- Freeradius-Users - lists.freeradius.org

Segregate Accounting
by Guilherme Domingues 10 Nov '15

10 Nov '15

We're looking to segregate regular Wan traffic of your dsl users, to special services (e.g: CDN). As a solution we've been thinking to setup netflow/snmp to decrease final acct register of amount of traffic. But imo it is think an ugly idea. Anyone has any suggestion for that kind of design? Best regards, Guilherme Domingues LPI 201 LPI000161013 https://cs.lpi.org/caf/Xamman/certification/process_verify code verification: v8bwxqzja7 Linux ID #425752 --- "A mente que se abre a uma nova idéia jamais voltará ao seu tamanho original." Albert Einstein

1 0

FreeRADIUS on maintenance mode? Open authentication.
by Antonio Fernández Pérez 10 Nov '15

10 Nov '15

Hi everybody: I would like to know if there are some option to adjust in FreeRADIUS configuration to allow open authentication from all users. I have to make some maintenance tasks on MySQL and I don't want to interrupt the service. My objective is prevent alter all hotspot configurations (NASes) disabling RADIUS server. I hope your advices. Regards, Antonio.

2 2

rfc6929 : combination extended-type/long-extended-type and TLV data type
by Vereecke, Katrien (Katrien) 10 Nov '15

10 Nov '15

Hello, I am using freeradius server version V3.0.x. According to rfc6929 the combination of a extended or long-extended-type and tlv-data type is allowed. The rfc states that the TLV-length must have a value between 3 and 255, but is this correct in case of an extended or long extended type , should it then not be respectively 252 and 251 max? I was testing the TLV data type and long extended type, I defined in my dictionary the following: ATTRIBUTE Test-Attr-261-11 246.11 tlv ATTRIBUTE Test-Attr-261-11-1 246.11.1 octets And in my users file I included Test-Attr-261-11-1 = 0x00112233445566aabbccddeeff0011223344.......... => with a length more than 300 octets In the wireshark I see that the attribute is fragmented but the length-attr and the tlv-length are both set to ff and the second fragmented part does only contain the octets up till data length 255, not all octets specified in my users file. Is this correct? Wireshark output : f6 ff 0b 80 01 ff 00 11 22 33 44 55 ..... f6 08 0b 00 99 aa bb cc ... Thanks, Kind regards, Katrien.

2 3

freeradius 3.0.x HOW TO ULANG read/write all list keys/values
by Michal Tomaszewski 10 Nov '15

10 Nov '15

Hello, Could you advice how to write and read all reply list parameters to/from database? I would like to store reply parameters between sessions of the same user without generating them from scratch. As I understand writing all parameters to the database is possible using e.g. such command: &AllReplyString := "%{pairs:reply:[*]}" Then I can write AllReplyString to e.g. SQL database. But how can I read it back and fill all reply parameters into freeradius? I can retrieve AllReplyString from database. How to assign all parameters from such string to radius reply list? I imagine there shall be a kind of construction like Update reply { .... list := AllReplyString } but I couldn't find proper construction in ulang manual nor any converting function. Could you suggest the proper way of solving such issue? Regards, Mike ________________________________________ Uwaga: Treść niniejszej wiadomości może być poufna i objęta zakazem jej ujawniania. Jeśli czytelnik tej wiadomości nie jest jej zamierzonym adresatem, pracownikiem lub pośrednikiem upoważnionym do jej przekazania adresatowi, informujemy że wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomości jest zabronione. Jeśli otrzymałeś tę wiadomość omyłkowo, proszę bezzwłocznie odesłać ją nadawcy, a samą wiadomość usunąć z komputera. Dziękujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

2 6

Radius data counting questions
by Oliver Paget 10 Nov '15

10 Nov '15

Hi All :) I've been devving with freeradius with mysql for my DSL infrastructure (FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2012 at 01:22:51) It is being sent 64 byte accounting packets from a cisco router, aka my dev LNS. I have been trying to find a viable method for counting data for my test LNS but I have noticed this behaviour. To get the total data used for a user I simply sum(AcctOutputOctets) to find the total amount of data transferred for that user ever. When I query the DB a second time an hour later, sometimes the value is less than the previous time. Can somebody confirm for me that this is either broken or intended as im not sure I am knowledgeable enough to determine whether freeradius has a specific reason for this. Cheers, ojx

2 1

RE: If block in authenticate statement
by Franks Andy (IT Technical Architecture Manager) 09 Nov '15

09 Nov '15

Hi Alan, Thanks for the reply. I did try the OK bit at the end of the module, but it still returns noop, which is what confuses me. Whether I did the ok bit in the correct place is debateable but I did try it in the logical places. Does the ok placement need to be after an "else" statement? I'd put it at logical exit, i.e. after the if bit that I would want an ok returned, but if I need to specifically reject within the if/else and ok for all other eventualities at the end I didn't try that.. Anyway, onto why - I don't want to flat reject people using that SSID, just people who use PEAP and use mschapv2 (instead of TLS) on certain SSIDs. In certain circumstances I might want them to be allowed if they bring me sweets at Christmas for example. The problem is we (afaik) don't find out what the auth type is until the authorize stage where that module (eap in this case) sets it, and the inner auth type here is a few layers into the onion, that's why it sort of made sense to me to do it at "final" authenticate stage. I could probably also do it post-auth too I guess, pass it then check and reject.. The custom debug message was an "overall" delivery message to the indicate why failure had occurred at any point in the chain. Module-Failure-Message only works on certain modules afaik (or did when I last asked) so failures in certain areas would yield blanks. I'd quite happily ditch that if all modules do it now! I also think (from unreliable memory) that I had issues copying some of the attributes from inner to outer, some worked and some didn't - does the module-failure-message get automatically copied now from inner to outer layer? Thanks for your help as always! Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 06 November 2015 14:42 To: FreeRadius users mailing list Subject: Re: If block in authenticate statement On Nov 5, 2015, at 7:20 PM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > I'm doing something off-piste again probably. > Can I get away with doing an if statement within the mschap auth block? Yes. > I'm trying to allow peap-eap-mschap inner tunnel auth on certain ssids only; without the if statement, it works ok, but when I check against a control variable containing SSID, it produces this : > > mschap: --> --nt-response=10fe5a0664f0f3debffdcd61b60865947601331bdefef81c > (9) mschap: Program returned code (0) and output 'NT_KEY: CD7018318BC2359E8A362E0557384BEC' > (9) mschap: Adding MS-CHAPv2 MPPE keys > (9) [mschap] = ok > (9) if (!ok) { > (9) if (!ok) -> FALSE > (9) } # if (( control:SSID == "A_WiFi" ) || ( control:SSID == "Another_WiFi" )) = ok > (9) } # Auth-Type MS-CHAP = noop That's the issue. You can fix it by listing "ok" as the last module in the block which should return "ok". But as a larger issue... why are you doing these checks in the authenticate section? You should be doing most of them in the "authorize" section. You want to reject users as early in the process as possible. authorize { ... if (( control:SSID != "A_WiFi" ) && ( control:SSID != "Another_WiFi" )) { reject } ... } And why are you updating Debug-RejectInformation? Why not just use Module-Failure-Message directly? So the authenticate section can then look like this: authenticate { ... Auth-Type MS-CHAP { mschap } ... } If you need to see why a request was rejected, use Post-Auth-Type Reject: post-auth { ... Post-Auth-Type Reject { # Module-Failure-Message says why the user was rejected } ... } Much simpler. Much easier to understand. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Sharing a server
by Jason Vanlandingham 08 Nov '15

08 Nov '15

New user here... I have not installed FreeRADIUS yet. When I do, it will be on a CentOS 6 machine with the version that is installed from yum. (2.2.6-6.el6_7) I'm also running a network monitoring utility. (Observium) I want to be sure I'm not going to have problems with the web interface, so I want to create port-based virtual hosts. I am a network guy, and I admit my Linux/web server admin knowledge is a bit on the slim side. Is there a doc that helps out with what I need to do? If I leave Observium's page in the default port 80, will there be a problem when FreeRADIUS gets installed?

2 1

Clarifications on expected behavior when using proxy-inner-tunnel (3.x)
by Brian Julin 07 Nov '15

07 Nov '15

I don't know whether to rely on this behavior, because it seems a bit convoluted. In a server configured to proxy inner tunnel requests the requests flow as expected between the outer server and the client until PEAP starts unwrapping. Then the packet flow seems to be this: 1) normal client -> (outer-eap) -> outer server -> peap -> 2) proxy-inner-tunnel server autz (sets Proxy-To-Realm) 3) proxy-inner-tunnel server ("sends reply" back to outer) 4) either outer pre-proxy section or pre-proxy from a realm virtual_server directive 5) request actually sent to external inner 6) either outer post-proxy section or post-proxy from a realm virtual_server directive 7) outer post-auth proxy-inner-tunnel's post-auth never gets run, and its pre-proxy/post-proxy will not get run unless you use a realm "virtual_server" directive to force it. If this is set up naively without an "eap" in outer's post-proxy section and with no realm virtual_server directive, the administrator will find inner tunnel replies being sent directly to the client. If you do provide a post-proxy in the outer server or a realm virtual_server directive, everything ends up "working" minus not running some sections of the proxy-inner-tunnel server. 3,4,5 look like this: (7) Debug: authorize { (7) Debug: update control { (7) Debug: Proxy-To-Realm := "idpi" (7) Debug: } # update control = noop (7) Debug: } # authorize = noop (7) Debug: } # server eduroam_idp_proxy (7) Debug: Virtual server sending reply (7) Debug: eap_peap: Got tunneled reply code 0 (7) Debug: eap_peap: Tunnelled authentication will be proxied to idpi (7) Debug: eap: Tunneled session will be proxied. Not doing EAP (7) Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 7 (7) Debug: [eap] = handled (7) Debug: } # authenticate = handled (7) Debug: Empty pre-proxy section in virtual server "eduroam_idp_in". Using default return values. (7) Debug: proxy: Trying to allocate ID (0/2) (7) Debug: proxy: Trying to open a new listener to the home server (7) Debug: proxy: Trying to allocate ID (1/2) (7) Debug: proxy: request is now in proxy hash (7) Debug: proxy: allocating destination X.X.X.X port 1812 - Id 149 (7) Debug: Proxying request to home server X.X.X.X port 1812 timeout 30.000000 If that's the way it is supposed to work, as long as I can get my session-state handling straight, I'm happy to do it that way, but it looked odd so I didn't want to rely on it without asking. Also the default mods-available/proxy-inner-tunnel could use some commentary to this effect.

2 4

HOW TO WIRED 802.1x FreeRadius RHEL6 configuration for Dummies?
by lux xul 07 Nov '15

07 Nov '15

All- brand New to linux and freeradius, networking. Im winging it as best I can. Linux: RHEL6 Linux System Admin Dropdown with INSTALLED filter shows: freeRadius 2.2.6-6.el6_7(x86_64) Command line "radiusd -v" shows "freeRadius version 3.0.8" Confused. I downloaded the RHEL6 compatible 2.2.6 RPM and installed it using yum. That was what I THOUGHT I was working with. I also ran Yum and updated the servers database, etc. Question 1: Are freeradius RPM files labeled differently than freeRadius installation versions? Meaning a 2.2.6.el6_7 RPM can actually be the binary of a freeRadius version 3.0.8? Then... Following the Using radtest and the HOW-TOs on the freeRadius site I have configured and was able to verify that the freeRadius Server authenticates PAP and EAP-MD5. I have spent several days trying to locate how to configure the freeRadius server and 802.1x Port Security in a LINUX ONLY (no ms windows) and WIRED only test lab on one RHEL6 linux box. I want to eventually enlarge upon that n/w setup to include at least one separate client node. One step at a time. I find many tutorials on how to configure "freeRadius/802.1x client/server" on WIFI and in MSwindows environment, or a combination of linux and MS Windows. Now, it may be my lack of experience and lack of linux/networking understanding, but I cannot confidently follow tutorials that are not in sync with my linux/wired only limitations, especially when written with certain assumptions of a knowledge / experience base/vocabulary that I do not possess at this time. Question 2: Is there any available how to guide that may prove more basic and "for dummies" that I may use to step through a freeRadius/802.1x/Wired only/RHEL linux Only process? thank you for your suggestions in advance. I spent many hours trying to answer this so I wouldnt have to ask. -nube

3 2

EAP Taking Too Long to Authenticate
by Syed Rais Ahmad NON DRI 06 Nov '15

06 Nov '15

How can I reduce authentication time FreeRadius takes to authenticate laptop users based on security certs/EAP ? My implementation is taking about 18 seconds for the users to get authenticated. Thanks. This e-mail message is for the sole use of the intended recipient and may contain information that is confidential, proprietary or privileged. Any unauthorized review, use, distribution, copying or disclosure is strictly prohibited. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, please notify sender of the delivery error by replying to this message and then delete it from your system. Receipt by anyone other than the intended recipient is not a waiver of confidentiality or privilege.

5 9