- Freeradius-Users - lists.freeradius.org

Performance - was Re: LDAP Groups to Freeradius and then Ruckus Wireless?
by Rui Ribeiro 10 Jun '14

10 Jun '14

Hi Arran, To be fair, I have read a lot of performance problems in FreeRadius, and I have yet to see any. We have been running here for more than a year now, Debian 7/FreeRadius from 2.1.12 to 2.2.5, MySQL, detail files and AD authentication, roaming/proxying too, in a virtual machine with 64 bits, 1GB RAM and 2 CPUs, 3500 daily EDUROAM users, and I have yet to see the CPU loads go up more than 0.05-0.10. Even when I have major events that bring down the wifi intra-structure, like yesterdays where a switch went crazy, I hardly register an heavy load. What are your mileage, guys? Regards, Rui Ribeiro Regards, > > Message: 4 > Date: Tue, 10 Jun 2014 07:09:30 +0100 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: LDAP Groups to Freeradius and then Ruckus Wireless? > Message-ID: <B5471695-B7D2-4970-B4C8-6A4905489FCC(a)freeradius.org> > Content-Type: text/plain; charset="us-ascii" > > > On 10 Jun 2014, at 06:36, Fajar A. Nugraha <list(a)fajar.net> wrote: > > > On Mon, Jun 9, 2014 at 9:43 PM, Arran Cudbard-Bell > > <a.cudbardb(a)freeradius.org> wrote: > ...... > > > Would it make sense to enable the flag on all bundled package recipes? > > IIRC 2.x debian/rules has it (official debian/ubuntu package has it as > > well), but 3.0.x doesn't. Haven't checked others though. > > No, there's a noticeable performance impact. One of the other users said > it was as much as 15%. > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team > ************************************************* >

4 3

I must have NT domain hack configured wrong.
by Matthew Berry 09 Jun '14

09 Jun '14

>From a fresh installation of Freeradius 2 on Ubuntu 13.10 Server, with a single test user added to the users file, and with mschap turned on, I've successfully received an access-accept response when testing with radtest both on the inner tunnel port 18120 and the regular 1812 port using mschap [1]. The test user is setup to mirror a user on a test windows laptop, using the HOSTNAME\username convention. On my first attempt to connect the laptop, I receive the below error about the inner username matching neither the outer username nor the eap identity. Info: [files] users: Matched entry HOSTNAME\me at line 93 ... Info: [peap] Identity - HOSTNAME\me ... ERROR: User-Name (HOSTNAME\me) is not the same as MS-CHAP Name (me) from EAP-MSCHAPv2 So from what I've read this has been addressed by adding the with_ntdomain_hack flag in the mschap module to 'yes'. However, as shown in the referenced pastebins [2][3], it appears to have no effect. There is one other place in the configuration where with_ntdomian_hack is present, which is in the preprocess module, however it specifically says in the comments not to use it. Based on observations, it seems to strip the "HOSTNAME\\" from the username (but not the eap identity). I must have done something wrong when I enabled the with_ntdomain_hack in the mschap configuration, as from my understanding that should have caused Freeradius to account for the way Windows performs the authentication. Is there something further I need to do? Server: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 24 2014 at 15:09:01 (ubuntu package version 2.1.12+dfsg-1.2ubuntu5.1 ) End-Host: Windows 7 host, which is not part of a domain, with hostname of HOSTNAME, with a user named 'me', who has a password 'PASSWORD' End-Host Network Profile: Server validation turned off since test certs are being used, "Use windows username/password" is on. NAS: Tomato 1.28 [1] radtest log: http://pastebin.com/S5Kb1ggd [2] with_ntdomain_hack off: http://pastebin.com/CnFcXWAX [2] with_nt_domain_hack on: http://pastebin.com/KS8AJPbc -Matt

3 2

authentication order
by Dan Letkeman 09 Jun '14

09 Jun '14

Hello, I am trying to find some info on authentication ordering. Is it the client(switch or wireless controller) that defines the authentication ordering or is it the radius server? If it is the radius server how would I define EAP as the first authentication method and then mac authentication as the second? Thanks, Dan.

2 3

Fwd: eap-sim on freeradius failed
by Muhammad Hasan 09 Jun '14

09 Jun '14

Hi, First, I want to apologize if my english is not so well and I have no experience in Ubuntu and freeradius before. I have a probem with freeradius when I was trying to install EAP-SIM with freeradius-server-2.2.0 on ubuntu server 12.04.4 I was following the steps on this web https://code.google.com/p/seek-for-android/wiki/EapSimAka the step are: 1. apt-get install dpkg-dev 2. apt-get build-dep freeradius 3. tar xvzf freeradius-server-2.2.0.tar.gz 4. apply patch on eapsimlib.c https://github.com/FreeRADIUS/freeradius-server/commit/cfd61d24b99022eb6130… 5. build the deb packages on freeradius-server folder debian/rules binary 6. out from freeradius-server folder and install the packages dpkg -i libfreeradius2_2.2.0... dpkg -i freeradius_2.2.0... dpkg -i freeradius-common_2.2.0... dpkg -i freeradius-utils_2.2.0... and then when I was on step 6, dpkg -i freeradius_2.2.0... i got fail, * checking FreeRADIUS daemon configuration ... [fail] invoke-rc.d: initscript freeradius, action "restart" failed. Processing triggers for ureadahead. this is result when I type Freeradius -X Unable to open file "/etc/freeradius/sql/mysql/ippool-dhc.conf": No such file or directory Errors reading or parsing /etc/feeradius/radius.conf what should I do then? please help me... -- Best Regards, Email : muhhasan.1311(a)gmail.com CP : 085694394257 -- Best Regards, Email : muhhasan.1311(a)gmail.com CP : 085694394257

3 5

Re: authentication order
by Rui Ribeiro 09 Jun '14

09 Jun '14

Hi Dan, Please read better the previous answer. Alan already told you EAP is authentication and MAC is authorisation. EAP also supports several types of authorisation, and you arent being very clear of what you intend to do. The sooner your learn how the process works, the better you are. It is no use to put together a few recipes over the Internet, if then you both cant maintain the service or do not understand how it works. Search the list arquive for answers before posting here, for starters discussions about policies to whitelist or blacklist MACs are rather frequent. Regards > Message: 5 > Date: Sun, 8 Jun 2014 18:00:31 -0500 > From: Dan Letkeman <danletkeman(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: authentication order > Message-ID: > <CAPY==jk0CzgvJC8+bux2XtBD2kiMoo=7S3OrfG68ML= > SPwo8ng(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > On Sun, Jun 8, 2014 at 5:39 PM, Alan DeKok <aland(a)deployingradius.com> > wrote: > > > Dan Letkeman wrote: > > > I am trying to find some info on authentication ordering. > > > > Probably because no one uses that term. > > > > Ok, but I just did, so I guess I use that term :) > > > > > > > Is it the client(switch or wireless controller) that defines the > > > authentication ordering or is it the radius server? > > > > You're asking the wrong question. > > > > Yes, I am asking the wrong question, because I need help, otherwise I would > not be posting a question.....(: > > > > > > > If it is the radius server how would I define EAP as the first > > > authentication method and then mac authentication as the second? > > > > MAC auth isn't authentication. MAC auth is just another authorization > > check. > > > > Ok, so I can authorize a user based on there mac address. I can also > authenticate a user using EAP. I want to authenticate a user using EAP, > but if the device that a user is using does not support EAP I would like to > authorize a user based on the mac address as a last resort. > > > > > > EAP is authentication. As part of authorizing a user, you can deny > > them access because their bills aren't paid, or because they're using > > the wrong MAC. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > >

1 0

[ANN] FreeRADIUS officially webscale
by Arran Cudbard-Bell 06 Jun '14

06 Jun '14

https://twitter.com/arr2036 twitter { oauth_consumer_key = '' oauth_consumer_secret = '' oauth_access_token = '' oauth_access_token_secret = '' api_uri = 'https://api.twitter.com/1.1/statuses/update.json' } server { ... authorize { # Stage 1.0 - Generating the signature # Stage 1.1 - What are we tweeting about? update request { Tmp-String-0 := "User %{User-Name} connected to %{NAS-Identifier} #WatchingYou #NoPrivacy #FreeRADIUS #Winning" } # Stage 1.2 - Generate the nonce (base64 encoding of 32 bytes of random data) update request { Tmp-Octets-0 := "0x%{randstr:hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh}" Tmp-String-1 := "%{base64:&Tmp-Octets-0}" Tmp-Integer-0 := "%l" } # Stage 1.3 - Build the paramter string update request { Tmp-String-2 := "\ oauth_consumer_key=%{urlquote:${twitter.oauth_consumer_key}}&\ oauth_nonce=%{urlquote:%{Tmp-String-1}}&\ oauth_signature_method=HMAC-SHA1&\ oauth_timestamp=%{Tmp-Integer-0}&\ oauth_token=%{urlquote:${twitter.oauth_access_token}}&\ oauth_version=1.0&\ status=%{urlquote:%{Tmp-String-0}}" } # Stage 1.4 - Create the signature base string update request { Tmp-String-3 := "POST&%{urlquote:${twitter.api_uri}}&%{urlquote:%{Tmp-String-2}}" } # Stage 1.5 - Create the signing key update request { Tmp-String-4 := "%{urlquote:${twitter.oauth_consumer_secret}}&%{urlquote:${twitter.oauth_access_token_secret}}" } # Stage 1.6 - Create the oAuth signature update request { Tmp-Octets-1 := "0x%{hmacsha1:&Tmp-String-3 &Tmp-String-4}" } update request { Tmp-String-5 := "%{base64:&Tmp-Octets-1}" } # Stage 2.0 - Building the request # Stage 2.1 - Adding the authorization header update control { REST-HTTP-Header := "Connection: close" REST-HTTP-Header += "\ Authorization: OAuth \ oauth_consumer_key=\"%{urlquote:${twitter.oauth_consumer_key}}\", \ oauth_nonce=\"%{urlquote:%{Tmp-String-1}}\", \ oauth_signature=\"%{urlquote:%{Tmp-String-5}}\", \ oauth_signature_method=\"HMAC-SHA1\", \ oauth_timestamp=\"%{Tmp-Integer-0}\", \ oauth_token=\"%{urlquote:${twitter.oauth_access_token}}\", \ oauth_version=\"1.0\"" } # Stage 3.0 - Sending the request update request { Tmp-String-6 := "%{rest:POST ${twitter.api_uri} status=%{Tmp-String-0}}" } } } v3.0.x HEAD only. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

HMAC expansions in v3.0.x HEAD
by Arran Cudbard-Bell 06 Jun '14

06 Jun '14

Hi All, Two new xlats available in v3.0.x head. %{hmacsha1:&data &key} %{hmacsha1:&data supersecret} and %{hmacmd5:&data &key} %{hmacmd5:&data supersecret} Potentially useful for doing signing of requests for Web APIs and other security stuff. Let me know if anyone has an immediate need for other flavours. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Cisco Hack
by Chuck 06 Jun '14

06 Jun '14

Hi, I’m running freeRadius 3.0.3 with an oracle database. I enabled the cisco hack in preprocess module and it appears to be working for start records, however, for stop records I get an error 'Unknown attribute’ for the dsp-id. Here is a debug snip from a stop record: Received Accounting-Request Id 125 Cisco-AVPair = 'dsp-id=1/1:1' Acct-Status-Type = Stop ….. (6) ERROR: sql : ... isconnect-cause}', DSPID = '%{dsp-id}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL (6) ERROR: sql : ... ^ Unknown attribute Here is a debug snip from the start record that works: Received Accounting-Request Id 120 Cisco-AVPair = 'call-id=DA889581-EC2611E3-8C62BC7B-A853074F(a)172.17.8.11' Acct-Status-Type = Start …… (1) sql : EXPAND INSERT INTO radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey, CallID) VALUES('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '%{Acct-Authentic}', '%{h323-setup-time}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{X-Ascend-Session-Svr-Key}', '%{call-id}’) Here is the update query from my queries file: UPDATE ${....acct_table2} \ SET \ AcctStopTime = TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Octets}' + \ ('%{%{Acct-Input-Gigawords}:-0}' * 4294967296), \ AcctOutputOctets = '%{Acct-Output-Octets}' + \ ('%{%{Acct-Output-Gigawords}:-0}' * 4294967296), \ AcctTerminateCause = '%{Acct-Terminate-Cause}', \ AcctStopDelay = '%{%{Acct-Delay-Time}:-0}', \ ConnectInfo_stop = '%{h323-disconnect-time}', \ ACCTTERMINATECAUSE = '%{h323-disconnect-cause}', \ DSPID = '%{dsp-id}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress = '%{NAS-IP-Address}' \ AND AcctStopTime IS NULL" Is there another place I need to enable the cisco hack? Thanks! Chuck

3 5

FreeRADIUS 2.X.X small functionality extensions
by Kostas Zorbadelos 06 Jun '14

06 Jun '14

Greetings to all, in our company (a big commercial telecom/ISP) we run a project to completely migrate our AAA infrastructure to FreeRADIUS (we use FreeRADIUS in parts of it for many years). One of our requirements in authentication/authorization is DSLAM port checking. The port info comes in NAS-Port-Id in our case and can be extracted in a normalized form with a regular expression. The problem was that FreeRADIUS provided in variables only the first 8 matching groups in %{0}..%{8}, whereas in our setup we needed up until %{12} to get the port information. So I developed a relevant patch which I communicated through GitHub as a pull request (following procedure described in http://wiki.freeradius.org/contributing/GitHub) The patch is against 2.X.X (tested with 2.2.5) and provides two functions: - make available %{0}..%{16} in regex matches - make available a new xlat function tonumber() to translate strings as numbers In our case the port info coming from the regular expression is a string of the form 15243:1/1/02/04 and we want to transform it to 15243:1/1/2/4. I would really like to see the functionality included upstream and hopefully it can benefit others as well. Let me know what you think (and bear with me since it's my first patch to FreeRADIUS). Regards, Kostas -- Kostas Zorbadelos twitter:@kzorbadelos http://gr.linkedin.com/in/kzorba ---------------------------------------------------------------------------- () www.asciiribbon.org - against HTML e-mail & proprietary attachments /\

4 12

freeradius+ chillispot + facebook login
by Osman Hirgiz 06 Jun '14

06 Jun '14

Hi Everyone, Has anyone implemented an oAuth authentication to chillispot using freeradius? I have been doing research over the internet and came across nothing. I would like the user to select the authentication method on the captive login page. The user would choose AD/LDAP, Facebook or normal user/password method. Is this possible? How can I achieve this? Thanks in advance.

2 1