- Freeradius-Users - lists.freeradius.org

Re: Freeradius DHCP IP pool and not correct port for DHCP
by Thomas Bru 03 Apr '14

03 Apr '14

Hello Alan You're true and your explanations are very usefull. The IAD has no problem because it did what I programmed. But there are not solution to this source-nat problem. The problem will always appear on the DHCP renewal and I can't do any thing on this IAD. I will used the DHCP request sended at 87,5% of the lease time for workaround this. Thanks you for your explanations and your help. Thomas >> When the renewal DHCP packets are send using unicast, my client try to >> reach FreeRadius. he send DHCP request using his IP address with source >> port 68 and the freeradius IP Address with destinatio port 67. >> My IAD source pat the flow using a dynamic random port. > That is not how DHCP works. > DHCP clients use a source port of 68. DHCP relays use a source port of 67. > Your IAD (whatever that is) is broken. Replace it with something that does DHCP properly. >> I don't understand why Freeradius will not reply to the initial source >> port ? > Because DHCP is insane. The replies do *not* cause the src/dst ports to be swapped, as with every other UDP protocol. >>> 3) This packet trace is not evidently the first requests, but a renewal? >> You're true, i see the problem only on the renewal (When 50% of the >> lease time have been reached). > Then look at the packet traces to see how the first request is different from the renewal. Alan DeKok.

2 1

Re: Accounting and octets - a silly one! was Re: Freeradius-Users Digest, Vol 108, Issue 13
by Rui Ribeiro 03 Apr '14

03 Apr '14

Octets means bytes, and in fact it also the most used french word in lieu of byte. Historically, and very long long ago, the point is that byte was not always 8 bits - there were very old mainframes with 9 bits. Regards, Message: 5 > Date: Thu, 3 Apr 2014 11:28:11 +0200 > From: Chris Knipe <savage(a)savage.za.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Accounting and octets - a silly one! > Message-ID: > < > CA+4TWFuaf9UCZbNZqPHQAZmQkoUc-5k2OoRKfL3aD7ybrVavhA(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Thanks all for clearing it up - as I said, really stilly question :-) > > I must have pulled some old stuff off google then that referenced > octets as *possibly* being bits... > > On Thu, Apr 3, 2014 at 11:05 AM, Arran Cudbard-Bell > <a.cudbardb(a)freeradius.org> wrote: > > > > On 3 Apr 2014, at 09:36, Chaigneau, Nicolas < > nicolas.chaigneau(a)capgemini.com> wrote: > > > >> > >> "octets" means "bytes". > > > > Yes, in modern systems they are synonymous. > > > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > > FreeRADIUS Development Team > > > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > -- > > Regards, > Chris Knipe > > >

2 1

Walk through for External CA usage
by Sam Fakhreddine 03 Apr '14

03 Apr '14

Does anyone have a walk through for how to use external certs instead of the internal certification? The internet is full of copy-paste from the documents on how to use the internal cert authority. Sam Fakhreddine Site Systems Administrator Ledcor Industries Inc., Information Services 7008 Roper Road NW, Edmnoton, AB T6B 3H2 p 780-395-5455 | c 780-996-0763 www.ledcor.com<http://www.ledcor.com> FORWARD. TOGETHER.

4 5

Accounting and octets - a silly one!
by Chris Knipe 03 Apr '14

03 Apr '14

Hi Guys, I just have a quick question, and I think I know the answer to this, but let's make sure. Generally speaking, is acct-input-octets / acct-output-octets referenced in bits, or bytes? Google reveals very conflicting information, whilst I personally would presume it would be NAS dependant (i.e. whether the NAS sends the accounting as bits or bytes)... What is it usually, and what does Cisco NASes generally represent? -- Regards, Chris Knipe

5 7

FreeRADIUS Version 2.1.12 installation and setup
by Andrew Belford 02 Apr '14

02 Apr '14

Hi Team I am new in freeradius and assign to build and configure a new freeradius server version 2.1.12 on a rhel6 There are 2 current freeradius(Version 2.1.12) servers(rhel5) running in PROD, both connecting to ldap for authentication and mysql for db. The only difference I can see on the 2 servers are one is running as master openldap and another as a consumer. I am not aware whether there is a master/slave setting in freeradius layer but assuming it works like that in the current status. Can someone please confirm whether you can setup freeradius like master and slave in the application layer to confirm from theory? My assignment is to build another freeradius server version 2.1.12 with the plan to attach it to the current 2 servers to expand its HA scenario. Openldap is now working as a consumer on the new build(RHEL6). I want to setup freeradius on the new build the same configuration as the current setup. What are the files in /etc/raddb that I need to compare between the running host and the new build to make sure I can get an identical setup? Is there a documentation of how to setup freeradius Version 2.1.12 from scatch? Appreciate your assistance thanks

1 0

new install (?) error "failed binding" when run freeradius -X
by Williams John D.-HDWQ83 02 Apr '14

02 Apr '14

Hello, New subscriber and having some trouble with new install, very basic so far. Question 1 All documentation refers to commands run from "/etc/raddb" that doesn't exist install on Ubuntu 12.04 created "/etc/freeradius". Not a big issue just a curiosity. Question 2 Running "/etc/freeradius/freeradius -X" I get error "failed binding" I'll paste entire output (long) below. Failed binding to authentication address * port 1812: Address already in use /etc/freeradius/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 If I run radtest with the test user I get access-accept from for local host so it appears the server is basically working: tutqa@tutqa-P380:/etc/freeradius$ sudo radtest bob hello 127.0.0.1 0 testing123 Sending Access-Request of id 95 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=95, length=20 Full output of debug: tutqa@tutqa-P380:/etc/freeradius$ sudo freeradius -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Feb 24 2014 at 15:16:51 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to authentication address * port 1812: Address already in use /etc/freeradius/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 tutqa@tutqa-P380:/etc/freeradius$ Thanks in advance. John D. Williams Sr Product Support / Quality Assurance Motorola Solutions Email jwilliams(a)motorolasolutions.com

3 3

Re: Freeradius DHCP IP pool and not correct port for DHCP
by Thomas Bru 02 Apr '14

02 Apr '14

> Hi, Hello Rui > 1) Could it be some problem with internal firewall, AppArmor or SELinux? No problem in this side > 2) How you are doing the relay? I was auditing our relay with our Cisco > Firewall recently and found some nasty side effects due to some lack of > understanding of the relay process when configuring the firewall. My DHCP client is behind an IAD with relay the DHCP packet to Freeradius. For the 1st DHCP flow (Discovery-Offer-Request-ACK), everything is OK because it is a broadcast packet. When the renewal DHCP packets are send using unicast, my client try to reach FreeRadius. he send DHCP request using his IP address with source port 68 and the freeradius IP Address with destinatio port 67. My IAD source pat the flow using a dynamic random port. I received the DHCP packet with source port 10.239.0.2.55175 but the freeradius not replied to 55175 but to 67. The firewall included on the box is statefull and so I dropped the reply DHCP packet. I don't understand why Freeradius will not reply to the initial source port ? > 3) This packet trace is not evidently the first requests, but a renewal? You're true, i see the problem only on the renewal (When 50% of the lease time have been reached). > Regards, > Rui Ribeiro Thanks for your help Thomas Cordialement, Thomas BRU Ingénieur Réseaux & Télécoms Pôle Ingénierie Tél. 02 72 73 59 96 tbru(a)afone.com AFONE - 11, place François Mitterrand - CS 11024 - 49055 ANGERS cedex 02 [t] 0825 168639 - [f] 0820 160 329 - ou composez le 3213 et dites « AFONE » ----- Mail original ----- De: freeradius-users-request(a)lists.freeradius.org À: freeradius-users(a)lists.freeradius.org Envoyé: Mercredi 2 Avril 2014 10:08:21 Objet: Freeradius-Users Digest, Vol 108, Issue 8 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Freeradius DHCP IP pool and not correct port for DHCP reply - Re: Freeradius-Users Digest, Vol 108, Issue 6 (Rui Ribeiro) 2. 1. Re: Wildcard SSL Certificates (Angel Franch) - Re: Freeradius-Users Digest, Vol 108, Issue 6 (Rui Ribeiro) 3. Re: use freeeradius 3.0.2 with sqlite fail when loading modules (Arran Cudbard-Bell) 4. Re: panic_action / ptrace: Operation not permitted (Stefan Winter) 5. RE: 3.0.2 / possible bug when proxying with no response from home server (Chaigneau, Nicolas) ---------------------------------------------------------------------- Message: 1 Date: Wed, 2 Apr 2014 06:07:32 +0100 From: Rui Ribeiro <ruyrybeyro(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius DHCP IP pool and not correct port for DHCP reply - Re: Freeradius-Users Digest, Vol 108, Issue 6 Message-ID: <CAGnR_r9pGzqvMRZu3T38vvieQWBWv6QA9pSSNP5wEt4JUWisqg(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi, 1) Could it be some problem with internal firewall, AppArmor or SELinux? 2) How you are doing the relay? I was auditing our relay with our Cisco Firewall recently and found some nasty side effects due to some lack of understanding of the relay process when configuring the firewall. 3) This packet trace is not evidently the first requests, but a renewal? Regards, Rui Ribeiro > Message: 4 > Date: Tue, 01 Apr 2014 14:32:52 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius DHCP IP pool and not correct port for DHCP > reply > Message-ID: <533B0654.8060306(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Thomas Bru wrote: > > On the Bug fixes list , I see the problem was solved using Freeradius > 3.0.4 (http://freeradius.org/version3.html, Use correct port when DHCP > relaying, ) > > So I reinstall the Freeradius 3.0.4 on my server but the problem is > still present and my server dropped the packets. > > > > 17:42:23.875867 IP 10.239.0.2.55175 > 10.225.2.8.67: BOOTP/DHCP, Request > from c9:31:cf:d8:af:ec, length 308 > > 17:42:23.932246 IP 10.225.2.8.67 > 10.239.0.2.67: BOOTP/DHCP, Reply, > length 300 > > > > AS you can see, the request packet from 10.239.0.2 with source port > 55175 but will go back to 10.239.0.2 BUT with 67 port. > > The correct destination port for DHCP relay packets is 67. > > What exactly do you think the problem is? > > Alan DeKok. > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/mailman/private/freeradius-users/attachments/20…> ------------------------------ Message: 2 Date: Wed, 2 Apr 2014 06:26:57 +0100 From: Rui Ribeiro <ruyrybeyro(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: 1. Re: Wildcard SSL Certificates (Angel Franch) - Re: Freeradius-Users Digest, Vol 108, Issue 6 Message-ID: <CAGnR_r-TAQMA9o8QGfL4OuRQ5AYn5_NLHmGHVyeKoTRh3XNM=Q(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi, Yeah, I also can confirm wildcards dont work with TTLS, never tested them with PEAP. The PEAP code seems to be much more forgiving, TTLS took longer to work, without ticking off the option to ignore the checks of the client certificate on the Windows client. Regards > > Message: 1 > Date: Tue, 1 Apr 2014 18:14:57 +0200 > From: Angel Franch <angel.franch(a)cnic.es> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Wildcard SSL Certificates > Message-ID: <533AE601.4000506(a)cnic.es> > Content-Type: text/plain; charset="ISO-8859-1" > > Hello all. My first post. > > Windows 7 fails validating wildcard certificate using TTLS. With PEAP it > works. > > Angel. > > > On 4/1/2014 5:33 PM, Miroslav Lednicky wrote: > > Hello, > > > > We using wildcard certificate and Windows have problem with it. ;-) > > > > Mirek > > > > Dne 1.4.2014 15:58, Sam Fakhreddine napsal(a): > >> Hello, > >> > >> Can we use Wildcard SSL Certificates from a third party CA with > >> freeradius servers? > >> > >> > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/mailman/private/freeradius-users/attachments/20…> ------------------------------ Message: 3 Date: Wed, 2 Apr 2014 07:31:53 +0100 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> To: "kids67.tw" <kids67.tw(a)yahoo.com.tw>, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: use freeeradius 3.0.2 with sqlite fail when loading modules Message-ID: <614F4AFF-4117-42AA-AA58-F0C9FE6DD34D(a)freeradius.org> Content-Type: text/plain; charset="iso-8859-1" On 2 Apr 2014, at 02:33, kids67.tw <kids67.tw(a)yahoo.com.tw> wrote: > Dear Sir, > > I complier freeradius 3.0.2 with sqlite enable and complier successful. > But when I run ./radiusd -XC -d ./raddb/ then display below error > > ...... > # Instantiating module "linelog" from file ./raddb//mods-enabled/linelog > linelog { > filename = "/home/saxontseng/senao_ source/ap_controller/ freeradius/install/LINUX/var/ log/radius/linelog" > permissions = 384 > format = "This is a log message for %{User-Name}" > reference = "%{%{Packet-Type}:-format}" > } > ./raddb//mods-enabled/sql[26]: Failed to link to module 'rlm_sqlite': rlm_sqlite.so: cannot open shared object file: No such file or directory > > And after I check I find only have "rlm_sql_sqlite.so", not find any rlm_sqlite.so. > > I just modify site-enable/default and mod-available/sql, make ln to mod-enabled/sql > below is my diff with those two config file You move the sqlite section into the sql section before uncommenting it. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 881 bytes Desc: Message signed with OpenPGP using GPGMail URL: <http://lists.freeradius.org/mailman/private/freeradius-users/attachments/20…> ------------------------------ Message: 4 Date: Wed, 02 Apr 2014 08:55:09 +0200 From: Stefan Winter <stefan.winter(a)restena.lu> To: freeradius-users(a)lists.freeradius.org Subject: Re: panic_action / ptrace: Operation not permitted Message-ID: <533BB44D.40908(a)restena.lu> Content-Type: text/plain; charset="iso-8859-1" Hi, > It works fine for me on OSX (10.9.1) and the the yama detection disabled > on ubuntu 13.07. > > We've used it at customer sites to send out automatic emails when the hosts > have gone down with the backtraces, and it seems to work there too > (ubuntu 12.04). > > Not really sure what else to suggest, sorry. Well, I found it now :-) My config had security.allow_core_dumps = no. As it happens, that setting is entangled with panic_action's gdb attach. allow_core_dumps modifies PR_SET_DUMPABLE. From the man page of prctl: "PR_SET_DUMPABLE (since Linux 2.3.20) [... bla bla ...] Processes that are not dumpable can not be attached via ptrace(2) PTRACE_ATTACH." So, my bad for producing an inconsistent configuration ;-) It would be very nice if the comments near panic_action could give users a hint though "If your panic_action uses gdb attach (such as the examples below), remember to allow core dumps for this to work (security.allow_core_dumps)." That would avoid some amount of guesswork :-) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - R?seau T?l?informatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66 -------------- next part -------------- A non-text attachment was scrubbed... Name: 0x8A39DC66.asc Type: application/pgp-keys Size: 3243 bytes Desc: not available URL: <http://lists.freeradius.org/mailman/private/freeradius-users/attachments/20…> -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 901 bytes Desc: OpenPGP digital signature URL: <http://lists.freeradius.org/mailman/private/freeradius-users/attachments/20…> ------------------------------ Message: 5 Date: Wed, 2 Apr 2014 08:07:39 +0000 From: "Chaigneau, Nicolas" <nicolas.chaigneau(a)capgemini.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: RE: 3.0.2 / possible bug when proxying with no response from home server Message-ID: <AB94B0B675BDF14189CD5A861DB36C84134C80D1(a)DE-CM-MBX26.corp.capgemini.com> Content-Type: text/plain; charset="iso-8859-1" OK, thanks. Any hope for a fix soon ? Regards, Nicolas. De : freeradius-users-bounces+nicolas.chaigneau=capgemini.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+nicolas.chaigneau=capgemini.com@lists.freeradius.org] De la part de Arran Cudbard-Bell Envoy? : mardi 1 avril 2014 09:51 ? : FreeRadius users mailing list Objet : Re: 3.0.2 / possible bug when proxying with no response from home server On 1 Apr 2014, at 08:15, Chaigneau, Nicolas <nicolas.chaigneau(a)capgemini.com<mailto:nicolas.chaigneau@capgemini.com>> wrote: Thanks for the fix! I still have a question, though. Now, the request goes through: - authorize - pre-proxy (no response from proxy server) - Post-Auth-Type REJECT It does *not* go through "Post-Proxy-Type Fail" anymore. Is that the expected behaviour ? Nope! As show by this handy dandy revised diagram. [cid:image001.png@01CF4E5B.60196060] Arran Cudbard-Bell <a.cudbardb(a)freeradius.org<mailto:a.cudbardb@freeradius.org>> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/mailman/private/freeradius-users/attachments/20…> -------------- next part -------------- A non-text attachment was scrubbed... Name: image001.png Type: image/png Size: 43484 bytes Desc: image001.png URL: <http://lists.freeradius.org/mailman/private/freeradius-users/attachments/20…> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 108, Issue 8 ************************************************

2 1

Freeradius v3 + Active Directory + WPA2 Enterprise + ntlm + mschapv2
by banditfr 02 Apr '14

02 Apr '14

i need solution for freeradius v3

7 12

use freeeradius 3.0.2 with sqlite fail when loading modules
by kids67.tw 02 Apr '14

02 Apr '14

Dear Sir, I complier freeradius 3.0.2 with sqlite enable and complier successful. But when I run ./radiusd -XC -d ./raddb/ then display below error ...... # Instantiating module "linelog" from file ./raddb//mods-enabled/linelog linelog { filename = "/home/saxontseng/senao_ source/ap_controller/ freeradius/install/LINUX/var/ log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "%{%{Packet-Type}:-format}" } ./raddb//mods-enabled/sql[26]: Failed to link to module 'rlm_sqlite': rlm_sqlite.so: cannot open shared object file: No such file or directory And after I check I find only have "rlm_sql_sqlite.so", not find any rlm_sqlite.so. I just modify site-enable/default and mod-available/sql, make ln to mod-enabled/sql below is my diff with those two config file --- mods-available/sql 2014-04-01 15:14:36.935046321 +0800 +++ /home/saxontseng/freeradius- server-3.0.2/raddb/mods- available/sql 2014-03-21 20:27:25.000000000 +0800 @@ -23,15 +23,15 @@ # # Driver specific options are: # - sqlite { - # Path to the sqlite database - filename = "$(PWD)/bin/LINUX/radius.db" - - # If the file above does not exist and bootstrap is set - # a new database file will be created, and the SQL statements - # contained within the file will be executed. - bootstrap = "$(PWD)/bin/LINUX/freeradius/ etc/raddb/mods-config/sql/ main/sql_sqlite/schema.sql" - } +# sqlite { +# # Path to the sqlite database +# filename = "/my/sqlite/database.db" +# +# # If the file above does not exist and bootstrap is set +# # a new database file will be created, and the SQL statements +# # contained within the file will be executed. +# bootstrap = "/my/sqlite/schema.sql" +# } # # mysql { # # If any of the below files are set tls encryption is enabled @@ -55,14 +55,14 @@ # * rlm_sql_sqlite # * rlm_sql_null (log queries to disk) # - driver = "rlm_sql_sqlite" + driver = "rlm_sql_null" # The dialect of SQL you want to use, this should usually match # the driver you selected above. # # If you're using rlm_sql_null, then it should be the type of # database the logged queries are going to be executed against. - dialect = "sqlite" + dialect = "mysql" # Connection info: # @@ -110,7 +110,7 @@ # Write SQL queries to a logfile. This is potentially useful for tracing # issues with authorization queries. - logfile = ${logdir}/sqllog.sql +# logfile = ${logdir}/sqllog.sql # As of version 3.0, the "pool" section has replaced the # following configuration items: --- sites-enabled/default 2014-04-01 14:03:20.544123741 +0800 +++ /home/saxontseng/freeradius- server-3.0.2/raddb/sites- available/default 2014-03-21 20:27:25.000000000 +0800 @@ -252,7 +252,7 @@ # If you want to have a log of authentication requests, # un-comment the following line, and the 'detail auth_log' # section, above. - auth_log +# auth_log # # The chap module will set 'Auth-Type := CHAP' if we are @@ -271,7 +271,7 @@ # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authenticate' section. -# digest + digest # # The WiMAX specification says that the Calling-Station-Id @@ -328,14 +328,14 @@ # # Read the 'users' file -# files + files # # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf - sql + -sql # # If you are using /etc/smbpasswd, and are also doing @@ -434,7 +434,7 @@ # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. -# digest + digest # # Pluggable Authentication Modules. @@ -548,7 +548,7 @@ # Update the wtmp file # # If you don't use "radlast", you can delete this line. -# unix + unix # # For Simultaneous-Use tracking. @@ -565,7 +565,7 @@ # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf - sql + -sql # # If you receive stop packets with zero session length, @@ -613,7 +613,7 @@ # # See "Simultaneous Use Checking Queries" in sql.conf - sql +# sql } @@ -639,7 +639,7 @@ # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf - sql + -sql # # Instead of sending the query to the SQL server, @@ -742,7 +742,7 @@ # Post-Auth-Type REJECT { # log failed authentications in SQL, too. - sql + -sql attr_filter.access_reject # Insert EAP-Failure message if the request was Does my config have wrong? How to config will make 3.0.2 run with sqlite? Regards, SaxonTseng

2 1

1. Re: Wildcard SSL Certificates (Angel Franch) - Re: Freeradius-Users Digest, Vol 108, Issue 6
by Rui Ribeiro 02 Apr '14

02 Apr '14

Hi, Yeah, I also can confirm wildcards dont work with TTLS, never tested them with PEAP. The PEAP code seems to be much more forgiving, TTLS took longer to work, without ticking off the option to ignore the checks of the client certificate on the Windows client. Regards > > Message: 1 > Date: Tue, 1 Apr 2014 18:14:57 +0200 > From: Angel Franch <angel.franch(a)cnic.es> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Wildcard SSL Certificates > Message-ID: <533AE601.4000506(a)cnic.es> > Content-Type: text/plain; charset="ISO-8859-1" > > Hello all. My first post. > > Windows 7 fails validating wildcard certificate using TTLS. With PEAP it > works. > > Angel. > > > On 4/1/2014 5:33 PM, Miroslav Lednicky wrote: > > Hello, > > > > We using wildcard certificate and Windows have problem with it. ;-) > > > > Mirek > > > > Dne 1.4.2014 15:58, Sam Fakhreddine napsal(a): > >> Hello, > >> > >> Can we use Wildcard SSL Certificates from a third party CA with > >> freeradius servers? > >> > >> >

1 0