- Freeradius-Users - lists.freeradius.org

acct_unique ID algorithm
by Mehdi Ravanbakhsh 20 Sep '13

20 Sep '13

Hi all I need the algorithm that use to create acct_unique ID that use in radacct table. any one can help on this ? Best regards.

2 2

eap-ttls with SMD5-Password
by Nasser Heidari 20 Sep '13

20 Sep '13

Hi, I'm trying to setup eap-ttls with freeradius, all my tests in LAB was successful. I've test it with both users file and sql and it was working. Now I'm going to prepare it for real setup, my only problem is that all my User-Passwords is database is stored with SMD5-Password attribute and when I'm trying it with EAP authentications fails and I get these messages in debug: Fri Sep 20 08:58:47 2013 : Info: [eap] Request found, released from the list Fri Sep 20 08:58:47 2013 : Info: [eap] EAP/md5 Fri Sep 20 08:58:47 2013 : Info: [eap] processing type md5 Fri Sep 20 08:58:47 2013 : Debug: rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication Fri Sep 20 08:58:47 2013 : Info: [eap] Handler failed in EAP/md5 Fri Sep 20 08:58:47 2013 : Info: [eap] Failed in EAP select Fri Sep 20 08:58:47 2013 : Info: ++[eap] returns invalid Fri Sep 20 08:58:47 2013 : Info: Failed to authenticate the user. Is there any possibility to make it work without changing password attribute? Kind Regards, Nasser

2 1

eap-ttls with SMD5-Password
by Nasser Heidari 20 Sep '13

20 Sep '13

Hi, I'm trying to setup eap-ttls with freeradius, all my tests in LAB was successful. I've test it with both users file and sql and it was working. Now I'm going to prepare it for real setup, my only problem is that all my User-Passwords is database is stored with SMD5-Password attribute and when I'm trying it with EAP authentications fails and I get these messages in debug: Fri Sep 20 08:58:47 2013 : Info: [eap] Request found, released from the list Fri Sep 20 08:58:47 2013 : Info: [eap] EAP/md5 Fri Sep 20 08:58:47 2013 : Info: [eap] processing type md5 Fri Sep 20 08:58:47 2013 : Debug: rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication Fri Sep 20 08:58:47 2013 : Info: [eap] Handler failed in EAP/md5 Fri Sep 20 08:58:47 2013 : Info: [eap] Failed in EAP select Fri Sep 20 08:58:47 2013 : Info: ++[eap] returns invalid Fri Sep 20 08:58:47 2013 : Info: Failed to authenticate the user. Is there any possibility to make it work without changing password attribute? Kind Regards, Nasser

1 0

ubuntu postgresql unknown client
by rich carroll 19 Sep '13

19 Sep '13

I am having problems getting freeradius with ubuntu and postgres to work. I have set up this setup on freebsd several time successfully. I believe that it is not checking the database at all. Below is my radtest command and my debug command. My configs are identical to my configs on a working freebsd server. I would be happy to share what ever ones would be helpfull. I can uncomment the client.conf file out of the radiusd.conf and set my nas in it and get a password error. Which you would expect if it wasn't reading from accounts from the db also. I installed freeraduis-postgresql normally I would have just installed freeradius and configured it to use postgres. my sql.conf radtest command root@radius1:/etc/freeradius# radtest test test 127.0.0.1 1812 test Sending Access-Request of id 158 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Server Debug: root@radius1:/etc/init.d# freeradius -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Sep 24 2012 at 17:53:32 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/postgresql/dialup.conf including configuration file /etc/freeradius/sql/postgresql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 127.0.0.1 port 52834 Ready to process requests. -- Richard Carroll richcarroll(a)gmail.com

3 3

Active Directory authentication question
by Roberto Carna 19 Sep '13

19 Sep '13

Dear, I have several Windows 7 clients over WiFi autheticating throug EAP-TLS to a Freeradius 2.1 service against a local MySQL database, it works OK. Now I have to change the authentication from MySQL to a remote Active Directory on a Windows 2012 server. Because I don't know so much about Windows world, I need to know if I have to use NTLM, LDAP or Kerberos in order to authenticate against the remote AD. Thanks a lot !!! Roberto

5 8

Looking for help with DHCP
by Alan DeKok 19 Sep '13

19 Sep '13

Not many people know that FreeRADIUS implements DHCP. I'd like to change that. I'm therefore offering to pay for some work on the feature. As background, the current version does DHCP, and DHCP relaying. It allocates IPs from an SQL pool. The git "master" branch has a script to import an ISC lease file into the SQL database. We need more. I'm looking for the following: - detailed documentation on how to get it working. Ideally a step-by-step guide, in the style of the EAP docs on http://deployingradius.com/ - the documentation should include examples of an ISC configuration, and how it maps to a FreeRADIUS configuration - the documentation should include simple tests, and common problems to check - it should include any new scripts, etc. necessary to get it working. - any code / configuration will become part of the main FreeRADIUS releases - the documentation and worked examples will get hosted on the FreeRADIUS web site, and prominently linked from the main page - your name will go on everything - since my company is paying for it, all copyright will belong to Network RADIUS SARL. This is a request for *paid* work. I'm prepared to pay reasonable rates for this. And not the "$100 bounty for 6 days work" kind of nonsense, either. Please send email to me with your proposal, background, and price. I'll pick someone in the next week, and work behind the scenes to get this done. The hope is to crush that pesky ISC server. It's been frustrating people world-wide for years. :) Alan DeKok.

1 0

DHCP relaying
by Nikolaos Milas 19 Sep '13

19 Sep '13

Hi, I would like to ask how we can direct FR dhcp server (using an ldap backend) to relay to another dhcp server. The idea is that we have a db of known MAC addresses which have an associated VLAN (assigned during MAC Auth) and a static IP address (assigned through FR dhcp server). If a MAC address is unknown, we would like to be able to relay to another dhcp server which will be responsible for dynamic IP address allocation (because, as I understand, FR does not support dynamic IP address allocation) on a private IP address range, with limited access. What will be the "command" to use for relaying? Thanks in advance, Nick

2 3

ipad ssl error in free radius
by val john 19 Sep '13

19 Sep '13

hi guys we are getting follwong error in our radius log when ipad trying to connect to our WIFI network , our WIFI network using EAP-TTLS + LDAP authentication , All other devices (linux , windows, mac os 10.8 , Suse , android ) are working fine apart from ipads .. Error === Tue Sep 17 13:36:25 2013 : Error: TLS Alert read:warning:close notify Tue Sep 17 13:36:25 2013 : Error: TLS_accept: failed in SSLv3 read client certificate A Tue Sep 17 13:36:25 2013 : Error: rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure Tue Sep 17 13:36:25 2013 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Tue Sep 17 13:36:25 2013 : Auth: Login incorrect (TLS Alert read:warning:close notify): [user(a)ihk.com] (from client ManagementAPs port 1 cli 00-88-65-42-50-88) Do you guys any idea what cause this issue Thank you John

4 3

Version 2.2.1 has been released.
by Alan DeKok 17 Sep '13

17 Sep '13

After a long wait, we have released the 2.2.1 version of FreeRADIUS. The focus of this release is stability. Minor features may be added, but the goal is to increase system stability at the cost of missing features. People interested in major new features should look at the v3 release branch. Our focus now is fixing the last few issues in v3, before making a new release. Once v3 has been released, there will be no further new development on Version 2. Bug fixes and security issues will be addressed for three (3) years after v3 has been released. The change log for v2.2.1 is as follows: Alan DeKok FreeRADIUS Project Leader ----- Feature improvements * Updated dictionaries for alcatel, broadsoft, bskyb, dlink, meru, telkom, trapeze, proxim, zeus, rfc6677, 6911, and rfc6930. * Added %{randstr:..} support. Creates random strings in a controllable format. * Added operator support to rlm_python * Added %{hex:...} for hex version of raw attribute data * Added %{sha1:...} for SHA1 hashing of data * Added %{base64:...} for raw attribute data (e.g. 32-bit IP addr), and %{tobase64:...} for the printable string form (e.g. 1.2.3.4), and %{base64tohex:...} to convert a base64 string to a hex string. * rlm_expr is now responsible for registering many of the xlat expansions. This is cleaner than bundling them all in the server core. You should ensure 'expr' is listed in instantiate to ensure correct operation of xlat expansions. * Use correct terminology when printing errors regarding request/ response/message authenticators. * Added keytab support to Heimdal Kerberos. Patch from Ryan Steinmetz. * radsqlrelay does multiple INSERTs in one transaction. Patch from Uwe Meyer-Gruhl. * Run Post-Proxy-Type Reject {} if the upstream server rejected the request. * On startup, the server checks if it was linked with the correct OpenSSL libraries. If not, it errors out. This prevents later crashes in OpenSSL, due to library incompatibilities. * Added radmin command "hup main.log", to re-open the log files, without HUPing any other part of the server. * Added support for EAP-Key-Name. See raddb/sites-available/default, and look for comments mentioning EAP-Key-Name. MacSec now works. * Added support for hex numbers (0x...) to %{expr: ...} * Backported TLS client certificate validation from 3.0.0. * Run Post-Auth for EAP inner-tunnel methods. * Added more RFCs * Added "show config <path>" to radmin. You can now examine any configuration item in a running server. * Added TLS-Client-Cert-X509v3-Extended-Key-Usage for TLS-based EAP methods. It is set automatically from the fields in the certificate. * Add CRLCP attribute in certificate creation script. Windows phones require it. Patch from Alan Buxey. Bug fixes * Skip OCSP if there's no host / port / url, with soft_fail * Properly decode AT_IDENTITY in EAP-SIM. Patch from Iliya Peregoudov * Thread max_queue_size has better bounds checking. * Use correct variable for warning message if the user misconfigures the server. * radtest is more generous about parsing ppphint * radeapclient now accepts -4 and -6, just like radclient. Patch from John Dennis. * Ignore ".rpmnew" and a bunch of other files when loading config files from a directory. * Wait for child threads before exiting. This prevents errors on exit, but may increase exit time if databases are blocked! Patch from Iliya Peregoudov. * Wrap rbtree calls in mutexes in rlm_cache to prevent memory corruption. Patch from Phil Mayers. * Port fix for %{3GPP-*} expansion from master branch. * Fix sample certificate scripts when multiple client certs are made * Track return code priorities across if/else/elsif in unlang. Closes #107 * In debug mode, print out DHCP options when sending a DHCP packet. * Fixes to the redis modules from Brian Candler * Print better debug message for LDAP "operations error" * Fix a number of minor issues as found by Coverity * Frees module config in order to prevent occasional crash on exit * Update DHCP debugging messages to make it clearer what's going on. * Print multiple DHCP options the correct number of times in debugging mode * On debug builds, don't dlclose() modules when '-m' is used. This allows valgrind to show module symbols. * Don't count Status-Server packets in Access-Request statistics * Minor cleanups to debug output * Be more careful handling module configurations to avoid crash on otherwise clean exit. * For raddebug, correctly set the group of the output file. * renamed dhclient to dhcpclient. People who install it shouldn't have their systems broken. * for EAP-TLS methods, random_file is no longer required. OpenSSL already reads /dev/urandom. * Fix Suse and Redhat scripts. Patches from Fajar Nugraha. * Minor bug fix for base64 decoding. * Allow two consecutive WiMAX TLVs of the same number. * Remove requirement that User-Name has to match MS-CHAP-User-Name. I18n issues means that the character sets could be different. * Don't use ephemeral thread states from PyGILState_Ensure(), use our own, generated one per thread and stored in TLS. * Port module processing fixes from v3. The code is simpler, and one or two esoteric bugs are now gone. * update code handling max_requests_per_server. It should now work correctly. * wrap ASCTIME_R for systems not supporting the standard API.

1 0

Re: Freeradius2 + MySQL + Accouting
by Arran Cudbard-Bell 17 Sep '13

17 Sep '13

On 17 Sep 2013, at 19:02, Wederson Rodrigues <wederson(a)vipvilhena.com.br> wrote: > I used radtest just to show the attributes that are returning. > > I'm using a debian (ppp) as NAS, with the enabled plugins: plugin > rp-radius.so pppoe.so radattr.so Even better, RTFS. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

1 0