- Freeradius-Users - lists.freeradius.org

Version 3.0.5 has been released
by Alan DeKok 21 Nov '14

21 Nov '14

We've added loads more regression tests, and a few nice features. Release notes are here: http://freeradius.org/version3.html * many more parts of the configuration are syntax checked when the server starts. * The detail file reader can now read a partial detail file, and then continue from where it left off * The couchbase module supports loading of dynamic clients * Better decoding of unknown VSAs * allow TLSv1.1 and TLSv1.2 in EAP. These can be selectively disabled. Other RADIUS implementations are doing the same. * escaping is now fixed. See "radiusd.conf", the "correct_escapes" setting. The last one is nice. It means you no longer need to use \\\\\\\\ in places. Just one escaping is good enough. Alan DeKok.

2 1

RE: Compare request:Calling-Station-Id with control:Calling-Station-Id
by Stabla, Daniel 21 Nov '14

21 Nov '14

The debug output (generated with radiusd -X ) says "everything" is fine. Maybe you will see an error/mistake anywhere: radiusd: FreeRADIUS Version 3.0.4, for host x86_64-unknown-linux-gnu, built on Nov 13 2014 at 15:39:48 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /tmp/test/share/freeradius/dictionary including dictionary file /tmp/test/share/freeradius/dictionary.dhcp including dictionary file /tmp/test/share/freeradius/dictionary.vqp including dictionary file /tmp/test/etc/raddb/dictionary including configuration file /tmp/test/etc/raddb/radiusd.conf including configuration file /tmp/test/etc/raddb/proxy.conf including configuration file /tmp/test/etc/raddb/clients.conf including files in directory /tmp/test/etc/raddb/mods-enabled/ including configuration file /tmp/test/etc/raddb/mods-enabled/detail including configuration file /tmp/test/etc/raddb/mods-enabled/cache_eap including configuration file /tmp/test/etc/raddb/mods-enabled/files including configuration file /tmp/test/etc/raddb/mods-enabled/exec including configuration file /tmp/test/etc/raddb/mods-enabled/digest including configuration file /tmp/test/etc/raddb/mods-enabled/radutmp including configuration file /tmp/test/etc/raddb/mods-enabled/dynamic_clients including configuration file /tmp/test/etc/raddb/mods-enabled/always including configuration file /tmp/test/etc/raddb/mods-enabled/expiration including configuration file /tmp/test/etc/raddb/mods-enabled/attr_filter including configuration file /tmp/test/etc/raddb/mods-enabled/realm including configuration file /tmp/test/etc/raddb/mods-enabled/eap including configuration file /tmp/test/etc/raddb/mods-enabled/logintime including configuration file /tmp/test/etc/raddb/mods-enabled/pap including configuration file /tmp/test/etc/raddb/mods-enabled/chap including configuration file /tmp/test/etc/raddb/mods-enabled/preprocess including configuration file /tmp/test/etc/raddb/mods-enabled/expr including configuration file /tmp/test/etc/raddb/mods-enabled/mschap including configuration file /tmp/test/etc/raddb/mods-enabled/echo including configuration file /tmp/test/etc/raddb/mods-enabled/cache including configuration file /tmp/test/etc/raddb/mods-enabled/passwd including files in directory /tmp/test/etc/raddb/policy.d/ including configuration file /tmp/test/etc/raddb/policy.d/filter including configuration file /tmp/test/etc/raddb/policy.d/control including configuration file /tmp/test/etc/raddb/policy.d/canonicalization including configuration file /tmp/test/etc/raddb/policy.d/eap including configuration file /tmp/test/etc/raddb/policy.d/debug including configuration file /tmp/test/etc/raddb/policy.d/dhcp including configuration file /tmp/test/etc/raddb/policy.d/operator-name including configuration file /tmp/test/etc/raddb/policy.d/accounting including configuration file /tmp/test/etc/raddb/policy.d/cui including files in directory /tmp/test/etc/raddb/sites-enabled/ including configuration file /tmp/test/etc/raddb/sites-enabled/inner-tunnel including configuration file /tmp/test/etc/raddb/sites-enabled/default main { security { allow_core_dumps = no } } main { name = "radiusd" prefix = "/tmp/test" localstatedir = "/tmp/test/var" sbindir = "/tmp/test/sbin" logdir = "/tmp/test/var/log/radius" run_dir = "/tmp/test/var/run/radiusd" libdir = "/tmp/test/lib" radacctdir = "/tmp/test/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/tmp/test/var/run/radiusd/radiusd.pid" checkrad = "/tmp/test/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> shortname = "localhost" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_detail # Instantiating module "detail" from file /tmp/test/etc/raddb/mods-enabled/detail detail { filename = "/tmp/test/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_cache # Instantiating module "cache_eap" from file /tmp/test/etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_files # Instantiating module "files" from file /tmp/test/etc/raddb/mods-enabled/files files { filename = "/tmp/test/etc/raddb/mods-config/files/authorize" usersfile = "/tmp/test/etc/raddb/mods-config/files/authorize" acctusersfile = "/tmp/test/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/tmp/test/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /tmp/test/etc/raddb/mods-config/files/authorize [/tmp/test/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /tmp/test/etc/raddb/mods-config/files/authorize [/tmp/test/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /tmp/test/etc/raddb/mods-config/files/accounting reading pairlist file /tmp/test/etc/raddb/mods-config/files/pre-proxy # Instantiating module "radius-station-init" from file /tmp/test/etc/raddb/mods-enabled/files files radius-station-init { usersfile = "/tmp/test/etc/raddb/radius-station-init" compat = "cistron" key = "%{Calling-Station-Id}" } reading pairlist file /tmp/test/etc/raddb/radius-station-init reading pairlist file /tmp/test/etc/raddb/radius-station-allow reading pairlist file /tmp/test/etc/raddb/radius-station-ids reading pairlist file /tmp/test/etc/raddb/radius-station-mac [/tmp/test/etc/raddb/radius-station-init]:5 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/radius-station-init]:7 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/radius-station-init]:25 Cistron compatibility checks for entry dstabla ... [/tmp/test/etc/raddb/radius-station-init]:5 Cistron compatibility checks for entry 11aa22-bb33cc ... [/tmp/test/etc/raddb/radius-station-init]:10 Cistron compatibility checks for entry DEFAULT ... # Loaded module rlm_exec # Instantiating module "exec" from file /tmp/test/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_digest # Instantiating module "digest" from file /tmp/test/etc/raddb/mods-enabled/digest # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /tmp/test/etc/raddb/mods-enabled/radutmp radutmp { filename = "/tmp/test/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /tmp/test/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_always # Instantiating module "reject" from file /tmp/test/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /tmp/test/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /tmp/test/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /tmp/test/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /tmp/test/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /tmp/test/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /tmp/test/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /tmp/test/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /tmp/test/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_expiration # Instantiating module "expiration" from file /tmp/test/etc/raddb/mods-enabled/expiration # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /tmp/test/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/tmp/test/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /tmp/test/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /tmp/test/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/tmp/test/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /tmp/test/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /tmp/test/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/tmp/test/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /tmp/test/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /tmp/test/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/tmp/test/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /tmp/test/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /tmp/test/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/tmp/test/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /tmp/test/etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_realm # Instantiating module "IPASS" from file /tmp/test/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /tmp/test/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /tmp/test/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /tmp/test/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_eap # Instantiating module "eap" from file /tmp/test/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/radiusd/certs/" pem_file_type = yes private_key_file = "/etc/radiusd/certs/radius.pem" certificate_file = "/etc/radiusd/certs/radius.pem" private_key_password = <<< secret >>> dh_file = "/etc/radiusd/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_logintime # Instantiating module "logintime" from file /tmp/test/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_pap # Instantiating module "pap" from file /tmp/test/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_chap # Instantiating module "chap" from file /tmp/test/etc/raddb/mods-enabled/chap # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /tmp/test/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/tmp/test/etc/raddb/mods-config/preprocess/huntgroups" hints = "/tmp/test/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /tmp/test/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /tmp/test/etc/raddb/mods-config/preprocess/hints # Loaded module rlm_expr # Instantiating module "expr" from file /tmp/test/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_mschap # Instantiating module "mschap" from file /tmp/test/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Instantiating module "echo" from file /tmp/test/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{Calling-Station-Id}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "cache" from file /tmp/test/etc/raddb/mods-enabled/cache cache { key = "%{User-Name}" ttl = 10 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /tmp/test/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no } # modules radiusd: #### Loading Virtual Servers #### server { # from file /tmp/test/etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /tmp/test/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server default { # from file /tmp/test/etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server default2 { # from file /tmp/test/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} } # server default2 radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = * port = 1645 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address :: port 1812 as server default Listening on acct address :: port 1813 as server default Listening on auth address * port 1645 as server default2 Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 57043 Ready to process requests Received Access-Request Id 168 from 192.168.0.1:3072 to 192.168.0.240:1812 length 200 User-Name = 'dstabla' Service-Type = Framed-User NAS-IP-Address = 192.168.0.1 NAS-Port = 1 NAS-Port-Id = '1' Called-Station-Id = 'XX-XX-XX-XX-XX-XX:WLAN TEST' Calling-Station-Id = '11-22-33-44-55-66' Connect-Info = 'CONNECT 144 Mbps 802.11g/n' NAS-Identifier = 'wpa' NAS-Port-Type = Wireless-802.11 Framed-MTU = 1500 EAP-Message = 0x0201000f015a445c64737461626c61 Message-Authenticator = 0x8e155265de6f1dee6dbfd87f96ab73af (0) Received Access-Request packet from host 192.168.0.1 port 3072, id=168, length=200 (0) User-Name = 'dstabla' (0) Service-Type = Framed-User (0) NAS-IP-Address = 192.168.0.1 (0) NAS-Port = 1 (0) NAS-Port-Id = '1' (0) Called-Station-Id = 'XX-XX-XX-XX-XX-XX:WLAN TEST' (0) Calling-Station-Id = '11-22-33-44-55-66' (0) Connect-Info = 'CONNECT 144 Mbps 802.11g/n' (0) NAS-Identifier = 'wpa' (0) NAS-Port-Type = Wireless-802.11 (0) Framed-MTU = 1500 (0) EAP-Message = 0x0201000f015a445c64737461626c61 (0) Message-Authenticator = 0x8e155265de6f1dee6dbfd87f96ab73af (0) # Executing section authorize from file /tmp/test/etc/raddb/sites-enabled/default (0) authorize { (0) EXPAND %{control:Calling-Station-Id} (0) --> #<=============================== missing, should be known from radius-station-ids (0) EXPAND %{control:NAS-Identifier} (0) --> #<=============================== missing, should be known from radius-station-ids (0) EXPAND %{request:Calling-Station-Id} (0) --> 11-22-33-44-55-66 (0) if (&request:Calling-Station-Id == &control:Calling-Station-Id) (0) if (&request:Calling-Station-Id == &control:Calling-Station-Id) -> FALSE (0) else else { (0) [reject] = reject (0) } # else else = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /tmp/test/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> dstabla (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Request was previously rejected, inserting EAP-Failure (0) [eap] = updated (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sending Access-Reject packet to host 192.168.0.1 port 3072, id=168, length=0 (0) EAP-Message = 0x04010004 (0) Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Reject Id 168 from 192.168.0.240:1812 to 192.168.0.1:3072 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds.

3 2

ERROR at testing freeradius
by Tania Romero 20 Nov '14

20 Nov '14

This is the first time I install and test Freeradius. This is the version of freeradius: -- freeradius -v freeradius: FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Feb 24 2014 at 15:16:51 Copyright (C) 1999-2010 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. This user is one of the default users, and I just uncommented that user line in /etc/freeradius/users: ******************************************************************************* # # Please read the documentation file ../doc/processing_users_file, # or 'man 5 users' (after installing the server) for more information. # # This file contains authentication security and configuration # information for each user. Accounting requests are NOT processed # through this file. Instead, see 'acct_users', in this directory. # # The first field is the user's name and can be up to # 253 characters in length. This is followed (on the same line) with # the list of authentication requirements for that user. This can # include password, comm server name, comm server port number, protocol # type (perhaps set by the "hints" file), and huntgroup name (set by # the "huntgroups" file). # # If you are not sure why a particular reply is being sent by the # server, then run the server in debugging mode (radiusd -X), and # you will see which entries in this file are matched. # # When an authentication request is received from the comm server, # these values are tested. Only the first match is used unless the # "Fall-Through" variable is set to "Yes". # # A special user named "DEFAULT" matches on all usernames. # You can have several DEFAULT entries. All entries are processed # in the order they appear in this file. The first entry that # matches the login-request will stop processing unless you use # the Fall-Through variable. # # If you use the database support to turn this file into a .db or .dbm # file, the DEFAULT entries _have_ to be at the end of this file and # you can't have multiple entries for one username. # # Indented (with the tab character) lines following the first # line indicate the configuration values to be passed back to # the comm server to allow the initiation of a user session. # This can include things like the PPP configuration values # or the host to log the user onto. # # You can include another `users' file with `$INCLUDE users.other' # # # For a list of RADIUS attributes, and links to their definitions, # see: # # http://www.freeradius.org/rfc/attributes.html # # # Deny access for a specific user. Note that this entry MUST # be before any other 'Auth-Type' attribute which results in the user # being authenticated. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #lameuser Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # Deny access for a group of users. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # steve Cleartext-Password := "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP # # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. # #"John Doe" Cleartext-Password := "hello" # Reply-Message = "Hello, %{User-Name}" # # Dial user back and telnet to the default host for that port # #Deg Cleartext-Password := "ge55ged" # Service-Type = Callback-Login-User, # Login-IP-Host = 0.0.0.0, # Callback-Number = "9,5551212", # Login-Service = Telnet, # Login-TCP-Port = Telnet # # Another complete entry. After the user "dialbk" has logged in, the # connection will be broken and the user will be dialed back after which # he will get a connection to the host "timeshare1". # #dialbk Cleartext-Password := "callme" # Service-Type = Callback-Login-User, # Login-IP-Host = timeshare1, # Login-Service = PortMaster, # Callback-Number = "9,1-800-555-1212" # # user "swilson" will only get a static IP number if he logs in with # a framed protocol on a terminal server in Alphen (see the huntgroups file). # # Note that by setting "Fall-Through", other attributes will be added from # the following DEFAULT entries # #swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.65, # Fall-Through = Yes # # If the user logs in as 'username.shell', then authenticate them # using the default method, give them shell access, and stop processing # the rest of the file. # #DEFAULT Suffix == ".shell" # Service-Type = Login-User, # Login-Service = Telnet, # Login-IP-Host = your.shell.machine # # The rest of this file contains the several DEFAULT entries. # DEFAULT entries match with all login names. # Note that DEFAULT entries can also Fall-Through (see first entry). # A name-value pair from a DEFAULT entry will _NEVER_ override # an already existing name-value pair. # # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. # #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.32+, # Fall-Through = Yes #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft" # Framed-IP-Address = 192.168.2.32+, # Fall-Through = Yes # # Sample defaults for all framed connections. # #DEFAULT Service-Type == Framed-User # Framed-IP-Address = 255.255.255.254, # Framed-MTU = 576, # Service-Type = Framed-User, # Fall-Through = Yes # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected # by the terminal server in which case there may not be a "P" suffix. # The terminal server sends "Framed-Protocol = PPP" for auto PPP. # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. # DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for SLIP: dynamic IP address, SLIP mode. # DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # # Last default: rlogin to our main server. # #DEFAULT # Service-Type = Login-User, # Login-Service = Rlogin, # Login-IP-Host = shellbox.ispdomain.com # # # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Administrative-User # On no match, the user is denied access. ******************************************************************************* I have a terminal where I see the debugging messages, and another where I entered the following commands: -- radtest steve testing 127.0.0.1 0 testing123 This is the outcome: Sending Access-Request Id 79 from 0.0.0.0:37440 to 127.0.0.1:1812 User-Name = 'steve' User-Password = 'testing' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Reject Id 79 from 127.0.0.1:1812 to 127.0.0.1:37440 length 20 (0) -: Expected Access-Accept got Access-Reject In the debug console, this is the result: ******************************************************************************* rad_recv: Access-Request packet from host 127.0.0.1 port 37440, id=79, length=75 User-Name = "steve" User-Password = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x57890edab06058e2770c96eea02e0d0a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> steve attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 22 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 22 Sending Access-Reject of id 79 to 127.0.0.1 port 37440 Waking up in 4.9 seconds. Cleaning up request 22 ID 79 with timestamp +9927 Ready to process requests. ******************************************************************************* I'm not sure if that's the file where I have to enable the "steve" user, because for what I've read this line: ++[files] returns noop Indicates that Freeradius hasn't found my user configuration. Is it possible that I've been configuring the wrong file? Any other ideas of why Freeradius keeps rejecting my request?

4 4

Re:NAP
by Zulzig 20 Nov '14

20 Nov '14

Hey Alan, i have tested your suggestion, but i'm in front of the same bug, that i said in my last message. the radius server send to the switch the incorrect information.. it send the last valor instead of to use the new. may be i need to upgrade my version to the 2.2.5 or I missed something. thank

2 1

RE:NAP with Freeradius
by Zulzig 20 Nov '14

20 Nov '14

Hey Alan, i have tested your suggestion, but i'm in front of the same bug, that i said in my last message. the radius server send to the switch the incorrect information.. it send the last valor instead of to use the new. may be i need to upgrade my version to the 2.2.5 or I missed something. thank

1 0

Compare request:Calling-Station-Id with control:Calling-Station-Id
by Stabla, Daniel 20 Nov '14

20 Nov '14

Hello, we have a problem that the check if (&request:Calling-Station-Id == &control:Calling-Station-Id) fails, because control:Calling-Station-Id is empty in freeradius 3.0.x. We have a file which contains a list like this one: userXNAS-Identifier =~ "someAP*", Calling-Station-Id += "00-11-22-33-44-55" userX2NAS-Identifier =~ "someAP*", Calling-Station-Id += "00-12-23-34-45-56" and this works well with checkval on freeradius 2.x So what do we need to get this to work with freeradius 3.x ? Kind regards. D. Stabla

2 1

Comments before 3.0.5?
by Alan DeKok 20 Nov '14

20 Nov '14

We're going to release 3.0.5 soon. Please double-check that there are no last-minute issues. We've added a large number of regression tests to the source. They can't catch everything. So some manual double-checking is useful. Alan DeKok.

2 1

Freeradius version 2.1.12 with TTLS support
by Prasad Jadhav 20 Nov '14

20 Nov '14

Hi, I configured the freeradius version 2.1.12 with TTLS support. Note: for testing purpose using self signed certificate having following question 1. do I need to create certificate for per client machine base or per client username base. 2. Which certificates need to install on client side (OS: Windows 8) for TTLS Regards, Prasad Jadhav Alepo Technologies Pvt. Ltd. www.alepo.com<https://west.exch021.serverdata.net/owa/redir.aspx?C=519fb39324ec491582fa0b…> [Description: Description: cid:image001.png@01CAF37B.1103A920] _____________________________ Office: +91 22 61085000 Extn - 217 Skype ID : prasad9920 ________________________________ This email (message and any attachment) is confidential and may be privileged. If you are not certain that you are the intended recipient, please notify the sender immediately by replying to this message, and delete all copies of this message and attachments. Any other use of this email by you is prohibited. ________________________________

1 0

Error in user authentication : Freeradius + MySQL - Failed to create the pair: Invalid vendor name in attribute name "Password"
by Karuppasamy, Senthil 19 Nov '14

19 Nov '14

Hi, Followed the diff forum threads and have managed to link the Freeradius to look for users from a Mysql DB but am still not able to successfully authenticate users in this setup.I get the following error on receiving a user request Received Access-Request Id 24 from 10.127.6.21:59169 to 10.127.6.244:1645 length 76 User-Name = 'test' User-Password = 'test' NAS-IP-Address = 10.127.6.21 Service-Type = Administrative-User Calling-Station-Id = '10.120.92.40' NAS-Port-Type = Virtual (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "test", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop (1) sql : EXPAND %{User-Name} (1) sql : --> test (1) sql : SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (1) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id desc (1) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc' rlm_sql: Failed to create the pair: Invalid vendor name in attribute name "Password" rlm_sql (sql): Error parsing user data from database result (1) ERROR: sql : SQL query error But the user exists in the DB as we can see from the following output : SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc; +----+----------+-----------+-------+----+ | id | username | attribute | value | op | +----+----------+-----------+-------+----+ | 2 | test | Password | test | := | | 1 | test | Auth-Type | Local | := | +----+----------+-----------+-------+----+ 2 rows in set (0.00 sec) I have attached the configuration files along with this mail. Any help in this would be very much appreciated. Senthil KSK ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

4 12

Verify Certificate
by Munroe Sollog 19 Nov '14

19 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When using 802.1x to authenticate clients to Active Directory using PEAP. It seems that even when using a complete trust chain for a certificate (a real honest-to-god certificate) the clients still get prompted to 'verify' the certificate. It would seem like this behavior is by design, as the user is still expected to confirm that the certificate is what they expect to see (similar to how ssh works). Setting aside the common user doesn't do any of that checking, and setting aside a managed computer environment (Active directory) can side load the certificate on the client automatically. Is my experience accurate, and if so how do people deal with this annoyance that I feel is perpetuating the 'ignore certificate alerts' behavior normal users have? For reference I have posted images of the certificate alert. http://i.imgur.com/gNOpBJ0.jpg - -- Munroe Sollog LTS - Network Analyst x85002 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJUbLTRAAoJEPbbZiWCKDVC1JcIAIYRcVbBVEyX1JvtboawuQBb bl14QohEhGg0W0dXbckaKXjJSZNoztvUXe1k/ckBlb6kG5v6uGZoOuEoLF11VrNT ISRYcJf3lBzFK4xg1ZABC8jVzpgS2a+UiGs0YmafuyvY6+hQAnvveVp1S8OtCs6I SsZtCUR4phxHvonUN/gKAYL2kaGKQcKDGED47hzXop3a/iUM63eFm1L9vz331lCr x9t9yN+yZTeJcfGPvJRd4AV03ALWgmnq9RbGcmMGvWpRXN9XpdDmtrgh4ml2RtcG 5JIkuxm4PtrxcVprRRzsQJCSv2Vejc8lJ8LsyuepoAFBw2pc6r18/MSRLvAwE6k= =H44Y -----END PGP SIGNATURE-----

1 0