- Freeradius-Users - lists.freeradius.org

Attribute IP addresses to users while authenticating against external server!
by HaTiM Chikhi 24 Jun '15

24 Jun '15

Hi, I'm running freeradius version 2.1.12. I have configured my freeradius server to authenticate users against an external server (LinOTP server) using a perl plugin. The authentication is working correctly. My users' conf file "/etc/freeradius/users" contains the following: DEFAULT Auth-type := perl The linotp module configuration is as follows: ################## authorize { preprocess IPASS suffix ntdomain files expiration logintime pap } #here the linotp perl module is called for further processing authenticate { perl } accounting { detail unix radutmp exec attr_filter.accounting_response } ################## I need to know how can I provide IP addresses to connecting users using the "*Frame-IP-Address*" attribute while still autheticating against the external server?? Thanks for your help! Hatim

1 0

Attribute IP addresses to users while authenticating against external server
by HaTiM Chikhi 24 Jun '15

24 Jun '15

Hi, I have configured my freeradius server to authenticate users against an external server (LinOTP server) using a perl plugin. The authentication is working correctly. My users' conf file "*/etc/freeradius/users*" contains the following: *DEFAULT Auth-type := perl* The linotp module configuration is as follows: *authorize { preprocess IPASS suffix ntdomain files expiration logintime pap}#here the linotp perl module is called for further processingauthenticate { perl}accounting { detail unix radutmp exec attr_filter.accounting_response}*I need to know how can I provide IP addresses to connecting users using the " *Frame-IP-Address*" attribute while still autheticating against the external server?? Thanks for your help! (Sorry for the last incomplete mail)

1 0

(no subject)
by HaTiM Chikhi 24 Jun '15

24 Jun '15

Hi, I have configured my freeradius server to authenticate users against an external server (LinOTP server) using a perl plugin. The authentication is working correctly. My users' conf file "/etc/freeradius/users" contains the following: DEFAULT Auth-type := perl The linotp module configuration is as follows: authorize { preprocess IPASS suffix ntdomain files expiration logintime pap } #here the linotp perl module is called for further processing authenticate { perl } accounting { # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # For Exec-Program and Exec-Program-Wait exec # Filter attributes from the accounting response. attr_filter.accounting_response } Now, I want to provide IP addresses to connecting users using the "Frame-IP-Address" attribute. I don't now how to do that since I'm -- *CHIKHI Hatim* *Stage Administrateur Réseau et Sécurité* *Linkbynet*

1 0

radiusd.log not showing authentication requests
by Stefano Zanmarchi 24 Jun '15

24 Jun '15

Hello, I'm setting up a new radius server, copying the configuration from the actual one (both are 2.1.12). Everything is working in debug mode, but if I start the new radius normally it just shows start|stop info ("ready to process requests") in the radiusd.log file, not the authentication requests. The actual server instead is logging fine: Tue Jun 23 17:40:23 2015 : Auth: Login OK: [marie.curie(a)studenti.unipd.it] (from client server2.unipd.it port 1 cli 00-26-b6-f8-6f-e5 via TLS tunnel) Tue Jun 23 17:40:23 2015 : Auth: Login OK: [marie.curie(a)studenti.unipd.it] (from client server2.unipd.it port 1 cli 00-26-b6-f8-6f-e5) The "log" section of the radiusd.conf on both servers is: log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } Is there some other setting to activate authentication logging in radiusd.log file? I'm sure I'm missing something, but I can't see where. Thank you very much for your help, Stefano

2 2

acct-start-time
by Jake He 24 Jun '15

24 Jun '15

Hi, I am running freeradius v3. acct-start-time is not inserted into the sql database. Below is the from the debug log. After running this sql, acctstarttime field is 0000-00-00 00:00:00. I want the acct-start-time to have date and time. INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('82100105', 'bce29f02064857e16fe65303d219cfe4', 'jake', '', '10.1.1.23', '', 'Wireless-802.11', 1435126480, 1435126480, NULL, '0', 'RADIUS', '', '', '0', '0', '', '', '', 'Framed-User', '', '')

1 1

Issue with intermediate CAs
by Alan DeKok 23 Jun '15

23 Jun '15

We had a CVE issued today: http://www.ocert.org/advisories/ocert-2015-008.html OpenSSL doesn't check intermediate CAs for expiry when setting the "check CRL" flag. You need to set another flag saying "I really mean check ALL of the CRLs". FreeRADIUS didn't set that flag. The impact for 99% of people is nothing. In order to be vulnerable, you have to have all of the following in the configuration: 1) the RADIUS system has to use a public CA 2) use an intermediate CA to issue client certificates 3) enable EAP-TLS Most people don't have EAP-TLS enabled. A small number of people might be using an intermediate CA. A vanishingly small number of people will be using a public CA for RADIUS. Using a public CA is a *terrible* idea. We have been recommending against it for years. The problem got a CERT advisory issued because technically it is a security bug, and the original person who reporting it didn't want to contact security(a)freeradius.org. We'll get 2.2.8 and 3.0.9 out soon. In the mean time, most people can ignore this issue. Alan DeKok.

5 7

Please check: 3.0.9 is going to be released soon
by Alan DeKok 23 Jun '15

23 Jun '15

For people with time... please check that the v3.0.x branch from github works for you. It passes all of our tests, including tests we added since 3.0.8 was released. But the tests aren't exhaustive. If all goes well, we will release 3.0.9 on Friday. Alan DeKok.

1 0

Implementing FUP with FreeRadius and Mikrotik
by Randeep 23 Jun '15

23 Jun '15

Hi, We are doing the implementation with FreeRadius+mysql+mikrotik. for a starter plan we have 30G usage limit @4mbps(d)/4mbps(u). After this limit, we need to scale down the speed to @2mbps(d)/2mbps(u). I have configured Mikrotik-Rate-Limit = '4096k/4096k' Is it mandatory to give the burst rates and burst time? Does it really help? And once the 30G is reached I need to send Mikrotik-Xmit-Limit Mikrotik-Recv-Limit In a pre-auth condition right? But I am confused with the following: Mikrotik-Recv-Limit-Gigawords Mikrotik-Xmit-Limit-Gigawords I read about it. But I'm not getting the thing 32 bit and 64 bit. Maximum 4G limit we can give? Can someone help me on this. -- Best Regards, Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

1 1

Assigning ip address (FreeRadius or NAS)
by Randeep 23 Jun '15

23 Jun '15

Hi, I have a question please help. We have configured IP Pool. And the radius is sending the ip and other information. [root@localhost ~]# radtest randeep randeep123 192.168.1.182 0 lukup124 Sent Access-Request Id 70 from 0.0.0.0:38745 to 192.168.1.182:1812 length 77 User-Name = 'randeep' User-Password = 'randeep123' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = 'randeep123' Received Access-Accept Id 70 from 192.168.1.182:1812 to 0.0.0.0:0 length 86 Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.0 Framed-MTU = 1500 Framed-Routing = Broadcast-Listen Framed-Compression = Van-Jacobson-TCP-IP Service-Type = Framed-User MS-Primary-DNS-Server = 8.8.8.8 MS-Secondary-DNS-Server = 8.8.4.4 Framed-IP-Address = 192.168.1.39 [root@localhost ~]# But in this it is telling the NAS to give the IP 192.168.1.39 to the client right? NAS should have PPPoE / DHCP running in that right? Also the Private IP to Public IP nating also will happen on the NAS right? Can someone please explain how it works in the production environment Best Regards, Randeep

2 3

Unknown module "clients"
by Stefano Zanmarchi 23 Jun '15

23 Jun '15

Hello, I'm performing some filtering, based on the client, in the authorize section of inner-tunnel: authorize { preprocess rewrite.calling_station_id if ("%{clients:shortname}" =~ /internal_radius_(.*)/i) { ok update control { Auth-Type := Accept } } ... } The output logs in debug mode show the following warning: .. ++? if ("%{clients:shortname}" =~ /internal_radius_(.*)/i) WARNING: Unknown module "clients" in string expansion "%" .. Does this mean that the 'if ("%{clients:shortname}"...' clause is not being evaluated? How can I solve the problem generating the warning? Thank you, Stefano

3 3