- Freeradius-Users - lists.freeradius.org

ERROR: User-Name ... is not the same as MS-CHAP Name
by Jim Seymour 02 Oct '15

02 Oct '15

Hi All, FreeRADIUS version 2.1.12 (2.1.12+dfsg-1.2ubuntu8.1) Ubuntu 14.04.3 LTS OpenLDAP 2.4.31 Goal is to use existing sambaLMPassword/sambaNTPassword/sambaEtc. in OpenLDAP server data, to authenticate wireless clients--mostly running MS-Win7. Some MS-WinXP. A few Linux clients. Old version was FreeRADIUS 1.1.1, built from a tarball, running on a Sun Sparc Solaris box, working against an older version of OpenLDAP and Samba. Worked like a champ. Still working. Referring to various on-line "how to"s and my old configs: Got the new server kind of more-or-less running, the trick being in finding.. filter = "(uid=%{mschap:User-Name})" to get clients authenticating via ldap. Then ran into the dreaded Info: [mschap] ERROR: User-Name (hostname\username) is not the same as MS-CHAP Name (username) from EAP-MSCHAPv2 Realms is not possible, because these are all workgroup computers--not part of a domain. So they all send "HOSTNAME\\username", rather than just "username." I can auth with a Linux Mint client, no problem. Searching and searching: I finally ran across a Red Hat bug report thread where RH claimed "It's a bug, it's been patched" and they closed it. So: *Was* it a bug and *has* it been squashed? I have no problem building and installing from a tarball, *if* it will fix the problem. Thanks, Jim -- Note: My mail server employs *very* aggressive anti-spam filtering. If you reply to this email and your email is rejected, please accept my apologies and let me know via my web form at <http://jimsun.LinxNet.com/contact/scform.php>.

6 9

Operator to remove attributes
by Gary T. Giesen 01 Oct '15

01 Oct '15

I'm currently using FreeRADIUS 2.1.12 with an SQL backend and a custom-developed front end. I've run into a situation where we need to be able to apply a group to the user (that contains a check attribute) that would strip reply items (basically we want to strip Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Route, etc) depending on which device the request is coming from. I realize that using unlang is probably the best supported method for this, unfortunately it doesn't jive well with our setup. I noticed a while back that Joe Maimon wrote some patches to create some custom operators to do just that: http://lists.freeradius.org/pipermail/freeradius-devel/2005-October/000550.h tml "Attribute -= Value" As a reply item it means remove matching items from the reply list. Not allowed as a check item. "Attribute -* Value" As a reply item it means remove all "Attribute" attributes items from the reply list. Not allowed as a check item. "Attribute -~ Value" As a reply item it means remove regex matching items from the reply list. Not allowed as a check item. Since it's not in the documentation, I presume this never made it into an official release. Were there problems with the patch? I'd be very interested to see this implemented... Cheers, Gary T. Giesen

4 12

REST API in v3
by Jim Shi 01 Oct '15

01 Oct '15

Hi, I was recommend to use REST API instead of jradius. Is there any doc how to implement the backend (which servers the REST API calls)? Thanks Jim

3 4

Testing Certificates
by Lightfoot, Maurice P. 30 Sep '15

30 Sep '15

Hello, I am having trouble testing if the certificates created are actually working. I am using JRadiusSimulator to test if the certificates work. I can get an access-accept when I input the correct the correct user name and password and the Radius server IP address and password. There is also a Keys tab on the JRadiusSimulator to input the client certificate and root certificate. When I put the wrong or right path and password for the certificates I still get an access-accept from the debugger. My question is how do I test the certificates created with RADIUS. Thank you

3 4

freeradius + jradius
by Jim Shi 30 Sep '15

30 Sep '15

Hi, I would like to use freeradius radius for verify client certificate (EAP - TLS) (authentication), and use jradius (which is java code) for authorization. In jradius, I need access the CN of client certificate for authorization. Is that possible? That is, I would like freeradius to put client certificate’s CN in the radius packet before sending to jradius for authorization. Thanks Jim

3 4

Please check v3.0.x head
by Alan DeKok 30 Sep '15

30 Sep '15

We're getting ready for the release of 3.0.10. Please do a last double-check to be sure it's OK. We've added a LOT of tests since 3.0.9. The tests make sure that future code changes will be caught by the test cases before they're seen in production. :) The list of changed or added tests follows: src/tests/eapsim-03/radiusd-example.txt src/tests/keywords/count-error src/tests/keywords/else-error src/tests/keywords/foreach-break-4 src/tests/keywords/radiusd.conf src/tests/keywords/switch-escape src/tests/keywords/switch-virtual src/tests/keywords/update-delete src/tests/keywords/virtual src/tests/keywords/virtual-load-balance src/tests/keywords/virtual_policy src/tests/keywords/with_dots src/tests/map/base src/tests/map/base.out src/tests/map/count-error src/tests/map/count-list-error src/tests/map/map_tests.mk src/tests/map/map_unit.c src/tests/map/map_unit.mk src/tests/modules/ldap/groups_rfc2307bis.unlang src/tests/peap-client-mschapv2.conf src/tests/unit/rfc.txt src/tests/unit/tunnel.txt src/tests/unit/vendor.txt src/tests/unit/xlat.txt Alan DeKok.

7 20

RE: Backtrace of ldap related crash
by Franks Andy (IT Technical Architecture Manager) 30 Sep '15

30 Sep '15

Just noticed I rather rudely didn't say thanks. Thanks! Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 22 September 2015 19:42 To: FreeRadius users mailing list Subject: Re: Backtrace of ldap related crash > On 22 Sep 2015, at 15:35, Matthew Newton <mcn4(a)LEICESTER.AC.UK> wrote: > > On Tue, Sep 22, 2015 at 01:59:17PM +0000, Franks Andy (IT Technical Architecture Manager) wrote: >> Drat, I fixed AD (memory leak) and now it's not likely to happen >> again until the next time, which could be a while away. > > Have you still got the coredump? Should be able to fire up gdb again > and get it from there. Pushed a fix. Missed return code check from rlm_ldap_map_profile. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Alive sessions in radacct table
by Anisa Allahdadi 30 Sep '15

30 Sep '15

Hi all, My FreeRADIUS is up and running. However, in 'radacct' table, there are only 'acctstarttime' and 'acctstoptime' being recorded, how about 'alive'? In the real world situation we can record Alive sessions every 10-15 min. Could anybody tell me if it is possible in FreeRADIUS as well? Many thanks Anisa

7 28

buffered_sql problem
by Ricardo Larrañaga 29 Sep '15

29 Sep '15

Hello Guys: I was wondering if you could help me with an issue that i am having with my buffered_sql configuration. I am using freeradius 3.0.4, under centos 7, and with buffered sql configuration, and since 3 days ago, no accounting records are being imported into my database. detail and detail.work files are in the proper directory, but detail.work keeps growing and it does not look like it is offloading any data to the DB, Almost like buffered_sql would not be reading the detail.work file anymore. Now, i did run the server in debug mode, and i see the detail.work file being read. I do see one problem with the db insertion of some accounting records. It looks like it looks like some acct records are coming with a acctuniqueid that is already in the db, so those fail, but my question is, will the server keep trying to insert that record and not try any others in the detail.work file? My buffered_sql config is pretty standard: server buffered-sql { listen { type = detail filename = "/buffer_disk/detail" load_factor = 10 poll_interval = 1 retry_interval = 30 } preacct { preprocess acct_unique files } accounting { sql_radacct } The first packet in the detail.work file fails with a db error for having a duplicated acctuniqueid. Will the server continue processing other packets? Will that packet stay in the file? At this point i have a really big amount of packets in the file, and no accounting records on my db, so i am really looking forward to fix this issue. Thanks for any help you could provide. Regards

5 14

Excluding traffic from one ip in accounting
by Randeep 29 Sep '15

29 Sep '15

Hi All, We have a couple of streaming servers in our network. We would like to exclude the traffic from these servers to client from accounting. How we can do that? We tried to put a filter in accounting section when interim accounts is processed. But in interim accounts, only the data usage is receiving. It doesn't have any ip information in those. How can we achieve this. Please suggest. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 11