- Freeradius-Users - lists.freeradius.org

How to chroot FreeRadius
by Sven_Menschner＠drewag.de 31 Jul '14

31 Jul '14

I have set up FreeRADIUS 2.1.12 on Debian for authentication in a WPA2-Enterprise environment. Now I'd like to jail it with chroot. There is a parameter in radiusd.conf configuration file pointing to the chroot location: #chroot = /opt/jail/freeradius But with the documentation inside of radiusd.conf I can't figure out what files and dirs needs to be inside the chroot directory. I have figured out that I need /var/run/freeradius, /var/log/freeradius and the /etc/freeradius directory containing the configuration files and modules. Do I really need to put the latter into the jail or can they stay outside and be read on freeradius startup before the chroot is performed? If not, do I need all files or only those being actually used in my deployment? As pointed out before, I am only using authentication features. Many thanks in advance. Sven Menschner ------------------------------------------------------------------------- DREWAG - Stadtwerke Dresden GmbH Sitz der Gesellschaft: Dresden Geschäftsführer: Reiner Zieschank (Sprecher), Dr. Reinhard Richter Vorsitzende des Aufsichtsrates: Helma Orosz, Oberbürgermeisterin Registergericht: Amtsgericht Dresden HRB 2626 ------------------------------------------------------------------------- DREWAG - das heißt für Sie: sehr guter Service und ein faires Preis-Leistungs-Verhältnis! 2013 wurde die DREWAG wiederholt vom Wirtschaftsmagazin FOCUS-Money als einer der fairsten Stromversorger Deutschlands ausgezeichnet.

1 0

LDAP Scope
by Stuart Naylor 31 Jul '14

31 Jul '14

Many thanks, Mega fast replies guys and also thanks to Fajar Nugraha :) Stuart -----Original message----- > From:freeradius-users-request@lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> > Sent: Thursday 31st July 2014 11:05 > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 111, Issue 87 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE: Freeradius-Users Digest, Vol 111, Issue 84 (Stefan Paetow) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 31 Jul 2014 09:53:03 +0000 > From: Stefan Paetow <Stefan.Paetow(a)ja.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius-Users Digest, Vol 111, Issue 84 > Message-ID: <C072996E0B81144DBB9426B44462540C0D691CE3@EXC001> > Content-Type: text/plain; charset="us-ascii" > > Stuart: > > https://launchpad.net/~freeradius/+archive/ubuntu/testing-3.x > > These builds are being maintained by Fajar Nugraha, who is also very active on this list. > > Please note, you *must* uninstall FR 2.x and then move your configuration away from the standard /etc/freeradius before installing these, as FR 2.x configuration files are not entirely compatible with FR 3.x. It is recommended that you copy the changes in your 2.x configuration to 3.x manually. > > :-) > > Stefan > > -----Original Message----- > From: freeradius-users-bounces+stefan.paetow=ja.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org] On Behalf Of Stuart Naylor > Sent: 31 July 2014 10:33 > To: freeradius-users(a)lists.freeradius.org > Subject: RE: Freeradius-Users Digest, Vol 111, Issue 84 > > Thanks Arran , > > Apols as stuck back in time due to Ubuntu. > > Are there any debs anywhere is the compiler always scares this noob :) > > Just had a search and everything is firmly stuck in the land of 2.0 series. > > Is there anyway to add multiple ldap search queries with different base DNs. > > Just stuck as bit stumped that scope=sub isn't supported?! > > Stuart > > > > > -----Original message----- > > From:freeradius-users-request@lists.freeradius.org > > <freeradius-users-request(a)lists.freeradius.org> > > Sent: Thursday 31st July 2014 0:45 > > To: freeradius-users(a)lists.freeradius.org > > Subject: Freeradius-Users Digest, Vol 111, Issue 84 > > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. RE: Freeradius Log with Rsyslog (Puzzel) > > 2. Re: Multivalued attributes (Herwin Weststrate) > > 3. TLS Alert: Fatal: Protocol version (Soham T. Aurangabadkar) > > 4. LDAP scope (Stuart Naylor) > > 5. Re: LDAP scope (Arran Cudbard-Bell) > > 6. Re: Some inconsistencies concerning OpenSSL include > > configuration in FRS 3 (Arran Cudbard-Bell) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Wed, 30 Jul 2014 19:56:02 +0200 > > From: "Puzzel" <puzzel1982(a)gmail.com> > > To: "'FreeRadius users mailing list'" > > <freeradius-users(a)lists.freeradius.org> > > Subject: RE: Freeradius Log with Rsyslog > > Message-ID: <009f01cfac1f$87e243b0$97a6cb10$@com> > > Content-Type: text/plain; charset="us-ascii" > > > > You need to install rsyslog daemon on radius machine. > > Then in /etc/rsyslog.conf > > > > # Save radius logs into file > > > > local1.* /var/log/radius/radius.log > > > > # All to syslog server > > > > *.* @ip_address_of_your_syslog_server > > > > It works fine form me > > > > -----Original Message----- > > From: > > freeradius-users-bounces+puzzel1982=gmail.com(a)lists.freeradius.org > > [mailto:freeradius-users-bounces+puzzel1982=gmail.com@lists.freeradius > > .org] > > On Behalf Of Marco Aresu > > Sent: Wednesday, July 30, 2014 3:43 PM > > To: FreeRadius users mailing list > > Subject: Freeradius Log with Rsyslog > > > > Hi all, > > > > i ve configured Freeradius on my server and i would like to forward > > authentication log to an external server. > > I saw in the forum that i have to change Logdir from file to syslog > > but where do i have to specify the destination server? > > > > Thanks > > > > Marco Aresu > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Wed, 30 Jul 2014 20:08:06 +0200 > > From: Herwin Weststrate <herwin(a)quarantainenet.nl> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: Multivalued attributes > > Message-ID: <53D93486.6060203(a)quarantainenet.nl> > > Content-Type: text/plain; charset=windows-1252 > > > > On 30-07-14 11:51, Phil Mayers wrote: > > > On 30/07/14 09:21, Herwin Weststrate wrote: > > > > > >> What would the semantics be if a negative comparison operator would > > >> be used, like this? > > >> > > >> if (Attr[*] !~ /regex/) > > >> > > >> My intuition would say this would only be true if none of the > > >> attributes matches, instead of if at least one of the attributes matches. > > > > > > Assuming I've understood correctly, using the analogy of the > > > postgres operator, this is more like: > > > > > > if (any Attr !~ /regex/) > > > > > > i.e. if any of the attributes *don't* match. > > > > That would make the following two expressions different: > > > > if (Attr[*] !~ /regex/) > > if (!(Attr[*] =~ /regex/)) > > > > First one is true if any of the attributes doesn't match the regex, > > the second one if none of the attribute match the regex. I would > > expect them to return the same. There might be some rule or lemma in > > mathematical set theory here, but I'm not really sure about that > > (especially since that would probably require explicit any/all-modifiers). > > > > > The regex operators would presumably have the special behaviour of > > > setting capture groups for the first of the attributes. This doesn't > > > have much meaning for !~ > > > > Using capture groups with !~ would require an else (because if the > > regex doesn't match, there are no capture groups). Using code like > > that would just be stupid: > > > > if (Attr !~ /(regex)/) { > > ... > > } else { > > # Do someting with %{1} > > } > > > > Just write it a little bit different and use =~. But this discussion > > is not really related to multivalued attributes. > > > > >> And I'm not sure what the expected result should be in the > > >> following > > >> statement: > > >> > > >> if (Attr[*] > 10) > > > > > > Likewise > > > > > > if (any Attr > 10) > > > > This gives the same behaviour as with !~, I would expect these two to > > be the same > > > > if (Attr[*] > 10) > > if (!(Attr[*] <= 9)) > > > > About a year ago I was working on a small filtering language for an > > API which required multi-valued attributes. We changed the use of >, > > <, <= and >= to yield to syntax errors when combined with multi-valued > > attributes, because nobody here really knew what they were supposed to > > do in this context. > > > > -- > > Herwin Weststrate > > > > > > ------------------------------ > > > > Message: 3 > > Date: Wed, 30 Jul 2014 16:06:21 -0400 (EDT) > > From: "Soham T. Aurangabadkar" <sohama4(a)ccs.neu.edu> > > To: freeradius-users(a)lists.freeradius.org > > Subject: TLS Alert: Fatal: Protocol version > > Message-ID: <10005916.567041406750781574.JavaMail.root@zimbra> > > Content-Type: text/plain; charset=utf-8 > > > > Hello, I am getting a strange error in my FreeRADIUS debug output, > > which I have posted below. I have built the client using C, OpenSSL > > and raw sockets, and uses the 'user(a)example.com.pem' certificate > > generated by the scripts provided in /raddb/certs. Can you please tell > > me where am I going wrong? It is an error at the penultimate step of > > the EAP-TLS exchange. Thank you ! :) > > > > - Soham > > > > > > > > rad_recv: Access-Request packet from host 192.168.1.11 port 62733, id=254, length=829 > > User-Name = "sohama411111" > > Called-Station-Id = "ec-e5-55-9c-c3-b6" > > Calling-Station-Id = "00:24:9b:0c:2f:6e" > > NAS-Identifier = "ec-e5-55-9c-c3-ac" > > NAS-IP-Address = 192.168.1.11 > > NAS-Port = 6 > > Framed-MTU = 1500 > > NAS-Port-Type = Ethernet > > State = 0xa2a1f780a7a7fad11c1fdcdf4905f39b > > EAP-Message = 0x020602a00d8000000a825997f20225258bb1ff09cf6b173f27777f32ed2ef263a69ea7500fa0df24d984336cfaa193a9be78c06dc15278b6ef4b7cd930d166dd8427b3d155235edc0ce87fedcb214f913db8080089ccb1c651ec2042c9f1f8438926650157af19f77f059a5be97bb32f4c522230719d03a1f6553f3e311249f84eb6bb6740d218c346fe6fb5e08a471fe90bce818d62480b66b82412ff00a1fde2d7e9e2ef2c09d9dcddb20923c9d911fc13aa74742728bf7a2228a1a3de6cb4e9375b66638d73dee5d6dfde7144f8d701a9e16304225c983231cb1bbf1d67f713eb13d5ad916e404c71160301004610000042410414242a58afc24797 > > EAP-Message = 0x1adbed2ab769f9d1840a5956aad1bc07ec4de29645f706568bdeb474f455be264384b32a21ef52fa83a0ce73f1eb065a0a67cde112c2082916030101060f0001020100cb37b6b39e07acbe5db0119c5f7bc8d2aef80ae74c33c1c7c4e3a85bdb9d98a0c540d9d16d6f08d0e019b1fce07a337e9869e079519f2f65161a744f38b0a3e541461a74c2c05adebde38b07c6c6d7301be51de656cf231ff4d58e4836e09633bdc379bca36a538b5bc4646e2a212b9c436af8749840e14d646268d52770f263e0bcbc965b37ae0d0dbb5e3e259882a29cdfb0f7eaba21d984748d017f4e495bcbe909d71e2f7a3d08689a49d9479e4887ea0558293d4e0dcc74 > > EAP-Message = 0x61e3d33b48576d468e293468648476786964d5d050203aa0706fef1426432c3e5f5e49d33f77148209d34f01928db02b6b8d30338b9fd51e589b57576217a16c19c5a60bc875140301000101160301003099875a615089ecf3a1b21b7297c276f5bc8ab7be2f85d981f32a93c53ba178cf38c3be709ef5a241f1641f18bfc86cff1503010020ecc14febfeb1efd89ca273228fabc163f4d2536f8077de497b8257f10c0cfd80 > > Message-Authenticator = 0xb2addbdef36eea66889ed2c3e3ee302e > > # Executing section authorize from file > > /usr/local/etc/raddb/sites-enabled/default > > +group authorize { > > ++[preprocess] = ok > > ++[chap] = noop > > ++[mschap] = noop > > ++[digest] = noop > > [suffix] No '@' in User-Name = "sohama411111", looking up realm NULL > > [suffix] No such realm "NULL" > > ++[suffix] = noop > > [eap] EAP packet type response id 6 length 253 [eap] No EAP Start, > > assuming it's an on-going EAP conversation > > ++[eap] = updated > > ++[files] = noop > > ++[expiration] = noop > > ++[logintime] = noop > > ++[pap] = noop > > +} # group authorize = updated > > Found Auth-Type = EAP > > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > > +group authenticate { > > [eap] Request found, released from the list [eap] EAP/tls [eap] > > processing type tls [tls] Authenticate [tls] processing EAP-TLS > > TLS Length 2690 > > [tls] Length Included > > [tls] eaptls_verify returned 11 > > [tls] <<< TLS 1.0 Handshake [length 08c7], Certificate [tls] > > chain-depth=1, [tls] error=0 [tls] --> User-Name = sohama411111 [tls] > > --> BUF-Name = Example Certificate Authority [tls] --> subject = > > /C=FR/ST=Radius/L=Somewhere/O=Example > > Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority > > [tls] --> issuer = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority [tls] --> verify return:1 > > TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" > > [tls] chain-depth=0, > > [tls] error=0 > > [tls] --> User-Name = sohama411111 > > [tls] --> BUF-Name = sohama4(a)gmail.com [tls] --> subject = > > /C=FR/ST=Radius/O=Example > > Inc./CN=sohama4@gmail.com/emailAddress=sohama4@gmail.com > > [tls] --> issuer = /C=FR/ST=Radius/L=Somewhere/O=Example > > Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority [tls] --> verify return:1 > > [tls] TLS_accept: SSLv3 read client certificate A > > [tls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange > > [tls] TLS_accept: SSLv3 read client key exchange A > > [tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify > > [tls] TLS_accept: SSLv3 read certificate verify A > > [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [tls] <<< TLS 1.0 > > Handshake [length 0010], Finished > > [tls] TLS_accept: SSLv3 read finished A > > [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] > > [tls] TLS_accept: SSLv3 write change cipher spec A > > [tls] >>> TLS 1.0 Handshake [length 0010], Finished > > [tls] TLS_accept: SSLv3 write finished A > > [tls] TLS_accept: SSLv3 flush data > > [tls] (other): SSL negotiation finished successfully > > [tls] <<< TLS 1.0 Alert [length 0002], fatal protocol_version TLS > > Alert read:fatal:protocol version > > rlm_eap: SSL error error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 > > alert protocol version SSL Connection Established [tls] eaptls_process > > returned 13 > > ++[eap] = handled > > +} # group authenticate = handled > > Sending Access-Challenge of id 254 to 192.168.1.11 port 62733 > > EAP-Message = 0x010700450d800000003b1403010001011603010030fcca5a85d37c2ec29f40904ccb9dbe3ac886668b24f36a70ea88aed096ed2520ee567dcce866caf89a455cdc9b1421ed > > Message-Authenticator = 0x00000000000000000000000000000000 > > State = 0xa2a1f780a4a6fad11c1fdcdf4905f39b > > Finished request 6. > > Going to the next request > > Waking up in 2.2 seconds. > > rad_recv: Access-Request packet from host 192.168.1.11 port 62733, id=255, length=159 > > User-Name = "sohama411111" > > Called-Station-Id = "ec-e5-55-9c-c3-b6" > > Calling-Station-Id = "00:24:9b:0c:2f:6e" > > NAS-Identifier = "ec-e5-55-9c-c3-ac" > > NAS-IP-Address = 192.168.1.11 > > NAS-Port = 6 > > Framed-MTU = 1500 > > NAS-Port-Type = Ethernet > > State = 0xa2a1f780a4a6fad11c1fdcdf4905f39b > > EAP-Message = 0x020700060d00 > > Message-Authenticator = 0x9edad03d955fdbb9df9945226a174d53 > > # Executing section authorize from file > > /usr/local/etc/raddb/sites-enabled/default > > +group authorize { > > ++[preprocess] = ok > > ++[chap] = noop > > ++[mschap] = noop > > ++[digest] = noop > > [suffix] No '@' in User-Name = "sohama411111", looking up realm NULL > > [suffix] No such realm "NULL" > > ++[suffix] = noop > > [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, > > assuming it's an on-going EAP conversation > > ++[eap] = updated > > ++[files] = noop > > ++[expiration] = noop > > ++[logintime] = noop > > ++[pap] = noop > > +} # group authorize = updated > > Found Auth-Type = EAP > > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > > +group authenticate { > > [eap] Request found, released from the list [eap] EAP/tls [eap] > > processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] > > Received TLS ACK [tls] ACK alert [tls] eaptls_verify returned 4 [tls] > > eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed > > in EAP select > > ++[eap] = invalid > > +} # group authenticate = invalid > > Failed to authenticate the user. > > Using Post-Auth-Type REJECT > > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > > +group REJECT { > > [attr_filter.access_reject] expand: %{User-Name} -> sohama411111 > > attr_filter: Matched entry DEFAULT at line 11 > > ++[attr_filter.access_reject] = updated > > +} # group REJECT = updated > > Delaying reject of request 7 for 1 seconds Going to the next request > > Waking up in 0.9 seconds. > > Sending delayed reject for request 7 > > Sending Access-Reject of id 255 to 192.168.1.11 port 62733 > > EAP-Message = 0x04070004 > > Message-Authenticator = 0x00000000000000000000000000000000 > > Waking up in 1.2 seconds. > > Cleaning up request 0 ID 248 with timestamp +21 Waking up in 2.6 > > seconds. > > Cleaning up request 1 ID 249 with timestamp +24 Cleaning up request 2 > > ID 250 with timestamp +24 Cleaning up request 3 ID 251 with timestamp > > +24 Cleaning up request 4 ID 252 with timestamp +24 Cleaning up > > request 5 ID 253 with timestamp +24 Cleaning up request 6 ID 254 with > > timestamp +24 Waking up in 1.0 seconds. > > Cleaning up request 7 ID 255 with timestamp +24 > > > > > > ------------------------------ > > > > Message: 4 > > Date: Wed, 30 Jul 2014 23:59:35 +0100 > > From: Stuart Naylor <stuartiannaylor(a)thursbygarden.org> > > To: freeradius-users(a)lists.freeradius.org > > <freeradius-users(a)lists.freeradius.org> > > Subject: LDAP scope > > Message-ID: > > <zarafa.53d978d7.73bf.594fda2e60fe5c48(a)zent1.thursbygarden.lan> > > Content-Type: text/plain; charset=utf-8 > > > > Hi, > > > > I am having problems with ldap. > > > > I am running FreeRADIUS Version 2.1.12 and Samba4 and the LDAP searches are not subtree searches. > > > > I have to add the CN=Users to the base DN and it works. > > > > If I want to search from the base DN I get an ldap search error. > > > > Is there anyway to set the search scope to subtree? > > > > Stuart > > > > > > > > > > ------------------------------ > > > > Message: 5 > > Date: Wed, 30 Jul 2014 19:40:48 -0400 > > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: LDAP scope > > Message-ID: <42D1F2C2-5061-45D0-9833-29709DF2A8EF(a)freeradius.org> > > Content-Type: text/plain; charset="us-ascii" > > > > > > On 30 Jul 2014, at 18:59, Stuart Naylor <stuartiannaylor(a)thursbygarden.org> wrote: > > > > > Hi, > > > > > > I am having problems with ldap. > > > > > > I am running FreeRADIUS Version 2.1.12 and Samba4 and the LDAP searches are not subtree searches. > > > > > > I have to add the CN=Users to the base DN and it works. > > > > > > If I want to search from the base DN I get an ldap search error. > > > > > > Is there anyway to set the search scope to subtree? > > > > 1. Download v3.0.3 > > 2. Install v3.0.3 > > 3. Enjoy the ability to alter search scopes for LDAP objects > > > > -Arran > > > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development > > team > > > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > > -------------- next part -------------- A non-text attachment was > > scrubbed... > > Name: signature.asc > > Type: application/pgp-signature > > Size: 881 bytes > > Desc: Message signed with OpenPGP using GPGMail > > URL: > > <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20 > > 140730/ed95504f/attachment-0001.pgp> > > > > ------------------------------ > > > > Message: 6 > > Date: Wed, 30 Jul 2014 19:42:24 -0400 > > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: Some inconsistencies concerning OpenSSL include > > configuration in FRS 3 > > Message-ID: <DD0F2DD5-2CF8-4BE4-817D-29FACC737F60(a)freeradius.org> > > Content-Type: text/plain; charset="us-ascii" > > > > > > On 29 Jul 2014, at 12:55, Dr. Andreas Rieke <rieke(a)isl.de> wrote: > > > > > Arran Cudbard-Bell wrote: > > >> > > >> On 29 Jul 2014, at 06:05, Dr. Andreas Rieke <rieke(a)isl.de> wrote: > > >> > > >>> Arran Cudbard-Bell wrote: > > >>>> Should work now without dumb hacks... > > >>> I have tested your solution, too, and it also works well. However, there is a small difference between your an Alan's appraoch: With Alan's suggestion, the rlm_wimax shared object does not have any references to openssl, whereas in your approch, ldd says that both libssl and libcrypto are required. > > >>> > > >>> I do not know which one is correct, > > >> > > >> Mine, seeing as the module uses symbols from those libraries. > > >> > > >> Technically it probably only needs libcrypto, but never mind. > > >> > > > Thanks a lot to Alan and you, Arran, for your time and for your > > > patience with a newbie on this list, > > > > No problem, thanks for reporting the OpenSSL issues. > > > > -Arran > > > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development > > team > > > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > > -------------- next part -------------- A non-text attachment was > > scrubbed... > > Name: signature.asc > > Type: application/pgp-signature > > Size: 881 bytes > > Desc: Message signed with OpenPGP using GPGMail > > URL: > > <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20 > > 140730/df2937ad/attachment.pgp> > > > > ------------------------------ > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > End of Freeradius-Users Digest, Vol 111, Issue 84 > > ************************************************* > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > Janet(UK) is a trading name of Jisc Collections and Janet Limited, a > not-for-profit company which is registered in England under No. 2881024 > and whose Registered Office is at Lumen House, Library Avenue, > Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238 > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 111, Issue 87 > ************************************************* >

1 0

RE: Freeradius-Users Digest, Vol 111, Issue 84
by Stuart Naylor 31 Jul '14

31 Jul '14

Thanks Arran , Apols as stuck back in time due to Ubuntu. Are there any debs anywhere is the compiler always scares this noob :) Just had a search and everything is firmly stuck in the land of 2.0 series. Is there anyway to add multiple ldap search queries with different base DNs. Just stuck as bit stumped that scope=sub isn't supported?! Stuart -----Original message----- > From:freeradius-users-request@lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> > Sent: Thursday 31st July 2014 0:45 > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 111, Issue 84 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE: Freeradius Log with Rsyslog (Puzzel) > 2. Re: Multivalued attributes (Herwin Weststrate) > 3. TLS Alert: Fatal: Protocol version (Soham T. Aurangabadkar) > 4. LDAP scope (Stuart Naylor) > 5. Re: LDAP scope (Arran Cudbard-Bell) > 6. Re: Some inconsistencies concerning OpenSSL include > configuration in FRS 3 (Arran Cudbard-Bell) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 30 Jul 2014 19:56:02 +0200 > From: "Puzzel" <puzzel1982(a)gmail.com> > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius Log with Rsyslog > Message-ID: <009f01cfac1f$87e243b0$97a6cb10$@com> > Content-Type: text/plain; charset="us-ascii" > > You need to install rsyslog daemon on radius machine. > Then in /etc/rsyslog.conf > > # Save radius logs into file > > local1.* /var/log/radius/radius.log > > # All to syslog server > > *.* @ip_address_of_your_syslog_server > > It works fine form me > > -----Original Message----- > From: freeradius-users-bounces+puzzel1982=gmail.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+puzzel1982=gmail.com@lists.freeradius.org] > On Behalf Of Marco Aresu > Sent: Wednesday, July 30, 2014 3:43 PM > To: FreeRadius users mailing list > Subject: Freeradius Log with Rsyslog > > Hi all, > > i ve configured Freeradius on my server and i would like to forward > authentication log to an external server. > I saw in the forum that i have to change Logdir from file to syslog but > where do i have to specify the destination server? > > Thanks > > Marco Aresu > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Message: 2 > Date: Wed, 30 Jul 2014 20:08:06 +0200 > From: Herwin Weststrate <herwin(a)quarantainenet.nl> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Multivalued attributes > Message-ID: <53D93486.6060203(a)quarantainenet.nl> > Content-Type: text/plain; charset=windows-1252 > > On 30-07-14 11:51, Phil Mayers wrote: > > On 30/07/14 09:21, Herwin Weststrate wrote: > > > >> What would the semantics be if a negative comparison operator would be > >> used, like this? > >> > >> if (Attr[*] !~ /regex/) > >> > >> My intuition would say this would only be true if none of the attributes > >> matches, instead of if at least one of the attributes matches. > > > > Assuming I've understood correctly, using the analogy of the postgres > > operator, this is more like: > > > > if (any Attr !~ /regex/) > > > > i.e. if any of the attributes *don't* match. > > That would make the following two expressions different: > > if (Attr[*] !~ /regex/) > if (!(Attr[*] =~ /regex/)) > > First one is true if any of the attributes doesn't match the regex, the > second one if none of the attribute match the regex. I would expect them > to return the same. There might be some rule or lemma in mathematical > set theory here, but I'm not really sure about that (especially since > that would probably require explicit any/all-modifiers). > > > The regex operators would presumably have the special behaviour of > > setting capture groups for the first of the attributes. This doesn't > > have much meaning for !~ > > Using capture groups with !~ would require an else (because if the regex > doesn't match, there are no capture groups). Using code like that would > just be stupid: > > if (Attr !~ /(regex)/) { > ... > } else { > # Do someting with %{1} > } > > Just write it a little bit different and use =~. But this discussion is > not really related to multivalued attributes. > > >> And I'm not sure what the expected result should be in the following > >> statement: > >> > >> if (Attr[*] > 10) > > > > Likewise > > > > if (any Attr > 10) > > This gives the same behaviour as with !~, I would expect these two to be > the same > > if (Attr[*] > 10) > if (!(Attr[*] <= 9)) > > About a year ago I was working on a small filtering language for an API > which required multi-valued attributes. We changed the use of >, <, <= > and >= to yield to syntax errors when combined with multi-valued > attributes, because nobody here really knew what they were supposed to > do in this context. > > -- > Herwin Weststrate > > > ------------------------------ > > Message: 3 > Date: Wed, 30 Jul 2014 16:06:21 -0400 (EDT) > From: "Soham T. Aurangabadkar" <sohama4(a)ccs.neu.edu> > To: freeradius-users(a)lists.freeradius.org > Subject: TLS Alert: Fatal: Protocol version > Message-ID: <10005916.567041406750781574.JavaMail.root@zimbra> > Content-Type: text/plain; charset=utf-8 > > Hello, I am getting a strange error in my FreeRADIUS debug output, which I have posted below. I have built the client using C, OpenSSL and raw sockets, and uses the 'user(a)example.com.pem' certificate generated by the scripts provided in /raddb/certs. Can you please tell me where am I going wrong? It is an error at the penultimate step of the EAP-TLS exchange. Thank you ! :) > > - Soham > > > > rad_recv: Access-Request packet from host 192.168.1.11 port 62733, id=254, length=829 > User-Name = "sohama411111" > Called-Station-Id = "ec-e5-55-9c-c3-b6" > Calling-Station-Id = "00:24:9b:0c:2f:6e" > NAS-Identifier = "ec-e5-55-9c-c3-ac" > NAS-IP-Address = 192.168.1.11 > NAS-Port = 6 > Framed-MTU = 1500 > NAS-Port-Type = Ethernet > State = 0xa2a1f780a7a7fad11c1fdcdf4905f39b > EAP-Message = 0x020602a00d8000000a825997f20225258bb1ff09cf6b173f27777f32ed2ef263a69ea7500fa0df24d984336cfaa193a9be78c06dc15278b6ef4b7cd930d166dd8427b3d155235edc0ce87fedcb214f913db8080089ccb1c651ec2042c9f1f8438926650157af19f77f059a5be97bb32f4c522230719d03a1f6553f3e311249f84eb6bb6740d218c346fe6fb5e08a471fe90bce818d62480b66b82412ff00a1fde2d7e9e2ef2c09d9dcddb20923c9d911fc13aa74742728bf7a2228a1a3de6cb4e9375b66638d73dee5d6dfde7144f8d701a9e16304225c983231cb1bbf1d67f713eb13d5ad916e404c71160301004610000042410414242a58afc24797 > EAP-Message = 0x1adbed2ab769f9d1840a5956aad1bc07ec4de29645f706568bdeb474f455be264384b32a21ef52fa83a0ce73f1eb065a0a67cde112c2082916030101060f0001020100cb37b6b39e07acbe5db0119c5f7bc8d2aef80ae74c33c1c7c4e3a85bdb9d98a0c540d9d16d6f08d0e019b1fce07a337e9869e079519f2f65161a744f38b0a3e541461a74c2c05adebde38b07c6c6d7301be51de656cf231ff4d58e4836e09633bdc379bca36a538b5bc4646e2a212b9c436af8749840e14d646268d52770f263e0bcbc965b37ae0d0dbb5e3e259882a29cdfb0f7eaba21d984748d017f4e495bcbe909d71e2f7a3d08689a49d9479e4887ea0558293d4e0dcc74 > EAP-Message = 0x61e3d33b48576d468e293468648476786964d5d050203aa0706fef1426432c3e5f5e49d33f77148209d34f01928db02b6b8d30338b9fd51e589b57576217a16c19c5a60bc875140301000101160301003099875a615089ecf3a1b21b7297c276f5bc8ab7be2f85d981f32a93c53ba178cf38c3be709ef5a241f1641f18bfc86cff1503010020ecc14febfeb1efd89ca273228fabc163f4d2536f8077de497b8257f10c0cfd80 > Message-Authenticator = 0xb2addbdef36eea66889ed2c3e3ee302e > # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default > +group authorize { > ++[preprocess] = ok > ++[chap] = noop > ++[mschap] = noop > ++[digest] = noop > [suffix] No '@' in User-Name = "sohama411111", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] = noop > [eap] EAP packet type response id 6 length 253 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] = updated > ++[files] = noop > ++[expiration] = noop > ++[logintime] = noop > ++[pap] = noop > +} # group authorize = updated > Found Auth-Type = EAP > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > +group authenticate { > [eap] Request found, released from the list > [eap] EAP/tls > [eap] processing type tls > [tls] Authenticate > [tls] processing EAP-TLS > TLS Length 2690 > [tls] Length Included > [tls] eaptls_verify returned 11 > [tls] <<< TLS 1.0 Handshake [length 08c7], Certificate > [tls] chain-depth=1, > [tls] error=0 > [tls] --> User-Name = sohama411111 > [tls] --> BUF-Name = Example Certificate Authority > [tls] --> subject = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority > [tls] --> issuer = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority > [tls] --> verify return:1 > TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" > [tls] chain-depth=0, > [tls] error=0 > [tls] --> User-Name = sohama411111 > [tls] --> BUF-Name = sohama4(a)gmail.com > [tls] --> subject = /C=FR/ST=Radius/O=Example Inc./CN=sohama4@gmail.com/emailAddress=sohama4@gmail.com > [tls] --> issuer = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority > [tls] --> verify return:1 > [tls] TLS_accept: SSLv3 read client certificate A > [tls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange > [tls] TLS_accept: SSLv3 read client key exchange A > [tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify > [tls] TLS_accept: SSLv3 read certificate verify A > [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] > [tls] <<< TLS 1.0 Handshake [length 0010], Finished > [tls] TLS_accept: SSLv3 read finished A > [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] > [tls] TLS_accept: SSLv3 write change cipher spec A > [tls] >>> TLS 1.0 Handshake [length 0010], Finished > [tls] TLS_accept: SSLv3 write finished A > [tls] TLS_accept: SSLv3 flush data > [tls] (other): SSL negotiation finished successfully > [tls] <<< TLS 1.0 Alert [length 0002], fatal protocol_version > TLS Alert read:fatal:protocol version > rlm_eap: SSL error error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version > SSL Connection Established > [tls] eaptls_process returned 13 > ++[eap] = handled > +} # group authenticate = handled > Sending Access-Challenge of id 254 to 192.168.1.11 port 62733 > EAP-Message = 0x010700450d800000003b1403010001011603010030fcca5a85d37c2ec29f40904ccb9dbe3ac886668b24f36a70ea88aed096ed2520ee567dcce866caf89a455cdc9b1421ed > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xa2a1f780a4a6fad11c1fdcdf4905f39b > Finished request 6. > Going to the next request > Waking up in 2.2 seconds. > rad_recv: Access-Request packet from host 192.168.1.11 port 62733, id=255, length=159 > User-Name = "sohama411111" > Called-Station-Id = "ec-e5-55-9c-c3-b6" > Calling-Station-Id = "00:24:9b:0c:2f:6e" > NAS-Identifier = "ec-e5-55-9c-c3-ac" > NAS-IP-Address = 192.168.1.11 > NAS-Port = 6 > Framed-MTU = 1500 > NAS-Port-Type = Ethernet > State = 0xa2a1f780a4a6fad11c1fdcdf4905f39b > EAP-Message = 0x020700060d00 > Message-Authenticator = 0x9edad03d955fdbb9df9945226a174d53 > # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default > +group authorize { > ++[preprocess] = ok > ++[chap] = noop > ++[mschap] = noop > ++[digest] = noop > [suffix] No '@' in User-Name = "sohama411111", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] = noop > [eap] EAP packet type response id 7 length 6 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] = updated > ++[files] = noop > ++[expiration] = noop > ++[logintime] = noop > ++[pap] = noop > +} # group authorize = updated > Found Auth-Type = EAP > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > +group authenticate { > [eap] Request found, released from the list > [eap] EAP/tls > [eap] processing type tls > [tls] Authenticate > [tls] processing EAP-TLS > [tls] Received TLS ACK > [tls] ACK alert > [tls] eaptls_verify returned 4 > [tls] eaptls_process returned 4 > [eap] Handler failed in EAP/tls > [eap] Failed in EAP select > ++[eap] = invalid > +} # group authenticate = invalid > Failed to authenticate the user. > Using Post-Auth-Type REJECT > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > +group REJECT { > [attr_filter.access_reject] expand: %{User-Name} -> sohama411111 > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] = updated > +} # group REJECT = updated > Delaying reject of request 7 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 7 > Sending Access-Reject of id 255 to 192.168.1.11 port 62733 > EAP-Message = 0x04070004 > Message-Authenticator = 0x00000000000000000000000000000000 > Waking up in 1.2 seconds. > Cleaning up request 0 ID 248 with timestamp +21 > Waking up in 2.6 seconds. > Cleaning up request 1 ID 249 with timestamp +24 > Cleaning up request 2 ID 250 with timestamp +24 > Cleaning up request 3 ID 251 with timestamp +24 > Cleaning up request 4 ID 252 with timestamp +24 > Cleaning up request 5 ID 253 with timestamp +24 > Cleaning up request 6 ID 254 with timestamp +24 > Waking up in 1.0 seconds. > Cleaning up request 7 ID 255 with timestamp +24 > > > ------------------------------ > > Message: 4 > Date: Wed, 30 Jul 2014 23:59:35 +0100 > From: Stuart Naylor <stuartiannaylor(a)thursbygarden.org> > To: freeradius-users(a)lists.freeradius.org > <freeradius-users(a)lists.freeradius.org> > Subject: LDAP scope > Message-ID: > <zarafa.53d978d7.73bf.594fda2e60fe5c48(a)zent1.thursbygarden.lan> > Content-Type: text/plain; charset=utf-8 > > Hi, > > I am having problems with ldap. > > I am running FreeRADIUS Version 2.1.12 and Samba4 and the LDAP searches are not subtree searches. > > I have to add the CN=Users to the base DN and it works. > > If I want to search from the base DN I get an ldap search error. > > Is there anyway to set the search scope to subtree? > > Stuart > > > > > ------------------------------ > > Message: 5 > Date: Wed, 30 Jul 2014 19:40:48 -0400 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: LDAP scope > Message-ID: <42D1F2C2-5061-45D0-9833-29709DF2A8EF(a)freeradius.org> > Content-Type: text/plain; charset="us-ascii" > > > On 30 Jul 2014, at 18:59, Stuart Naylor <stuartiannaylor(a)thursbygarden.org> wrote: > > > Hi, > > > > I am having problems with ldap. > > > > I am running FreeRADIUS Version 2.1.12 and Samba4 and the LDAP searches are not subtree searches. > > > > I have to add the CN=Users to the base DN and it works. > > > > If I want to search from the base DN I get an ldap search error. > > > > Is there anyway to set the search scope to subtree? > > 1. Download v3.0.3 > 2. Install v3.0.3 > 3. Enjoy the ability to alter search scopes for LDAP objects > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS development team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > >

2 1

LDAP scope
by Stuart Naylor 31 Jul '14

31 Jul '14

Apols doh title -----Original message----- > From:freeradius-users-request@lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> > Sent: Thursday 31st July 2014 10:35 > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 111, Issue 85 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius Log with Rsyslog (Marco Aresu) > 2. Re: Multivalued attributes (Alan DeKok) > 3. RE: Freeradius Log with Rsyslog (Puzzel) > 4. Re: Freeradius Log with Rsyslog (Marco Aresu) > 5. RE: Freeradius-Users Digest, Vol 111, Issue 84 (Stuart Naylor) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 31 Jul 2014 10:32:14 +0200 > From: Marco Aresu <marcoaresu(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius Log with Rsyslog > Message-ID: > <CAKvBoPkuackJCBsHECj+LAn=THp75yMpHkbLfg4SsyksfWSxEQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi Puzzel, > > thanks for your reply, it seems to be ok. > Just last question, where i will choose the log level to send in the > syslog?Into Radiusd.conf file? > > Thanks > Marco > > Marco Aresu > > > On 30 July 2014 19:56, Puzzel <puzzel1982(a)gmail.com> wrote: > > You need to install rsyslog daemon on radius machine. > > Then in /etc/rsyslog.conf > > > > # Save radius logs into file > > > > local1.* /var/log/radius/radius.log > > > > # All to syslog server > > > > *.* @ip_address_of_your_syslog_server > > > > It works fine form me > > > > -----Original Message----- > > From: freeradius-users-bounces+puzzel1982=gmail.com(a)lists.freeradius.org > > [mailto:freeradius-users-bounces+puzzel1982=gmail.com@lists.freeradius.org] > > On Behalf Of Marco Aresu > > Sent: Wednesday, July 30, 2014 3:43 PM > > To: FreeRadius users mailing list > > Subject: Freeradius Log with Rsyslog > > > > Hi all, > > > > i ve configured Freeradius on my server and i would like to forward > > authentication log to an external server. > > I saw in the forum that i have to change Logdir from file to syslog but > > where do i have to specify the destination server? > > > > Thanks > > > > Marco Aresu > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 2 > Date: Thu, 31 Jul 2014 10:33:49 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Multivalued attributes > Message-ID: <53D9FF6D.1030004(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Herwin Weststrate wrote: > > That would make the following two expressions different: > > > > if (Attr[*] !~ /regex/) > > if (!(Attr[*] =~ /regex/)) > > In general, != and !~ should be the same as !(.. == ) and !(.. =~) > > > First one is true if any of the attributes doesn't match the regex, the > > second one if none of the attribute match the regex. I would expect them > > to return the same. There might be some rule or lemma in mathematical > > set theory here, but I'm not really sure about that (especially since > > that would probably require explicit any/all-modifiers). > > I'll try to remember my math. I'm sure I had this in one of my degrees. > > > About a year ago I was working on a small filtering language for an API > > which required multi-valued attributes. We changed the use of >, <, <= > > and >= to yield to syntax errors when combined with multi-valued > > attributes, because nobody here really knew what they were supposed to > > do in this context. > > Makes sense. > > Alan DeKok. > > > ------------------------------ > > Message: 3 > Date: Thu, 31 Jul 2014 10:49:31 +0200 > From: "Puzzel" <puzzel1982(a)gmail.com> > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius Log with Rsyslog > Message-ID: <00fd01cfac9c$59f15ea0$0dd41be0$@com> > Content-Type: text/plain; charset="us-ascii" > > Yes in radiusd.conf find the line "syslog_facility = local1" > > -----Original Message----- > From: freeradius-users-bounces+puzzel1982=gmail.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+puzzel1982=gmail.com@lists.freeradius.org] > On Behalf Of Marco Aresu > Sent: Thursday, July 31, 2014 10:32 AM > To: FreeRadius users mailing list > Subject: Re: Freeradius Log with Rsyslog > > Hi Puzzel, > > thanks for your reply, it seems to be ok. > Just last question, where i will choose the log level to send in the > syslog?Into Radiusd.conf file? > > Thanks > Marco > > Marco Aresu > > > On 30 July 2014 19:56, Puzzel <puzzel1982(a)gmail.com> wrote: > > You need to install rsyslog daemon on radius machine. > > Then in /etc/rsyslog.conf > > > > # Save radius logs into file > > > > local1.* /var/log/radius/radius.log > > > > # All to syslog server > > > > *.* @ip_address_of_your_syslog_server > > > > It works fine form me > > > > -----Original Message----- > > From: > > freeradius-users-bounces+puzzel1982=gmail.com(a)lists.freeradius.org > > [mailto:freeradius-users-bounces+puzzel1982=gmail.com@lists.freeradius > > .org] > > On Behalf Of Marco Aresu > > Sent: Wednesday, July 30, 2014 3:43 PM > > To: FreeRadius users mailing list > > Subject: Freeradius Log with Rsyslog > > > > Hi all, > > > > i ve configured Freeradius on my server and i would like to forward > > authentication log to an external server. > > I saw in the forum that i have to change Logdir from file to syslog > > but where do i have to specify the destination server? > > > > Thanks > > > > Marco Aresu > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Message: 4 > Date: Thu, 31 Jul 2014 11:12:46 +0200 > From: Marco Aresu <marcoaresu(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius Log with Rsyslog > Message-ID: > <CAKvBoPkbs++eHen+k_utT9cY-=Bn0k-Fw332V+Z_y6N2GWkCvg(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Puzzel, > > facility is working. Do you know if i will send to syslog Radacct > logs? I need them for verify authentication. > > Thanks > Marco > > Marco Aresu > > > On 31 July 2014 10:49, Puzzel <puzzel1982(a)gmail.com> wrote: > > Yes in radiusd.conf find the line "syslog_facility = local1" > > > > -----Original Message----- > > From: freeradius-users-bounces+puzzel1982=gmail.com(a)lists.freeradius.org > > [mailto:freeradius-users-bounces+puzzel1982=gmail.com@lists.freeradius.org] > > On Behalf Of Marco Aresu > > Sent: Thursday, July 31, 2014 10:32 AM > > To: FreeRadius users mailing list > > Subject: Re: Freeradius Log with Rsyslog > > > > Hi Puzzel, > > > > thanks for your reply, it seems to be ok. > > Just last question, where i will choose the log level to send in the > > syslog?Into Radiusd.conf file? > > > > Thanks > > Marco > > > > Marco Aresu > > > > > > On 30 July 2014 19:56, Puzzel <puzzel1982(a)gmail.com> wrote: > >> You need to install rsyslog daemon on radius machine. > >> Then in /etc/rsyslog.conf > >> > >> # Save radius logs into file > >> > >> local1.* /var/log/radius/radius.log > >> > >> # All to syslog server > >> > >> *.* @ip_address_of_your_syslog_server > >> > >> It works fine form me > >> > >> -----Original Message----- > >> From: > >> freeradius-users-bounces+puzzel1982=gmail.com(a)lists.freeradius.org > >> [mailto:freeradius-users-bounces+puzzel1982=gmail.com@lists.freeradius > >> .org] > >> On Behalf Of Marco Aresu > >> Sent: Wednesday, July 30, 2014 3:43 PM > >> To: FreeRadius users mailing list > >> Subject: Freeradius Log with Rsyslog > >> > >> Hi all, > >> > >> i ve configured Freeradius on my server and i would like to forward > >> authentication log to an external server. > >> I saw in the forum that i have to change Logdir from file to syslog > >> but where do i have to specify the destination server? > >> > >> Thanks > >> > >> Marco Aresu > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 5 > Date: Thu, 31 Jul 2014 10:32:38 +0100 > From: Stuart Naylor <stuartiannaylor(a)thursbygarden.org> > To: freeradius-users(a)lists.freeradius.org > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius-Users Digest, Vol 111, Issue 84 > Message-ID: > <zarafa.53da0d36.4554.3fc820511be3c041(a)zent1.thursbygarden.lan> > Content-Type: text/plain; charset=utf-8 > > Thanks Arran , > > Apols as stuck back in time due to Ubuntu. > > Are there any debs anywhere is the compiler always scares this noob :) > > Just had a search and everything is firmly stuck in the land of 2.0 series. > > Is there anyway to add multiple ldap search queries with different base DNs. > > Just stuck as bit stumped that scope=sub isn't supported?! > > Stuart > > > > > -----Original message----- > > From:freeradius-users-request@lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> > > Sent: Thursday 31st July 2014 0:45 > > To: freeradius-users(a)lists.freeradius.org > > Subject: Freeradius-Users Digest, Vol 111, Issue 84 > > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. RE: Freeradius Log with Rsyslog (Puzzel) > > 2. Re: Multivalued attributes (Herwin Weststrate) > > 3. TLS Alert: Fatal: Protocol version (Soham T. Aurangabadkar) > > 4. LDAP scope (Stuart Naylor) > > 5. Re: LDAP scope (Arran Cudbard-Bell) > > 6. Re: Some inconsistencies concerning OpenSSL include > > configuration in FRS 3 (Arran Cudbard-Bell) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Wed, 30 Jul 2014 19:56:02 +0200 > > From: "Puzzel" <puzzel1982(a)gmail.com> > > To: "'FreeRadius users mailing list'" > > <freeradius-users(a)lists.freeradius.org> > > Subject: RE: Freeradius Log with Rsyslog > > Message-ID: <009f01cfac1f$87e243b0$97a6cb10$@com> > > Content-Type: text/plain; charset="us-ascii" > > > > You need to install rsyslog daemon on radius machine. > > Then in /etc/rsyslog.conf > > > > # Save radius logs into file > > > > local1.* /var/log/radius/radius.log > > > > # All to syslog server > > > > *.* @ip_address_of_your_syslog_server > > > > It works fine form me > > > > -----Original Message----- > > From: freeradius-users-bounces+puzzel1982=gmail.com(a)lists.freeradius.org > > [mailto:freeradius-users-bounces+puzzel1982=gmail.com@lists.freeradius.org] > > On Behalf Of Marco Aresu > > Sent: Wednesday, July 30, 2014 3:43 PM > > To: FreeRadius users mailing list > > Subject: Freeradius Log with Rsyslog > > > > Hi all, > > > > i ve configured Freeradius on my server and i would like to forward > > authentication log to an external server. > > I saw in the forum that i have to change Logdir from file to syslog but > > where do i have to specify the destination server? > > > > Thanks > > > > Marco Aresu > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Wed, 30 Jul 2014 20:08:06 +0200 > > From: Herwin Weststrate <herwin(a)quarantainenet.nl> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: Multivalued attributes > > Message-ID: <53D93486.6060203(a)quarantainenet.nl> > > Content-Type: text/plain; charset=windows-1252 > > > > On 30-07-14 11:51, Phil Mayers wrote: > > > On 30/07/14 09:21, Herwin Weststrate wrote: > > > > > >> What would the semantics be if a negative comparison operator would be > > >> used, like this? > > >> > > >> if (Attr[*] !~ /regex/) > > >> > > >> My intuition would say this would only be true if none of the attributes > > >> matches, instead of if at least one of the attributes matches. > > > > > > Assuming I've understood correctly, using the analogy of the postgres > > > operator, this is more like: > > > > > > if (any Attr !~ /regex/) > > > > > > i.e. if any of the attributes *don't* match. > > > > That would make the following two expressions different: > > > > if (Attr[*] !~ /regex/) > > if (!(Attr[*] =~ /regex/)) > > > > First one is true if any of the attributes doesn't match the regex, the > > second one if none of the attribute match the regex. I would expect them > > to return the same. There might be some rule or lemma in mathematical > > set theory here, but I'm not really sure about that (especially since > > that would probably require explicit any/all-modifiers). > > > > > The regex operators would presumably have the special behaviour of > > > setting capture groups for the first of the attributes. This doesn't > > > have much meaning for !~ > > > > Using capture groups with !~ would require an else (because if the regex > > doesn't match, there are no capture groups). Using code like that would > > just be stupid: > > > > if (Attr !~ /(regex)/) { > > ... > > } else { > > # Do someting with %{1} > > } > > > > Just write it a little bit different and use =~. But this discussion is > > not really related to multivalued attributes. > > > > >> And I'm not sure what the expected result should be in the following > > >> statement: > > >> > > >> if (Attr[*] > 10) > > > > > > Likewise > > > > > > if (any Attr > 10) > > > > This gives the same behaviour as with !~, I would expect these two to be > > the same > > > > if (Attr[*] > 10) > > if (!(Attr[*] <= 9)) > > > > About a year ago I was working on a small filtering language for an API > > which required multi-valued attributes. We changed the use of >, <, <= > > and >= to yield to syntax errors when combined with multi-valued > > attributes, because nobody here really knew what they were supposed to > > do in this context. > > > > -- > > Herwin Weststrate > > > > > > ------------------------------ > > > > Message: 3 > > Date: Wed, 30 Jul 2014 16:06:21 -0400 (EDT) > > From: "Soham T. Aurangabadkar" <sohama4(a)ccs.neu.edu> > > To: freeradius-users(a)lists.freeradius.org > > Subject: TLS Alert: Fatal: Protocol version > > Message-ID: <10005916.567041406750781574.JavaMail.root@zimbra> > > Content-Type: text/plain; charset=utf-8 > > > > Hello, I am getting a strange error in my FreeRADIUS debug output, which I have posted below. I have built the client using C, OpenSSL and raw sockets, and uses the 'user(a)example.com.pem' certificate generated by the scripts provided in /raddb/certs. Can you please tell me where am I going wrong? It is an error at the penultimate step of the EAP-TLS exchange. Thank you ! :) > > > > - Soham > > > > > > > > rad_recv: Access-Request packet from host 192.168.1.11 port 62733, id=254, length=829 > > User-Name = "sohama411111" > > Called-Station-Id = "ec-e5-55-9c-c3-b6" > > Calling-Station-Id = "00:24:9b:0c:2f:6e" > > NAS-Identifier = "ec-e5-55-9c-c3-ac" > > NAS-IP-Address = 192.168.1.11 > > NAS-Port = 6 > > Framed-MTU = 1500 > > NAS-Port-Type = Ethernet > > State = 0xa2a1f780a7a7fad11c1fdcdf4905f39b > > EAP-Message = 0x020602a00d8000000a825997f20225258bb1ff09cf6b173f27777f32ed2ef263a69ea7500fa0df24d984336cfaa193a9be78c06dc15278b6ef4b7cd930d166dd8427b3d155235edc0ce87fedcb214f913db8080089ccb1c651ec2042c9f1f8438926650157af19f77f059a5be97bb32f4c522230719d03a1f6553f3e311249f84eb6bb6740d218c346fe6fb5e08a471fe90bce818d62480b66b82412ff00a1fde2d7e9e2ef2c09d9dcddb20923c9d911fc13aa74742728bf7a2228a1a3de6cb4e9375b66638d73dee5d6dfde7144f8d701a9e16304225c983231cb1bbf1d67f713eb13d5ad916e404c71160301004610000042410414242a58afc24797 > > EAP-Message = 0x1adbed2ab769f9d1840a5956aad1bc07ec4de29645f706568bdeb474f455be264384b32a21ef52fa83a0ce73f1eb065a0a67cde112c2082916030101060f0001020100cb37b6b39e07acbe5db0119c5f7bc8d2aef80ae74c33c1c7c4e3a85bdb9d98a0c540d9d16d6f08d0e019b1fce07a337e9869e079519f2f65161a744f38b0a3e541461a74c2c05adebde38b07c6c6d7301be51de656cf231ff4d58e4836e09633bdc379bca36a538b5bc4646e2a212b9c436af8749840e14d646268d52770f263e0bcbc965b37ae0d0dbb5e3e259882a29cdfb0f7eaba21d984748d017f4e495bcbe909d71e2f7a3d08689a49d9479e4887ea0558293d4e0dcc74 > > EAP-Message = 0x61e3d33b48576d468e293468648476786964d5d050203aa0706fef1426432c3e5f5e49d33f77148209d34f01928db02b6b8d30338b9fd51e589b57576217a16c19c5a60bc875140301000101160301003099875a615089ecf3a1b21b7297c276f5bc8ab7be2f85d981f32a93c53ba178cf38c3be709ef5a241f1641f18bfc86cff1503010020ecc14febfeb1efd89ca273228fabc163f4d2536f8077de497b8257f10c0cfd80 > > Message-Authenticator = 0xb2addbdef36eea66889ed2c3e3ee302e > > # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default > > +group authorize { > > ++[preprocess] = ok > > ++[chap] = noop > > ++[mschap] = noop > > ++[digest] = noop > > [suffix] No '@' in User-Name = "sohama411111", looking up realm NULL > > [suffix] No such realm "NULL" > > ++[suffix] = noop > > [eap] EAP packet type response id 6 length 253 > > [eap] No EAP Start, assuming it's an on-going EAP conversation > > ++[eap] = updated > > ++[files] = noop > > ++[expiration] = noop > > ++[logintime] = noop > > ++[pap] = noop > > +} # group authorize = updated > > Found Auth-Type = EAP > > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > > +group authenticate { > > [eap] Request found, released from the list > > [eap] EAP/tls > > [eap] processing type tls > > [tls] Authenticate > > [tls] processing EAP-TLS > > TLS Length 2690 > > [tls] Length Included > > [tls] eaptls_verify returned 11 > > [tls] <<< TLS 1.0 Handshake [length 08c7], Certificate > > [tls] chain-depth=1, > > [tls] error=0 > > [tls] --> User-Name = sohama411111 > > [tls] --> BUF-Name = Example Certificate Authority > > [tls] --> subject = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority > > [tls] --> issuer = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority > > [tls] --> verify return:1 > > TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" > > [tls] chain-depth=0, > > [tls] error=0 > > [tls] --> User-Name = sohama411111 > > [tls] --> BUF-Name = sohama4(a)gmail.com > > [tls] --> subject = /C=FR/ST=Radius/O=Example Inc./CN=sohama4@gmail.com/emailAddress=sohama4@gmail.com > > [tls] --> issuer = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority > > [tls] --> verify return:1 > > [tls] TLS_accept: SSLv3 read client certificate A > > [tls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange > > [tls] TLS_accept: SSLv3 read client key exchange A > > [tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify > > [tls] TLS_accept: SSLv3 read certificate verify A > > [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] > > [tls] <<< TLS 1.0 Handshake [length 0010], Finished > > [tls] TLS_accept: SSLv3 read finished A > > [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] > > [tls] TLS_accept: SSLv3 write change cipher spec A > > [tls] >>> TLS 1.0 Handshake [length 0010], Finished > > [tls] TLS_accept: SSLv3 write finished A > > [tls] TLS_accept: SSLv3 flush data > > [tls] (other): SSL negotiation finished successfully > > [tls] <<< TLS 1.0 Alert [length 0002], fatal protocol_version > > TLS Alert read:fatal:protocol version > > rlm_eap: SSL error error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version > > SSL Connection Established > > [tls] eaptls_process returned 13 > > ++[eap] = handled > > +} # group authenticate = handled > > Sending Access-Challenge of id 254 to 192.168.1.11 port 62733 > > EAP-Message = 0x010700450d800000003b1403010001011603010030fcca5a85d37c2ec29f40904ccb9dbe3ac886668b24f36a70ea88aed096ed2520ee567dcce866caf89a455cdc9b1421ed > > Message-Authenticator = 0x00000000000000000000000000000000 > > State = 0xa2a1f780a4a6fad11c1fdcdf4905f39b > > Finished request 6. > > Going to the next request > > Waking up in 2.2 seconds. > > rad_recv: Access-Request packet from host 192.168.1.11 port 62733, id=255, length=159 > > User-Name = "sohama411111" > > Called-Station-Id = "ec-e5-55-9c-c3-b6" > > Calling-Station-Id = "00:24:9b:0c:2f:6e" > > NAS-Identifier = "ec-e5-55-9c-c3-ac" > > NAS-IP-Address = 192.168.1.11 > > NAS-Port = 6 > > Framed-MTU = 1500 > > NAS-Port-Type = Ethernet > > State = 0xa2a1f780a4a6fad11c1fdcdf4905f39b > > EAP-Message = 0x020700060d00 > > Message-Authenticator = 0x9edad03d955fdbb9df9945226a174d53 > > # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default > > +group authorize { > > ++[preprocess] = ok > > ++[chap] = noop > > ++[mschap] = noop > > ++[digest] = noop > > [suffix] No '@' in User-Name = "sohama411111", looking up realm NULL > > [suffix] No such realm "NULL" > > ++[suffix] = noop > > [eap] EAP packet type response id 7 length 6 > > [eap] No EAP Start, assuming it's an on-going EAP conversation > > ++[eap] = updated > > ++[files] = noop > > ++[expiration] = noop > > ++[logintime] = noop > > ++[pap] = noop > > +} # group authorize = updated > > Found Auth-Type = EAP > > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > > +group authenticate { > > [eap] Request found, released from the list > > [eap] EAP/tls > > [eap] processing type tls > > [tls] Authenticate > > [tls] processing EAP-TLS > > [tls] Received TLS ACK > > [tls] ACK alert > > [tls] eaptls_verify returned 4 > > [tls] eaptls_process returned 4 > > [eap] Handler failed in EAP/tls > > [eap] Failed in EAP select > > ++[eap] = invalid > > +} # group authenticate = invalid > > Failed to authenticate the user. > > Using Post-Auth-Type REJECT > > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > > +group REJECT { > > [attr_filter.access_reject] expand: %{User-Name} -> sohama411111 > > attr_filter: Matched entry DEFAULT at line 11 > > ++[attr_filter.access_reject] = updated > > +} # group REJECT = updated > > Delaying reject of request 7 for 1 seconds > > Going to the next request > > Waking up in 0.9 seconds. > > Sending delayed reject for request 7 > > Sending Access-Reject of id 255 to 192.168.1.11 port 62733 > > EAP-Message = 0x04070004 > > Message-Authenticator = 0x00000000000000000000000000000000 > > Waking up in 1.2 seconds. > > Cleaning up request 0 ID 248 with timestamp +21 > > Waking up in 2.6 seconds. > > Cleaning up request 1 ID 249 with timestamp +24 > > Cleaning up request 2 ID 250 with timestamp +24 > > Cleaning up request 3 ID 251 with timestamp +24 > > Cleaning up request 4 ID 252 with timestamp +24 > > Cleaning up request 5 ID 253 with timestamp +24 > > Cleaning up request 6 ID 254 with timestamp +24 > > Waking up in 1.0 seconds. > > Cleaning up request 7 ID 255 with timestamp +24 > > > > > > ------------------------------ > > > > Message: 4 > > Date: Wed, 30 Jul 2014 23:59:35 +0100 > > From: Stuart Naylor <stuartiannaylor(a)thursbygarden.org> > > To: freeradius-users(a)lists.freeradius.org > > <freeradius-users(a)lists.freeradius.org> > > Subject: LDAP scope > > Message-ID: > > <zarafa.53d978d7.73bf.594fda2e60fe5c48(a)zent1.thursbygarden.lan> > > Content-Type: text/plain; charset=utf-8 > > > > Hi, > > > > I am having problems with ldap. > > > > I am running FreeRADIUS Version 2.1.12 and Samba4 and the LDAP searches are not subtree searches. > > > > I have to add the CN=Users to the base DN and it works. > > > > If I want to search from the base DN I get an ldap search error. > > > > Is there anyway to set the search scope to subtree? > > > > Stuart > > > > > > > > > > ------------------------------ > > > > Message: 5 > > Date: Wed, 30 Jul 2014 19:40:48 -0400 > > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: LDAP scope > > Message-ID: <42D1F2C2-5061-45D0-9833-29709DF2A8EF(a)freeradius.org> > > Content-Type: text/plain; charset="us-ascii" > > > > > > On 30 Jul 2014, at 18:59, Stuart Naylor <stuartiannaylor(a)thursbygarden.org> wrote: > > > > > Hi, > > > > > > I am having problems with ldap. > > > > > > I am running FreeRADIUS Version 2.1.12 and Samba4 and the LDAP searches are not subtree searches. > > > > > > I have to add the CN=Users to the base DN and it works. > > > > > > If I want to search from the base DN I get an ldap search error. > > > > > > Is there anyway to set the search scope to subtree? > > > > 1. Download v3.0.3 > > 2. Install v3.0.3 > > 3. Enjoy the ability to alter search scopes for LDAP objects > > > > -Arran > > > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > > FreeRADIUS development team > > > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > >

1 0

Freeradius Log with Rsyslog
by Marco Aresu 31 Jul '14

31 Jul '14

Hi all, i ve configured Freeradius on my server and i would like to forward authentication log to an external server. I saw in the forum that i have to change Logdir from file to syslog but where do i have to specify the destination server? Thanks Marco Aresu

3 8

Re: Re: Some inconsistencies concerning OpenSSL include configuration in FRS 3
by rieke＠isl.de 30 Jul '14

30 Jul '14

Arran Cudbard-Bell wrote: > > On 29 Jul 2014, at 06:05, Dr. Andreas Rieke <rieke(a)isl.de> wrote: > >> Arran Cudbard-Bell wrote: >>> Should work now without dumb hacks... >> I have tested your solution, too, and it also works well. However, there is a small difference between your an Alan's appraoch: With Alan's suggestion, the rlm_wimax shared object does not have any references to openssl, whereas in your approch, ldd says that both libssl and libcrypto are required. >> >> I do not know which one is correct, > > Mine, seeing as the module uses symbols from those libraries. > > Technically it probably only needs libcrypto, but never mind. > Thanks a lot to Alan and you, Arran, for your time and for your patience with a newbie on this list, best regards, Andreas

2 1

LDAP scope
by Stuart Naylor 30 Jul '14

30 Jul '14

Hi, I am having problems with ldap. I am running FreeRADIUS Version 2.1.12 and Samba4 and the LDAP searches are not subtree searches. I have to add the CN=Users to the base DN and it works. If I want to search from the base DN I get an ldap search error. Is there anyway to set the search scope to subtree? Stuart

2 1

TLS Alert: Fatal: Protocol version
by Soham T. Aurangabadkar 30 Jul '14

30 Jul '14

Hello, I am getting a strange error in my FreeRADIUS debug output, which I have posted below. I have built the client using C, OpenSSL and raw sockets, and uses the 'user(a)example.com.pem' certificate generated by the scripts provided in /raddb/certs. Can you please tell me where am I going wrong? It is an error at the penultimate step of the EAP-TLS exchange. Thank you ! :) - Soham rad_recv: Access-Request packet from host 192.168.1.11 port 62733, id=254, length=829 User-Name = "sohama411111" Called-Station-Id = "ec-e5-55-9c-c3-b6" Calling-Station-Id = "00:24:9b:0c:2f:6e" NAS-Identifier = "ec-e5-55-9c-c3-ac" NAS-IP-Address = 192.168.1.11 NAS-Port = 6 Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0xa2a1f780a7a7fad11c1fdcdf4905f39b EAP-Message = 0x020602a00d8000000a825997f20225258bb1ff09cf6b173f27777f32ed2ef263a69ea7500fa0df24d984336cfaa193a9be78c06dc15278b6ef4b7cd930d166dd8427b3d155235edc0ce87fedcb214f913db8080089ccb1c651ec2042c9f1f8438926650157af19f77f059a5be97bb32f4c522230719d03a1f6553f3e311249f84eb6bb6740d218c346fe6fb5e08a471fe90bce818d62480b66b82412ff00a1fde2d7e9e2ef2c09d9dcddb20923c9d911fc13aa74742728bf7a2228a1a3de6cb4e9375b66638d73dee5d6dfde7144f8d701a9e16304225c983231cb1bbf1d67f713eb13d5ad916e404c71160301004610000042410414242a58afc24797 EAP-Message = 0x1adbed2ab769f9d1840a5956aad1bc07ec4de29645f706568bdeb474f455be264384b32a21ef52fa83a0ce73f1eb065a0a67cde112c2082916030101060f0001020100cb37b6b39e07acbe5db0119c5f7bc8d2aef80ae74c33c1c7c4e3a85bdb9d98a0c540d9d16d6f08d0e019b1fce07a337e9869e079519f2f65161a744f38b0a3e541461a74c2c05adebde38b07c6c6d7301be51de656cf231ff4d58e4836e09633bdc379bca36a538b5bc4646e2a212b9c436af8749840e14d646268d52770f263e0bcbc965b37ae0d0dbb5e3e259882a29cdfb0f7eaba21d984748d017f4e495bcbe909d71e2f7a3d08689a49d9479e4887ea0558293d4e0dcc74 EAP-Message = 0x61e3d33b48576d468e293468648476786964d5d050203aa0706fef1426432c3e5f5e49d33f77148209d34f01928db02b6b8d30338b9fd51e589b57576217a16c19c5a60bc875140301000101160301003099875a615089ecf3a1b21b7297c276f5bc8ab7be2f85d981f32a93c53ba178cf38c3be709ef5a241f1641f18bfc86cff1503010020ecc14febfeb1efd89ca273228fabc163f4d2536f8077de497b8257f10c0cfd80 Message-Authenticator = 0xb2addbdef36eea66889ed2c3e3ee302e # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "sohama411111", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 2690 [tls] Length Included [tls] eaptls_verify returned 11 [tls] <<< TLS 1.0 Handshake [length 08c7], Certificate [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = sohama411111 [tls] --> BUF-Name = Example Certificate Authority [tls] --> subject = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority [tls] --> issuer = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority [tls] --> verify return:1 TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" [tls] chain-depth=0, [tls] error=0 [tls] --> User-Name = sohama411111 [tls] --> BUF-Name = sohama4(a)gmail.com [tls] --> subject = /C=FR/ST=Radius/O=Example Inc./CN=sohama4@gmail.com/emailAddress=sohama4@gmail.com [tls] --> issuer = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority [tls] --> verify return:1 [tls] TLS_accept: SSLv3 read client certificate A [tls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [tls] TLS_accept: SSLv3 read client key exchange A [tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify [tls] TLS_accept: SSLv3 read certificate verify A [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [tls] <<< TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 read finished A [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [tls] TLS_accept: SSLv3 write change cipher spec A [tls] >>> TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 write finished A [tls] TLS_accept: SSLv3 flush data [tls] (other): SSL negotiation finished successfully [tls] <<< TLS 1.0 Alert [length 0002], fatal protocol_version TLS Alert read:fatal:protocol version rlm_eap: SSL error error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version SSL Connection Established [tls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 254 to 192.168.1.11 port 62733 EAP-Message = 0x010700450d800000003b1403010001011603010030fcca5a85d37c2ec29f40904ccb9dbe3ac886668b24f36a70ea88aed096ed2520ee567dcce866caf89a455cdc9b1421ed Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2a1f780a4a6fad11c1fdcdf4905f39b Finished request 6. Going to the next request Waking up in 2.2 seconds. rad_recv: Access-Request packet from host 192.168.1.11 port 62733, id=255, length=159 User-Name = "sohama411111" Called-Station-Id = "ec-e5-55-9c-c3-b6" Calling-Station-Id = "00:24:9b:0c:2f:6e" NAS-Identifier = "ec-e5-55-9c-c3-ac" NAS-IP-Address = 192.168.1.11 NAS-Port = 6 Framed-MTU = 1500 NAS-Port-Type = Ethernet State = 0xa2a1f780a4a6fad11c1fdcdf4905f39b EAP-Message = 0x020700060d00 Message-Authenticator = 0x9edad03d955fdbb9df9945226a174d53 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "sohama411111", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK alert [tls] eaptls_verify returned 4 [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> sohama411111 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 255 to 192.168.1.11 port 62733 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.2 seconds. Cleaning up request 0 ID 248 with timestamp +21 Waking up in 2.6 seconds. Cleaning up request 1 ID 249 with timestamp +24 Cleaning up request 2 ID 250 with timestamp +24 Cleaning up request 3 ID 251 with timestamp +24 Cleaning up request 4 ID 252 with timestamp +24 Cleaning up request 5 ID 253 with timestamp +24 Cleaning up request 6 ID 254 with timestamp +24 Waking up in 1.0 seconds. Cleaning up request 7 ID 255 with timestamp +24

1 0

RE: Cisco AV Pair
by Franks Andy (RLZ) IT Systems Engineer 30 Jul '14

30 Jul '14

Isn’t cisco-avpair a multivalue attribute? To do it properly, you’d have to check each instance for an ssid wouldn’t you? In V3, we do this with foreach, but I’m not sure in V2. Typically the ssid attribute sent from a cisco ap is the first one, but maybe that’s not always the case. If I’m way off track just ignore me! J From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Dan Fleming Sent: 29 July 2014 13:27 To: FreeRadius users mailing list Subject: Re: Cisco AV Pair Reading the documentation I am still at a loss. I am familiar on how to do this with Cisco ACS, but looking to do it now with free radius. I now have it working if I check the Cisco-avpair under the user in dalo Radius (Cisco-avpair =~ .*SSID$) . Is there a way to configure this so i dont have to keep typing that attribute under every user? I thought the group would work, but from what you are saying it sounds like it wouldnt. I have tried saying if it doesnt match the above regex then the Radgroupreply says ( Auth-Typ := Reject) Thank you for your time. Dan On Mon, Jul 28, 2014 at 2:15 PM, Alan DeKok <aland(a)deployingradius.com> wrote: > > Dan Fleming wrote: > > Thank you I have read through it makes sense. So how do I do something > > based on the results? > > The SQL document talks about "radreply", which lets you do something > with the results. > > > I would like to only authorize a connection if the > > users password matches and they are connecting to the correct ssid in > > the av-pair. Is there a HOWTO or other document outlining how to do that? > > No. Because that's a specific solution. The documents describe how > the server works, and lets you put it together yourself. > > For your situation, the key is to understand that the server accepts > users if their password is correct. If you add more conditional checks, > the user is still accepted. > > The solution is either to: > > a) set the "known good" password ONLY if the conditions also match. The > SQL documentation describes how to set conditions > > b) if the password is stored somewhere else (e.g. LDAP), then you need > to REJECT the user if the conditions match. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 6

Re: Re: Some inconsistencies concerning OpenSSL include configuration in FRS 3
by rieke＠isl.de 29 Jul '14

29 Jul '14

Arran Cudbard-Bell wrote: > Should work now without dumb hacks... I have tested your solution, too, and it also works well. However, there is a small difference between your an Alan's appraoch: With Alan's suggestion, the rlm_wimax shared object does not have any references to openssl, whereas in your approch, ldd says that both libssl and libcrypto are required. I do not know which one is correct, Best regards, Andreas

2 1