- Freeradius-Users - lists.freeradius.org

Question on new dictionaries & values
by Mathieu Simon (Lists) 10 Feb '14

10 Feb '14

G'day I've been pondering a bit on the different dictionnaries and hope to provide some new. I understand that modifying/renaming old values can be is putting at risk current setups current setups, however new ones are easier to add :-) What is the current consenscus on tha Attribute naming. I've learned that underline usage isn't appreciated even though some vendors use it. VENDOR foovendor <id> a) ATTRIBUTE foovendor-name-by-vendor-doc... b) ATTRIBUTE name-by-vendor-doc... I've seen both in usage but mostly consistently throughout a dictionary itself (some vendors indicate variant a, some don't but it doesn't always match with FR's dicts). Thanks for your feedback, I hope to send in some Equallogic updates to other vendors dictionaries that I've found on respective vendor docs. -- Mat

3 3

rlm_exec with ntlm_auth broken in 3.0.2+git??
by peter.geiser＠id.unibe.ch 10 Feb '14

10 Feb '14

Is ntlm_auth with clear text password broken in FR 3.0.2+git? Modul Config: # exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } Debug output: Found Auth-Type = ntlm_auth (0) # Executing group from file /etc/freeradius/sites-enabled/ntlm (0) Auth-Type ntlm_auth { (0) ntlm_auth : Executing: /usr/bin/ntlm_auth --request-nt-key ‹domain=DOMAIN --username=%{mschap:User-Name} --password=%{User-Password} (0) ntlm_auth : expand: "--username=%{mschap:User-Name}" -> '--username=testuser' (0) ntlm_auth : expand: "--password=%{User-Password}" -> '--password=TEST1234' (0) ERROR: ntlm_auth : Failed parsing output from: /usr/bin/ntlm_auth --request-nt-key ‹domain=DOMAIN --username=%{mschap:User-Name} --password=%{User-Password}: Expecting operator (0) ERROR: ntlm_auth : Program returned code (0) and output 'NT_STATUS_OK: Success (0x0)' (0) [ntlm_auth] = fail (0) } # Auth-Type ntlm_auth = fail (0) Failed to authenticate the user. Authentication seems to be ok but FR can¹t parse the return values. Thanks for any Feedback. - Peter

2 2

Support for specific Cisco-Attributes
by Andreas Kalb (akalb) 07 Feb '14

07 Feb '14

Hello, I'm trying to use attributes like: Cisco-Enc += "xyz=1" Cisco-SSG-Account-Info += "Aratelimit(up=2000,down=2000)" where I get the following errors: /etc/freeradius/users[101]: Parse error (reply) for entry the-bob-10-v4v6-28(a)example.org: Invalid octet string "xyz=1" for attribute name "Cisco-Enc" Errors reading /etc/freeradius/users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[124]: Failed to load module "files". /etc/freeradius/sites-enabled/inner-tunnel[47]: Errors parsing authorize section. /etc/freeradius/users[113]: Parse error (reply) for entry the-bob-10-v4v6-28(a)example.org: Invalid octet string "Aratelimit(up=2000,down=2000)" for attribute name "Cisco-SSG-Account-Info" Errors reading /etc/freeradius/users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[124]: Failed to load module "files". /etc/freeradius/sites-enabled/inner-tunnel[47]: Errors parsing authorize section. Without these attributes all is working as expected. I tried this with combinations of Ubuntu 12.04.4, 13.10 and FreeRadius 2.1.10 (via apt-get), FreeRadius 2.2.3 and 3.0.1 (via configure/make/install) all in VMware. When going via install I preceded this with: - sudo apt-get install gcc make build-essential - sudo apt-get install libtalloc-dev to prevent concerning errors. A colleague uses above with success with 2.1.10, so I consider any setting missing. I tried to keep the config-files provided with the distribution but understood required to: - a client-entry in clients.conf for my router - listen-commands to radiusd.conf for own ip and to adjust the port to 1645/1646 - 2 user-entries in users So far I didn't try to copy his setup over, but if one proposes it, I'd give it a try. If a specific software is required or a knob is missing, I appreciated some feedback. Kind Regards, Andreas

2 2

proxy question
by adrian.p.smith＠bt.com 07 Feb '14

07 Feb '14

Hopefully an easy one to answer by the experts..... I've read some old posts, but just want to confirm. 1. When proxying requests FreeRadius will not perform any retries? But will forward retries received from clients? 2. The only retries are when status-checks are being done? Many thanks. Adrian Smith.

4 7

IP Address as User name
by Darren Ward (darrward) 07 Feb '14

07 Feb '14

Hi All I'm struggling with getting an IP address to eb accepted as a username in the clients file and suspect it's somehow being filtered but I can't find where I've create a user like: Test Cleartext-Password := "test" And using radtest can get an access-accept but when I try: 1.1.1.1 Cleartext-Password := "test" I get an access-reject and it has a noop against the files in the debug I have tried in quotes as well but no luck Can anyone point me in the right direction as the configs are quite vanilla/plain Darren

3 3

Does freeradius can automatically add new user in own user database
by matrix30003 07 Feb '14

07 Feb '14

Does freeradius can automatically add new user in own user database. For example I will be send request to freeradius with request add new user in freeradiusd users datastore.

4 4

split Called-Station-Id
by Zeus Panchenko 07 Feb '14

07 Feb '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, please, where am I mistaking? I need to auth user, comming from via hostapd as client, only if the user belongs to definite Ldap-Group (works fine via radiusGroupName attribute set for user LDAP object) and SSID (which I'm unable to pick - From Called-Station-Id) ... please advise how to do that correct ... I am trying to do it the way described here: http://wiki.freeradius.org/guide/Mac%20Auth#Mac-Auth-authorisation-by-SSID in debug I see - ---[ quotation start ]------------------------------------------- ... rad_recv: Access-Request packet from host 10.241.16.117 port 58063, id=40, length=202 User-Name = "vudhNrF7zxJJmteIVF/Xzg==" NAS-Identifier = "es-student.wrt" Called-Station-Id = "48-5B-39-E7-B0-3B:USER_SSID" NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Calling-Station-Id = "00-BD-3A-69-69-1B" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x0254001d01767564684e7246377a784a4a6d74654956462f587a673d3d Message-Authenticator = 0x6c46a58131867c13ca7fb318d9d407fd ... Fri Jan 31 22:50:48 2014 : Info: ++[logintime] = noop Fri Jan 31 22:50:48 2014 : Info: ++policy rewrite.called_station_id { ... Fri Jan 31 22:50:48 2014 : Info: ? Evaluating (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) -> TRUE Fri Jan 31 22:50:48 2014 : Info: +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) -> TRUE Fri Jan 31 22:50:48 2014 : Info: +++if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) { Fri Jan 31 22:50:48 2014 : Info: ++++update request { Fri Jan 31 22:50:48 2014 : Info: expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 485b39e7b03b Fri Jan 31 22:50:48 2014 : Info: expand: %{7} -> USER_SSID Fri Jan 31 22:50:48 2014 : Info: ++++} # update request = noop Fri Jan 31 22:50:48 2014 : Info: +++} # if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) = noop Fri Jan 31 22:50:48 2014 : Info: +++ ... skipping else for request 1: Preceding "if" was taken Fri Jan 31 22:50:48 2014 : Info: ++} # policy rewrite.called_station_id = updated ... - ---[ quotation end ]------------------------------------------- but what is next? so, how to get Called-Station-Id and Called-Station-SSID set to be able to add SSID to user ldap attributes? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlLsFQQACgkQr3jpPg/3oyrdogCgn6YZa0otNybkcWo38KHLRomD adsAoKVxMXQhF48JC6unIqdftzrEXZva =oe77 -----END PGP SIGNATURE-----

2 3

Username Wildcards?
by Darren Ward (darrward) 06 Feb '14

06 Feb '14

Hi All Sorry for what I'm sure is hopefully a simple question... Is it possible to have wildcards in a username? e.g. remote* Cleartext-Password = "password" to match remote101 and remote102 etc? Addressing is being done via DHCP pools but I need to have a few common attributes sent - I know passwords will be common but that's fine I don't want to type out 500 or so identical usernames with a three character variance ! :) Cheers Darren

4 4

status server
by nicolas.clo＠ricoh-industrie.fr 06 Feb '14

06 Feb '14

Hi List, I encountering a problem when i want load the virtual server "status" : i searched for a solution in conf file but i haven't found it. can anybody help me ? freeradius: FreeRADIUS Version 3.1.0 (git #65de468), for host i486-pc-linux-gnu, built on Feb 6 2014 at 12:57:04 server status { # from file /etc/freeradius/sites-enabled/status # Creating Autz-Type = Status-Server # Loading authorize {...} } # server status server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading virtual module split_domain_host # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Loading virtual module ssid # Loading virtual module log_eap_error } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 3812 } listen { type = "status" /etc/freeradius/sites-enabled/status[31]: No dictionary entry for protocol status Nicolas.

2 2

rlm_sql_sqlite issue on CentOS 6.x with sqlite3_create_function_v2
by stefan.paetow＠diamond.ac.uk 06 Feb '14

06 Feb '14

Hi Alan/Arran, We have discovered a problem with the SQLite module. During the compilation, you look for sqlite3_open_v2, but not for sqlite3_create_function_v2. On CentOS, the most recent version of SQLite is 3.6.20 (as per "sqlite3 -version"), and the sqlite3_create_function_v2 function was only added in version 3.7.3 as per http://freecode.com/projects/sqlite/releases/323290. In https://github.com/FreeRADIUS/freeradius-server/blob/f95aa0da8b512c4e36ab5b… you've wrapped the use of that function in a nice IFDEF, but I'm guessing the setting of that IFDEF needs to be updated to check for that function as well? : : checking for x86_64-redhat-linux-gnu-gcc... no checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for sqlite3_open in -lsqlite3... yes checking for sqlite3_open_v2 in -lsqlite3... yes checking for sqlite3.h... yes : : Without that check, we get this error: Could not link driver rlm_sql_sqlite: /usr/lib64/freeradius/rlm_sql_sqlite.so: undefined symbol: sqlite3_create_function_v2 Make sure it (and all its dependent libraries!)are in the search path of your system's ld. We discovered this as part of a Moonshot test. Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

2 4