- Freeradius-Users - lists.freeradius.org

Difference in escaping character
by Peter Balsianok 23 Apr '15

23 Apr '15

Hi, I have compared reply attributes between version 2.2.6 & 3.0.8 ( for the same request), i found little difference for Cisco-AVPair attribute (escaping \\n vs \n). Is it correct ? Debug log (version 3.0.8): ... (0) perl: &reply:Cisco-AVPair += $RAD_REPLY{'Cisco-AVPair'} -> 'lcp:interface-config=ip vrf forwarding TOPVAR \nip unnumbered Loopback1' (0) perl: &reply:Cisco-AVPair += $RAD_REPLY{'Cisco-AVPair'} -> 'ip:dns-servers=10.248.136.20 10.18.86.16' ... (0) [perl] = ok (0) } # post-auth = ok (0) Login OK: [421908290143@TOPVAR/<CHAP-Password>] (from client localhost port 2197 cli 421908290143) (0) Sent Access-Accept Id 173 from 127.0.0.1:1812 to 127.0.0.1:36008 length 0 (0) Framed-IP-Netmask = 255.255.255.255 (0) Framed-IP-Address = 172.30.72.54 (0) Cisco-AVPair += 'lcp:interface-config=ip vrf forwarding TOPVAR \\nip unnumbered Loopback1' (0) Cisco-AVPair += 'ip:dns-servers=10.248.136.20 10.18.86.16' (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) Finished request Debug log (version 2.2.6): +group post-auth { ... rlm_perl: Added pair Cisco-AVPair = lcp:interface-config=ip vrf forwarding TOPVAR \nip unnumbered Loopback1 rlm_perl: Added pair Cisco-AVPair = ip:dns-servers=10.248.136.20 10.18.86.16 ++[perl] = ok +} # group post-auth = ok Sending Access-Accept of id 3 to 127.0.0.1 port 40061 Cisco-AVPair += "lcp:interface-config=ip vrf forwarding TOPVAR \nip unnumbered Loopback1" Cisco-AVPair += "ip:dns-servers=10.248.136.20 10.18.86.16" Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 172.30.72.54 Framed-IP-Netmask = 255.255.255.255 Finished request 0. Thank you very much

2 2

debug level
by Peter Balsianok 23 Apr '15

23 Apr '15

Hi, Is it possible to get current debug level in unlang ? Is it possible (in rlm_perl) ? config { debug_level = [get current debug level] } Thx.

2 3

SASL
by Brendan Kearney 22 Apr '15

22 Apr '15

i see that in 3.0.7 SASL binds were introduced and that non-interactive methods are available. does this mean kerberos5 or gssapi methods can be used? does this mean that the keytab i have for the krb5 module can be used by the ldap module to bind to the directory? thanks, brendan

2 3

Version 2.2.7 has been released
by Alan DeKok 22 Apr '15

22 Apr '15

We've also release version 2.2.7. The ChangeLog is short. We hope that this will be the last release of the version 2 software. From now on, the only changes to version 2 will be security fixes, and critical bug fixes. We hope that everyone upgrades to version 3 over the next year. FreeRADIUS 2.2.7 Wednesday 22 Apr 2014 14:00:00 EST, urgency=medium Feature improvements * Allow "eap" to be listed in Post-Auth-Type Reject so that it sends EAP-Fail and Message-Authenticator. Bug fixes * Fix typo in code checking for blocked threads. Closes #880. * Added more $(EXEEXT) to module utilities so that it builds on Cygwin. Closes #875. * Note that we don't need to generate ephemeral RSA keys. * Port detail file fixes from v3. * Use correct destination port for replies to DHCP relay. * rlm_perl can store multiple tagged attributes of the same name. * Update EAP-TLS methods for TLSv1.2 * Fix load-balance sections. Closes #945

1 0

attr_filter rule evaluation
by Gerald Vogt 22 Apr '15

22 Apr '15

Hi! >From the documentation I find it a little bit confusing how filter rules work exactly. The manual page rlm_attr_filter says: "The rules for each entry are parsed to top to bottom, and an attribute must pass *all* the rules which affect it in order to make it past the filter." The post-proxy file contains this: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, ... But if it has to pass all the rules doesn't that mean that Service-Type and Login-Service are basically always filtered out because, for instance, for a single valued Service-Type attribute either the first or second rule will always fail. And as there is always one rule failing it will never make it past the filter. Thanks, Gerald

2 4

Re: Freeradius-Users Digest, Vol 120, Issue 91
by Rui Ribeiro 22 Apr '15

22 Apr '15

Yes, use the git for now. I can confirm I never used in production 3.0.7 because of this issue, and the git 3.0.8 has been rock solid for a while and seems to be faster too. > > > Message: 3 > Date: Wed, 22 Apr 2015 06:49:19 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: dynamic expansion will not be dynamically expanded in > ldap configuration > Message-ID: <0B8AC4C2-9E60-4C66-9DDA-DED45F33948B(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Apr 22, 2015, at 3:19 AM, Angel L. Mateo <amateo(a)um.es> wrote: > > I'm trying to configure ldap module for freeradius. For group > membership I have this configuration: > > > > membership_filter = "(&(uid=%{User-Name})(objectClass=posixAccount))" > > > > but whenever I start freeradius, I get the error > > > > /etc/freeradius/mods-enabled/ldap[176]: Found dynamic expansion in > string which will not be dynamically expanded > > It's an issue which was fixed, and will be in 3.0.8. > > Alan DeKok. > > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

Time users
by sandy.napoles＠eccmg.cupet.cu 22 Apr '15

22 Apr '15

Hello list, Iam using freeradius with Active directory. Everythings is ok. but I need to put time users, example only connect at a specific time. I try to put it in iptables rules, but when I put this rules nobody can connect. example $IPTABLES -A OUTPUT -d x.x.x.x -p tcp -m multiport --sports 1812,1813 -m time --timestart 00:00 --timestop 20:00 --weekdays Sun,Mon,Tue,Wed,Thu,Fri,Sat -j ACCEPT Thereis some file in freeradius that make it..???

2 1

buffered-sql pool_interval
by Marcin 22 Apr '15

22 Apr '15

Hi, Are there any solution to increas pool_interval up to 300s? -- Pozdrawiam Marcin / nicraM

2 4

Access Challenge (11) reply
by Olivier Nicole 22 Apr '15

22 Apr '15

Hello, My FreeRadius 2.2 is trying to proxy authentication to another radius server, but the reply I get is Access Challenge (11). I tried to google for that error but really get nothing. Here a tcpdump of the dialogue: 14:16:13.266719 00:0c:29:34:75:1c (oui Unknown) > f0:4d:a2:0c:0f:a3 (oui Unknown), ethertype IPv4 (0x0800), length 198: ldap.cs.ait.ac.th.1647 > eduroam-th.uni.net.th.radius: RADIUS, Access Request (1), id: 0x3b length: 156 0x0000: 4500 00b8 65a8 0000 4011 703a c029 aa06 E...e...@.p:.).. 0x0010: ca1c 7006 066f 0714 00a4 a508 013b 009c ..p..o.......;.. 0x0020: 346b 4b04 1c8b 6239 fe62 aecb faf8 f099 4kK...b9.b...... 0x0030: 0116 6775 6573 742d 6169 7440 756e 692e ..guest-ait@uni. 0x0040: 6e65 742e 7468 etc. hidden forsecurity net.th etc. 14:16:13.271033 f0:4d:a2:0c:0f:a3 (oui Unknown) > 00:0c:29:34:75:1c (oui Unknown), ethertype IPv4 (0x0800), length 109: eduroam-th.uni.net.th.radius > ldap.cs.ait.ac.th.1647: RADIUS, Access Challenge (11), id: 0x3b length: 67 0x0000: 4500 005f 1f3c 0000 3b11 bbff ca1c 7006 E.._.<..;.....p. 0x0010: c029 aa06 0714 066f 004b 7aea 0b3b 0043 .).....o.Kz..;.C 0x0020: a618 0ac0 99f6 2162 8997 7996 d6bc b5b7 ......!b..y..... 0x0030: 4f08 0102 0006 1920 5012 e641 225b 62b6 O.......P..A"[b. 0x0040: 9910 a5ed e9e7 6a4a fbad 1812 3dfc 0c96 ......jJ....=... 0x0050: 3dfe 1591 41d5 e623 3bab acf5 2103 30 =...A..#;...!.0 The other party seems even more cluless than I am so I really don't know where to seek for enlightment. Thanks in advance, Olivier --

2 1

802.1x with Cisco wireless controller
by Mohammad H. Al Shami 21 Apr '15

21 Apr '15

Hi all, I have been asked to integrate our Cisco WLC2504 wireless controller with Active Directory through LDAP. It is currently working well with Microsoft's radius server. For some reason while running radiusd -X, I can see the requests coming from the access controller but nothing happens after a "Sent Access-Challenge" message. But if I wait some time without doing anything, the authentication works. What is puzzling me is the fact that the connection sometimes works but not always, also, I got a TP-Link running OpenWRT and set up WiFi to work with the same radius setup. It works properly. Am I missing anything guys? Here are the client sections for both client cisco { ipaddr = 192.168.0.240 secret = 123456 nas_type = cisco } client openwrt { ipaddr = 192.168.0.33 secret = 123456 }

6 12