- Freeradius-Users - lists.freeradius.org

Debian 7 sendfromto()
by r00tk1d＠km.pl.ua 24 Jan '14

24 Jan '14

Hi! I'm using Debian 7 (Linux bill0 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64 GNU/Linux) and got the problem with Freeradius DHCP from current git. It's doesn't sent DHCP response back to user, and, while debugging it, i found that by default Freeradius sets a WITH_UDPFROMTO and thus uses udpfromto() function, but it always returns errno 22 (Invalid argument). But when use --with-udpfromto=no for configure, there's no any problem. Is it expected behavior? I'm using these parameters ./configure --with-static-modules=perl --with-dhcp --with-system-libtool --with-system-libpcre for

3 9

(Ruckus AP + CHAP + 802.1x EAP) + (FreeRadius + OpenLDAP) is possible? or need some magic?
by Jorge Pereira 24 Jan '14

24 Jan '14

hi folks! I've in my labs the "Ruckus AP" with SSID setted with authentication "802.1x EAP" and encryption method "WPA2" / algorithm AES. but, my only option for "Auth Method" is CHAP (not ms-chap) or PAP! of course that in this case, my only way out is use "CHAP" (again, i don't have ms-chap in my AP) my question is: could be possible authorize in my FreeRadius+OpenLdap? because i'm looking by many weeks about some solutions and didn't found anything that can solve my problem.... I heard something that need to add/create a new field in my openldap for store the "chap-password"... something like that! by the way: in my lab, i've winbind authorizing perfectly in my AD (that use OpenLDAP) eg: [root@lab samba]# ntlm_auth --request-nt-key --domain=domainlab --username="jpereiran" password: NT_STATUS_OK: Success (0x0) [root@lab samba]# obs: if someone available to try clarify my ideas, and give some way... I'll be very grateful!! :) Att, Jorge Pereira

2 1

Proper use of Mikrotik-Xmit-Limit-Gigawords
by Kwesi Yankson 24 Jan '14

24 Jan '14

Hi, I've been following the postings in this mailing list for a while (mostly on FR 3.x) so please forgive me for asking this "basic" stuff. I want to use FreeRADIUS to limit user data above 4GB, of course the right attribute is Mikrotik-Xmit-Limit-Gigawords. The documentation explains it as 4G (2^32). I get that. My question is (and forgive me if it sounds silly to some of you), assuming I want to limit data such as 10GB, 11GB and such figures, how am I supposed to approach it using Mikrotik-Xmit-Limit-Gigawords. Thank you

3 7

ldap authentication fails with windows 2008 server when base dn does not contain cn
by Winson Fernandes 24 Jan '14

24 Jan '14

Hi, "resending this post as the previous post was of larger size and hence blocked" When I configure the freeradius 2.1.12 with the following ldap config where base-dn does not have the "cn=Users" configured, *basedn = "dc=KC-DC-Solutions,dc=com" *the authentication does not work fine with windows 2008 active directory. The same works fine with a server configured on linux box with openldap. The openldap is able to search the user and authentication goes fine ldap ldap_primary { server = 172.31.100.250 port = 389 identity = "cn=Administrator,cn=Users,dc=KC-DC-Solutions,dc=com" password = "abcdefg" *basedn = "dc=KC-DC-Solutions,dc=com"* filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupacces" dictionary_mapping = ${raddbdir}/ldap.attrma With windows AD the free radius fails in authenticating the client with the reason " [ldap_primary] ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout." The below are the radiusd logs [ldap_primary] rlm_ldap: performing user authorization for Kiran [ldap_primary] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap_primary] expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=Kiran) [ldap_primary] expand: dc=KC-DC-Solutions,dc=com -> dc=KC-DC-Solutions,dc=com [ldap_primary] ldap_get_conn: Checking Id: 0 [ldap_primary] ldap_get_conn: Got Id: 0 [ldap_primary] attempting LDAP reconnection [ldap_primary] (re)connect to 172.31.100.250:389, authentication 0 [ldap_primary] bind as cn=Administrator,cn=Users,dc=KC-DC-Solutions,dc=com/abcdefg to 172.31.100.250:389 [ldap_primary] waiting for bind result ... [ldap_primary] Bind was successful [ldap_primary] performing search in dc=KC-DC-Solutions,dc=com, with filter (sAMAccountName=Kiran) [ldap_primary] ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. ldap server 172.31.100.250 is dead [ldap_primary] attempting LDAP reconnection [ldap_primary] closing existing LDAP connection [ldap_primary] (re)connection attempt failed [ldap_primary] search failed [ldap_primary] ldap_release_conn: Release Id: 0 +++[ldap_primary] returns fail ++- policy redundant returns fail Invalid user: [Kiran] (from client localhost port 1 cli 00-1E-E5-F9-BE-BC When I configure the same with basedn = "cn=Users,dc=KC-DC-Solutions,dc=com", the ldap search works fine and authentication goes fine ldap ldap_primary { server = 172.31.100.250 port = 389 identity = "cn=Administrator,cn=Users,dc=KC-DC-Solutions,dc=com" password = "abcdefg" basedn = "cn=Users,dc=KC-DC-Solutions,dc=com" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupacces" dictionary_mapping = ${raddbdir}/ldap.attrmap Please let me know what needs to be done for the ldap search to work with windows AD when the cn is not configured. Regards, Winson

2 1

FreeRadius3 - TLS 1.2 & Eapol_Test
by O'Connell, Ryan 23 Jan '14

23 Jan '14

Is there a way to use eapol_test to force TLS 1.2? I have downloaded and compiled the latest wpa_supplicant with OpenSSL 1.0.1e-fips 11 Feb 2013. I can't seem to find the configuration switch to enable TLS 1.2. On the server side I have tried configuring the eap module with: cipher_list = "DEFAULT" cipher_list = "ALL:!MEDIUM:!LOW" cipher_list = "AES256-SHA" cipher_list = "AES256-SHA256" cipher_list = "AES256-SHA256:AES128-SHA256" cipher_list = "AES256-SHA256:AES128:SHA" The command string I am currently using is: ./eapol_test -c eapol_test.conf.tls -a10.115.10.32 -p1812 -stesting123 -r1 The contents of the eapol_test.conf.tls are: eapol_version=2 network={ eap=TLS eapol_flags=3 proto=WPA #key_mgmt=IEEE8021X key_mgmt=WPA-EAP identity="00A0BC2FF8C0@test" ca_cert="testca.pem" client_cert="Client_Cert.pem" private_key="Client_privKey.pem" } My FreeRadius3 server server details: [root@aaa ~]# /usr/sbin/radiusd -Xv Wed Jan 22 13:00:52 2014 : Info: radiusd: FreeRADIUS Version 3.0.1, for host x86_64-redhat-linux-gnu, built on Jan 20 2014 at 01:36:32 Wed Jan 22 13:00:52 2014 : Debug: Server was built with: Wed Jan 22 13:00:52 2014 : Debug: accounting Wed Jan 22 13:00:52 2014 : Debug: authentication Wed Jan 22 13:00:52 2014 : Debug: ascend binary attributes Wed Jan 22 13:00:52 2014 : Debug: coa Wed Jan 22 13:00:52 2014 : Debug: control-socket Wed Jan 22 13:00:52 2014 : Debug: detail Wed Jan 22 13:00:52 2014 : Debug: dhcp Wed Jan 22 13:00:52 2014 : Debug: dynamic clients Wed Jan 22 13:00:52 2014 : Debug: proxy Wed Jan 22 13:00:52 2014 : Debug: regex-pcre Wed Jan 22 13:00:52 2014 : Debug: session-management Wed Jan 22 13:00:52 2014 : Debug: stats Wed Jan 22 13:00:52 2014 : Debug: tcp Wed Jan 22 13:00:52 2014 : Debug: threads Wed Jan 22 13:00:52 2014 : Debug: tls Wed Jan 22 13:00:52 2014 : Debug: unlang Wed Jan 22 13:00:52 2014 : Debug: vmps Wed Jan 22 13:00:52 2014 : Debug: Server core libs: Wed Jan 22 13:00:52 2014 : Debug: talloc : 2.0.* Wed Jan 22 13:00:52 2014 : Debug: ssl : OpenSSL 1.0.1e-fips 11 Feb 2013 Wed Jan 22 13:00:52 2014 : Info: Copyright (C) 1999-2014 The FreeRADIUS server project and contributors Wed Jan 22 13:00:52 2014 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Wed Jan 22 13:00:52 2014 : Info: PARTICULAR PURPOSE Wed Jan 22 13:00:52 2014 : Info: You may redistribute copies of FreeRADIUS under the terms of the Wed Jan 22 13:00:52 2014 : Info: GNU General Public License Wed Jan 22 13:00:52 2014 : Info: For more information about these matters, see the file named COPYRIGHT Thanks, Ryan

4 6

Removing log entries
by René Olskjær Nielsen 23 Jan '14

23 Jan '14

Hello I am running a couple of freeradius 2.2.3 servere behind an ACE HLB. The HLB is probing the servers frequently and I want to remove these logins from the log, as the logs is used intensively by supporters to help users with login issues. Is this possible? And if how? Best rgds.

5 5

ERX vs Unisphere ATTRIBUTES (Juniper MX)
by r00tk1d＠km.pl.ua 23 Jan '14

23 Jan '14

Hi! Got a problem with Juniper MX80, because ALL attributes suddenly changed. Old: ERX-Dhcp-Mac-Addr, Now: Unisphere-Dhcp-Mac-Addr, but my perl plugin uses ERX attributes. Do i need to rewrite my plugin or it will be fixed?

2 1

freeradius3 dhcp.dictionary error
by Darrel 22 Jan '14

22 Jan '14

"Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.dhcp[208]: Type "tlv" can only be for "format=1,1". Can I dereference dhcp.dictionary somehow? This error is on FreeBSD10. I did not enable dhcp, the dictionary is there by default. Darrel

5 8

Fwd: Issues with rlm_perl
by Ryan De Kock 22 Jan '14

22 Jan '14

Hi, No sure if this has been seen before but there is an issue with 3.0.1 where the correct pairs or not sent to the rlm_perl module. Version: radiusd: FreeRADIUS Version 3.0.1, for host x86_64-unknown-linux-gnu, built on Jan 20 2014 at 12:27:00 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Debug: ....... Ready to process requests. rad_recv: Accounting-Request packet from host 105.236.242.204 port 43909, id=61, length=196 Acct-Status-Type = Stop Acct-Terminate-Cause = User-Request NAS-Port-Type = Wireless-802.11 Calling-Station-Id = 'FC:C7:34:BA:7A:39' Called-Station-Id = 'hotspot1' NAS-Port-Id = 'Hotspot-Bridge' User-Name = 'supertest123' NAS-Port = 2163212315 Acct-Session-Id = '80f0001b' Framed-IP-Address = 10.20.30.3 Mikrotik-Host-IP = 10.20.30.3 Event-Timestamp = 'Jan 22 2014 09:45:49 SAST' Acct-Input-Octets = 104 Acct-Output-Octets = 52 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 2 Acct-Output-Packets = 1 Acct-Session-Time = 8 NAS-Identifier = 'Dev' Acct-Delay-Time = 0 NAS-IP-Address = 105.236.242.204 ........ rlm_perl: *DEBUG* Stop != Acct-Start so not doing mail. rlm_perl: *DEBUG* Checking Valid username/location rlm_perl: Added pair Acct-Input-Octets = 104 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Acct-Session-Id = 80f0 rlm_perl: Added pair Acct-Output-Gigawords = 0 rlm_perl: Added pair Acct-Unique-Session-Id = c165 rlm_perl: Added pair Called-Station-Id = hots rlm_perl: Added pair Tmp-IP-Address-0 = 105.236.242.204 rlm_perl: Added pair Acct-Status-Type = Stop rlm_perl: Added pair Acct-Output-Packets = 1 rlm_perl: Added pair Mikrotik-Host-IP = 10.20.30.3 rlm_perl: Added pair NAS-IP-Address = 105.236.242.204 rlm_perl: Added pair NAS-Port-Id = Hots rlm_perl: Added pair Acct-Output-Octets = 52 rlm_perl: Added pair Acct-Terminate-Cause = User-Request rlm_perl: Added pair Acct-Session-Time = 8 rlm_perl: Added pair Calling-Station-Id = FC:C rlm_perl: Added pair User-Name = supe rlm_perl: Added pair NAS-Identifier = Dev rlm_perl: Added pair Event-Timestamp = Jan 22 2014 09:45:49 SAST rlm_perl: Added pair Acct-Input-Gigawords = 0 rlm_perl: Added pair Acct-Input-Packets = 2 rlm_perl: Added pair Framed-IP-Address = 10.20.30.3 rlm_perl: Added pair NAS-Port = 2163212315 rlm_perl: Added pair Acct-Delay-Time = 0 rlm_perl: Added pair Tmp-Integer-0 = 100 .......... Called-Station-Id, Acct-Session-Id, Calling-Station-Id, User-Name,NAS-Identifier are all incorrect (maybe others as well?) Is there a potential fix? This was the latest version on the freeradius site

2 1

what is version 8014870 of threads.c?
by Maciej Uhlig 22 Jan '14

22 Jan '14

Excuse me for the most probably stupid question: what is version 8014870 of threads.c and where can it be downloaded from? I'm running freeradius 2.2.1 and get many / Error: WARNING: Unresponsive child for request *, in component <core> module <thread> / log entries. I've found Alan's mail http://lists.cistron.nl/pipermail/freeradius-devel/2013-September/008702.ht… and I could try his advice if I only knew where is the mentioned file. Or maybe 2.2.3 is the way to go? Please advice. Best regards, MU

7 9