown-Types = 0 FreeRADIUS-Total-Proxy-Accounting-Requests = 0 FreeRADIUS-Total-Proxy-Accounting-Responses = 0 FreeRADIUS-Total-Proxy-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Unknown-Types = 0 FreeRADIUS-Stats-Start-Time = "Nov 26 2015 18:16:07 BRST" FreeRADIUS-Stats-HUP-Time = "Nov 26 2015 18:16:07 BRST" FreeRADIUS-Queue-Len-Internal = 0 FreeRADIUS-Queue-Len-Proxy = 0 FreeRADIUS-Queue-Len-Auth = 0 FreeRADIUS-Queue-Len-Acct = 0 FreeRADIUS-Queue-Len-Detail = 0 FreeRADIUS-Queue-PPS-In = 0 FreeRADIUS-Queue-PPS-Out = 0 $ -- Jorge Pereira

1 0

Failed binding to authentication address
by Federico Olivieri 26 Nov '15

26 Nov '15

Hi All, I know that this topics has been discussed many times but all solution/answers found on the mailing list didn't work for me (sure that is my fault!) When I stop the service and I run freeradius -xxx the message is: Thu Nov 26 15:14:25 2015 : Info: ... adding new socket proxy address * port 47256 Thu Nov 26 15:14:25 2015 : Debug: Listening on authentication address * port 1812 Thu Nov 26 15:14:25 2015 : Debug: Listening on accounting address * port 1813 Thu Nov 26 15:14:25 2015 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Thu Nov 26 15:14:25 2015 : Debug: Listening on proxy address * port 1814 Thu Nov 26 15:14:25 2015 : Info: Ready to process requests. then, I start radius and when I try to do radtest I get this error: root@raspberrypi:~# /etc/init.d/freeradius start [ ok ] Starting FreeRADIUS daemon: freeradius. root@raspberrypi:~# radtest "John Doe" hello 127.0.0.1 0 testing123 Sending Access-Request of id 126 to 127.0.0.1 port 1812 User-Name = "John Doe" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=126, length=20 Looking into a second debug I can see: Thu Nov 26 15:15:06 2015 : Debug: radiusd: #### Opening IP addresses and Ports #### Thu Nov 26 15:15:06 2015 : Debug: listen { Thu Nov 26 15:15:06 2015 : Debug: type = "auth" Thu Nov 26 15:15:06 2015 : Debug: ipaddr = * Thu Nov 26 15:15:06 2015 : Debug: port = 0 Thu Nov 26 15:15:06 2015 : Error: Failed binding to authentication address * port 1812: Address already in use Thu Nov 26 15:15:06 2015 : Error: /etc/freeradius/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 What I'm doing wrong? For me is normal that the port is 1812 is busy because freeradius is using it! Thanks!

4 12

Freeradius and LDAP/AD integration
by Antoine JOUBERT 26 Nov '15

26 Nov '15

Hi, I've been reading through Freeradius' documentation, various howtos and this mailing-list archives for the past few days, and I'm still not sure if the architecture I'm trying to set up can be achieved, so I figured I'd ask here. My company currently uses a Windows Server running Active Directory for user account management. We would like to setup 802.1x for both wired and WLAN access on Windows, Linux, Mac, iOS and Android devices (using PEAP/MS-CHAPv2). We have three offices where VLANs are configured. Many of our users frequently move between offices. A user who uses VLAN 10 when he is in the office A would use VLAN 20 when he is in the office B and VLAN 30 when he is in the office C. Hence, unless I've missed something, I don't believe we can fully centralize our RADIUS configuration. I'm thinking of setting up a Freeradius server in each office that communicates with our Active Directory to check if the user's credentials are valid, and then checks a local MySQL database for the "Tunnel-Type", "Tunnel-Medium-Type" and "Tunnel-Private-Group-Id" parameters for that user. Can this be achieved ? We'll also need to configure Mac Authentication Bypass for devices that do not handle 802.1x (VOIP phones, printers, etc.). Can those be configured locally in the same MySQL database as well ? Thanks, Antoine

3 2

cache_ocsp
by Scott Armitage 25 Nov '15

25 Nov '15

I might be doing something wrong but I can’t seem to find the cache_ocsp module anywhere which is called in the tls-cache server: /etc/raddb/sites-enabled/tls-cache[114]: Failed to find "cache_ocsp" as a module or policy. /etc/raddb/sites-enabled/tls-cache[114]: Please verify that the configuration exists in /etc/raddb/mods-enabled/cache_ocsp. /etc/raddb/sites-enabled/tls-cache[114]: Failed to parse "cache_ocsp" entry. Has anyone else experienced this problem? Regards Scott

5 11

about radius user password
by Serkan KASAP 25 Nov '15

25 Nov '15

hi. is it possible to insert raddacct password variable or value? username working but password not working. please help. accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')"

2 1

EAP-TLS and Active Directory
by Simon Larsson 25 Nov '15

25 Nov '15

Hi there! I’m having a problem where I don’t fully understand exactly how EAP-TLS works in regards to authorization. I'm trying to implement a 802.1x wireless network which uses EAP-TLS for security reasons. I already have a Windows server with a Certificate Authority, so that's not really an issue. All I have to do there is to create the certificates and then insert them into both the FreeRADIUS server and all the clients. Here’s my problem. As I understand it, EAP-TLS uses the certificates for authentication and therefor my users credentials become less important (not needed to log in to the network). Now, if my users never enter their credentials and the FreeRADIUS server never checks with Active Directory for authorization, what decides what network resources a specific user should have access to? My goal here is to have it so that when a user connects to the network, the user should automatically get access that users network resources. Thanks in advance, Simon

5 8

Filtering VLAN assignmen in eduroam
by Angel L. Mateo 25 Nov '15

25 Nov '15

Hello, I'm using freeradius 3.0.10 to authenticate eduroam connections. In my inner server I return attributes to assign VLAN to our internal users and I want these attributes to be filtered when the connection is from an external organization. So in the outer server I have: post-proxy { eduroam_log files_eduroam_outer.authorize attr_filter.post-proxy } and in the attr_filter.post-proxy file I have: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, Framed-IP-Address == 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Protocol == PPP, Framed-Protocol == SLIP, Framed-Compression == Van-Jacobson-TCP-IP, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, MS-MPPE-Recv-Key =* ANY, MS-MPPE-Send-Key =* ANY, MS-CHAP-MPPE-Keys =* ANY, State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Calling-Station-Id =* ANY, Operator-Name =* ANY, Port-Limit <= 2, GSS-Acceptor-Service-Name =* ANY, GSS-Acceptor-Host-Name =* ANY, GSS-Acceptor-Service-Specifics =* ANY, GSS-Acceptor-Realm-Name =* ANY, SAML-AAA-Assertion =* ANY, EAP-Channel-Binding-Message =* ANY According to attr_filter documentation, if I don't have the Tunnel-Private-Group-Id in this file, then the attribute should be filtered, isn't it? But, the attribute is not being filtered. It is returned to my upper radius server. Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

3 2

eapol_test question
by Alex Sharaz 24 Nov '15

24 Nov '15

Not a freeradius question as such, but guess people on the list use eapol_test. >From the man page -N attr spec Send arbitrary attribute specific by attr_id:syntax:value, or attr_id alone. attr_id should be the numeric ID of the attribute, and syntax should be one of 's' (string), 'd' (inte‐ ger), or 'x' (octet string). The value is the attribute value to send. When attr_id is given alone, NULL is used as the attribute value. Multiple attributes can be specified by using the option several times. so -N 61:d:19 means set NAS-Port-Type to be Wireless-802.11 ( val=19) Anyone know if I can specify a VSA attribute this way? is it just a case of VSA base val + attribute number ? Rgds Alex

5 7

State of RadSec in FR 3.0.10
by Sebastian Hagedorn 24 Nov '15

24 Nov '15

Hi, we have never used RadSec before but are planning to do so for Eduroam. I found this (three years old) document from GÉANT on it, and was planning on trying it that way: <https://wiki.geant.org/display/H2eduroam/freeradius3-flr> But our national Eduroam center (DFN) recommends using radsecproxy instead, because according to them RadSec isn't yet stable in FR 3.0. What's your take on that? To be honest, I'd rather help fix problems in FR's RadSec implementation than install another piece of software - unless you recommend against it. -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

3 3