- Freeradius-Users - lists.freeradius.org

Connection pool reuse v3.0.x
by Arran Cudbard-Bell 12 Jul '14

12 Jul '14

A few people have requested this be added since v3.0.0 was released. Occasionally for some complex modules like rlm_ldap, it's useful to run different sets of queries against the same server. People usually achieved this by using multiple instances of the same module (though I've also seen some quite creative uses of xlat). When multiple instances of the same module were used, a new set of connections were opened for the module. Where many instances of the same module were used the number of open connections could get very large. The connection pool reuse feature allows multiple instances of the same module to share a single connection pool. Example: ldap baz { pool = ldap } ldap { pool { <pool parameters> } } ldap foo { pool = ldap } ldap bar { pool = foo } The server will automatically fix the loading order of modules, so in this case even though baz is listed first, ldap will get instantiated first. The server will also detect cycles, i.e. ldap foo { pool = bar } ldap bar { pool = foo } and error out. If you specify server settings in module instances which use another module's connection pool they will be ignored. Log messages involving the shared connection pool will have prefixes consistent with the module that 'owns' the connection pool, not the modules that use it. You cannot use connection pools from modules of a different type, doing so will produce an error. I've worked through the obvious test cases for this feature, but if anyone else wants to try it out, that would be much appreciated. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Core Developer FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

error log radius.log
by Arnaud . 11 Jul '14

11 Jul '14

Hello, Looking at the file radius.log I still have the same error comes up: Error: rlm_radutmp: Logout for NAS localhost 5 port, but no Login record Error: rlm_radutmp: Logout for NAS localhost port 3, but no Login record Error: rlm_radutmp: Logout for NAS localhost Port 4, but no Login record .... Can you tell me what it is and what should be done to avoid this error? Best regards.

3 5

Error 1: gmake Free Radius 3.0.3 at Solaris
by Rafael de Farias Meurer 11 Jul '14

11 Jul '14

I'm trying to install free radius 3.0.3 at Solaris, after I use gmake command I got this error, I tried to use make and didn't work either: CC src/lib/cbuff.c In file included from /home/nms/radiusTeste/freeradius-server-3.0.3/src/freeradius-devel/libradius.h:65, from src/lib/cbuff.c:26: /home/nms/radiusTeste/freeradius-server-3.0.3/src/freeradius-devel/missing.h:419:1: warning: "htonll" redefined In file included from /usr/include/netinet/in.h:73, from /usr/include/netdb.h:74, from /home/nms/radiusTeste/freeradius-server-3.0.3/src/freeradius-devel/missing.h:40, from /home/nms/radiusTeste/freeradius-server-3.0.3/src/freeradius-devel/libradius.h:65, from src/lib/cbuff.c:26: /usr/include/sys/byteorder.h:46:1: warning: this is the location of the previous definition In file included from src/lib/cbuff.c:26: /home/nms/radiusTeste/freeradius-server-3.0.3/src/freeradius-devel/libradius.h:637: error: syntax error before "func" gmake: *** [build/objs/src/lib/cbuff.lo] Error 1 What can I do to solve this error? Thanks

7 31

Assigning users into different VLANs
by Martin Hrabovský 11 Jul '14

11 Jul '14

Hi, I am using FreeRADIUS together with WLC from Cisco. I have 1 WLAN connected to 2 VLANs and I need to assign user into VLAN based on successful pass AAA or not. By that I mean to separate guests and members. How can I achieve that? For now I am using "users" as source of members. I came up wtih this "admin" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 52, Tunnel-Preference = 0x000000 to assign member into VLAN 52 but I strugle with assigning VLAN for user without certificate or password (I need two variants based on certificate and PEAP, two different servers). Thank you for any advice. -- Martin

3 14

Two or more Address Lists
by Anderson Scouto da Silva 11 Jul '14

11 Jul '14

You return only one and not all lists, this worked once. Thank you.

5 7

Client Library
by Scott Neugroschl 10 Jul '14

10 Jul '14

I'm currently using the FreeRADIUS client library, version 1.1.6. I have a requirement for IPv6. Has the client library been updated? Or should I be asking this on the dev list? --- Scott Neugroschl

2 4

Musing and digressing around sqlite
by Axel Luttgens 10 Jul '14

10 Jul '14

Hello, I'm testing FR with the slite backend, with the configs provided by: raddb/mods-config/sql/main/sqlite/schema.sql raddb/mods-config/sql/main/sqlite/queries.conf And I have some questions. So, if I may ask... 1. Almost all tables have an id column, conveniently named "id" and defined as: id int(11) PRIMARY KEY Is there any reason for not having defined those columns as id INTEGER PRIMARY KEY AUTOINCREMENT instead? 2. Incidentally, table "radusergroup" doesn't have such a column. An omission? Or could it prove problematic to define such a column? 3. The post-auth query is defined as: query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, authdate) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ %{%{integer:Event-Timestamp}:-date('now')})" and the log shows it expands as: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bob', 'hello', 'Access-Accept', ) As a result, no row is inserted into table "radpostauth", since its column "authdate" is defined to be NOT NULL. How is the expression %{%{integer:Event-Timestamp}:-date('now')} supposed to be interpreted? More specifically, why the enclosing %{...}? 4. Replacing above expression by '%S' works beautifully. I mean, the expansion for the query yields a timestamp such as "'2014-07-08 18:09:54'", and a row is now happily inserted into table "radpostauth". :-) What is the rationale for having devised a query based on Event-Timestamp at first hand? 5. BTW, file http://networkradius.com/doc/FreeRADIUS-Implementation-Ch16.pdf describes %S as returning a timestamp with format "YYYY-mmm-ddd HH:MM:SS". Wouldn't something like "YYYY-MM-DD HH:MM:SS" be more accurate? 6. I've left the default setting radius_db = "radius" in raddb/mods-available/sql, even if my db file is named "radiusdb". Everything seems to be working fine. What is the role of variable "radius_db" in an sqlite context? 7. Going back to question 3, this raises the usual question about sqlite in such cases. Would there be a way to get an explicit error message written to syslog? Many thanks in advance, Axel

3 7

Question about cui.post-auth in FR 3
by Stefan Paetow 09 Jul '14

09 Jul '14

Hi, I've just spotted something that I'm not entirely sure is right: I get a reply from another host and it feeds back into my post-auth section. I happen to have the 'cui' module set in it. The existing 'cui' policy will strip the User-Name property regardless of whether the conditions for the CUI were met or not, is that correct? Shouldn't it strip the User-Name only if a CUI was generated? I'm just wondering... Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

4 11

SSL Certificate Question
by Charles Plater 09 Jul '14

09 Jul '14

Many moons ago, i set up a FreeRadius server as part of our 802.1x / WPA project. At that time, I asked this list about using a commercially signed SSL certificate as opposed to a self signed certificate. I’m not sure I understood all of the reasons, but I was advised by another member of this list to use a self signed certificate. Fast forward 6 years to today, and our management is convinced that problems we are seeing w/ clients having problems connecting are related to the self signed SSL certificate. Could someone please describe to me the reasoning behind using a self signed certificate with on with FreeRadius? What kinds of problems / vulnerabilities will we be exposed to if we use a commercially signed (DigiCert) SSL certificate? Many thanks in advance. -- Charles Plater Lead Application Technical Analyst Internet Services +1-313-577-4620 ab3189(a)wayne.edu

4 5

SSL Certificate Question (Charles Plater) was Re: Freeradius-Users Digest, Vol 111, Issue 19
by Rui Ribeiro 09 Jul '14

09 Jul '14

Hi Charles, The experience we have here is iOS devices, and apparently, the iPhone more than the iPad are very picky with certificates. Recent OSX versions seem to very a little more picky too. We used to have a lot of strange errors before we fixed our certtificates. Your certificate on the RADIUS side has to be carefully built to include any extra certificates if you are using an intermediate root certificate. I also maybe stating the obvious, however if you are using self signed certificates it is a must to install the root certificate in the client devices. I advise, for Windows and iOS devices, to build profiles. Regards, Rui Ribeiro https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > > Message: 1 > Date: Tue, 8 Jul 2014 15:32:27 -0400 > From: Charles Plater <ab3189(a)wayne.edu> > To: freeradius-users(a)lists.freeradius.org > Subject: SSL Certificate Question > Message-ID: <6271539D-6C15-4B9A-A71F-F4A72F1B3EAB(a)wayne.edu> > Content-Type: text/plain; charset=windows-1252 > > Many moons ago, i set up a FreeRadius server as part of our 802.1x / WPA > project. At that time, I asked this list about using a commercially signed > SSL certificate as opposed to a self signed certificate. I?m not sure I > understood all of the reasons, but I was advised by another member of this > list to use a self signed certificate. Fast forward 6 years to today, and > our management is convinced that problems we are seeing w/ clients having > problems connecting are related to the self signed SSL certificate. Could > someone please describe to me the reasoning behind using a self signed > certificate with on with FreeRadius? What kinds of problems / > vulnerabilities will we be exposed to if we use a commercially signed > (DigiCert) SSL certificate? > > Many thanks in advance. > > -- > Charles Plater > Lead Application Technical Analyst > Internet Services > +1-313-577-4620 > ab3189(a)wayne.edu > >

1 0