- Freeradius-Users - lists.freeradius.org

Version 2.2.1 has been released.
by Alan DeKok 17 Sep '13

17 Sep '13

After a long wait, we have released the 2.2.1 version of FreeRADIUS. The focus of this release is stability. Minor features may be added, but the goal is to increase system stability at the cost of missing features. People interested in major new features should look at the v3 release branch. Our focus now is fixing the last few issues in v3, before making a new release. Once v3 has been released, there will be no further new development on Version 2. Bug fixes and security issues will be addressed for three (3) years after v3 has been released. The change log for v2.2.1 is as follows: Alan DeKok FreeRADIUS Project Leader ----- Feature improvements * Updated dictionaries for alcatel, broadsoft, bskyb, dlink, meru, telkom, trapeze, proxim, zeus, rfc6677, 6911, and rfc6930. * Added %{randstr:..} support. Creates random strings in a controllable format. * Added operator support to rlm_python * Added %{hex:...} for hex version of raw attribute data * Added %{sha1:...} for SHA1 hashing of data * Added %{base64:...} for raw attribute data (e.g. 32-bit IP addr), and %{tobase64:...} for the printable string form (e.g. 1.2.3.4), and %{base64tohex:...} to convert a base64 string to a hex string. * rlm_expr is now responsible for registering many of the xlat expansions. This is cleaner than bundling them all in the server core. You should ensure 'expr' is listed in instantiate to ensure correct operation of xlat expansions. * Use correct terminology when printing errors regarding request/ response/message authenticators. * Added keytab support to Heimdal Kerberos. Patch from Ryan Steinmetz. * radsqlrelay does multiple INSERTs in one transaction. Patch from Uwe Meyer-Gruhl. * Run Post-Proxy-Type Reject {} if the upstream server rejected the request. * On startup, the server checks if it was linked with the correct OpenSSL libraries. If not, it errors out. This prevents later crashes in OpenSSL, due to library incompatibilities. * Added radmin command "hup main.log", to re-open the log files, without HUPing any other part of the server. * Added support for EAP-Key-Name. See raddb/sites-available/default, and look for comments mentioning EAP-Key-Name. MacSec now works. * Added support for hex numbers (0x...) to %{expr: ...} * Backported TLS client certificate validation from 3.0.0. * Run Post-Auth for EAP inner-tunnel methods. * Added more RFCs * Added "show config <path>" to radmin. You can now examine any configuration item in a running server. * Added TLS-Client-Cert-X509v3-Extended-Key-Usage for TLS-based EAP methods. It is set automatically from the fields in the certificate. * Add CRLCP attribute in certificate creation script. Windows phones require it. Patch from Alan Buxey. Bug fixes * Skip OCSP if there's no host / port / url, with soft_fail * Properly decode AT_IDENTITY in EAP-SIM. Patch from Iliya Peregoudov * Thread max_queue_size has better bounds checking. * Use correct variable for warning message if the user misconfigures the server. * radtest is more generous about parsing ppphint * radeapclient now accepts -4 and -6, just like radclient. Patch from John Dennis. * Ignore ".rpmnew" and a bunch of other files when loading config files from a directory. * Wait for child threads before exiting. This prevents errors on exit, but may increase exit time if databases are blocked! Patch from Iliya Peregoudov. * Wrap rbtree calls in mutexes in rlm_cache to prevent memory corruption. Patch from Phil Mayers. * Port fix for %{3GPP-*} expansion from master branch. * Fix sample certificate scripts when multiple client certs are made * Track return code priorities across if/else/elsif in unlang. Closes #107 * In debug mode, print out DHCP options when sending a DHCP packet. * Fixes to the redis modules from Brian Candler * Print better debug message for LDAP "operations error" * Fix a number of minor issues as found by Coverity * Frees module config in order to prevent occasional crash on exit * Update DHCP debugging messages to make it clearer what's going on. * Print multiple DHCP options the correct number of times in debugging mode * On debug builds, don't dlclose() modules when '-m' is used. This allows valgrind to show module symbols. * Don't count Status-Server packets in Access-Request statistics * Minor cleanups to debug output * Be more careful handling module configurations to avoid crash on otherwise clean exit. * For raddebug, correctly set the group of the output file. * renamed dhclient to dhcpclient. People who install it shouldn't have their systems broken. * for EAP-TLS methods, random_file is no longer required. OpenSSL already reads /dev/urandom. * Fix Suse and Redhat scripts. Patches from Fajar Nugraha. * Minor bug fix for base64 decoding. * Allow two consecutive WiMAX TLVs of the same number. * Remove requirement that User-Name has to match MS-CHAP-User-Name. I18n issues means that the character sets could be different. * Don't use ephemeral thread states from PyGILState_Ensure(), use our own, generated one per thread and stored in TLS. * Port module processing fixes from v3. The code is simpler, and one or two esoteric bugs are now gone. * update code handling max_requests_per_server. It should now work correctly. * wrap ASCTIME_R for systems not supporting the standard API.

1 0

Re: Freeradius2 + MySQL + Accouting
by Arran Cudbard-Bell 17 Sep '13

17 Sep '13

On 17 Sep 2013, at 19:02, Wederson Rodrigues <wederson(a)vipvilhena.com.br> wrote: > I used radtest just to show the attributes that are returning. > > I'm using a debian (ppp) as NAS, with the enabled plugins: plugin > rp-radius.so pppoe.so radattr.so Even better, RTFS. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

1 0

Freeradius2 + MySQL + Accouting
by Wederson Rodrigues 17 Sep '13

17 Sep '13

Regards, I have a server configured with freeradius2 rlm_mysql and have authentication working well. But the Accouting is only done on start and stop. Wanted it to be done every 5 minutes (300 interim-update) but is not working. Radtest result: Sending Access-Request of id 250 to 127.0.0.1 port 1812 User-Name = "cebolark2" User-Password = "xxxxx" NAS-IP-Address = xxxxxxx NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id = 250, length = 59 Acct-Status-Type = Interim-Update Acct-Interim-Interval = 300 Calling-Station-Id = "C89CDC4B8CA9" Filter-Id = "m2048" Framed-IP-Address = yyy.yyy.yyy.yyy But the table radcct not updated, only start and stop. -- []'s ----------------------------------------- .'. Wederson Rodrigues .'. (CeBoLaRk) VIP - Vilhena Internet Provider Gerente de T.I. http://www.vipvilhena.com.br MSN: cebolark(a)hotmail.com SKYPE: cebolark EMAIL: wederson(a)vipvilhena.com.br INOC VOIP: 28240*100 Celular: 0xx69 8437-0186 Fixo: 0xx69 3322-2244 -----------------------------------------

2 1

reconnecting to mysql
by Edgars Makņa 17 Sep '13

17 Sep '13

Hello, I just setup 2.2.0 from freebsd ports. In the testing environment it looks okey except this error: rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 It appears on every second authorization attempt. Ping to mysql server runs fine, another db's works without any clue. Google didnt give me any answers about this problem. rad_recv: Access-Request packet from host 127.0.0.1 port 27983, id=47, length=50 User-Name = "2-40" User-Password = "PjTKX2Ln" Framed-Protocol = PPP # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2-40", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> 2-40 [sql] sql_set_user escaped user --> '2-40' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribu rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribu [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergrou [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, grou [sql] User found in group Plaza20 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, grou rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "PjTKX2Ln" [pap] Using CRYPT password "PCA82A.D836/k" [pap] User authenticated successfully ++[pap] returns ok Login OK: [2-40/PjTKX2Ln] (from client localhost port 0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 2-40 [sql] sql_set_user escaped user --> '2-40' [sql] expand: %{User-Password} -> PjTKX2Ln [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 47 to 127.0.0.1 port 27983 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 47 with timestamp +51 Ready to process requests. Thanks.

2 1

EAP-TLS works but not PEAP/EAP-TLS
by John Carter 17 Sep '13

17 Sep '13

Hi, I've got a Windows 7 machine attempting to connect to FreeRADIUS 2.2.0. EAP-TLS with a client certificate works fine, but with PEAP/EAP-TLS it doesn't. Is there anything I'm missing? The problem appears to be that the client doesn't send over the client cert. I know Windows is very fussy with what it accepts as a cert for EAP-TLS, but I'm confused as to why it works for one and not the other. Mon Sep 16 12:56:55 2013 : Info: [tls] Length Included Mon Sep 16 12:56:55 2013 : Info: [tls] eaptls_verify returned 11 Mon Sep 16 12:56:55 2013 : Info: [tls] (other): before/accept initialization Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: before/accept initialization Mon Sep 16 12:56:55 2013 : Info: [tls] <<< TLS 1.0 Handshake [length 005a], ClientHello Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: SSLv3 read client hello A Mon Sep 16 12:56:55 2013 : Info: [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: SSLv3 write server hello A Mon Sep 16 12:56:55 2013 : Info: [tls] >>> TLS 1.0 Handshake [length 053e], Certificate Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: SSLv3 write certificate A Mon Sep 16 12:56:55 2013 : Info: [tls] >>> TLS 1.0 Handshake [length 000d], CertificateRequest Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: SSLv3 write certificate request A Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: SSLv3 flush data Mon Sep 16 12:56:55 2013 : Info: [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A Mon Sep 16 12:56:55 2013 : Debug: In SSL Handshake Phase ... Mon Sep 16 12:57:00 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Sep 16 12:57:00 2013 : Debug: WARNING: !! EAP session for state 0x7c569f3d755a860c did not finish! Mon Sep 16 12:57:00 2013 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Mon Sep 16 12:57:00 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Sep 16 12:57:00 2013 : Info: Ready to process requests. radius.log: http://pastebin.com/9fBdxfYt eap.conf: http://pastebin.com/7dL69pmQ inner-tunnel: http://pastebin.com/BGzJSKz0 Thanks, John. -- John Carter Identity Networks jcarter(a)identitynetworks.com skype:jcartermeru

2 2

Debugging "No EAP session matching the State variable"
by John Douglass 16 Sep '13

16 Sep '13

I run two freeradius servers (both 2.2.0 x86_64) with MySQL backends doing ntlm_auth (RHEL 6 Samba 3.6.9) for EAP-PEAP-MSChapV2 for our client devices. I have enabled the server debug using radmin (the debug file is HUUUUUGE so that is why I am not posting it along with). I have googled and read and analyzed as much as I can so I am looking to the list to see if anyone has experienced this problem. I was concentrating on a single user mhaley: Sep 16 08:40:33 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:40:42 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:40:42 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:40:54 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:40:54 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:41:22 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:41:22 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:41:33 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:41:33 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:41:49 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:41:49 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:42:08 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:42:08 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:42:12 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:42:12 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 08:42:15 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 08:42:15 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client resnet1-WiSM-A port 13 cli 3c:e0:72:a5:b7:81) Sep 16 09:57:56 newdvlanb radiusd[15211]: Invalid user: [mhaley7] (from client Rich-core-WiSM-E port 29 cli 3c:e0:72:a5:b7:81) Sep 16 09:58:01 newdvlanb radiusd[15211]: Invalid user: [mhaley7] (from client Rich-core-WiSM-E port 29 cli 3c:e0:72:a5:b7:81) Sep 16 09:58:57 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-E port 29 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 09:58:57 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-E port 29 cli 3c:e0:72:a5:b7:81) Sep 16 10:03:42 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 10:03:42 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81) Sep 16 10:03:49 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 10:03:54 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81) Sep 16 10:06:09 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 10:06:09 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81) Sep 16 10:36:10 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81 via TLS tunnel) Sep 16 10:36:10 newdvlanb radiusd[15211]: Login OK: [mhaley7] (from client Rich-core-WiSM-C port 13 cli 3c:e0:72:a5:b7:81) Around there (without the OK's, I am seeing many of this style of message): Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [jwalters38] (from client resnet1-WiSM-A port 13 cli a8:26:d9:34:bc:5f) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [arogers44] (from client Rich-core-WiSM-E port 29 cli a8:06:00:cc:6b:29) Sep 16 09:57:56 newdvlanb radiusd[15211]: Invalid user: [mhaley7] (from client Rich-core-WiSM-E port 29 cli 3c:e0:72:a5:b7:81) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [bboggess3] (from client Rich-core-WiSM-E port 29 cli 40:a6:d9:9a:9a:53) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [cparker31] (from client Rich-core-WiSM-E port 29 cli 88:53:95:79:ea:0c) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [djohnson77] (from client Rich-core-WiSM-E port 29 cli 60:45:bd:f2:7e:a8) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [lnichols3] (from client Rich-core-WiSM-E port 29 cli e0:75:7d:4e:97:bb) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [oanachebe3] (from client Rich-core-WiSM-E port 29 cli 98:d6:f7:5f:aa:cf) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [bmcgowan6] (from client Rich-core-WiSM-E port 29 cli c8:aa:21:39:7e:32) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. Sep 16 09:57:56 newdvlanb radiusd[15211]: Login incorrect: [yyu98] (from client Rich-core-WiSM-E port 29 cli 9c:3a:af:60:ed:bc) Sep 16 09:57:56 newdvlanb radiusd[15211]: rlm_eap: No EAP session matching the State variable. I need some guidance on what to enable, what to look for, etc. to fix this. I will be glad to post a full debug log (this server is very busy, but it's beefy beefy so should be handling things). I'll gladly post the multi megabyte debug log somewhere with a date/time of when things are occurring. Within the debug mode, I didn't see a way for me to follow a given thread of authentication. It looks like (forgive me if I am misreading) the debug messages are interleaved. There appears to be a process ID (5357?) but that same guide number style doesn't appear in the debug (allowing me to focus in on that one authentication session). It appears to be doing ok, but these failed auth's may appear to the end user as a wireless session drop so I am very concerned. [root@newdvlana 2013]# /services/snacks/lawn/util/radius-server-status.sh Received response ID 28, code 2, length = 140 FreeRADIUS-Total-Access-Requests = 14103212 FreeRADIUS-Total-Access-Accepts = 2072612 FreeRADIUS-Total-Access-Rejects = 132162 FreeRADIUS-Total-Access-Challenges = 11896299 FreeRADIUS-Total-Auth-Responses = 14101073 FreeRADIUS-Total-Auth-Duplicate-Requests = 430 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 1824 FreeRADIUS-Total-Auth-Unknown-Types = 0 After finding some messages on the devel list, I saw some reference to memory clean up but that was a while ago so not sure how valid that comment/problem is in the 2.2.0 version. How should I approach this problem? - John Douglass, Sr. Systems IT/Architect

2 1

Freeradius + 2 x LDAP + VLAN
by Miroslav Lednicky 16 Sep '13

16 Sep '13

Hello, I have Freeradius 2.1.10 with 2 LDAP servers (ldap1 + ldap2) and Ubuntu 12.04 I using it for 802.1x users. I need switch users from ldap1 to VLAN 1 and users from ldap2 to VLAN 2. I don't know how can i do it. My configuration: /etc/freeradius/modules/ldap: ldap ldap1 { ... server = 1.1.1.1 basedn = ou=users,dc=test,dc=cz ... } ldap ldap2 { ... server = 2.2.2.2 basedn = ou=users,dc=test1,dc=cz .... } /etc/freeradius/sites-enabled/inner-tunnel: authorize { chap mschap unix suffix eap { ok=return } files ldap1 ldap2 expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP1 { ldap1 } Auth-Type LDAP2 { ldap2 } eap } It works. But i need send atributes to switch or Access Point: Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id=1 for users from ldap1 and Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id=2 for users from ldap2 I tried configure it in /etc/freeradius/users, but without success. Thank You for help Miroslav

4 4

Last call for Version 2.2.1
by Alan DeKok 16 Sep '13

16 Sep '13

Unless there are any objections, we'll release 2.2.1 tomorrow. The list of changes is large: https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/doc/ChangeLog Alan DeKok.

3 3

RE: Freeradius 2.1.12 Second LDAP Server
by Beliars Fire 16 Sep '13

16 Sep '13

Hi, thanks for the Help. Actually im decided to create a new VM and reinstall the complete Server. I`m following the complete How-To, but i`m getting two different Errors. The First One is this: It`s under the first Point: Configuring Authentification with Active Directory I`m startet the Samba and Kerberos Services und used this Command: net join -U MyAdministrator > Worked. I`m getting this Message: Using short domain name -- MYDomain Joined 'UBUNTU' to realm 'MYDomain' The next Step wbinfo -a user%password works too, but i`m getting this Error-Message: Could not authenticate user Username%Password with plaintext password challenge/response password authentication succeeded Is this normal? How can I fix it? The Response seems to work correctly. The Second One is this: It`s the last Point on this Page: Configuring FreeRadius to use ntml_auth for MS-CHAP In this Step, i must edit the following line with this text in the file: /etc/freeradius/modules/mschap ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" But my default commented ntml_auth looks like this: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" In my default ntlm_auth, the option "--domain=%{%{mschap:NT-Domain}:-MYDOMAIN}" is missing. Should i add it? Actually i`m using my default uncommented ntlm_auth. So, i`m going to test the MS-CHAP authentification reuqest with this command: $ radtest -t mschap bob hello localhost 0 testing123 And i`m getting this Error-Message: Sending Access-Request of id 251 to 127.0.0.1 port 1812 User-Name = "bob" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = 0x01774f129c72245c MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000024ff68dcea66e8348622a45aa91804201f2102e9ecc0add6 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=251, length=38 MS-CHAP-Error = "\000E=691 R /etc/freeradius/users First Line: bob Cleartext-Password := "hello" # # Please read the documentation file ../doc/processing_users_file, # or 'man 5 users' (after installing the server) for more information. # .... @Mathieu Is there a current RADIUS-book that you can recommend? -- BeliarsFire

3 2

Last call for Version 2.2.1
by Alan DeKok 16 Sep '13

16 Sep '13

Unless there are any objections, we'll release 2.2.1 tomorrow. The list of changes is large:

2 1