- Freeradius-Users - lists.freeradius.org

Cache module to save user password?
by Enrique Sainz Baixauli 15 Oct '14

15 Oct '14

Hello there, I have a freeradius server for testing running v3.0.3, and I had a config where the server read the user details from an LDAP server and cached it to avoid future searches for the same user. I am pretty sure it used to work when I finally configured it, and without any changes or updates it just stopped working. Now, I can test any of the users in the database and it will send Access-Accept the first time I test, but if I try again while the entry in the cache is still there it will pop put "no known-good password for that user". My config for the auth section is as follows: update control { Cache-Status-Only := yes } cache if (notfound) { ldap update control { Cache-Status-Only := no } cache } While the update section of the cache module config is as follows: control:LDAP-Group += control:LDAP-Group control:Password-With-Header += control:Password-With-Header (although I also tried with control:User-Password instead of Password-With-Header) So the thing is that, when the cache module finds an entry for the user, it reads it (with Cache-Status-Only := yes, might that be the problem?) but then it doesn't find a known-good password for that user. If it had read the cache entry, I understand that it should be there. Any help is appreciated. And any additional info will be provided if needed :) Best regards, Enrique Sainz

1 0

Two questions SYSLOG (level of detail written and forwarding to a SIEM)
by Shawn Wiley 14 Oct '14

14 Oct '14

I have two questions. Please point me in the right direction if the answer is documented somewhere and I've missed it. First some background. I am running Red Hat Enterprise Linux 2.6.32-279.11.1.el6.x86_64 #1 SMP Sat Sep 22 07:10:26 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux Installed Package Name : freeradius Arch : x86_64 Version : 2.1.12 Release : 4.el6_3 I would like to feed logs into a SIEM (ArcSight). Has anyone done it? Is the procedure documented anywhere? It looks like I just parse the syslog output and feed that into the SIEM but I'd like some advice from anyone who has done it. Second Question The current syslog output is not very verbose but when I run Radiusd in -X mode I see a ton of data. I'd like to log close to what the -X outputs to my syslog file. From what I've read there's a module that will allow me to log that level of detail but I'm not sure I'm 100% familiar with the module concept. Do I just $INCLUDE modulename in the radius.conf file and then go into the module itself and make the configuration changes there? Ultimately I'd like my syslog file to show who tried to authenticate USERNAME, the IP address they initiated the auth request from USER's IP, successful authentication or fail/reject. Thanks in advance. Shawn L. Wiley, CISSP - Information and Application Security Architecture ________________________________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), Euronext or any of their subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired. ________________________________________________________

2 1

Version 3 ldap Generic
by Cody Ritts 14 Oct '14

14 Oct '14

Hello, I am upgrading from FR 1.1 to 3.0.4. I am struggling to understand the the syntax for upgrading my $GENERIC$ statement. I have only found 3 threads discussing, which I did non fully understand, and am not sure they covered my problem. In my old ldap.attrmap I have the following lines: > replyItem Framed-IP-Address dslIPAddress > replyItem Idle-Timeout dslIdleTimeout > replyItem $GENERIC$ dslACLin > replyItem $GENERIC$ dslACLout > replyItem $GENERIC$ dslINSPECTin > replyItem $GENERIC$ dslINSPECTout > replyItem $GENERIC$ dslStatus The example ldap contents of dslACLin and dslACLout are: > dslACLin: cisco-avpair += "ip:inacl=OUTBOUND" > dslACLout: cisco-avpair += "ip:outacl=FIREWALL" So, in my mods-enabled/ldap, when I added: > valuepair_attribute = "dslACLin" In my radtest reply, I do get a: > Cisco-AVPair = "ip:inacl=OUTBOUND" But based on one of the other threads and the way that it is configured, I will assume that "valuepair_attribute =" is only good once? Good news for me however, down at the bottom of update{} I see the following. > # These are provided for backwards compatibility. > # Where only a list is specified as the RADIUS attribute, > # the value of the LDAP attribute is parsed as a valuepair > # in the same format as the 'valuepair_attribute' (above). > # control: += 'radiusCheckAttributes' > # reply: += 'radiusReplyAttributes' so I add: > reply: += 'dslACLout' Then radiusd -X gets: >> /usr/local/etc/raddb/mods-enabled/ldap[85]: Invalid source for list '+=' so I try :=, and = with the same. To be honest, I dont know what the source list is. After reading man unlang I see that there is "update <list>" but then again, it says right above the block that this is not a unlang update format so, I am still lost. So I try this: > reply:Cisco-AVPair += 'dslACLout' And the server will start, but it does not parse out the avpair, this is the radius reply: > Cisco-AVPair = "cisco-avpair += \"ip:outacl=FIREWALL\"" So I dont know what I am doing wrong there, but I also bear in mind that this is just a "compatibility" feature, so when that gets dropped I will still be in the same spot. That makes me wonder about how I should have done that in the first place. I suppose I used GENERIC because it was in the same file as the other attributes, I tried it and it worked. Is there a "more correct" way of doing that for long term support? Like creating dictionary entries for those attributes then map them? Also, as an interim solution until I can update my schema and management applications, if I add dslACLout to the dictionary, and map it, then is it possible to use unlang and regex in post-auth/"update reply" to parse "cisco-avpair +=" out of dslACLout and then add it back in as cisco-avpair? Thanks in advance any help, Cody

2 4

Rlm_sqlippool with Simultaneous-Use > 1
by Amir Tal 14 Oct '14

14 Oct '14

Using freeradius-2.2.5-1.centos6.x86_64. Accounting data in mysql, IP pools in psql. Is it possible to use rlm_sqlippool with Simultaneous-Use > 1 ? Currently on second connection user is assigned same IP, causing a conflict on client side. Is it possible to add some other unique parameter to allow to assign multiple IPs for duplicate connections from same user? (assuming the two sessions are registered correctly in accounting DB) Amir.

2 1

FreeRadius 3.0.3 module thread safety
by Dejan Markic 14 Oct '14

14 Oct '14

Hello! I've written a module for FreeRadius currently running on version 3.0.3. I must admit, I have a very limited understanding about the thread safety in regards to modules. I register module as RLM_TYPE_THREAD_SAFE and in my instantiate function I load several MySQL database instances and some other instances. So they are all in rlm_MYMODULE_t instance stuct. Do I understand correctly, that if RLM_TYPE_THREAD_SAFE is used, this module instance struct might be used in different threads even tough I define only 4 instances, and 4 instances are created? So to put it in another way, I have four instances that might be used by 8 threads simultaneously? I now protect each instance with a mutex and sometimes it happens, that one instance gets the reply from our service with a bit of delay and then that instance mutex stays locked for >0.2 second and an avalanche effect occours. I guess three instances are working normaly, but one gets slowed down with each additional request, since it waits for that same mutex. Is that correct? Thank you very much for your replies. Kind regards, Dejan Markic

2 1

Re: Beginner help
by KAVYA PRABHAKAR 14 Oct '14

14 Oct '14

Hi, I am trying to setup radsec using freeradius version 3.0.3. I have generated self-signed certificate on my freeradius server using openssl commands. I generates .pem and .pfx certificate. I have placed the same files in certs folder of raddb and edited tls file respectively. Command to send radius request: radtest test 456 localhost 2083 testing123 When I run the above command I could see that request is going on 1812 port. Then i checked netstat command to check ports opened for radiusd. TCP port 2083 is not opened. How to open up TCP port and any extra parameters needs to be present in radtest command? Thanks, Kavya

2 1

Re: Cert validation on Android platforms
by Alan Buxey 13 Oct '14

13 Oct '14

Seems that one part of android dev doesn't talk to another part as if you use a private CA with recent releases you get a 'your network may be monitored' message which you can either just ignore/clear every time you restart your phone or remove the CA and don't validate your remote server!!! :( alan

1 0

Cert validation on Android platforms
by Arran Cudbard-Bell 13 Oct '14

13 Oct '14

I know a lot of people on here run WPA2-Enterprise and may be surprised to hear that it is currently not possible to configure the supplicant on Android devices to validate the CN in cert presented by the server. Maybe someone could poke the correct person at google and get this fixed: https://code.google.com/p/android/issues/detail?id=37178 Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2

FW: service messages
by Franks Andy (RLZ) IT Systems Engineer 13 Oct '14

13 Oct '14

Hi again, Got a bit trigger happy on the email - testing this works fine - I added my service_messages to ${raddbdir} and it worked ok. Whereabouts is this documented - wondering on how far the scope goes.. Thanks Andy From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Franks Andy (RLZ) IT Systems Engineer Sent: 13 October 2014 17:00 To: freeradius-users(a)lists.freeradius.org Subject: service messages Hi all, Is the v2 functionality of service_messages etc (under the logging bit of radiusd.conf) in v3? I'd like to configure some standard error messages to be in one place and refer to them in policies etc without having to dig out where they are at.. Something like service_messages { # invalid mac address mac_address_incorrect = "the mac address format is invalid" } Then in policies etc Reply-Message := "${service_messages.mac_address_incorrect}" That sort of thing. Am I missing some obvious documentation somewhere? Apologies if so. Thanks Andy - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

service messages
by Franks Andy (RLZ) IT Systems Engineer 13 Oct '14

13 Oct '14

Hi all, Is the v2 functionality of service_messages etc (under the logging bit of radiusd.conf) in v3? I'd like to configure some standard error messages to be in one place and refer to them in policies etc without having to dig out where they are at.. Something like service_messages { # invalid mac address mac_address_incorrect = "the mac address format is invalid" } Then in policies etc Reply-Message := "${service_messages.mac_address_incorrect}" That sort of thing. Am I missing some obvious documentation somewhere? Apologies if so. Thanks Andy

1 0