- Freeradius-Users - lists.freeradius.org

Re: mac address in data vlan - drop
by A.L.M.Buxey＠lboro.ac.uk 19 Nov '14

19 Nov '14

Hi, > if ("%{User-Name}" =~ /^001ef7/) { > > > > update reply { > > Cisco-AVPair = "device-traffic-class=voice" rather than relying on the User-Name you might be able to do something more elegant - check the request to see if theres anything obvious/nice in it > And all works but when I plug off computer from CiscoPhone and plag in in > again, so computer mac-address is droped... because the port on the switch hasnt changed - the phone port PC has - check the phone settings for passthrough - but this isnt FreeRADIUS issue - this is all Cisco stuff. check eg http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/rel… alan

1 0

Freeradius 2.1.12-6 test issue
by Clive Allen 19 Nov '14

19 Nov '14

3 3

RE: mac address in data vlan - drop
by Alan Buxey 19 Nov '14

19 Nov '14

Cisco issue. Freeradius is sending back access-accept. Your issue sounds familiar to something I've seen with pass through before. Verify the behaviour with a change to the auth type on the switch eg multi-host alan

1 0

Use Mozilla's intermediate cipher suites set by default.
by Nick Lowe 19 Nov '14

19 Nov '14

Alan and Arran, Please may I suggest that you consider changing the default cipher suites configuration in FreeRADIUS 2.x and 3.x to use Mozilla's intermediate compatibility (default) set to encourage the use of better cipher suites that use ECDHE, GCM and PFS? See https://wiki.mozilla.org/Security/Server_Side_TLS This is: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA This is fully compatible all the way back to Windows XP where 3DES will be used. It also brings FreeRADIUS in to compliance with the very likely upcoming: https://datatracker.ietf.org/doc/draft-ietf-tls-prohibiting-rc4/ Cheers, Nick

3 11

mac address in data vlan - drop
by Bilik.AA＠lsrgroup.ru 19 Nov '14

19 Nov '14

Hello everybody! I faced such issue. When I connect CiscoPhone and a computer through it to my cisco switch port, authentication goes well (voice vlan for phone and data vlan for computer), but when I plug a computer off from Cisco Phone and plug in again, authentication is ok too but on port I see that: 1 a000xxxxxxxxxxxx DYNAMIC Drop 100 001exxxxxxxxxxxx STATIC Fa0/35 So computer can’t get access to local network. Port settings are following: --------------------------------------------------------- switchport mode access switchport nonegotiate switchport voice vlan 100 no logging event link-status authentication host-mode multi-domain authentication port-control auto authentication violation replace mab storm-control broadcast level pps 100 spanning-tree portfast spanning-tree bpduguard enable --------------------------------------------------------- How it can be fixed? (I work with freeradius-server-2.2.5 now) Thanks in advance, Alex Bilik С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image003.png@01D003E7.42ED21B0]

2 1

Version 2.2.6 has been released.
by Alan DeKok 18 Nov '14

18 Nov '14

We're happy to announce the release of Version 2.2.6. It has only minor changes from Version 2.2.5. ----------------- Feature improvements * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. Bug Fixes * Fix redundant-load-balance blocks to try other modules in the group if one fails. * Fix potential read into uninitialised memory in rlm_pap when normalising octet type attributes containing password hashes. This is very unlikely to happen in the wild. * Don't stop decoding DHCP options if we find a padding option. * Define sig_t on systems which don't have it. Closes #765 * When clients are loaded from SQL, allow them to be tied to a virtual server. * Prevent race conditions between fork and wait for child. Patch from James Rouzier. * Allow UTF-8 characters in SQL. * Back-port udpfromto fixes from v3

1 0

Update 3.0.4 to 3.0.x syntax surprises / bugs?
by Stefan Winter 17 Nov '14

17 Nov '14

Hi, some things to note: 1) one of my client definitions has an opening parenthesis in its secret (no closing), which is not a problem for 3.0.4, but in current 3.0.x I get: /usr/local/freeradius/config/raddb/clients.conf[655]: Parse error after "sdfsre": unexpected token "(" Errors reading or parsing /usr/local/freeradius/config/raddb/radiusd.conf sdfsre are the characters of the secret preceding the ( . Should such a secret now be surrounded by quotes, or is that more like a bug? 2) When running, I see that SQL queries are getting executed correctly (I see the retrieved AVPs), but the section still bails out with Query Error (and the exact same config works fine in 3.0.4). Here's a sample: rlm_sql (sql-commonauth): Reserved connection (4) (35) sql-commonauth: EXPAND (SELECT id, username, attribute, value, op FROM %{control:RESTENA-SQL-Table} WHERE username='%{SQL-User-Name}') (35) sql-commonauth: --> (SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='xxxcensoredxxx') rlm_sql (sql-commonauth): Executing query: '(SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='xxxcensoredxxx')' (35) sql-commonauth: User found in radcheck table (35) sql-commonauth: Conditional check items matched, merging assignment check items (35) sql-commonauth: RESTENA-SSHA1-Password := 'XXXV4iX9qSO8BcMxDJ6P0FNINVALIDQ1MGo1ZmNuZXJoVzWXXX==' (35) sql-commonauth: ERROR: SQL query error rlm_sql (sql-commonauth): Released connection (4) (I changed username and retrieved hash in the mail) I couldn't continue testing 3.0.x with that situation, so I'm back to 3.0.4 for now. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 4

Freeradius v2 Style Auth Log for V3 How to
by Akash 17 Nov '14

17 Nov '14

I'm using Freeradius-3.0.4, and see lots of following messages in 'radius.log' file whenever user connects/disconnects. Info: rlm_sql (sql): Closing connection (18): Hit idle_timeout, was idle for 300 second Warning: rlm_sql (sql): You probably need to lower "min" Info: rlm_sql (sql): 0 of 2 connections in use. Need more spares Info: rlm_sql (sql): Opening additional connection (21) Is there way to disable such messages, and only output Login OK, Login Failure messages, same like in version 2. Thanks

2 1

3.0.5 segmentation fault
by Lai Fu Keung 17 Nov '14

17 Nov '14

Hi, I would like to report a segmentation fault in using v3.0.5. My server syslog has the following message: Nov 14 18:18:33 machine-a kernel: radiusd[7198]: segfault at 108 ip 00007f63a5a3c023 sp 00007f639e4a9c80 error 4 in libfreeradius-server.so[7f63a5a2e000+23000] The daemon has been running for 5 days before segmentation fault and was running fine. There was no error message on radius.log except a "login OK" message right at Nov 14 18:18:33 segmentation fault time. The authentication fell back to secondary server. Hope the information is enough to trace the source of the problem. Thanks in advance. Lai

2 1

Configuring ssl-admin to include windows OIDs in the server cert
by Jasvinder S. Bahra 17 Nov '14

17 Nov '14

Hi, I've used the ssl-admin tool to generate a certificate authority certificate, a server certificate and multiple client certificates - all used to setup a FreeRadius EAP-TLS WPA2 Enterprise secured wireless network. Android devices connect to the network without any problems, but windows devices connections requests never even get passed to the freeradius daemon. After looking around on the internet as well as asking some questions on this list, I understand I have to embed the XP Extensions OIDs into the server certificate (something I have to do when actually creating the server certificate). I've found information on how to do this using the openssl command, but as i'm using the ssl-admin tool to handle certificate creation, I need to make it do the same. Has anyone had any experience in doing this? Regards, Jazz

2 1