- Freeradius-Users - lists.freeradius.org

PAP auth fails on new install/config of freeradius v 2.1.12
by John Williams 05 Mar '15

05 Mar '15

In the debug output freeradius –X I see the “WARNING: Please update your configuration and remove ‘Auth-Type = Local’” I have looked at all the config files and don’t seem to be finding Auth-Type = Local. I thought it should be found in sites-enabled/default Can someone please point me to where I’m missing that. <most of the freeradius –X> Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.24 port 43300, id=231, length=41 User-Name = "t5admin" NAS-Port = 5060 NAS-IP-Address = 192.168.1.24 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "t5admin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry t5admin at line 86 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> t5admin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 231 to 192.168.1.24 port 43300 Waking up in 4.9 seconds. Cleaning up request 1 ID 231 with timestamp +1703 Ready to process requests. TIA, John Williams -- *Thomas Edison once said, "The doctor of the future will give no medicine; instead he will interest his patients in the care of the human frame, nutrition and the cause and prevention of disease.”*

2 1

rlm_cache_memcached not installing
by Donald Sherker 05 Mar '15

05 Mar '15

I am using freeradius 3.0.7 and want to be able to use the rlm_cache_memcached driver to cache data between two servers. I have memcached, memcached-devel, libmemcached, and libmemcached-devel installed on the server. When I compile freeradius i get the following error: === configuring in ./drivers/rlm_cache_memcached (/tmp/freeradius-server-3.0.x/src/modules/rlm_cache/./drivers/rlm_cache_memcached) checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for libmemcached/memcached.h... yes checking for memcached in -lmemcached... no checking for memcached in -lmemcached in /usr/local/lib... no checking for memcached in -lmemcached in /opt/lib... no configure: WARNING: libmemcached libraries not found. Use --with-libmemcached-lib-dir=<path>. configure: WARNING: silently not building rlm_cache_memcached. configure: WARNING: FAILURE: rlm_cache_memcached requires: libmemcached . Here is the information on the memcached and libmemcached packages that are installed on the servers: ======================================================================================================== Package Arch Version Repository Size ======================================================================================================== Installing: memcached-devel x86_64 1.4.4-3.el6 base 8.8 k Installing for dependencies: memcached x86_64 1.4.4-3.el6 base 68 k ======================================================================================================== Package Arch Version Repository Size ======================================================================================================== Installing: libmemcached-devel x86_64 0.31-1.1.el6 base 116 k Installing for dependencies: libmemcached x86_64 0.31-1.1.el6 base 80 k I feel like I am missing something simple here and appreciate any help. Thanks, Don

2 1

Still battling to get FreeRadius running
by IT geek 31 05 Mar '15

05 Mar '15

Hi, When I try to run radiusd -X it hangs (no error) after instantiating the eap-tls module. I'm guessing it's having an issue with something, I just don't know what. Any thoughts? -Mark Debug output: FreeRADIUS Version 2.2.0, for host mipsel--netbsd, built on Mar 4 2015 at 18:04:29 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/pkg/etc/raddb/radiusd.conf including configuration file /usr/pkg/etc/raddb/proxy.conf including configuration file /usr/pkg/etc/raddb/clients.conf including files in directory /usr/pkg/etc/raddb/modules/ including configuration file /usr/pkg/etc/raddb/modules/acct_unique including configuration file /usr/pkg/etc/raddb/modules/always including configuration file /usr/pkg/etc/raddb/modules/attr_filter including configuration file /usr/pkg/etc/raddb/modules/attr_rewrite including configuration file /usr/pkg/etc/raddb/modules/chap including configuration file /usr/pkg/etc/raddb/modules/checkval including configuration file /usr/pkg/etc/raddb/modules/counter including configuration file /usr/pkg/etc/raddb/modules/detail including configuration file /usr/pkg/etc/raddb/modules/detail.example.com including configuration file /usr/pkg/etc/raddb/modules/detail.log including configuration file /usr/pkg/etc/raddb/modules/digest including configuration file /usr/pkg/etc/raddb/modules/echo including configuration file /usr/pkg/etc/raddb/modules/etc_group including configuration file /usr/pkg/etc/raddb/modules/exec including configuration file /usr/pkg/etc/raddb/modules/expiration including configuration file /usr/pkg/etc/raddb/modules/expr including configuration file /usr/pkg/etc/raddb/modules/files including configuration file /usr/pkg/etc/raddb/modules/inner-eap including configuration file /usr/pkg/etc/raddb/modules/ippool including configuration file /usr/pkg/etc/raddb/modules/krb5 including configuration file /usr/pkg/etc/raddb/modules/ldap including configuration file /usr/pkg/etc/raddb/modules/linelog including configuration file /usr/pkg/etc/raddb/modules/logintime including configuration file /usr/pkg/etc/raddb/modules/mac2ip including configuration file /usr/pkg/etc/raddb/modules/mac2vlan including configuration file /usr/pkg/etc/raddb/modules/mschap including configuration file /usr/pkg/etc/raddb/modules/otp including configuration file /usr/pkg/etc/raddb/modules/pam including configuration file /usr/pkg/etc/raddb/modules/pap including configuration file /usr/pkg/etc/raddb/modules/passwd including configuration file /usr/pkg/etc/raddb/modules/perl including configuration file /usr/pkg/etc/raddb/modules/policy including configuration file /usr/pkg/etc/raddb/modules/preprocess including configuration file /usr/pkg/etc/raddb/modules/radutmp including configuration file /usr/pkg/etc/raddb/modules/realm including configuration file /usr/pkg/etc/raddb/modules/smbpasswd including configuration file /usr/pkg/etc/raddb/modules/smsotp including configuration file /usr/pkg/etc/raddb/modules/sql_log including configuration file /usr/pkg/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/pkg/etc/raddb/modules/sradutmp including configuration file /usr/pkg/etc/raddb/modules/unix including configuration file /usr/pkg/etc/raddb/modules/wimax including configuration file /usr/pkg/etc/raddb/eap.conf including configuration file /usr/pkg/etc/raddb/policy.conf including files in directory /usr/pkg/etc/raddb/sites-enabled/ including configuration file /usr/pkg/etc/raddb/sites-enabled/default main { user = "radius" group = "radius" allow_core_dumps = no } including dictionary file /usr/pkg/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/pkg" localstatedir = "/var" sbindir = "/usr/pkg/sbin" logdir = "/var/log/radiusd" run_dir = "/var/run/radiusd" libdir = "/usr/pkg/lib" radacctdir = "/var/log/radiusd/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/pkg/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client ServerA { ipaddr = 192.168.1.2 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/pkg/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/pkg/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/pkg/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/pkg/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/pkg/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/pkg/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/pkg/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/pkg/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/pkg/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/pkg/etc/raddb/modules/unix unix { radwtmp = "/var/log/radiusd/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/pkg/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/pkg/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/pkg/etc/raddb/certs/server.pem" certificate_file = "/usr/pkg/etc/raddb/certs/server.pem" CA_file = "/usr/pkg/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/pkg/etc/raddb/certs/dh" random_file = "/dev/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/pkg/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } }

2 1

[Off Topic] Mysql system optimization to work with Freeradius
by Michell Antunes 05 Mar '15

05 Mar '15

Sorry for the off-topic, I have a problem with the authentication regarding the Radius with MySQL database. There are about 12k users who authenticate to 2 Radius servers and 1 MySQL. Accounting is done every 5 minutes and the IPs are in a PostgreSQL base. How much of the network is wireless during storms (I live in a tropical country) have to disconnect multiple users and when the station is restored have problems of "No DB Handles" which creates duplication of IP addresses in some cases. I have made some tests with various settings in MySQL, different file systems and when increasing the number of clients connecting to the system IO Wait begins to increase. When I make an appointment for an extract over a period of time a little bigger or my system performs the calculation of access franchise the situation worsens. See setups reports of Freeradius + MySQL in larger environments. Would advise evaluate PostgreSQL? Any suggestions to optimize the system? In the tests used a softraid (I know) and deactivated the Ext4 journaling on which gave me a good improvement. But do not feel comfortable working with the double filesystem + softraid, the more without journaling. I thank in advance the opinions on this subject. Under my system: OS: CentOS 7 Mem: 12G CPU: Xeon (R) CPU E5620 @ 2:40 BD: MariaDB 10.0.16 FS: EXT4 or XFS Raid: 10 (6 SATA disks 2TB 7200 RPM 64MB WD2003FYYS Cache SATA 3.0Gb / s) att Michell

4 3

Getting the following error - WARNING: Empty authorize section
by IT geek 31 05 Mar '15

05 Mar '15

Hi, I'm trying to do a simple PAP test on a fresh installation. When I fire up radiusd -X I get "Ready to process requests", but when I use radtest from another machine (defined in clients.conf) I get the following error: rad_recv: Access-Request packet from host 192.168.1.2 port 64983, id=105, length=74 User-Name = "test_user" User-Password = "test_pw" NAS-IP-Address = 192.168.1.2 NAS-Port = 0 Message-Authenticator = 0xb8f49c45c576d8eda5e8b0c6e4decb6c WARNING: Empty authorize section. Using default return values. ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 105 to 192.168.1.2 port 64983 Waking up in 4.9 seconds. This is a fresh build of 2.2.0 on NetBSD 5.2.2 (I can't go to 2.2.6 yet). I've not deleted anything, but my sites-enabled is empty. Should it be? As always, any help is appreciated. -Mark Full radiusd -X: FreeRADIUS Version 2.2.0, for host mipsel--netbsd, built on Mar 4 2015 at 18:04:29 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/pkg/etc/raddb/radiusd.conf including configuration file /usr/pkg/etc/raddb/proxy.conf including configuration file /usr/pkg/etc/raddb/clients.conf including files in directory /usr/pkg/etc/raddb/modules/ including configuration file /usr/pkg/etc/raddb/modules/acct_unique including configuration file /usr/pkg/etc/raddb/modules/always including configuration file /usr/pkg/etc/raddb/modules/attr_filter including configuration file /usr/pkg/etc/raddb/modules/attr_rewrite including configuration file /usr/pkg/etc/raddb/modules/chap including configuration file /usr/pkg/etc/raddb/modules/checkval including configuration file /usr/pkg/etc/raddb/modules/counter including configuration file /usr/pkg/etc/raddb/modules/detail including configuration file /usr/pkg/etc/raddb/modules/detail.example.com including configuration file /usr/pkg/etc/raddb/modules/detail.log including configuration file /usr/pkg/etc/raddb/modules/digest including configuration file /usr/pkg/etc/raddb/modules/echo including configuration file /usr/pkg/etc/raddb/modules/etc_group including configuration file /usr/pkg/etc/raddb/modules/exec including configuration file /usr/pkg/etc/raddb/modules/expiration including configuration file /usr/pkg/etc/raddb/modules/expr including configuration file /usr/pkg/etc/raddb/modules/files including configuration file /usr/pkg/etc/raddb/modules/inner-eap including configuration file /usr/pkg/etc/raddb/modules/ippool including configuration file /usr/pkg/etc/raddb/modules/krb5 including configuration file /usr/pkg/etc/raddb/modules/ldap including configuration file /usr/pkg/etc/raddb/modules/linelog including configuration file /usr/pkg/etc/raddb/modules/logintime including configuration file /usr/pkg/etc/raddb/modules/mac2ip including configuration file /usr/pkg/etc/raddb/modules/mac2vlan including configuration file /usr/pkg/etc/raddb/modules/mschap including configuration file /usr/pkg/etc/raddb/modules/otp including configuration file /usr/pkg/etc/raddb/modules/pam including configuration file /usr/pkg/etc/raddb/modules/pap including configuration file /usr/pkg/etc/raddb/modules/passwd including configuration file /usr/pkg/etc/raddb/modules/perl including configuration file /usr/pkg/etc/raddb/modules/policy including configuration file /usr/pkg/etc/raddb/modules/preprocess including configuration file /usr/pkg/etc/raddb/modules/radutmp including configuration file /usr/pkg/etc/raddb/modules/realm including configuration file /usr/pkg/etc/raddb/modules/smbpasswd including configuration file /usr/pkg/etc/raddb/modules/smsotp including configuration file /usr/pkg/etc/raddb/modules/sql_log including configuration file /usr/pkg/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/pkg/etc/raddb/modules/sradutmp including configuration file /usr/pkg/etc/raddb/modules/unix including configuration file /usr/pkg/etc/raddb/modules/wimax including configuration file /usr/pkg/etc/raddb/eap.conf including configuration file /usr/pkg/etc/raddb/policy.conf including files in directory /usr/pkg/etc/raddb/sites-enabled/ main { user = "radius" group = "radius" allow_core_dumps = no } including dictionary file /usr/pkg/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/pkg" localstatedir = "/var" sbindir = "/usr/pkg/sbin" logdir = "/var/log/radiusd" run_dir = "/var/run/radiusd" libdir = "/usr/pkg/lib" radacctdir = "/var/log/radiusd/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/pkg/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client serverA { ipaddr = 192.168.1.2 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/pkg/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/pkg/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/pkg/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/pkg/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/pkg/etc/raddb/radiusd.conf modules { } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } ... adding new socket proxy address * port 64982 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests.

2 2

Failed to link to module 'rlm_exec': file not found
by IT geek 31 05 Mar '15

05 Mar '15

Hi, I'm having trouble running FreeRadius 2.2.0 on NetBSD. I've compiled using *pkgsrc*, and it builds and installs perfectly. However, when I run radiusd -X I get the following: FreeRADIUS Version 2.2.0, for host mipsel--netbsd, built on Mar 4 2015 at 18:04:29 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/pkg/etc/raddb/radiusd.conf including configuration file /usr/pkg/etc/raddb/proxy.conf including configuration file /usr/pkg/etc/raddb/clients.conf including files in directory /usr/pkg/etc/raddb/modules/ including configuration file /usr/pkg/etc/raddb/modules/acct_unique including configuration file /usr/pkg/etc/raddb/modules/always including configuration file /usr/pkg/etc/raddb/modules/attr_filter including configuration file /usr/pkg/etc/raddb/modules/attr_rewrite including configuration file /usr/pkg/etc/raddb/modules/chap including configuration file /usr/pkg/etc/raddb/modules/checkval including configuration file /usr/pkg/etc/raddb/modules/counter including configuration file /usr/pkg/etc/raddb/modules/detail including configuration file /usr/pkg/etc/raddb/modules/detail.example.com including configuration file /usr/pkg/etc/raddb/modules/detail.log including configuration file /usr/pkg/etc/raddb/modules/digest including configuration file /usr/pkg/etc/raddb/modules/echo including configuration file /usr/pkg/etc/raddb/modules/etc_group including configuration file /usr/pkg/etc/raddb/modules/exec including configuration file /usr/pkg/etc/raddb/modules/expiration including configuration file /usr/pkg/etc/raddb/modules/expr including configuration file /usr/pkg/etc/raddb/modules/files including configuration file /usr/pkg/etc/raddb/modules/inner-eap including configuration file /usr/pkg/etc/raddb/modules/ippool including configuration file /usr/pkg/etc/raddb/modules/krb5 including configuration file /usr/pkg/etc/raddb/modules/ldap including configuration file /usr/pkg/etc/raddb/modules/linelog including configuration file /usr/pkg/etc/raddb/modules/logintime including configuration file /usr/pkg/etc/raddb/modules/mac2ip including configuration file /usr/pkg/etc/raddb/modules/mac2vlan including configuration file /usr/pkg/etc/raddb/modules/mschap including configuration file /usr/pkg/etc/raddb/modules/otp including configuration file /usr/pkg/etc/raddb/modules/pam including configuration file /usr/pkg/etc/raddb/modules/pap including configuration file /usr/pkg/etc/raddb/modules/passwd including configuration file /usr/pkg/etc/raddb/modules/perl including configuration file /usr/pkg/etc/raddb/modules/policy including configuration file /usr/pkg/etc/raddb/modules/preprocess including configuration file /usr/pkg/etc/raddb/modules/radutmp including configuration file /usr/pkg/etc/raddb/modules/realm including configuration file /usr/pkg/etc/raddb/modules/smbpasswd including configuration file /usr/pkg/etc/raddb/modules/smsotp including configuration file /usr/pkg/etc/raddb/modules/sql_log including configuration file /usr/pkg/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/pkg/etc/raddb/modules/sradutmp including configuration file /usr/pkg/etc/raddb/modules/unix including configuration file /usr/pkg/etc/raddb/modules/wimax including configuration file /usr/pkg/etc/raddb/eap.conf including configuration file /usr/pkg/etc/raddb/policy.conf including files in directory /usr/pkg/etc/raddb/sites-enabled/ main { user = "radius" group = "radius" allow_core_dumps = no } including dictionary file /usr/pkg/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/pkg" localstatedir = "/var" sbindir = "/usr/pkg/sbin" logdir = "/var/log/radiusd" run_dir = "/var/run/radiusd" libdir = "/usr/pkg/lib" radacctdir = "/var/log/radiusd/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/pkg/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { /usr/pkg/etc/raddb/modules/exec[24]: Failed to link to module 'rlm_exec': file not found The file */usr/pkg/etc/raddb/modules/exec* does indeed exist, and is owned by radius:radius and is chmod 640. The end-game is to get this authenticating Wireless EAP clients. I'd just to get it running so I can test PAP authentication first :-) Any help is greatly appreciated! -Mark

2 6

freeradius and the current date
by Graham Leggett 05 Mar '15

05 Mar '15

Hi all, I am looking to perform an LDAP search in freeradius that includes the option to specify users that have not expired, where expiry is contained an a standard LDAP attribute. Something similar to this: (&(uid=%{User-Name})(myExpiryTimestamp>=%{[TIMESTAMP_NOW]})) (In other words, I am looking for a suitable unlang attribute that represents “time now on radius server”) The closest I’ve found are these deprecated one character variables as follows: http://wiki.freeradius.org/config/Run%20time%20variables Unfortunately they are marked as deprecated with no indication of what replaces them. The source code for rlm_date seems to indicate that date formatting is possible, but there is no functionality that I can see to provide the current date, which is a shame. Should this module be a good place for this kind of functionality or should I be looking somewhere else for this? Regards, Graham —

4 7

Unable to use regexp in virtual server
by "RESTOUX, Loïc" 05 Mar '15

05 Mar '15

Hi everyone, I checked out the 3.0.x branch this morning, and I can't get it working. Part of the configuration is: authorize { [...] foreach Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /^circuit-id-tag=(.+)/ ) { <do something> } } [...] } The startup fails with the following error: <file>[38]: Invalid regular expression: <file>[38]: ^circuit-id-tag=(.+) <file>[38]: ^ Apparently, the failure comes from the computation of the size of the pattern. regex_compile() tries to find a NULL value in the 23 characters of the regexp, when obviously the length of the pattern is only 20. Am I missing something in the syntax of the virtual server configuration ? -- LRS This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 1

policy filter_username
by Maja Wolniewicz 05 Mar '15

05 Mar '15

Hello, I have a problem with the filter_username policy in FR 3.0.7 The rules checking double dots and starting / ending dot evaluate to TRUE for a correct username (2) User-Name = 'mgw(a)umk.pl' (2) NAS-IP-Address =... ... (2) # Executing section authorize from file /opt/FR/etc/raddb/sites-enabled/default-umk (2) authorize { (2) policy filter_username { (2) if (!&User-Name) { (2) if (!&User-Name) -> FALSE (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@.*@/ ) { (2) if (&User-Name =~ /@.*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> TRUE (2) if (&User-Name =~ /\.\./ ) { (2) update reply { (2) &Reply-Message += 'Rejected: Username contains ..s' (2) } # update reply = noop (2) [reject] = reject (2) } # if (&User-Name =~ /\.\./ ) = reject (2) } # policy filter_username = reject .. (2) Invalid user: [mgw(a)umk.pl] (from client ... ) Maja -- Maja Gorecka-Wolniewicz mgw(a)umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574

4 6

Challenge-Response in the server
by Alan DeKok 05 Mar '15

05 Mar '15

I’ve added a new virtual server: raddb/sites-available/challenge It implements a sample Challenge-Response protocol in the server. It requires the v3.0.x branch, and won’t work for 3.0.7 unfortunately. This example can be used to create “home brewed” one-time password systems. Alan DeKok.

2 1