- Freeradius-Users - lists.freeradius.org

reuse EAP-TLS client certificiate
by Matt Zagrabelny 09 Sep '15

09 Sep '15

Greetings, I've done a quick google and scan of the FR user mailing list archives and did not find a definitive answer to the following: With EAP-TLS, can one reuse the same client cert across multiple devices? I'm guessing "yes", but would appreciate confirmation. Tangentially, is there a way to "pin" a certificate to a client's MAC address? Thanks! -m

3 3

Authentication MS SQL Server 2008
by Andrés Gómez 09 Sep '15

09 Sep '15

Hi everyone. I have a list of authorized users stored in a Microsoft SQL Server 2008. My Freeradius system is installed on a Linux server, and I want to store the accounting (radacct table) data in my Linux server (mysql). can freeradius ask to Microsoft SQL Server 2008 to authorize an user? How can I do it? I have searched and I only get information abut how to store accounting data ina a ODBC database, but its not my case. Regards, -- *C. Andrés Gómez R.*

2 1

Realm Strip
by Dennis Xu 09 Sep '15

09 Sep '15

This is our setup: we put a FreeRadius version 2.1.10 on Ubuntu in front of the Cisco ACS 5 and we need the FreeRadius to strip the suffix starting from @ and just pass the username to ACS 5 for authentication(with AD). We use PEAP MS-CHAPv2. It did not work. ACS5 still sees the whole username(i.e, dxu(a)uoguelph.ca) with the suffix. I added the following to the proxy.conf file: realm uoguelph.ca { type = radius authhost = acs5-test2.uoguelph.ca:1812 accthost = acs5-test2.uoguelph.ca:1813 secret = testing123 } I added followings to the radiusd.conf file: realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } authorize { preprocess mschap suffix eap files } authenticate { Auth-Type MS-CHAP { mschap } eap } mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } Did I miss anything? Does FreeRadius strip the realm for both inner and outer IDs for peap authentication? Thank you for your help! --- Dennis Xu, MASc, CCIE #13056 Analyst 3, Network Infrastructure Computing and Communications Services(CCS) University of Guelph 519-824-4120 Ext 56217 dxu(a)uoguelph.ca www.uoguelph.ca/ccs

2 2

User authentication - users config file and MySQL databases
by Alexandre Oliveira 09 Sep '15

09 Sep '15

Hello all, I would like to transfer all the configured users in the users in the users con file to MySQL database, it is possible? I’ve configured Radius to work with MySQL and created a test user, teste, in radcheck database with a test password, teste. Follow the entry: username - teste attribute - cleartext-password op - := value - teste I also created an entry in radreply database. Follow the entry: username - teste attribute - fall-through op - = value - yes For this test all other databases are empty. I’ve stated free radius in debug mode to see if there were any erros, but there weren’t. Follow the log output: root@Ubuntu-Radius-Server:~# tail /var/log/freeradius/radius.log Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #2 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #3 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #4 Tue Sep 8 23:53:00 2015 : Info: Loaded virtual server inner-tunnel Tue Sep 8 23:53:00 2015 : Info: ... adding new socket proxy address * port 52669 Tue Sep 8 23:53:00 2015 : Info: Ready to process requests. After Freeradius server was running I testes if the user from radcheck database was going to be authenticated, and it wasn’t. I received a Rejected Message, as follow. Sending Access-Request of id 47 to 127.0.0.1 port 1812 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=47, length=20 Neither the debug or log shown if Freeradius was searching for his user in the users config file or in radcheck database. Since in Freeradius documentation states that if the user is not found it is rejected, I’m presuming that the user was not found. Although it is not clear if Freeradius is searching only in the users config or if it is searching also in radcheck database. Is is possible to add to the debug or in the log file where is Freeradius searching for he user? when I tested the authentication with an user, teste1, configured in the users config file, the authentication was accepted. root@Ubuntu-Radius-Server:~# radtest teste1 teste localhost 1812 testing123 Sending Access-Request of id 2 to 127.0.0.1 port 1812 User-Name = "teste1" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=2, length=20 I didn’t found in radiusd.conf o in sql.conf files a way to configure Freeradius to search it to use the radcheck database to authenticate the users. Is it possible to configure it? Thanks for the help. Regards Alex

1 0

Let FreeRADIUS ignore a request from rlm_perl
by Harm van Tilborg 09 Sep '15

09 Sep '15

Hey there, I'm using FreeRADIUS Version 2.2.8 and am wondering whether it is possible to ignore a request (i.e. send no reply at all) inside a rlm_perl module. I tried returning either RLM_MODULE_NOOP, RLM_MODULE_INVALID, RLM_MODULE_FAIL, and RLM_MODULE_HANDLED (without setting any reply attributes) inside an authenticate function. Although, in the end, they all result in the server rejecting the request, which is not what I want. How can I achieve this? -- Harm

4 5

Radius and MYSQL
by Alexandre Vilarinho 08 Sep '15

08 Sep '15

Hello all I'm new at Radius and I'm trying do configure Radius do authenticate the user from MYSQL databank. I configured the user in the user configuration file and it is working correctly, follow the configuration of the user. teste1 Cleartext-Password := "teste" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=1", Cisco-AVPair = "shell:cmd=show", Cisco-AVPair = "shell:cmd=show privilege" For this user I would like to configure a group in MYSQL called Privilege Level 1 and add it to that group. The Privilege Level 1 group should have the following configuration: Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=1", Cisco-AVPair = "shell:cmd=show", Cisco-AVPair = "shell:cmd=show privilege" The user should have have the following configuration: teste1 Cleartext-Password := "teste" I've already installed MYSQL database and it is also integrated with Radius. I've followed the following explanation webpage tutorial - guide/SQL HOWTO I think that mysql databank and databases are correct and integrated with Radius. I didn't find any tutorial for beginners that explain step-by-step what should be done to configure the user group and the user. Can anyone explain to me how I can configure the user and the group? Regards Alex

2 5

ascend-data-filter in freeradius v3.0.x - interaction with RFC6929?
by Vereecke, Katrien (Katrien) 08 Sep '15

08 Sep '15

Hello, I am using the freeradius-server version V3.0.x and have the problem that the data specified in the users file for the Ascend-Data-Filter attribute (from the Ascend vendor space) is not correct sent in the radius access-accept msg. Is this related to the rfc6929 extended-attribute 242 that I need to do something specific, the Ascend-Data-filter is sent as part of the vendor space Ascend(=529), so there is no conflict with the 242 extended-attribute of rfc6929? My users file contains the following: Ascend-Data-Filter = 0x01010100010203040a0b0c0d05200600000504d2020200000000000000000000, The radius output is : (12) Sent Access-Accept Id 222 from 138.203.10.191:1812 to 138.203.10.123:64397 length 0 .... (12) Alc-Default-Router = 10.50.2.1 (12) Ascend-Data-Filter = 0x (12) Class = 0x41444d494e31 (12) Finished request Waking up in 4.9 seconds. (12) <done>: Cleaning up request packet ID 222 with timestamp +184 Ready to process requests My wireshark shows for the ascend-data-filter the following " 1a 28 00 00 02 11 f2 22 20 27 7a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" In a previous version of freeradius V2.1.12. this is working fine, but I stepped up to version V3.0.8 to have support for the radius extensions RFC6929. Thanks, Regards, Katrien.

2 2

unixODBC errors - undefined symbol:get_vtable
by Mohamed Imran (NBI) 08 Sep '15

08 Sep '15

Hi all, I've installed freeradius (built from source version: freeradius-server-3.0.9) on Centos 6.7 and am trying to get it to talk to our MS SQL servers (using unixODBC and FreeTDS driver) to lookup a mac address etc. as part of the post-auth process but not having much success. Running radius -X shows the following error: rlm_sql_unixodbc: 01000 [unixODBC][Driver Manager]Can't open lib '/usr/lib64/libtdsodbc.so' : ??vb??: undefined symbol: get_vtable rlm_sql_unixodbc: SQL down 08003 [unixODBC][Driver Manager]Connnection does not exist rlm_sql_unixodbc: Can't allocate the stmt rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) Has anyone else seen this issue? Any ideas on how this can be fixed? Also wondering if it's the version of unixODBC or FreeTDS im using is incompatible with this verison of freeradius. If so which version should I be using? Any help much appreciated. ================================ Environment details: ================================ OS: Centos 6.7 Freeradius: freeradius-server-3.0.9 [built from source as the repo version 3.0.3 kept throwing segmentation fault error] unixODBC: (from centos repo) Arch : x86_64 Version : 2.2.14 Release : 14.el6 FreeTDS: (from centos repo) Arch : x86_64 Version : 0.91 Release : 2.el6 ==================================== Regards, Mohamed Connect with us on: <https://twitter.com/NBIPComputing> The NBI Partnership Ltd provides non-scientific services to the <http://www.jic.ac.uk/> John Innes Centre, the <http://www.ifr.ac.uk/> Institute of Food Research, <http://www.tgac.ac.uk/> The Genome Analysis Centre and <http://www.tsl.ac.uk/> The Sainsbury Laboratory Disclaimer: This e-mail message may contain confidential information and is intended only for the use of the intended recipient(s). Any unauthorized disclosure, dissemination, distribution, copying or the taking of any action in reliance on the information herein is prohibited. E-mails are not secure and cannot be guaranteed to be error free as they can be intercepted, amended, or contain viruses. Anyone who communicates with us by e-mail is deemed to have accepted these risks. Company Name is not responsible for errors or omissions in this message and denies any responsibility for any damage arising from the use of e-mail. Any opinion and other statement contained in this message and any attachment are solely those of the author and do not necessarily represent those of the company.

2 1

Trigger EDIR-Intruder Lockout in FR3
by Anja Ruckdaeschel 08 Sep '15

08 Sep '15

Hi there, I wonder what is the designated way in FR 3.0.9 to trigger an eDirectory-Intruder Lockout with edir_autz=yes in addition? I want to use a, universal password retrieval b, grace login consumation, account expire check, password expire check, login time restrictions check, attribute checks, etc. c, intruder lockout trigger (I do a named ldap bind with the login-user with a password which is bad, if mschap rejects) in one radius config for PEAP/MSCHAPv2 with eDIR. So far, I only manage to get a and b OR a and c running. Perhaps you can give me a hint? Thank you for your time. Ciao Anja

2 3

rlm_sql and string escaping
by Unik 08 Sep '15

08 Sep '15

Hello list! I'm currently trying to port our custom GPL'ed FreeRADIUS module to 3.x. In addition to updating it to work on newer versions I tried to convert it from using our own half-assed SQL abstraction layer to rlm_sql's (using rlm_sqlhpwippool as an inspiration). While doing that I noticed that there are no DB-specific mechanisms to escape strings for use in DB queries (sql_escape_func is too strict and doesn't know about DB escaping rules). So my question is - is it ok for me to extend rlm_sql with DB-specific string escaping API, and if so, what are your suggestions and requirements for such an API? One thing to consider is that data-string-escaping and identifier -string-escaping follow different rules in several DBs. My current plan is: * Add another function pointer to rlm_sql instance (sql_string_escape_func). * Make it default to sql_escape_func. * Check if driver implements its own string escaping function, and if so, replace sql_string_escape_func with it. This implies that new function will have the same signature as sql_escape_func. -- With best regards, Alex Unigovsky mailto:unik@compot.ru Systems Administrator Maksim Co. Ltd. work: +7 495 981-0313 cell: +7 926 619-8997 23 Barishikha st. 125368 Moscow Russian Federation

1 0