- Freeradius-Users - lists.freeradius.org

Sourceforge and FreeRADIUS
by Alan DeKok 28 Aug '14

28 Aug '14

Someone released a "FreeRADIUS for Windows" on sourceforge. Initially, he didn't include the source. After some discussion, he put up a copy of the "tar" file from an official release. That isn't good enough. FreeRADIUS does not build or run under Windows. Any changes made to build on Windows MUST be released publicly. In addition, he seems to have added a demand for a serial number. I've been getting a steady stream of questions from people asking how they get a serial number for the software. I've had to tell them they've been cheated. All versions of FreeRADIUS will be free to download and use. Always. Requiring a secondary license or user registration is not allowed. I've sent a DMCA notice to Sourceforge, and they've removed the offending software. It will not be allowed online until it is in compliance with the GPLv2. Alan DeKok.

1 0

configurable fail-over for policy virtual modules?
by Zenon Mousmoulas 27 Aug '14

27 Aug '14

Hi, should it be possible to do this: policy { check_something { if (Some-Attribute) { noop } else { reject } } } authorize { check_something { noop = return } } 2.x just gives a parser error, while 3.x also explains it failed to find "check_something" in the "modules" section. Thanks in advance for any insight, Z.

3 11

eap: set virtual server based on realm
by Saša Babić 27 Aug '14

27 Aug '14

Hi, is there a way to set virtual_server in eap based on realm (or non-stripped User-Name)? Thanks, -- Saša.

2 3

Avoiding UDP port 1814
by Brian Candler 26 Aug '14

26 Aug '14

[Using freeradius 2.1.12+dfsg-1.2ubuntu8 from ubuntu 14.04] I notice that freeradius listens on UDP port 1814. The problem is that this conflicts with another application I'm using: http://docs.ganeti.org/ganeti/master/man/ganeti-confd.html and I'd rather move freeradius than this one. However I cannot see how to change which port freeradius uses. There is no entry for 1814 in /etc/services. I see the following in freeradius -X output: Listening on proxy address * port 1814 but a grep -R of /etc/freeradius doesn't find 1814. Indeed, a grep -R of the entire source code doesn't find anything relevant for 1814. So my questions are: * why is FreeRADIUS using port 1814? Has it bound a socket to port 1814 for sending *outbound* proxy requests (and is only "Listening" in the sense that it receives replies to the requests it has sent?) * how can I bind this to a different port instead? In ./src/include/radius.h I can see #define PW_AUTH_UDP_PORT 1812 #define PW_ACCT_UDP_PORT 1813 but I'm stuck finding where 1814 is chosen. Ah, maybe it's this: port = sock->port + 2; /* skip acct port */ ... /* * Try to find a proxy port (value doesn't matter) */ for (sock->port = port; sock->port < 64000; sock->port++) { if (listen_bind(this) == 0) { *last = this; last = &(this->next); /* just in case */ break; } } which suggests that it's hard-coded to be the authentication port + 2, or the first available socket after that. OK, to test this theory: stop both apps, restart the other app which binds to 1814, then restart freeradius. # netstat -naup | grep freeradius udp 0 0 0.0.0.0:42388 0.0.0.0:* 23378/freeradius udp 0 0 127.0.0.1:18120 0.0.0.0:* 23378/freeradius udp 0 0 0.0.0.0:1812 0.0.0.0:* 23378/freeradius udp 0 0 0.0.0.0:1813 0.0.0.0:* 23378/freeradius udp 0 0 0.0.0.0:1815 0.0.0.0:* 23378/freeradius Yep, freeradius has moved to 1815. So I can make this work, but only if ganeti-confd starts *before* freeradius. Is there any setting I've missed which would allow the freeradius port scan to start at a different place? Thanks, Brian.

2 2

Re: freeradius + firebird, how install in Ubuntu Linux
by Антон - 25 Aug '14

25 Aug '14

Hello! Thanks for you help! All right, I was able to compile freeradius with firebird support! =) my inexperience, some later I noticed that configure --help tells me next params: --with-experimental-modules, and also I viewed the file "stable" in src.../drivers directory, and saw that firebird is not stable. Then I'am run configure with next params: ./configure --prefix=/usr \ --exec-prefix=/usr \ --mandir=/usr/share/man \ --sysconfdir=/etc \ --libdir=/usr/lib/freeradius \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=/etc/freeradius \ --with-logdir=/var/log/freeradius \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --without-rlm_sql_postgresql \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ --without-rlm_sql_unixodbc \ --with-system-libtool \ --with-system-libltdl \ --with-experimental-modules \ --without-rlm_opendirectory \ --without-rlm_redis \ --without-rlm_rediswho \ --without-rlm_ruby \ --without-rlm_sql_sqlite \ --without-rlm_sql_db2 and then make and checkinstall make install as a result I got the module freeradius-XYZ.deb, which was successfully installed in the system. Yes, I expected that I must be got separate module, as to freeradius-firebird.deb, thanks you for you explaining, that my expectations are wrong. =) And question about why we are using firebird database. The reason is very simple, out billing software begun develops long ago, and for historical reasons used firebird database engine. This software was developed inside the company, and modernization of it is a complex process in which we do not need, except that we can't use freeradius, unfortunately, in production. May be only after full testing, may be. It is a pity that the module is still experimental, eh. Thanks for your answers!

4 4

Understanding radgroupcheck
by Marcus Ng 25 Aug '14

25 Aug '14

1. When a user has multiple entries of the same attribute in radgroupcheck, it is a OR condition meaning that if he satisfies one of the entry it is a PASS? E.g. If there are 3 NAS-IP-Address entries, then satisfying any of the 3 IP address is a PASS? 2. What if there are more than 1 type of attributes. Does it mean it is a PASS only if each of the attribute is satisfied at least once? E.g. if there are 3 entries of AttrA and 2 entries of AttrB, then it is a PASS if and only if at least 1 entry of AttrA is true and at least 1 entry of AttrB is true? 3. Does this apply to radcheck as well? Regards, -Marcus

2 1

Re: freeradius + firebird, how install in Ubuntu Linux
by Антон - 23 Aug '14

23 Aug '14

Hello! I try it. By manual from http://wiki.freeradius.org/building/Build#Building-Debian-packages I did these steps: I'm install firebird-dev package. Result of command "sudo dpkg -L firebird-dev" /. /usr /usr/lib /usr/lib/i386-linux-gnu /usr/share /usr/share/doc /usr/include /usr/include/perf.h /usr/include/ibase.h /usr/include/iberror.h /usr/include/ib_util.h /usr/lib/i386-linux-gnu/libfbembed.so /usr/lib/i386-linux-gnu/libfbclient.so /usr/share/doc/firebird-dev then I fix debian/rules file in this part (added strings with word "firebird"): ./configure $(confflags) \ --prefix=/usr \ --exec-prefix=/usr \ --mandir=$(mandir) \ --sysconfdir=/etc \ --libdir=$(libdir) \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --with-rlm_sql_firebird \ --with-rlm_sql_firebird_lib_dir=`/usr/lib/i386-linux-gnu/` \ --with-rlm_sql_firebird_include_dir=`/usr/include/` \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ --without-rlm_sql_unixodbc \ --with-system-libtool \ --with-system-libltdl But, firebird deb is absent, although other packages, such as mysql, postgresql is present. Why? Please tell me, where is my error? I would be very grateful for any help!

4 6

FreeRadius Support with Windows 2012 R2 domain
by Dennis Xu 21 Aug '14

21 Aug '14

Hello, Does FreeRadius support Windows 2012 R2 servers for PEAP MS-CHAPV2 authentication? Thanks! --- Dennis Xu Analyst 3, Network Infrastructure Computing and Communications Services(CCS) University of Guelph 519-824-4120 Ext 56217 dxu(a)uoguelph.ca www.uoguelph.ca/ccs

3 3

Issue with OpenLdap and FreeRadius
by Andrew Niemantsverdriet 21 Aug '14

21 Aug '14

Hi All, I'm am using FreeRadius 2.1.12 from the CentOS repo and am trying to get it working with OpenLDAP 2.3.43 also from the CentOS repo. Everything is working great until I add and ACL to OpenLDAP that gives self write access to sambaNTpassword. When that line is added FreeRadius will stop authenticating clients. I'm including a link to my log file gathered from radiusd -X > debug.txt. At the end of that file you can see where I turned off the sambaNTpassword and things start working again. Any idea on how I can fix this? https://www.dropbox.com/s/vhuolmhl62fphfd/debug.txt Thanks, -- _ /-\ ndrew Niemantsverdriet Linux System Administrator Academic Computing (406) 238-7360 Rocky Mountain College 1511 Poly Dr. Billings MT, 59102

3 7

Operator ":=" in reply packets
by Axel Luttgens 21 Aug '14

21 Aug '14

Hello, Let's define this query: authorize_reply_query = "\ SELECT 1, '%{SQL-User-Name}', 'Reply-Message', 'Hey', ':=' \ UNION \ SELECT 2, '%{SQL-User-Name}', 'Reply-Message', 'Hello', ':=' \ ORDER BY 1" In radiusd -X output, on may then read: Sending Access-Accept Id 201 from 127.0.0.1:1812 to 127.0.0.1:62417 Reply-Message = 'Hey' Reply-Message = 'Hello' A Reply-Message may indeed appear multiple times in an Acces-Accept (or -Reject or -Challenge) packet. Now, according to http://wiki.freeradius.org/config/Operators, operator ":=" has the same meaning as a reply item than as a check item. As a check item, it "replaces in the configuration items any attribute of the same name. If no attribute of that name appears in the request, then this attribute is added." How should that idea of replacement of "any attribute of the same name" then be interpreted? TIA, Axel

2 3