- Freeradius-Users - lists.freeradius.org

PacketFence + HP Switches + code hacking
by Nick Van Duyn 18 Apr '14

18 Apr '14

Hello All, So I am investigating a network upgrade + better NAC and I wanted to get some thoughts on the deployment. I am currently evaluating it in our lab and saw that PacketFence was pretty easy to set up. Currently have PF 4.1.0 integrated with a Samba4 AD server (No Windows :) ), so that part is done. Looking to get some thoughts on HP switches, looking at evaluating them with PacketFence. Since it doesn't look like they sell the ProCurve switches anymore I'll probably end up getting one (or multiple) of the following depending on how the lab evaluation goes: - HP 2530 - HP 2920 - HP 5120 So even though these are not explicitly listed on the supported list, is there a general consensus how much hacking is required to get support added, or is that is even possible? I'll probably end up sending a diff out so others can take advantage of my work. I'm planning on using 802.1X PEAP (wired), MAC based auth (either .1x or snmp traps), and SNMP so I can throw idiots on my network back into an isolation VLAN. I'm willing to looking into other vendors if someone how someone has suggestions; only reason I'm looking at HP is the price point is nice for the features provided. Thanks in advance! -- Thank You, Nick Van Duyn

3 5

SELINUX blocks radius but not when using radiusd -X (debug)
by Michael Monette 17 Apr '14

17 Apr '14

Hi, Could anyone explain why this is happening? I just spent like 3 hours trying to figure this out, and I feel like it just doesn't make much sense. On the RADIUS server, SELinux is ON. I start radius in Debug with "radiusd -X" and from my client I login with my RADIUS credentials(really..ldap creds) and it works. No problem. I stop radiusd in debug, and run a 'service radiusd start'. I try to login again and it fails! I then disable SELinux (setenforce 0) and try again and it works. Why does SElinux not block 'radiusd -X' but it seems to block radius when it's started as a service(service radiusd start). What is the difference? Mike Mike

4 3

radtest mac authentication
by Frederic Van Espen 17 Apr '14

17 Apr '14

Hi, I'm pretty new to freeradius so apologies if it is a silly question. I have a server set up to do mac authentication with an ldap backend on debian wheezy. I'm trying to use radtest to verify mac authentication, but I don't find a way to add the calling-station-id attribute to the request. I see that in previous versions of radtest, there was a -g option to pass it, but it is no longer there. How can I add it to the request with a recent version? Cheers, Frederic

2 1

help! seperate database for accounting
by Stacy Trippe 16 Apr '14

16 Apr '14

What is the best place to place directives to make separate calls to a separate database for accounting table updates. I want to use a database -- radius -- for strictly -- radcheck, reply, and radgroupcheck, group reply, and usergroup tables -- the radacct table I want to strictly be updated in a separate database: accounting. The reason for this is to keep database replication turned on for those check/reply tables, and not worry so much about replicating accounting tables between the database servers. I am running the following version of FreeRADIUS: radiusd: FreeRADIUS Version 2.2.4, for host i686-pc-linux-gnu, built on Apr 8 2014 at 18:21:52 At this point, I have SQL working for authorization and authentication purposes, and the databases are replicating between all 3 database servers. In radiusd.conf: $INCLUDE sql1.conf $INCLUDE sql2.conf $INCLUDE sqlacct1.conf $INCLUDE sqlacct2.conf In sites-enabled\default: authorize { ... redundant { sql1 sql2 } ... accounting { acct_unique detail unix radutmp sql sqlacct1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } Despite this, and despite the separate connection setting in sqlacct1.conf vs. sql1.conf -- radius still sending accounting data to radius:/radacct table for insertion. Sql1.conf: sql { ... # Database type # Current supported are: rlm_sql_mysql, rlm_sql_postgresql, # rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc, rlm_sql_freetds driver = "rlm_sql_mysql" # Connect info server = "127.0.0.1" login = "raduser" password = "XXXXXXXX" # Database table configuration radius_db = "radius" ... Sqlacct1.conf: Sql { ... # Database type # Current supported are: rlm_sql_mysql, rlm_sql_postgresql, # rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc, rlm_sql_freetds driver = "rlm_sql_mysql" # Connect info server = "127.0.0.1" login = "raduser" password = "XXXXXXXX" # Database table configuration radius_db = "accounting" ... Stacy

3 3

Authorized Macs File
by Matthew Ceroni 16 Apr '14

16 Apr '14

I followed the authorized_macs guide successfully and it has been working well for me. The issue is that I find myself constantly updating the file and restarting FreeRadius (this file is even maintained in SVN and pushed out via Puppet). Is there a way to query the data via LDAP? The systems in question are registered to our AD server and a custom attribute field contains the MAC address. If I could dynamically pull this data it would make life much easier. Thanks

2 1

Monitor current NAS list with dynamic clients
by Lorenzo Milesi 16 Apr '14

16 Apr '14

Hi I'm using FR with Dynamic Clients from SQL. Is it possible to know the current cache of NASes known to radius at a certain time? I'm having problems when I move NAS from one IP to another, I had a lifetime of 86400 but even if I move it after one week the new address is still not recognized, and radius packets ignored. thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

5 9

Stale sessions and simultaneous use issue
by Fernando Pizarro 16 Apr '14

16 Apr '14

Hi all! I had configured MySQL to store sessions of the users and I have a lots of records with wrong acctsessiontime value because NAS are sent Accounting On/Off packets and the database is update with the actual timestamp. I change deletestalesessions = no in sql.conf but the database is update too. What is the function of this parameter? There are some attribute to avoid stale sessions? I remember Idle-Timeout attribute but if the NAS isn't live the server never kill that session right? Thanks for all. Kings regards. Fernando.

4 8

Hex to Cleartext
by Joseph Showalter 16 Apr '14

16 Apr '14

So, after working on our puzzling issue, we have found the root cause of chap failing instance: Our equipment vendor is putting this in the end device 4867467528286D35655B523F585C5359. But freeradius needs to see this value: HgFu((m5e[R?X\\SY. This value is the "Escaped" value of the above hex. In the radius db we have the hex value stored like this: 4867467528286D35655B523F585C5359. Are there any suggestions on how we could easily convert this to the 'Escaped' value either with SQL changes or writing a perl plugin or something else that we have missed? Here is how it can be converted in Postgres: # select encode(E'\\x4867467528286D35655B523F585C5359','escape'); encode ------------------- HgFu((m5e[R?X\\SY (1 row) Any suggestions? One idea I have is to change the SQL select statement FR uses, at least if we find one that works right... -- regards, Joseph

2 3

New features in v3.0.3
by Alan DeKok 16 Apr '14

16 Apr '14

As part of our code cleanups and reorganizations, we've added some new features to version 3.0.3. Previously, array references could only be used in string expansions. e.g. "%{Cisco-AVPair[2]}". This limitation is problematic, so we've fixed it. You can now use array references in "unlang", in every place attribute references were allowed before. In some situations, this doesn't make much difference. In others, it makes a lot of difference. e.g. switch &Cisco-AVPair[2] {...} And even better (as an artificial example): update reply { Filter-Id[1] := &request:Cisco-AVPair[2] } In previous versions, it was impossible to update the second attribute of the same name. You could either update the first one, or delete all of them, and re-create them. It's now possible to "reach into" a list, and re-write individual attributes. Other new features include more sanity checks on inputs, so that more errors in the configuration files are caught. This means that dynamic expansions are pre-parsed, as are regular expressions. Please respond if there are issues, questions, concerns, etc. Alan DeKok.

3 4

Re: Question on pam_radius_auth module getting INCORRECT
by David Li 16 Apr '14

16 Apr '14

Hi Alan, I took out all the pam modules from my auth stack in /etc/pam/sshd except for pam_radius_auth. The problem didn't go away. I am not using SElinux either. One interesting thing I noticed is that first login attempt always fails due to this problem. But the second attempt after restarting the ssh session then it succeeds. This makes me wonder if somehow the password was stored on the first try and correctly retrieved on the second try. But I have no clue what happened. David > ------------------------------ > > Message: 2 > Date: Mon, 14 Apr 2014 20:53:52 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Question on pam_radius_auth module getting INCORRECT > password > Message-ID: <534C8320.8010907(a)deployingradius.com> > Content-Type: text/plain; charset=UTF-8 > > David Li wrote: > > I am new to this. Please let me know if there is a better list to post > > this question. > > It's an OK list. > > > I have been trying to track down a wired problem. When a user is logging > > via ssh, the pam_radius_auth module would try to retrieve the password > > and send it to the radius server. But the password returned by the > > rad_converse() function is INCORRECT. > > > > I have done some searching and found suggestions that there might be > > something wrong with "other" module that is doing the password checking. > > > > My real question is how I can find out which module is the culprit. > > It should be simple. Look at the pam ssh file, and see which modules > it's using. Then, delete them one by one until it works. > > But largely this is a PAM issue. I know very little about PAM, even > after spending time reading the docs and programming it. > > Alan DeKok. > > > ------------------------------ > >

2 1