- Freeradius-Users - lists.freeradius.org

Cisco 2960 and WLC Accounting Interim-Update
by Matthew Ceroni 08 Apr '14

08 Apr '14

I don't believe this is controlled by FreeRadius itself but I am kind of at a loss figuring out where it might be configured. I have Freeradius acting as an AAA server for a Cisco 2960 L2 switch as well as a Cisco Wireless LAN Controller. Working on setting up Accounting which for the most part works. However I am unable to determine what causes the Interim-Update Acct-Status-Type message to be sent. Checking the detail log (have that module turned on in accounting section) I have seen those messages present. In fact earlier in the day connected clients sent a few Interim-Update messages (one was 1 second apart, than 10 seconds apart, than 30 seconds apart). That happened early this morning. However ever since that I have not seen any Interim-Update accounting messages. I read through the 802.1x configuration guide for the 2960 and it just talks about the Interim-Update message being sent but doesn't list of a way to specify the interval (assuming that interval is specified on the switch side). Any help would be appreciated. Thanks

3 3

In auth request packet, Stripped-User-Name attribute value wrongly rewritten by radius server
by Adarsha S 07 Apr '14

07 Apr '14

Hi, I'm currently using free radius server versioned 2.1.12 [freeradius-server-2.1.12]. I'm having a setup where clients get authenticated by Windows AD 2003 server. It uses stripped-user-name attribute. I'm having free radius 2.1.12 as the radius server. The username are provided as DomainName\Username. Various combination of Domain name and user name worked but when ever the username starts with "t" or "n" the authentication failed. Network capture showed that the backslash delimiter between domain and username combined with specific letters are translated to special characters. \n = new line \r = return \t = tab Eg: During authentication, the usernames goes as "DOMAIN\timcopy. We are supposed to strip the domain name along with the "\" and populate the sAMAccount name with the username timcopy. But the username gets converted as "DOMAIN imcopy" which is then used as the sAMAccount name. I was getting the authentication problem when I used "timcopy" as the username and success when I used "kiran" as the username. On further looking into code could make out , On receiving the request packet at radius server side, rlm is adding the the new attribute stripped-user-name [attr number 1043] and updating the value as "DOMAIN imcopy" Here \timcopy got converted as "<tab space>imcopy" Please let me know the solution for this problem. Thanks, Adarsha

2 1

parameter "OR" on attribute "Calling-station-id" mysql
by Deivison Moraes 07 Apr '14

07 Apr '14

Hi, How I set two different macs on attribute calling station id in base mysql? I need insert 1 more mac with attribute Calling-Station-ID. mysql> SELECT * FROM radcheck WHERE UserName = 'deiveson'; +--------+----------+--------------------+----+-------------------+ | id | UserName | Attribute | op | Value | +--------+----------+--------------------+----+-------------------+ | 292359 | deiveson | user-password | == | 123 | | 292360 | deiveson | Calling-Station-ID | == | 78:44:76:0D:34:FB | +--------+----------+--------------------+----+-------------------+ I tested ":=" and "+=", but don't worked fine, with these options is accepting any mac. Anyone know how to make a "OR" for this situation? Tks Deivison Moraes

2 1

panic_action / ptrace: Operation not permitted
by Stefan Winter 07 Apr '14

07 Apr '14

Hi, I'm currently configuring the shiny new panic_action handler on my 3.0.2 system. The server runs as radiusd:radiusd. When I send it a kill -SEGV to try the panic_action, the resulting log file tells me: # cat gdb-radiusd-27780.log Reading symbols from /usr/local/freeradius/3.0.2/sbin/radiusd...done. Attaching to program: /usr/local/freeradius/3.0.2/sbin/radiusd, process 27780 ptrace: Operation not permitted. //27780: No such file or directory. /usr/local/freeradius/config/raddb/panic.gdb:1: Error in sourced command file: No frame selected. (gdb) quit The gdb session is started as radiusd (I guess; after all the running process dropped its root priv right after starting). So... I can't ptrace my own process? Why, thank you! I ran the panic_action command-line as root on a running process - and get the ptrace just fine. I read up on this on Google, and found that this would typically be a problem when using the "yama" security module, which I don't (there is no /proc/sys/kernel/yama subdir). This is a very recent system, openSUSE 13.1 with current patchlevel. The kernel is the shipped SuSE-flavoured "default" kernel. Before I dig into running a vanilla kernel to see if there's SUSE magic happening on their flavour - am I looking at the wrong place? Is this problem known and solved? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 5

RE: MPPE with PPTP - external module (P K)
by S y s C o / developer 07 Apr '14

07 Apr '14

Hi Alan, How can I do that multiOTP either supply the NT-Password to FreeRADIUS (the best option for me), or how to supply the derived attributes MS-MPPE-Recv-Key, MS-MPPE-Send-Key etc. directly. As multiOTP is doing two factor authentication, the NT-Password is not sensitive, as a new is created each time. I already fixed that with TeKRADIUS by supplying the clear one time password back to TekRADIUS. Regards, Andre > P K wrote: >> VPN works fine with CHAP & MSCHAP with multiotp. The trouble is >> encryption (PPTP with MPPE). When encryption is selected by the user, >> VPN fails. The problem is that radius will not send the required MPPE >> responses(MS-MPPE-Recv-Key, MS-MPPE-Send-Key etc.) to NAS. > Because the multiotp program isn't supplying them to FreeRADIUS. >> I note that mschap module has options like use_mppe, >> require_encryption etc.. How can I get radius to send those when I'm >> using multiotp module to perform chap/mschap so that PPTP with MPPE >> works? > Make the multiotp program supply them to FreeRADIUS. > The keys are derived from the NT-Password, and the MS-CHAP information. Since FreeRADIUS doesn't have the NT-Password, it can't derive the keys. > Alan DeKok.

3 5

Re: Freeradius-Users Digest, Vol 108, Issue 20
by Rui Ribeiro 06 Apr '14

06 Apr '14

Hi, First you´d better upgrade to 2.2.4; so many things have improved. We are serving around 2500 wifi customers, and the whole process of authentication takes less than 20 ms, and we do use a MySQL database. I advise to avoid external perl routines as possible, and have a look at unlang; are you sure you are also measuring correctly things? I used to use a couple of scripts that had their own setup, and though I had 200 ms when I was having 30ms in the past, until it dawned in me it was the time for the perl environment and script to load and setup the environment to work. Regards ------------------------------ > > Message: 4 > Date: Fri, 04 Apr 2014 16:46:11 +0700 > From: Eugene Grosbein <fr(a)grosbein.net> > To: freeradius-users(a)lists.freeradius.org > Subject: DHCP module and external DHCP relay > Message-ID: <533E7F63.5020109(a)grosbein.net> > Content-Type: text/plain; charset=us-ascii > > Hi! > > We use FreeRADIUS 2.2.0 as DHCP server with rlm_perl > to connect to external database to run stored procedure there > that returns IP/mask/DNS etc for option82-enabled requests. > > The database is pretty fast and serves hundreds of parallel requests > in 1 second or less. > > FreeRADIUS receives all DHCP requests from external high loaded DHCP relay > and threats them all as coming from single DHCP client. > > Our perl script does extensive logging through direct syslog connection > and I see that there is great delay between the moment of DHCP request > arrival > as shown by tcpdump and the moment when post_auth perl function is > invoked by FreeRADIUS. > > This delay is about 6 seconds and some DHCP clients do not wait for so > long. > > Is it possible to eliminate these delays? Here are lines from radiusd log: > > Request 14280134 has been waiting in the processing queue for 6 seconds. > Check that all databases are running properly! > Discarding duplicate request from client dhcp port 67 - ID: 1381353109 due > to unfinished request 14280311 > > Again, our database processes most request in less than 1 second and very > seldom in 2 seconds > but mentioned problem is persistent. > > Eugene Grosbein > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 108, Issue 20 > ************************************************* >

4 6

Re: Freeradius-Users Digest, Vol 108, Issue 24
by Rui Ribeiro 05 Apr '14

05 Apr '14

Hi, Probably you are using a Cisco that always fill it´s virtual port as 29 in every connection. I log everything to MySQL and see all the authentications there. So essentially it is a bug from Cisco, I think. If someone also manages to explain how to get radwho working properly I will be very interested. Regards > > Message: 7 > Date: Fri, 4 Apr 2014 14:06:55 -0700 > From: Matthew Ceroni <matthewceroni(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: radutmp and sradutmp modules > Message-ID: > < > CA+NsY5gjtmqnd3haj0nkzNroWQNG8+A3WmZ9GC_BcVRjy6rfSw(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi: > > I am utilizing FreeRadius as an authentication server for a 802.1x > environment (wired and wireless). Everything is up and running great. > > I recently enabled Accounting and turned on the radutmp and sradutmp files. > I am probably missing something simple but running radwho only shows the > last person to login. So if I sign onto the wireless or wired network, > authenticate successfully to the radius server and type radwho is shows me > as logged in. If another users signs on the output of radwho just shows > them (always a single line of output). > > Is radwho meant to keep track of all currently signed in users? Or am I > missing something simple? > > Thanks >

2 1

RE: Querying freeRADIUS from Java
by Estefania figueroa buitrago 04 Apr '14

04 Apr '14

Hello guys, thank you very much for your suggestions. I'm really impressed by the amount and quickness. I ended up using TinyRadius and it worked like a charm. Just in case someone have the same question I drop here the code I am using: --------------------------------------------------- public class RadiusClient { //check http://wiki.freeradius.org/guide/SQL-HOWTO first public static void main (String[] args) throws RadiusException{ org.tinyradius.util.RadiusClient radiusClient = new org.tinyradius.util.RadiusClient("127.0.0.1", "testing123"); AccessRequest accessRequest = new AccessRequest("dialrouter", "dialup"); try{ RadiusPacket response = radiusClient.authenticate(accessRequest); if(response.getPacketType() == RadiusPacket.ACCESS_ACCEPT){ String outs = response.getAttributeValue("Framed-Protocol"); System.out.println(outs); System.out.println("Authenticated"); } else if(response.getPacketType() == RadiusPacket.ACCESS_REJECT){ System.out.println("No Authenticated"); } }catch(IOException e){ e.printStackTrace(); }catch(RadiusException e){ e.printStackTrace(); } } } --------------------------------------------------- To support vendor specific AVPs check this tutorial. It helped me a lot: http://raihanulislam.wordpress.com/2012/03/25/supporting-vendor-specific-av… Greetings, Estefanía > Message: 2 > Date: Thu, 3 Apr 2014 21:26:52 +0100 > From: <adrian.p.smith(a)bt.com> > To: <freeradius-users(a)lists.freeradius.org> > Subject: RE: Querying freeRADIUS from Java > Message-ID: > <555F5D0F9437EB4EB0E1828E3A271939375E599D8D(a)EMV65-UKRD.domain1.systemhost.net> > > Content-Type: text/plain; charset="iso-8859-1" > > We use http://tinyradius.sourceforge.net/ for simple a Java Radius client. > > From: freeradius-users-bounces+adrian.p.smith=bt.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+adrian.p.smith=bt.com@lists.freeradius.org] On Behalf Of Estefania figueroa buitrago > Sent: 03 April 2014 20:30 > To: freeradius-users(a)lists.freeradius.org > Subject: Querying freeRADIUS from Java > > Hello guys, > > I just started to use freeRADIUS. The server is running and working with mySQL just like in this tutorial: > > http://wiki.freeradius.org/guide/SQL-HOWTO > > What I want to do is really simple. I want to be able to query the server from Java just like radtest does and get response information, for example: > > Framed-IP-Address = 2.3.4.1 > Framed-IP-Netmask = 255.255.255.255 > Framed-Routing = Broadcast-Listen > Framed-Route = "2.3.4.0 255.255.255.248" > Idle-Timeout = 900 > Service-Type = Framed-User > Framed-Protocol = PPP > > to be processed later also in Java. Is there a way to do this and keep it as simple as possible? I have an application server written in Java (Mobicents) and I only need to obtain authentication information from freeRADIUS to process it later. Sorry if my cuestion isn't pertinent, but I haven't find anything in the wiki. If there is no way to do this, I would be very grateful if you could show another way to do it. > > Greetings, > Estefan?a >

1 0

radutmp and sradutmp modules
by Matthew Ceroni 04 Apr '14

04 Apr '14

Hi: I am utilizing FreeRadius as an authentication server for a 802.1x environment (wired and wireless). Everything is up and running great. I recently enabled Accounting and turned on the radutmp and sradutmp files. I am probably missing something simple but running radwho only shows the last person to login. So if I sign onto the wireless or wired network, authenticate successfully to the radius server and type radwho is shows me as logged in. If another users signs on the output of radwho just shows them (always a single line of output). Is radwho meant to keep track of all currently signed in users? Or am I missing something simple? Thanks

2 1

Trusted CA, Signed Certs and Verification
by Sam Fakhreddine 04 Apr '14

04 Apr '14

Hello, I have been trying to use a Trusted CA to sign our freeradius server. The certificates are installed, the key, cert, the root chain all in their appropriate PEM files. The devices try to get the certificate that we specify; However, whenever we try to connect with an iOS device or Windows we get an error saying that the identity cannot be verified. I spoke with our SSL provider's support department, and they say this is normal behavior. There will always be a warning about identity not being able to be verified. Is this true? Am I missing something obvious? Sam Fakhreddine Site Systems Administrator

5 12