- Freeradius-Users - lists.freeradius.org

Authentication protocols that DO support hashed passwords
by E.S. Rosenberg 13 Nov '14

13 Nov '14

Hi all, I was doing some research into the authentication protocol used by a VPN solution we are trying and cam across this fairly old thread on your list: http://freeradius.1045715.n5.nabble.com/Chap-auhtentication-against-LDAP-td… Which in turn links to a nice page by Alan DeKok here: http://deployingradius.com/documents/protocols/compatibility.html Which left me asking myself 2 questions: 1. Did anything change in the past 5 years, is there any decently supported protocol that does support hashed passwords (other then PAP)? 2. How can it be that all these protocols were designed with the idea that the auth server should have a cleartext copy of the users' password, haven't we all known for years now that that's a bad idea? Thanks in advance, Eli

7 15

Dropping EAPOL frame, not key frame
by Norman Elton 13 Nov '14

13 Nov '14

We have wireless clients doing MS-CHAPv2 authentication against our access points. FreeRADIUS serves as a proxy between the APs and our domain controllers. When a Mac laptop connects, or in some cases roams, we see the wifi icon laddering up and down for 20-30 seconds. During this time, I've spotted the following error in the laptop's system.log: inputEAPOLFrame: Dropping EAPOL frame, not key frame Initial Googling hasn't turned up anything relevant, and I realize this is likely not a FreeRADIUS issue (as it's only a proxy). But I'm hoping that the collective wisdom of FreeRADIUS users could shed some light on what's going on. I'm comfortable wiresharking this to death, but my EAP knowledge is somewhat anemic. Can anyone shed some light on what's going on here? Thanks, Norman Elton

2 1

groupreply attribute was override
by chenjiang 12 Nov '14

12 Nov '14

3 2

Problem with group table being not checked by freeradius
by Akash 12 Nov '14

12 Nov '14

I have installed Freeradius-3.0.1....rpm on CentOS-7, which fails to check for group tables I have set read_group = yes In /etc/raddb/mods-enabled/sql file And in /etc/raddb/mods-config/sql/main/mysql/queries.conf file group_membership_query = " SELECT groupname FROM ${usergroup_table} WHERE username = '%{SQL-User-Name}' ORDER BY priority" authorize_group_check_query = " SELECT id, groupname, attribute, Value, op FROM ${groupcheck_table} WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = " SELECT id, groupname, attribute, value, op FROM ${groupreply_table} WHERE groupname = '%{Sql-Group}' ORDER BY id" How can I make radiusd check for group tables. I'm using mysql and have entries in radgroupcheck and radgrouply and also in radcheck and radreply. Thanks Akash

2 3

FreeRADIUS Authorization Question
by Russell Mike 12 Nov '14

12 Nov '14

Hi List Greetings How do we authorize users using FreeRADIUS such as way that ClientA can only use VOIP service, ClientB mail only, ClientC internet only and so on ? Do we do by using some attributes ? or possible in unlang only ? i do not have logical diagram in my mind, how would i achieve that, using port numbers of services ? Could someone help me to understand ? --THKS --RM

2 3

Freeradius 2.2.5 with unixodbc - compilation error
by Bilik.AA＠lsrgroup.ru 12 Nov '14

12 Nov '14

Hello everybody! I need to use MS SQL as database with freeradius authentification and therefore I need to install freeradius with unixodbc support. I installed freeradius-server-2.1.12 with unixodbc support from FreeBSD 8.3-RELEASE ports succesfully. Now I try to install freeradius-server-2.2.5 from FreeBSD 8.4-RELEASE ports (ports are up-to-date) and if without unixodbc support, compilation goes well, but when I try to install with unixodbc support, something goes wrong: ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- Making all in rlm_sql_unixodbc. gmake[9]: Entering directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules/rlm_sql/drivers/rlm_sql_unixodbc' /bin/sh /usr/ports/net/freeradius2/work/freeradius-server-2.2.5/libtool --mode=link --tag=CC cc -release 2.2.5 \ -module -export-dynamic -Wl,-rpath,/usr/lib:/usr/local/lib -o rlm_sql_unixodbc.la \ -rpath /usr/local/lib/freeradius-2.2.5 sql_unixodbc.lo -lodbc libtool: link: cc -shared -fPIC -DPIC .libs/sql_unixodbc.o -lodbc -Wl,-rpath -Wl,/usr/lib:/usr/local/lib -Wl,-soname -Wl,rlm_sql_unixodbc-2.2.5.so -o .libs/rlm_sql_unixodbc-2.2.5.so /usr/bin/ld: cannot find -lodbc ../rules.mak:104: recipe for target 'rlm_sql_unixodbc.la' failed gmake[9]: *** [rlm_sql_unixodbc.la] Error 1 gmake[9]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules/rlm_sql/drivers/rlm_sql_unixodbc' Makefile:23: recipe for target 'rlm_sql_unixodbc' failed gmake[8]: *** [rlm_sql_unixodbc] Error 2 gmake[8]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules/rlm_sql/drivers' Makefile:5: recipe for target 'all' failed gmake[7]: *** [all] Error 2 gmake[7]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules/rlm_sql/drivers' Makefile:34: recipe for target 'drivers' failed gmake[6]: *** [drivers] Error 2 gmake[6]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules/rlm_sql' Makefile:37: recipe for target 'rlm_sql' failed gmake[5]: *** [rlm_sql] Error 2 gmake[5]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules' Makefile:12: recipe for target 'all' failed gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src/modules' Makefile:39: recipe for target 'modules' failed gmake[3]: *** [modules] Error 2 gmake[3]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src' Makefile:14: recipe for target 'all' failed gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/src' Makefile:97: recipe for target 'src' failed gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory '/usr/ports/net/freeradius2/work/freeradius-server-2.2.5' Makefile:18: recipe for target 'all' failed gmake: *** [all] Error 2 *** Error code 1 Stop in /usr/ports/net/freeradius2. *** Error code 1 Stop in /usr/ports/net/freeradius2. *** Error code 1 Stop in /usr/ports/net/freeradius2. Any idea about this issue? Thank you in advance. С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image002.png@01CFFE7B.05B934D0]

1 0

Failed to find attr_rewrite
by Юрий Колесник 12 Nov '14

12 Nov '14

Hi all Need to change the username during the connection bwc to mobile . But I can not boot module attr_rewrite . Same error on FreeRADIUS Version 2.2.0 and FreeRADIUS Version 2.1.0 I add in file site- enabled / default authorize { attr_rewrite ..... } File modules/attr_rewrite attr_rewrite usernamebwc { attribute = User-Name # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet searchfor = "^bwc" replacewith = "mobile" ignore_case = no new_attribute = no max_matches = 10 ## If set to yes then the replace string will be ## appended to the original string append = no } When I run Freeradius in debug mode GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/sqlacct.conf including configuration file /usr/local/etc/raddb/sqlauth.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default ..... Module: Checking authorize {...} for more modules to load /usr/local/etc/raddb/sites-enabled/default[63]: Failed to find "attr_rewrite" in the "modules" section. /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. ls /usr/local/lib | grep attr_rew rlm_attr_rewrite-2.1.10.la rlm_attr_rewrite-2.1.10.so rlm_attr_rewrite.a rlm_attr_rewrite.la rlm_attr_rewrite.so Other modules are loaded and working correctly rlm_sql_oracle , rlm_attr_filter. I think the error in the configuration attr_rewrite , but where ?

3 3

Tacacs+
by Jon Spriggs 12 Nov '14

12 Nov '14

Hi developers, A while ago, Alan mentioned that there might have been some interest in developing a set of Tacacs+ features for FreeRadius. I don't want to appear that I'm pushing for this feature set to be created, but I was wondering whether the interest in this was sufficient to take a look at it, and if there was, how the process is going, whether there's been any progress, and if there's anything I as a humble layperson in this area can do to help? All the best, -- Jon "The Nice Guy" Spriggs

2 1

BSD users rejoice
by Alan DeKok 11 Nov '14

11 Nov '14

As of now, v3 (and later) will use the kqueue() API instead of select(). This doesn't make much difference for RADIUS functionality. But it should make the server a bit more efficient. Alan DeKok.

1 0

ipv6 with udpfromto on FreeBSD
by Jerry Dent 11 Nov '14

11 Nov '14

Is this supposed to work? FreeBSD 10.0-RELEASE-p9 freeradius-server-2.2.5. I get this error when I try to turn it on: listen { type = "auth" ipv6addr = :: IPv6 address [::] port = 0 Failed initializing udpfromto: Invalid argument /usr/local/etc/raddb/radiusd.conf[32]: Error binding to port for :: port 1812

2 3