- Freeradius-Users - lists.freeradius.org

Version 2.2.4 has been released
by Alan DeKok 20 Mar '14

20 Mar '14

The changes from 2.2.3 are minor. Feature improvements * A "panic_action" can be set to have the server dump a gdb log on SEGV or other fatal error. * allow radmin command "set module status <module> <code>" which can be used to forcibly enable/disable modules. Bug Fixes * If the server fails to bind() after fork(), that is now reported to the parent, which exits with an error. * Session / delay times in MySQL are unsigned int. & Use --tag=CC for libtool. Closes #497. Because libtool is too stupid to notice that compiling means compilation. * Fix bug when copying attributes for vendors > 32767 * Fix behaviour on FreeBSD where sending packets from an interface bound to an IP address would fail when the server was built with udpfromto. * Don't fail config check if were listening on an IP which is also a home server. Some deployments have valid reasons to loop packets back to another virtual server. * Use correct port when DHCP relaying. * Set source IP address for DHCP packets from DHCP-Server-IP-Address, or DHCP-DHCP-Server-Identifier, if we're unable to otherwise determine the source IP.

4 6

Assign link-local addresses on authentication/authorization failure
by William C. Chandler 20 Mar '14

20 Mar '14

Hey all, I'm having trouble wrapping my brain around the correct way to do this, if at all possible. Some guidance would be greatly appreciated! I'm looking to assign link-local addresses to clients who fail to authenticate or fail to be authorized for access. I was wondering if this was even possible with radius? Would it be a DHCP-Reject in the post-auth section? Maybe something update reply? I've even thought about creating a new vlan with a dhcp server/scope of 169.254.254.x/24 and just dropping the users there... For more details -- setting up WPA enterprise wifi network, and we require our LDAP users to be part of certain groups to get on ("wirelessfaculty," and "wirelessstudents"). If they fail to authenticate due to bad password it'd be nice to give them a 169.254.0.1 address. Or if they're not in the proper group, a 169.254.0.2. This seems like it'd help us more quickly assess which step caused the hangup. Thanks for any ideas! --William Email correspondence to and from this address may be subject to the North Carolina Public Records law and may be disclosed to third parties by an authorized state official (NCGS. ch. 132). Student educational records are subject to FERPA.

2 1

Fwd: Disconnect users hanging
by Julio Fsnet 19 Mar '14

19 Mar '14

I have a problem. When the user tries to connect and already has a connection to it, an error pops multiple logins. I need to write this mysql error log somewhere or else knock the hanging connection, how can I do this?

2 7

Decoding HEX data in accounting interim-updates
by Callum Barr 19 Mar '14

19 Mar '14

Hi, We have an Alcatel-Lucent 7750SR when it sends its interim-updates we get an output like the following; Alc-Acct-O-statmode = "0x1 v4-v6" Alc-Acct-O-Inprof-Octets-64 = 0x0001000000000002a19e Alc-Acct-O-Outprof-Octets-64 = 0x00010000000000000000 Alc-Acct-O-Inprof-Pkts-64 = 0x00010000000000000e32 Alc-Acct-O-Outprof-Pkts-64 = 0x00010000000000000000 Alc-Acct-O-statmode = "0x2 v4-v6" Alc-Acct-O-Inprof-Octets-64 = 0x00020000000000000000 Alc-Acct-O-Outprof-Octets-64 = 0x00020000000000000000 Alc-Acct-O-Inprof-Pkts-64 = 0x00020000000000000000 Alc-Acct-O-Outprof-Pkts-64 = 0x00020000000000000000 Alc-Acct-O-statmode = "0x3 v4-v6" Alc-Acct-O-Inprof-Octets-64 = 0x00030000000000000000 Alc-Acct-O-Outprof-Octets-64 = 0x00030000000000000000 Alc-Acct-O-Inprof-Pkts-64 = 0x00030000000000000000 Alc-Acct-O-Outprof-Pkts-64 = 0x00030000000000000000 Alc-Acct-I-statmode = "0x8001 v4-v6" Alc-Acct-I-Hiprio-Octets_64 = 0x80010000000000012442 Alc-Acct-I-Lowprio-Octets_64 = 0x80010000000000000000 Alc-Acct-I-Hiprio-Packets_64 = 0x80010000000000000996 Alc-Acct-I-Lowprio-Packets_64 = 0x80010000000000000000 Alc-Acct-I-statmode = "0x8002 v4-v6" Alc-Acct-I-Hiprio-Octets_64 = 0x80020000000000000000 Alc-Acct-I-Lowprio-Octets_64 = 0x80020000000000000000 Alc-Acct-I-Hiprio-Packets_64 = 0x80020000000000000000 Alc-Acct-I-Lowprio-Packets_64 = 0x80020000000000000000 Alc-Acct-I-statmode = "0x8003 v4-v6" Alc-Acct-I-Hiprio-Octets_64 = 0x80030000000000000000 Alc-Acct-I-Lowprio-Octets_64 = 0x80030000000000000000 Alc-Acct-I-Hiprio-Packets_64 = 0x80030000000000000000 Alc-Acct-I-Lowprio-Packets_64 = 0x80030000000000000000 Each of the Alc-Acct-I-Hiprio-Octets_64 counters are formatted as follows; Eg. 0x80010000000000012442 where the first 2B represent the queue ID and the last 8B represent the octet counter in hex. So queue 1, 74818 octets How can I manipulate the data to put it into our database correctly? Say if I wanted to put the above information into field acct_queue1_in_octets and so onŠ We are running Freeradius v2.1.9 but can upgrade if needed. Many thanks in advance, Callum Barr Vibecom NZ

2 3

dhcp pool on freeradius server
by Mahima Kumar 18 Mar '14

18 Mar '14

Hello , Can anyone guide me about how to make a dhcp pool on the freeradius server? TIA -- Regards, Mahima Kumar 1365962

2 1

Howto group Users authenticated with ldap
by Mischa Diehm 18 Mar '14

18 Mar '14

Hi, we are authenticating users via ldap but don't have group attributes in ldap. Is there a way to define groups within radius itself so that I can actually use these groups in the users file like: # don't know where and how to setup a group like that group mon = user1, user2, user3 #use it in the users file DEFAULT Auth-Type := pap, group == mon, Huntgroup-Name == ons Service-Type = Administrative-User, cisco-avpair = "shell:priv-lvl=0", Thanks in advance Mischa -- Mischa Diehm | Network Operations Center (NOC) UniBasel | UniRechenZentrum (URZ) Klingebergstr. 70 | CH-4056 Basel Tel. +41 61 267 2273 | http://urz.unibas.ch

2 4

Re: JSON format to use for rlm_rest
by Werner Stucky 17 Mar '14

17 Mar '14

Hi Arran Running like a charm now thanks. I'll keep testing, but so far it looks good. Thanks for the help.

2 1

Create date from system in ldap module
by Bogdan Siara 17 Mar '14

17 Mar '14

Hello, I use freeradius with ldap for eap-peap in my network. In ldap module I check user by means of: filter = "(&(uid=%{User-Name})(o=COMPANY))" I would like to add one more parameter to check attribute pwdchangedtime, for example: filter = "(&(uid=%{User-Name})(o=COMPANY)(pwdchangedtime>`date --date="90 day ago" "+%Y%m%d%H%M%S"T`))" How to realize this trick? Regards BS

3 4

Re: JSON format to use for rlm_rest
by Werner Stucky 17 Mar '14

17 Mar '14

Thanks Arran the authorization is working now but I can't do more than 1 request. I get a FATAL SIGNAL: Segmentation fault Below my output showing one Request and Response working, and then the following one fails: Ready to process requests rad_recv: Access-Request packet from host 192.168.118.102 port 58368, id=54, length=58 User-Name = '4411' CHAP-Password = 0xcc26c6f1f411c1f53fb28c2c59bb946d81 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) chap : Setting 'Auth-Type := CHAP' (0) [chap] = ok (0) [mschap] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop rlm_rest (rest): Reserved connection (4) (0) rest : Expanding URI components (0) rest : expand: "http://192.168.113.154:2233" -> ' http://192.168.113.154:2233' (0) rest : expand: "/authorize" -> '/authorize' (0) rest : Sending HTTP POST to "http://192.168.113.154:2233/authorize" (0) rest : Encoding attribute "User-Name" (0) rest : Encoding attribute "CHAP-Password" (0) rest : Encoding attribute "NAS-IP-Address" (0) rest : Encoding attribute "CHAP-Challenge" (0) rest : Status : 200 (OK) (0) rest : Type : json (application/json) (0) rest : Parsing attribute "control:Cleartext-Password" (0) rest : expand: "12345" -> '12345' (0) rest : Parsing attribute "reply:Reply-Message" (0) rest : expand: "pass" -> 'pass' rlm_rest (rest): Released connection (4) (0) [rest] = updated (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = updated (0) Found Auth-Type = CHAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type CHAP { (0) chap : Login attempt by "4411" with CHAP password (0) chap : Comparing with "known good" Cleartext-Password (0) chap : CHAP user "4411" authenticated successfully (0) [chap] = ok (0) } # Auth-Type CHAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) [exec] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) ? if (reply:EAP-Message && reply:Reply-Message) (0) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # post-auth = noop Sending Access-Accept of id 54 from 192.168.113.151 port 1812 to 192.168.118.102 port 58368 Reply-Message = 'pass' (0) Finished request 0. rad_recv: Access-Request packet from host 192.168.118.102 port 58368, id=54, length=58 Sending Access-Accept of id 54 from 192.168.113.151 port 1812 to 192.168.118.102 port 58368 Waking up in 999997.9 seconds. rad_recv: Access-Request packet from host 192.168.118.102 port 58368, id=54, length=58 Sending Access-Accept of id 54 from 192.168.113.151 port 1812 to 192.168.118.102 port 58368 Waking up in 1999995.9 seconds. rad_recv: Access-Request packet from host 192.168.118.102 port 45385, id=55, length=58 User-Name = '4411' CHAP-Password = 0x72932b75282b7002a540446a3f6929a94b (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) chap : Setting 'Auth-Type := CHAP' (1) [chap] = ok (1) [mschap] = noop (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop rlm_rest (rest): Reserved connection (4) (1) rest : Expanding URI components (1) rest : expand: "http://192.168.113.154:2233" -> ' http://192.168.113.154:2233' (1) rest : expand: "/authorize" -> '/authorize' (1) rest : Sending HTTP POST to "http://192.168.113.154:2233/authorize" (1) rest : Encoding attribute "User-Name" (1) rest : Encoding attribute "CHAP-Password" (1) rest : Encoding attribute "NAS-IP-Address" (1) rest : Encoding attribute "CHAP-Challenge" (1) rest : Status : 200 (OK) (1) rest : Type : json (application/json) (1) rest : Parsing attribute "control:Cleartext-Password" (1) rest : expand: "12345" -> '12345' FATAL SIGNAL: Segmentation fault Backtrace of last 25 frames: /usr/local/lib/libfreeradius-radius.so(fr_fault+0x72) [0x7effd806b92a] /lib64/libpthread.so.0() [0x36a200f710] /usr/local/lib/libjson-c.so.2(array_list_get_idx+0xd) [0x7effc89c2dcd] /usr/local/lib/rlm_rest.so(+0x5952) [0x7effc8bcf952] /usr/local/lib/rlm_rest.so(+0x5a99) [0x7effc8bcfa99] /usr/local/lib/rlm_rest.so(rest_request_decode+0x14e) [0x7effc8bd15a3] /usr/local/lib/rlm_rest.so(+0x337f) [0x7effc8bcd37f] radiusd() [0x422e71] radiusd() [0x42368b] radiusd() [0x423047] radiusd() [0x4243fe] radiusd(modcall+0x88) [0x425140] radiusd(indexed_modcall+0x2e4) [0x420723] radiusd(process_authorize+0x22) [0x422741] radiusd(rad_authenticate+0x1af) [0x40d241] radiusd() [0x4335af] radiusd() [0x4326bd] radiusd(request_receive+0x5f4) [0x433c69] radiusd() [0x414588] radiusd() [0x439523] /usr/local/lib/libfreeradius-radius.so(fr_event_loop+0x5ba) [0x7effd808edeb] radiusd(radius_event_process+0x26) [0x43ac73] radiusd(main+0xbdf) [0x4285ae] /lib64/libc.so.6(__libc_start_main+0xfd) [0x36a1c1ed1d] radiusd() [0x40c449] No panic action set _EXIT CALLED src/lib/debug.c[262]: 1:

2 1

Freeradius-mysql authentication
by Dahoun Baya 17 Mar '14

17 Mar '14

Hi, I am curently student, I have to implement freeradius-mysql with 802.1x and test this with client so the client must autheticate before entering to LAN. So, for the test it works only when I use client who belongs to users file (radius file) when I try with sql's client (client which belongs to my database) that doesn't work???????I get no response Can anyone help me please?? Thanks

5 8