- Freeradius-Users - lists.freeradius.org

Re: groupreply attribute was override
by chenjiang 14 Nov '14

14 Nov '14

1 0

rlm_cache - WebScale 2.0
by Arran Cudbard-Bell 13 Nov '14

13 Nov '14

The rlm_cache module in master (what will become v3.1.x) has been rewritten internally to support drivers in a similar way to the rlm_sql module. The standard rlm_cache_rbtree driver is still present and works as it did before (I wrote tests to verify that). But there's also a new driver rlm_cache_memcached which integrates rlm_cache with memcached. Using a memcached allows cache state to be shared between multiple radius daemons. It also allows the cache to persist across restarts, which is useful if the cache is critical to the server's performance. The rewritten rlm_cache module behaves in a similar way as before, but with some minor differences in return codes (it will return OK instead of UPDATED, unless it copied a cached entry into the request). It also no longer merges the new cache entry by default, though that can be re-enabled with &control:Cache-Merge := 'yes'. The new behaviour is documented in mods-available/cache. Let me know if you feel any additional libmemcached knobs need exposing. Note: Because of the return code changes, the new cache code will not be merged into v3.0.x as it may break existing installations. --- Whilst investigating cache related things, I found a page on serializing the state of an SSL session in progress. This is potentially interesting for EAP as it would allow the EAP state to be shared between multiple clustered RADIUS servers (allowing for dumb load balancing, and failover). memcached certainly has the throughput to support being used in such a way ~200,000 TPS on untuned commodity hardware, so that might be an interesting thing to investigate in the future if people believe it would be useful. --- redis is another good candidate from a cache store, it's also persistent, so you may see a driver for that in the not too distant future as well. Sooner if there's significant interest. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

Authentication protocols that DO support hashed passwords
by E.S. Rosenberg 13 Nov '14

13 Nov '14

Hi all, I was doing some research into the authentication protocol used by a VPN solution we are trying and cam across this fairly old thread on your list: http://freeradius.1045715.n5.nabble.com/Chap-auhtentication-against-LDAP-td… Which in turn links to a nice page by Alan DeKok here: http://deployingradius.com/documents/protocols/compatibility.html Which left me asking myself 2 questions: 1. Did anything change in the past 5 years, is there any decently supported protocol that does support hashed passwords (other then PAP)? 2. How can it be that all these protocols were designed with the idea that the auth server should have a cleartext copy of the users' password, haven't we all known for years now that that's a bad idea? Thanks in advance, Eli

7 15

Dropping EAPOL frame, not key frame
by Norman Elton 13 Nov '14

13 Nov '14

We have wireless clients doing MS-CHAPv2 authentication against our access points. FreeRADIUS serves as a proxy between the APs and our domain controllers. When a Mac laptop connects, or in some cases roams, we see the wifi icon laddering up and down for 20-30 seconds. During this time, I've spotted the following error in the laptop's system.log: inputEAPOLFrame: Dropping EAPOL frame, not key frame Initial Googling hasn't turned up anything relevant, and I realize this is likely not a FreeRADIUS issue (as it's only a proxy). But I'm hoping that the collective wisdom of FreeRADIUS users could shed some light on what's going on. I'm comfortable wiresharking this to death, but my EAP knowledge is somewhat anemic. Can anyone shed some light on what's going on here? Thanks, Norman Elton

2 1

groupreply attribute was override
by chenjiang 12 Nov '14

12 Nov '14

3 2

Problem with group table being not checked by freeradius
by Akash 12 Nov '14

12 Nov '14

I have installed Freeradius-3.0.1....rpm on CentOS-7, which fails to check for group tables I have set read_group = yes In /etc/raddb/mods-enabled/sql file And in /etc/raddb/mods-config/sql/main/mysql/queries.conf file group_membership_query = " SELECT groupname FROM ${usergroup_table} WHERE username = '%{SQL-User-Name}' ORDER BY priority" authorize_group_check_query = " SELECT id, groupname, attribute, Value, op FROM ${groupcheck_table} WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = " SELECT id, groupname, attribute, value, op FROM ${groupreply_table} WHERE groupname = '%{Sql-Group}' ORDER BY id" How can I make radiusd check for group tables. I'm using mysql and have entries in radgroupcheck and radgrouply and also in radcheck and radreply. Thanks Akash

2 3

FreeRADIUS Authorization Question
by Russell Mike 12 Nov '14

12 Nov '14

Hi List Greetings How do we authorize users using FreeRADIUS such as way that ClientA can only use VOIP service, ClientB mail only, ClientC internet only and so on ? Do we do by using some attributes ? or possible in unlang only ? i do not have logical diagram in my mind, how would i achieve that, using port numbers of services ? Could someone help me to understand ? --THKS --RM

2 3

Freeradius 2.2.5 with unixodbc - compilation error
by Bilik.AA＠lsrgroup.ru 12 Nov '14

12 Nov '14

Hello everybody! I need to use MS SQL as database with freeradius authentification and therefore I need to install freeradius with unixodbc support. I installed freeradius-server-2.1.12 with unixodbc support from FreeBSD 8.3-RELEASE ports succesfully. Now I try to install freeradius-server-2.2.5 from FreeBSD 8.4-RELEASE ports (ports are up-to-date) and if without unixodbc support, compilation goes well, but when I try to install with unixodbc support, something goes wrong: ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- Making all in rlm_sql_unixodbc. gmake[9]: Entering directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules/rlm_sql/drivers/rlm_sql_unixodbc' /bin/sh /usr/ports/net/freeradius2/work/freeradius-server-2.2.5/libtool --mode=link --tag=CC cc -release 2.2.5 \ -module -export-dynamic -Wl,-rpath,/usr/lib:/usr/local/lib -o rlm_sql_unixodbc.la \ -rpath /usr/local/lib/freeradius-2.2.5 sql_unixodbc.lo -lodbc libtool: link: cc -shared -fPIC -DPIC .libs/sql_unixodbc.o -lodbc -Wl,-rpath -Wl,/usr/lib:/usr/local/lib -Wl,-soname -Wl,rlm_sql_unixodbc-2.2.5.so -o .libs/rlm_sql_unixodbc-2.2.5.so /usr/bin/ld: cannot find -lodbc ../rules.mak:104: recipe for target 'rlm_sql_unixodbc.la' failed gmake[9]: *** [rlm_sql_unixodbc.la] Error 1 gmake[9]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules/rlm_sql/drivers/rlm_sql_unixodbc' Makefile:23: recipe for target 'rlm_sql_unixodbc' failed gmake[8]: *** [rlm_sql_unixodbc] Error 2 gmake[8]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules/rlm_sql/drivers' Makefile:5: recipe for target 'all' failed gmake[7]: *** [all] Error 2 gmake[7]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules/rlm_sql/drivers' Makefile:34: recipe for target 'drivers' failed gmake[6]: *** [drivers] Error 2 gmake[6]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules/rlm_sql' Makefile:37: recipe for target 'rlm_sql' failed gmake[5]: *** [rlm_sql] Error 2 gmake[5]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules' Makefile:12: recipe for target 'all' failed gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules' Makefile:39: recipe for target 'modules' failed gmake[3]: *** [modules] Error 2 gmake[3]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src' Makefile:14: recipe for target 'all' failed gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src' Makefile:97: recipe for target 'src' failed gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5' Makefile:18: recipe for target 'all' failed gmake: *** [all] Error 2 *** Error code 1 Stop in /usr/ports/net/freeradius2. *** Error code 1 Stop in /usr/ports/net/freeradius2. *** Error code 1 Stop in /usr/ports/net/freeradius2. Any idea about this issue? Thank you in advance. С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image002.png@01CFFE7B.05B934D0]

1 0

Failed to find attr_rewrite
by Юрий Колесник 12 Nov '14

12 Nov '14

Hi all Need to change the username during the connection bwc to mobile . But I can not boot module attr_rewrite . Same error on FreeRADIUS Version 2.2.0 and FreeRADIUS Version 2.1.0 I add in file site- enabled / default authorize { attr_rewrite ..... } File modules/attr_rewrite attr_rewrite usernamebwc { attribute = User-Name # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet searchfor = "^bwc" replacewith = "mobile" ignore_case = no new_attribute = no max_matches = 10 ## If set to yes then the replace string will be ## appended to the original string append = no } When I run Freeradius in debug mode GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/sqlacct.conf including configuration file /usr/local/etc/raddb/sqlauth.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default ..... Module: Checking authorize {...} for more modules to load /usr/local/etc/raddb/sites-enabled/default[63]: Failed to find "attr_rewrite" in the "modules" section. /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. ls /usr/local/lib | grep attr_rew rlm_attr_rewrite-2.1.10.la rlm_attr_rewrite-2.1.10.so rlm_attr_rewrite.a rlm_attr_rewrite.la rlm_attr_rewrite.so Other modules are loaded and working correctly rlm_sql_oracle , rlm_attr_filter. I think the error in the configuration attr_rewrite , but where ?

3 3

Tacacs+
by Jon Spriggs 12 Nov '14

12 Nov '14

Hi developers, A while ago, Alan mentioned that there might have been some interest in developing a set of Tacacs+ features for FreeRadius. I don't want to appear that I'm pushing for this feature set to be created, but I was wondering whether the interest in this was sufficient to take a look at it, and if there was, how the process is going, whether there's been any progress, and if there's anything I as a humble layperson in this area can do to help? All the best, -- Jon "The Nice Guy" Spriggs

2 1