- Freeradius-Users - lists.freeradius.org

BSD users rejoice
by Alan DeKok 11 Nov '14

11 Nov '14

As of now, v3 (and later) will use the kqueue() API instead of select(). This doesn't make much difference for RADIUS functionality. But it should make the server a bit more efficient. Alan DeKok.

1 0

ipv6 with udpfromto on FreeBSD
by Jerry Dent 11 Nov '14

11 Nov '14

Is this supposed to work? FreeBSD 10.0-RELEASE-p9 freeradius-server-2.2.5. I get this error when I try to turn it on: listen { type = "auth" ipv6addr = :: IPv6 address [::] port = 0 Failed initializing udpfromto: Invalid argument /usr/local/etc/raddb/radiusd.conf[32]: Error binding to port for :: port 1812

2 3

RE:rlm_sql_unixodbc: Can't open lib '/usr/local/lib/libtdsodbc.so'
by Bilik.AA＠lsrgroup.ru 11 Nov '14

11 Nov '14

>Bilik.AA at lsrgroup.ru wrote: >> Hello everybody! >> >>When I execute ‘radiusd -X’, I got a mistake in my debug output such as: >> >>rlm_sql_unixodbc: 01000 [unixODBC][Driver Manager]Can't open lib >> '/usr/local/lib/libtdsodbc.so' : Invalid shared object handle 0x28606880 > > The library doesn't exist. Install it. > >> What’s the problem here? I have freeradius-server-3.0.4, > >freetds-0.91.103, unixODBC-2.3.2 installed from ports (FreeBSD 8.4-RELEASE). > > Well... ask the ports people where they put the libraries. > > Alan DeKok. Well… I executed ‘dltest /usr/local/lib/libtdsodbc.so’ answer was ‘SUCCESS: Loaded /usr/local/lib/libtdsodbc.so’ Thus library DOES exist. С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image003.png@01CFFDD5.9DAE7030]

3 2

Freeradius 3.0.3 working only on loopback interface in fedora 20
by Karuppasamy, Senthil 11 Nov '14

11 Nov '14

Hi, Am using Fedora FC20 and trying to install freeradius 3.0.3 in it. The radtest on the radius server works fine but the access request from any external client is not being processed by the server. There is no firewall issue as I am able to capture the incoming Requests in the radius server using tcpdump but the access-request is not processed by the radius Server and am not able to see any logs of its receipt. I also noticed that the radius packets on radtest from the server seems to be reflected in the lo interface and it works fine. Have included the captures for the local interface and the p4p1 interface along with this mail. Also have attached the radiusX debug output along with this mail. Have been grappling with this problem for > 2 days and any help from u all will be greatly appreciated. Senthil KSK ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

2 1

rlm_sql_unixodbc: Can't open lib '/usr/local/lib/libtdsodbc.so'
by Bilik.AA＠lsrgroup.ru 11 Nov '14

11 Nov '14

Hello everybody! When I execute ‘radiusd -X’, I got a mistake in my debug output such as: rlm_sql_unixodbc: 01000 [unixODBC][Driver Manager]Can't open lib '/usr/local/lib/libtdsodbc.so' : Invalid shared object handle 0x28606880 rlm_sql_unixodbc: SQL down 08003 [unixODBC][Driver Manager]Connnection does not exist rlm_sql_unixodbc: Can't allocate the statement rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) rlm_sql (sql): Removing connection pool /usr/local/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" What’s the problem here? I have freeradius-server-3.0.4, freetds-0.91.103, unixODBC-2.3.2 installed from ports (FreeBSD 8.4-RELEASE). Thank you. С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image003.png@01CFFDD1.62EA53F0]

2 1

Keeping NAS and RADIUS in sync
by Vegard Svanberg 11 Nov '14

11 Nov '14

Hi, I have a few NAS servers (Mikrotik, PPPoE) using FreeRADIUS. >From time to time, maintenance, faults etc cause certain kinds of disruptions to the network which causes users to be disconnected from a NAS. However, the NAS sometimes also loses access to the RADIUS server, so the stop accounting packet will never get through. This causes various problems for some tools we use. These tools work on the RADIUS SQL database and require the data to be accurate. Is there a recommended way of solving such cases? Thanks in advance. -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

2 1

RE: freeradius 3.0.4 --- unlang --- unknown module
by Bilik.AA＠lsrgroup.ru 11 Nov '14

11 Nov '14

>Do you have the SQL module enabled? > >Look in /etc/raddb/mods-enabled. If 'sql' is not listed, enable it like this: > >cd /etc/raddb/mods-enabled >ln -s ../mods-available/sql > >Then retry. :-) > >Stefan Paetow >Moonshot Industry & Research Liaison Coordinator Stefan thanks a lot! Now it works! Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru www.lsrgroup.ru

1 0

freeradius 3.0.4 --- unlang --- unknown module
by Bilik.AA＠lsrgroup.ru 11 Nov '14

11 Nov '14

Hello everybody! I use unlang incut in „default“ configfile in „post-auth“ subsection and it works fine on 2.1.12 version (FreeBSD 8.3-RELEASE): ------------------------------------------------------------------------------------------------------------- if ("%{sql: SELECT vlan FROM radcheck WHERE username = '%{User-Name}'}" == "voice") { update reply { Cisco-AVPair = "device-traffic-class=voice" } } else { update reply { Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-ID = "%{sql: SELECT vlan FROM radcheck WHERE username = '%{User-Name}'}" } } ------------------------------------------------------------------------------------------------------------- But on 3.0.4 version (FreeBSD 8.4-RELEASE) in doesn’t work. When I execute „radiusd -X“ such lines appear in debug output: /usr/local/etc/raddb/sites-enabled/default[665]: Failed parsing expanded string: /usr/local/etc/raddb/sites-enabled/default[665]: %{sql: SELECT vlan FROM radcheck WHERE username = '%{User-Name}'} /usr/local/etc/raddb/sites-enabled/default[665]: ^ Unknown module How could I manage this issue? Thank you. С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image002.png@01CFFD98.D0D378D0]

2 1

Fwd: Problems updating freeradius on RHEL6
by Tijmen van den Brink 11 Nov '14

11 Nov '14

Dear all, I just tried updating my RHEL6 server with "yum update" and got the following error: --> Finished Dependency Resolution Error: Package: freeradius-ldap-2.1.12-4.el6_3.x86_64 (@rhel-6-server-optional-rpms) Requires: freeradius = 2.1.12-4.el6_3 Removing: freeradius-2.1.12-4.el6_3.x86_64 (@rhel-6-server-rpms) freeradius = 2.1.12-4.el6_3 Updated By: freeradius-2.1.12-6.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.12-6.el6 Available: freeradius-2.1.9-3.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.9-3.el6 Available: freeradius-2.1.10-5.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.10-5.el6 Available: freeradius-2.1.12-3.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.12-3.el6 Error: Package: freeradius-utils-2.1.12-4.el6_3.x86_64 (@rhel-6-server-optional-rpms) Requires: freeradius = 2.1.12-4.el6_3 Removing: freeradius-2.1.12-4.el6_3.x86_64 (@rhel-6-server-rpms) freeradius = 2.1.12-4.el6_3 Updated By: freeradius-2.1.12-6.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.12-6.el6 Available: freeradius-2.1.9-3.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.9-3.el6 Available: freeradius-2.1.10-5.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.10-5.el6 Available: freeradius-2.1.12-3.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.12-3.el6 You could try using --skip-broken to work around the problem You could try running: rpm -Va --nofiles --nodigest It looks like the ldap and utils package require the 32bit version. Am I doing something wrong? Any ideas how to fix this? Thanks for your help. Kind regards, Tijmen

3 4

Preserve ldap attributes after proxy
by Tamás Becz 11 Nov '14

11 Nov '14

Hi everyone, I'm trying to wrap my head around this, digging in the archives and the wiki with no luck, so I'm looking for a few pointers. We are currently using freeradius to to proxy requests to a central One-Time-password server (which is outside our control). This is purely authentication, we send the cleartext token we received from the NAS, they check and either reject or reply. (The only reason we do this is because the upstream organization is not willing to deal with the administration of the NASes and we've been asked to aggregate traffic) Now with a new solution I also need to query a central ldap database for authorization info: I need to get a given attribute off of user records and present them to the NAS. I was pointing my finger at Filter-Id, but purely because the NAS docs points at it, it could really be anything. If I omit the proxy part, then it's just a straightforward ldap config with adding the attribute as a reply Item mapped to Filter-ID in the ldap.attrmap with +=, getting rid of reading the userPassword so that no one tries to auth against the password there and enable ldap in the authorize section. However, when I then proxy the request these extra Filter-Ids are lost: they are neither proxied (which is just as well, I really don't know what would the homeserver do about it) nor are they sent in my reply. I've found traces of something like this being discussed that this is because there is a separate data structure, but that is over a decade old, and I'm a bit confused on how this supposed to work. Is there a way to keep does attributes (or to get them after proxying, either in post-proxy or post-auth maybe?) by using rlm_ldap? I could probably write a short perl that queries this directly in post-auth, but basically the reason I want to do this in radius instead of the NAS is because I would need a mild hack on my networking to allow it to directly reach the ldap, so I though that, the radius box can reach the ldap, it can talk ldap, the nas is connected anyway.. But if it's troublesome with radius, then I'd rather not hack it. Does anyone have a pointer on what track should I go down? Thanks! tamas

3 9