- Freeradius-Users - lists.freeradius.org

3Com Radius Failover
by Mike Ford 29 Aug '14

29 Aug '14

Hello, Yesterday I finally got my freeradius server playing nicely with a 3Com 5500 EI, thanks in no small part to the great posts in this forum. I have a question about failover radius configurations on the 3Com switch. I know this would probably be better posted on the 3Com / HP support site, but I thought I might get better answers here. ;) I know that it possible to have a primary and a secondary radius sever set up in the same radius scheme (example config below). # radius scheme freerad server-type extended primary authentication x.x.x.x primary accounting x.x.x.x accounting optional key authentication ****** key accounting ****** user-name-format without-domain # Is it possible to have a radius server set a primary, and if the server is not accessible, set the secondary to local login authentication? This is my first post here, sorry if there is not enough information, or if this post is in the wrong place. Thanks in advance!

1 0

3.0.4 release candidate 2
by Alan DeKok 29 Aug '14

29 Aug '14

I've put a release candidate on the net as: ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.4rc2.tar.gz After a few months of hard work, this should be the final release candidate. Please test it. We don't want any last-minute "oops" marring the release. The list of changed items is long. A number of small bug fixes, and a number of useful new features. We've also added more tests, to be sure that future releases don't go "backwards" in functionality and stability. Alan DeKok.

5 10

Re: FreeRadius in Windows - was Sourceforge and FreeRADIUS (Arran Cudbard-Bell)
by Rui Ribeiro 29 Aug '14

29 Aug '14

I have not replied to other previous similar message to not feed further this misunderstanding. I am not related in any way to the Windows guys, so I am not quite sure why I should have an interest into "introducing confusion". Relax a bit guys. I am quite aware this a serious matter - What I wanted to convey is that I found that site, and it appeared to be "very legit", only that - maybe on purpose. I may have read or not the previous message, however this one hit the point for me. Regards > Message: 2 > Date: Fri, 29 Aug 2014 11:11:53 +0200 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRadius in Windows - was Sourceforge and FreeRADIUS > Message-ID: <A19B4586-EB2C-4FA0-8002-AF5919A064E6(a)freeradius.org> > Content-Type: text/plain; charset="us-ascii" > > > You are saying you dont have a Windows version, however I do recall > reading some months ago about a Windows paid version too. At the time I > *think* it was quite deliberate that it purported to be quite official i.e. > your team. > > No. That is absolutely incorrect. You have not got that information from > either the FreeRADIUS users or FreeRADIUS developers list. > > I suspect you are attempting to purposely introduce confusion. > > > If it were not for this email I would not got the slightest idea it was > another individual. > > Well it is. > > This is serious. The GPLv2 violation is secondary. It's quite plausible > that the version being distributed on source forge may contain malicious > code. It would be fairly trivial to modify the server to forward > credentials to a remote site, whether they be from users, or the ones > embedded in the configuration. > > That's why it's so important from them to publish the actual code used to > create the windows binaries, so it can be checked against the code from our > repository. > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS development team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > >

1 0

Sourceforge and FreeRADIUS
by Alan DeKok 28 Aug '14

28 Aug '14

Someone released a "FreeRADIUS for Windows" on sourceforge. Initially, he didn't include the source. After some discussion, he put up a copy of the "tar" file from an official release. That isn't good enough. FreeRADIUS does not build or run under Windows. Any changes made to build on Windows MUST be released publicly. In addition, he seems to have added a demand for a serial number. I've been getting a steady stream of questions from people asking how they get a serial number for the software. I've had to tell them they've been cheated. All versions of FreeRADIUS will be free to download and use. Always. Requiring a secondary license or user registration is not allowed. I've sent a DMCA notice to Sourceforge, and they've removed the offending software. It will not be allowed online until it is in compliance with the GPLv2. Alan DeKok.

1 0

configurable fail-over for policy virtual modules?
by Zenon Mousmoulas 27 Aug '14

27 Aug '14

Hi, should it be possible to do this: policy { check_something { if (Some-Attribute) { noop } else { reject } } } authorize { check_something { noop = return } } 2.x just gives a parser error, while 3.x also explains it failed to find "check_something" in the "modules" section. Thanks in advance for any insight, Z.

3 11

eap: set virtual server based on realm
by Saša Babić 27 Aug '14

27 Aug '14

Hi, is there a way to set virtual_server in eap based on realm (or non-stripped User-Name)? Thanks, -- Saša.

2 3

Avoiding UDP port 1814
by Brian Candler 26 Aug '14

26 Aug '14

[Using freeradius 2.1.12+dfsg-1.2ubuntu8 from ubuntu 14.04] I notice that freeradius listens on UDP port 1814. The problem is that this conflicts with another application I'm using: http://docs.ganeti.org/ganeti/master/man/ganeti-confd.html and I'd rather move freeradius than this one. However I cannot see how to change which port freeradius uses. There is no entry for 1814 in /etc/services. I see the following in freeradius -X output: Listening on proxy address * port 1814 but a grep -R of /etc/freeradius doesn't find 1814. Indeed, a grep -R of the entire source code doesn't find anything relevant for 1814. So my questions are: * why is FreeRADIUS using port 1814? Has it bound a socket to port 1814 for sending *outbound* proxy requests (and is only "Listening" in the sense that it receives replies to the requests it has sent?) * how can I bind this to a different port instead? In ./src/include/radius.h I can see #define PW_AUTH_UDP_PORT 1812 #define PW_ACCT_UDP_PORT 1813 but I'm stuck finding where 1814 is chosen. Ah, maybe it's this: port = sock->port + 2; /* skip acct port */ ... /* * Try to find a proxy port (value doesn't matter) */ for (sock->port = port; sock->port < 64000; sock->port++) { if (listen_bind(this) == 0) { *last = this; last = &(this->next); /* just in case */ break; } } which suggests that it's hard-coded to be the authentication port + 2, or the first available socket after that. OK, to test this theory: stop both apps, restart the other app which binds to 1814, then restart freeradius. # netstat -naup | grep freeradius udp 0 0 0.0.0.0:42388 0.0.0.0:* 23378/freeradius udp 0 0 127.0.0.1:18120 0.0.0.0:* 23378/freeradius udp 0 0 0.0.0.0:1812 0.0.0.0:* 23378/freeradius udp 0 0 0.0.0.0:1813 0.0.0.0:* 23378/freeradius udp 0 0 0.0.0.0:1815 0.0.0.0:* 23378/freeradius Yep, freeradius has moved to 1815. So I can make this work, but only if ganeti-confd starts *before* freeradius. Is there any setting I've missed which would allow the freeradius port scan to start at a different place? Thanks, Brian.

2 2

Re: freeradius + firebird, how install in Ubuntu Linux
by Антон - 25 Aug '14

25 Aug '14

Hello! Thanks for you help! All right, I was able to compile freeradius with firebird support! =) my inexperience, some later I noticed that configure --help tells me next params: --with-experimental-modules, and also I viewed the file "stable" in src.../drivers directory, and saw that firebird is not stable. Then I'am run configure with next params: ./configure --prefix=/usr \ --exec-prefix=/usr \ --mandir=/usr/share/man \ --sysconfdir=/etc \ --libdir=/usr/lib/freeradius \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=/etc/freeradius \ --with-logdir=/var/log/freeradius \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --without-rlm_sql_postgresql \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ --without-rlm_sql_unixodbc \ --with-system-libtool \ --with-system-libltdl \ --with-experimental-modules \ --without-rlm_opendirectory \ --without-rlm_redis \ --without-rlm_rediswho \ --without-rlm_ruby \ --without-rlm_sql_sqlite \ --without-rlm_sql_db2 and then make and checkinstall make install as a result I got the module freeradius-XYZ.deb, which was successfully installed in the system. Yes, I expected that I must be got separate module, as to freeradius-firebird.deb, thanks you for you explaining, that my expectations are wrong. =) And question about why we are using firebird database. The reason is very simple, out billing software begun develops long ago, and for historical reasons used firebird database engine. This software was developed inside the company, and modernization of it is a complex process in which we do not need, except that we can't use freeradius, unfortunately, in production. May be only after full testing, may be. It is a pity that the module is still experimental, eh. Thanks for your answers!

4 4

Understanding radgroupcheck
by Marcus Ng 25 Aug '14

25 Aug '14

1. When a user has multiple entries of the same attribute in radgroupcheck, it is a OR condition meaning that if he satisfies one of the entry it is a PASS? E.g. If there are 3 NAS-IP-Address entries, then satisfying any of the 3 IP address is a PASS? 2. What if there are more than 1 type of attributes. Does it mean it is a PASS only if each of the attribute is satisfied at least once? E.g. if there are 3 entries of AttrA and 2 entries of AttrB, then it is a PASS if and only if at least 1 entry of AttrA is true and at least 1 entry of AttrB is true? 3. Does this apply to radcheck as well? Regards, -Marcus

2 1

Re: freeradius + firebird, how install in Ubuntu Linux
by Антон - 23 Aug '14

23 Aug '14

Hello! I try it. By manual from http://wiki.freeradius.org/building/Build#Building-Debian-packages I did these steps: I'm install firebird-dev package. Result of command "sudo dpkg -L firebird-dev" /. /usr /usr/lib /usr/lib/i386-linux-gnu /usr/share /usr/share/doc /usr/include /usr/include/perf.h /usr/include/ibase.h /usr/include/iberror.h /usr/include/ib_util.h /usr/lib/i386-linux-gnu/libfbembed.so /usr/lib/i386-linux-gnu/libfbclient.so /usr/share/doc/firebird-dev then I fix debian/rules file in this part (added strings with word "firebird"): ./configure $(confflags) \ --prefix=/usr \ --exec-prefix=/usr \ --mandir=$(mandir) \ --sysconfdir=/etc \ --libdir=$(libdir) \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --with-rlm_sql_firebird \ --with-rlm_sql_firebird_lib_dir=`/usr/lib/i386-linux-gnu/` \ --with-rlm_sql_firebird_include_dir=`/usr/include/` \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ --without-rlm_sql_unixodbc \ --with-system-libtool \ --with-system-libltdl But, firebird deb is absent, although other packages, such as mysql, postgresql is present. Why? Please tell me, where is my error? I would be very grateful for any help!

4 6