- Freeradius-Users - lists.freeradius.org

Freeradius 3.0.9 COA Disconnect Configuration
by Joaquin Alzola 04 Oct '15

04 Oct '15

Hi Guys, I have configured COA and have no problem on receiving and sending the COA package: Command: linux-8cwx:/usr/local/etc/raddb # cat coa-test.txt | radclient -x 192.168.56.101:3799 disconnect 'testing123' Sent Disconnect-Request Id 248 from 0.0.0.0:38327 to 192.168.56.101:3799 length 48 Acct-Session-Id = "00000580" User-Name = "root" NAS-IP-Address = 127.0.0.1 NAS-Port = 511 Received Disconnect-ACK Id 248 from 192.168.56.101:3799 to 0.0.0.0:0 length 20 Log: (13) Received Disconnect-Request Id 248 from 192.168.56.101:38327 to 192.168.56.101:3799 length 48 (13) Acct-Session-Id = "00000580" (13) User-Name = "root" (13) NAS-IP-Address = 127.0.0.1 (13) NAS-Port = 511 (13) # Executing section recv-coa from file /usr/local/etc/raddb/sites-enabled/coa (13) recv-coa { (13) [suffix] = noop (13) [ok] = ok (13) } # recv-coa = ok (13) # Executing section send-coa from file /usr/local/etc/raddb/sites-enabled/coa (13) send-coa { (13) [ok] = ok (13) } # send-coa = ok (13) Sent Disconnect-ACK Id 248 from 192.168.56.101:3799 to 192.168.56.101:38327 length 0 (13) Finished request (13) <done>: Cleaning up request packet ID 248 with timestamp +628 Ready to process requests Should I expect to see the root user with Session-ID 580 get disconnected? And to to trigger this disconnect automatically? BR Joaquin This email is confidential and may be subject to privilege. If you are not the intended recipient, please do not copy or disclose its content but contact the sender immediately upon receipt.

2 3

input_/output_password?
by Jim Seymour 04 Oct '15

04 Oct '15

Hi All, In the ca.cnf and server.cnf files: It would appear only the output_password is actually used? Can output_password be eliminated, as well? I intend that the resulting certs be used by more than FreeRADIUS alone. I've never found it necessary to protect certs with passwords, before. Thanks, Jim -- Note: My mail server employs *very* aggressive anti-spam filtering. If you reply to this email and your email is rejected, please accept my apologies and let me know via my web form at <http://jimsun.LinxNet.com/contact/scform.php>.

2 2

Version 2.2.9 has been released
by Alan DeKok 03 Oct '15

03 Oct '15

This should be the last release from version 2. We recommend everyone upgrade to v3. Feature improvements * None. Bug fixes * Fix Tunnel-Password crash from home server. Found by Denis Andzakovic. * Fix timer issue when proxying. * Update EAP-TTLS so that MPPE keys are correctly calculated with TLSv1.2. * Always delete MS-MPPE-* from the TTLS inner tunnel. This allows TTLS / EAP-MSCHAPv2 to work. * Don't fall through in empty "case" statements. Fixes #1274.

4 5

ERROR: User-Name ... is not the same as MS-CHAP Name
by Jim Seymour 02 Oct '15

02 Oct '15

Hi All, FreeRADIUS version 2.1.12 (2.1.12+dfsg-1.2ubuntu8.1) Ubuntu 14.04.3 LTS OpenLDAP 2.4.31 Goal is to use existing sambaLMPassword/sambaNTPassword/sambaEtc. in OpenLDAP server data, to authenticate wireless clients--mostly running MS-Win7. Some MS-WinXP. A few Linux clients. Old version was FreeRADIUS 1.1.1, built from a tarball, running on a Sun Sparc Solaris box, working against an older version of OpenLDAP and Samba. Worked like a champ. Still working. Referring to various on-line "how to"s and my old configs: Got the new server kind of more-or-less running, the trick being in finding.. filter = "(uid=%{mschap:User-Name})" to get clients authenticating via ldap. Then ran into the dreaded Info: [mschap] ERROR: User-Name (hostname\username) is not the same as MS-CHAP Name (username) from EAP-MSCHAPv2 Realms is not possible, because these are all workgroup computers--not part of a domain. So they all send "HOSTNAME\\username", rather than just "username." I can auth with a Linux Mint client, no problem. Searching and searching: I finally ran across a Red Hat bug report thread where RH claimed "It's a bug, it's been patched" and they closed it. So: *Was* it a bug and *has* it been squashed? I have no problem building and installing from a tarball, *if* it will fix the problem. Thanks, Jim -- Note: My mail server employs *very* aggressive anti-spam filtering. If you reply to this email and your email is rejected, please accept my apologies and let me know via my web form at <http://jimsun.LinxNet.com/contact/scform.php>.

6 9

Operator to remove attributes
by Gary T. Giesen 01 Oct '15

01 Oct '15

I'm currently using FreeRADIUS 2.1.12 with an SQL backend and a custom-developed front end. I've run into a situation where we need to be able to apply a group to the user (that contains a check attribute) that would strip reply items (basically we want to strip Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Route, etc) depending on which device the request is coming from. I realize that using unlang is probably the best supported method for this, unfortunately it doesn't jive well with our setup. I noticed a while back that Joe Maimon wrote some patches to create some custom operators to do just that: http://lists.freeradius.org/pipermail/freeradius-devel/2005-October/000550.h tml "Attribute -= Value" As a reply item it means remove matching items from the reply list. Not allowed as a check item. "Attribute -* Value" As a reply item it means remove all "Attribute" attributes items from the reply list. Not allowed as a check item. "Attribute -~ Value" As a reply item it means remove regex matching items from the reply list. Not allowed as a check item. Since it's not in the documentation, I presume this never made it into an official release. Were there problems with the patch? I'd be very interested to see this implemented... Cheers, Gary T. Giesen

4 12

REST API in v3
by Jim Shi 01 Oct '15

01 Oct '15

Hi, I was recommend to use REST API instead of jradius. Is there any doc how to implement the backend (which servers the REST API calls)? Thanks Jim

3 4

Testing Certificates
by Lightfoot, Maurice P. 30 Sep '15

30 Sep '15

Hello, I am having trouble testing if the certificates created are actually working. I am using JRadiusSimulator to test if the certificates work. I can get an access-accept when I input the correct the correct user name and password and the Radius server IP address and password. There is also a Keys tab on the JRadiusSimulator to input the client certificate and root certificate. When I put the wrong or right path and password for the certificates I still get an access-accept from the debugger. My question is how do I test the certificates created with RADIUS. Thank you

3 4

freeradius + jradius
by Jim Shi 30 Sep '15

30 Sep '15

Hi, I would like to use freeradius radius for verify client certificate (EAP - TLS) (authentication), and use jradius (which is java code) for authorization. In jradius, I need access the CN of client certificate for authorization. Is that possible? That is, I would like freeradius to put client certificate’s CN in the radius packet before sending to jradius for authorization. Thanks Jim

3 4

Please check v3.0.x head
by Alan DeKok 30 Sep '15

30 Sep '15

We're getting ready for the release of 3.0.10. Please do a last double-check to be sure it's OK. We've added a LOT of tests since 3.0.9. The tests make sure that future code changes will be caught by the test cases before they're seen in production. :) The list of changed or added tests follows: src/tests/eapsim-03/radiusd-example.txt src/tests/keywords/count-error src/tests/keywords/else-error src/tests/keywords/foreach-break-4 src/tests/keywords/radiusd.conf src/tests/keywords/switch-escape src/tests/keywords/switch-virtual src/tests/keywords/update-delete src/tests/keywords/virtual src/tests/keywords/virtual-load-balance src/tests/keywords/virtual_policy src/tests/keywords/with_dots src/tests/map/base src/tests/map/base.out src/tests/map/count-error src/tests/map/count-list-error src/tests/map/map_tests.mk src/tests/map/map_unit.c src/tests/map/map_unit.mk src/tests/modules/ldap/groups_rfc2307bis.unlang src/tests/peap-client-mschapv2.conf src/tests/unit/rfc.txt src/tests/unit/tunnel.txt src/tests/unit/vendor.txt src/tests/unit/xlat.txt Alan DeKok.

7 20

RE: Backtrace of ldap related crash
by Franks Andy (IT Technical Architecture Manager) 30 Sep '15

30 Sep '15

Just noticed I rather rudely didn't say thanks. Thanks! Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 22 September 2015 19:42 To: FreeRadius users mailing list Subject: Re: Backtrace of ldap related crash > On 22 Sep 2015, at 15:35, Matthew Newton <mcn4(a)LEICESTER.AC.UK> wrote: > > On Tue, Sep 22, 2015 at 01:59:17PM +0000, Franks Andy (IT Technical Architecture Manager) wrote: >> Drat, I fixed AD (memory leak) and now it's not likely to happen >> again until the next time, which could be a while away. > > Have you still got the coredump? Should be able to fire up gdb again > and get it from there. Pushed a fix. Missed return code check from rlm_ldap_map_profile. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0