- Freeradius-Users - lists.freeradius.org

Multiple policy files
by Jonathan Gazeley 09 Aug '13

09 Aug '13

For a while I've been using FreeRADIUS with a set of includes.d-style directories that I can drop modules, virtual sites, etc into. This works well - until today. So far I've only had one included policy file in use, and the stock policy.conf is commented out. Today I tried to add another new virtual site which also has a policy file. Although radiusd -X clearly shows that the new policy file is being read, my virtual server is unable to call upon policies defined in the file. On a FreeRADIUS server with no other sites/policies, the new site and policy work fine, so it appears to be some kind of namespace issue. I've been through both policy files and there are no namespace clashes. Each policy file has its own name, e.g. policy eduroam {} and policy rainbow {}. Unusually, the debug log doesn't seem to be that helpful (it says that the files have been loaded, and that the policy can't be found by name). Apologies for the naming scheme - the various sites, modules and policies we currently manage have been inherited from various authors and I'm working on overhauling it. "debug-working.log" is from a FreeRADIUS server using only the new virtual site, which works. "debug-not-working.log" is from a full development FreeRADIUS server with other sites and policies, which does not work. "policies" is the policy file used with the existing (eduroam) sites "rainbow.conf" is the new policy that works on its own, but not in conjunction with other policies. Can anyone spare a few minutes to cast an eye over the debug output and see if I've missed something? I spent all yesterday afternoon looking and this problem and didn't make much progress. Thanks, Jonathan

4 5

How to store session info in external database?
by Maciej Lew 09 Aug '13

09 Aug '13

Hi, I would like to store freeradius session information like Acct-Session-Id, Acct-Start-Time, Acct-Stop-Time, Acct-Input-Octets, Acct-Output-Octets, Framed-IP-Address, NAS-IP-Address in external database. We have our devices connected to databases which are readonly so we cannot store those informations there. Also we have database where we want to store session statistics from all devices. Is that possible to achieve ? Till now we tried setting up virtual host with Auth-Type rules redirecting to script but we cannot receive Acct-Session-Id. Here is how our /etc/freeradius/sites-avaliable/default looks like: authorize { chap mschap sql update control { Auth-Type := `/etc/freeradius/bin/testradius '%{User-Name}' '%{Calling-Station-Id}' '%{NAS-IP-Address}' '%{reply:Framed-IP-Address}' '%{reply:Acct-Session-Id}' '%{reply:Acct-Unique-Session-Id}'` } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } } preacct { acct_unique } accounting { # sql } session { # sql } post-auth { # sql } Sorry for any language mistakes :) -- Pozdrawiam Maciej Lew tel. 883-376-062

4 5

Sending the Framed-IP-Address from a module
by Romeo Mihalcea 09 Aug '13

09 Aug '13

I got a complicated schema where my radius server needs to send the Framed-IP-Address based on the results of a redis-db query so, I would like to know if if the post-auth part of my default config I can do that. Something like (or any other solutions doing this): update reply { Framed-IP-Address := xxx.xx.xx.xx } where xxx.xx.xx.xx is an ip address returned by a module. Much appreciated.

1 0

Re: Problems setting up a freeradius server with PEAP
by Alan Buxey 08 Aug '13

08 Aug '13

Hi How are you generating the certs and what format are they in? alan

1 0

Problems setting up a freeradius server with PEAP
by Jochen Gatternig 08 Aug '13

08 Aug '13

Hello I am currently trying to setup a Freeradius server on a SUSE 12.04. I tried with the packaged version and a version compiled from source (both 2.20). What works is the basic username/password authentication. As soon as I create the certificates (CA, server & client) and try to fire up the server, I'm getting the following error messages: rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/server.pem rlm_eap: Failed to initialize type tls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[310]: Failed to find "eap" in the "modules" section. /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. The eap.conf file has been modified: default_eap_type = peap However, the error appers regardless of the default_eap_type parameter. All other settings remained standard. Does anyone know how to handle this problem? Thanks! Regards Jochen

2 1

Can't figure out Group Authentication
by Jernej 08 Aug '13

08 Aug '13

Hi! i am kindly asking for help or pointing right way to solve this problem. Right now we are using LDAP for authentication to IBM products. Last thing we try to do is use Freeradius on same LDAP schema for wireless purposes (Cisco network). We didn't have problems with basic authentication, but when we try to implement Groups in same way than we used before we hit a hard rock. Our LDAP schema looks like: ou= entries + ou= groups + ou=services + cn=wireless -> uniquemember : uid=user0001, ou=users, ou=entries uniquemember : uid=user0002, ou=users, ou=entries + ou=users + uid = user0001 mail = user1(a)firm.com pass: something + uid = user0002 mail = user2(a)firm.com pass: something We are authenticating user by mail and password attribute. Is it possible to make search to met this criterias? Thank you and have a nice day.

1 0

VLAN assignment to HP Switch with 802.1x client
by Shaw, Colin M. 08 Aug '13

08 Aug '13

Hi, I'm in the process of attempting to move our 802.1x services off of an aging freeRADIUS (v1) server onto a newly built server running freeRADIUS v2.2 Tests so far with wireless clients using 802.1x PEAP/MS-CHAPv2 are working ok. Clients can authenticate (against AD) and be assigned the different vlans that I want them to be assigned. So the authentication, AD interaction & vlan assignment are all working as should be there. However, we also use wired 802.1x on some of our HP 5406 switches. This currently works fine with the existing old freeRADIUS server, so the actual switch configs (I've tested more than one) must be ok. But I cannot get the switches to use the assigned vlan that the clients (who again use PEAP/MS-CHAPv2) are given with the new freeRADIUS server. I've not changed the vlans that are to be used, the only change is the switch now points to the new RADIUS server. Running radiusd -X shows that the correct attributes are still being supplied early on in the authenticate process: "Sending Access-Challenge of id 123 to x.x.x.x port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "resnet" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e74c686cb9198540381901eb" Note I've also tried the vlan id number as well as the name (although the name works fine in the old server, so should be fine here). Plus I've tried using Egress-VLANID or Egress-VLAN-Name, but it made no difference. Lastly, for testing purposes, if I insert the required attributes into the default post-auth then it all works and the wired client is assigned the correct vlan, so again the switch side must be ok and I also therefore presume all the dictionary entries are there as required. But I shouldn't need (or want) to do this. i.e. in post-auth update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-ID := "resnet" } It's as though the attributes are being removed or ignored somewhere in the PEAP/inner-tunnel process (but that's just a guess). What am I just not getting here? I'm sure it must be something simple but I can't see it. Hopefully this sort of thing has been done enough times that someone out there has fallen into whatever trap I currently find myself in and can point me in the right direction I need to be looking. But if not, I can of course supply the output of radiusd -X and the switch debug if it's going to help any. Thanks in advance, Colin The University of Aberdeen is a charity registered in Scotland, No SC013683.

2 1

returning a HEX String as a HEX String (bit string) instead of the decimal equivalent - FreeRADIUS 2.1.10
by Andy 07 Aug '13

07 Aug '13

Hello, This is my first post here so please excuse any missed etiquette. I have read through the wiki's and googled a lot and not found anything. I have been trying configure our switch ports (HP 2910al) with Tagged VLANs via Egress-VLANID and Egress-VLAN-Name. The Radius backend is OpenLDAP, and I have tried setting the data type in OpenLDAP to binary, UTF-8 and IA5, but no matter what I do, the value returned by RADIUS is the decimal equivalent of the HEX bit string I enter :( For example I'm trying to store and send 0x31000012 to indicate a tagged VLAN (0x31) on VLAN 12. But looking at freeradius -X output I can see it sending the decimal number, when the switch wants the bit string as it was stored, and hence throws an error! Is this a FreeRADIUS thing or an OpenLDAP data type thing? Any help and advice would be greatly appreciated as I'm stuck. Thanks in advance, Andy.

4 11

RE: returning a HEX String as a HEX String (bit string) instead ofthe decimal equivalent - FreeRADIUS 2.1.10
by Franks Andy (RLZ) IT Systems Engineer 07 Aug '13

07 Aug '13

Hi, Just agreeing with Arran really, we've got 5406 procurve switches, which I believe are similar in software terms to the 2910s and we do the unlang string Arran has presented here : update reply { Egress-VLANID += "%{expr:822083584 + %{Tagged-VID}}" } It works fine, although that may not help you too much. I had some 2910s around here somewhere, maybe I'll test one.. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 07 August 2013 14:06 To: FreeRadius users mailing list Subject: Re: returning a HEX String as a HEX String (bit string) instead ofthe decimal equivalent - FreeRADIUS 2.1.10 On 7 Aug 2013, at 13:46, Alan DeKok <aland(a)deployingradius.com> wrote: > Arran Cudbard-Bell wrote: >> I'm honestly not entirely sure why the freeradius dictionary has the >> attribute as an unsigned int > > That's what the RFCs say. And the server doesn't really have a way > of packing arbitrary structures from attributes. It says the value is 4 octets. That's not quite saying it's an integer, was there a later one? I think it's arguably more useful as an integer though, for the reasons listed previously, and because you can use expr to build the bit string easily. For example: update reply { Egress-VLANID += "%{expr:822083584 + %{Tagged-VID}}" } With hex you need to manually pad the VID out to 12 bits. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Response-Packet-Type == Access-Challenge
by Dominique Frise 07 Aug '13

07 Aug '13

Hi, I have no luck with testing the Reponse-Packet-Type in the post-proxy section, after "rad_recv: Access-Challenge packet..." Something like : post-proxy { ... if (Response-Packet-Type == Access-Challenge) { ... } ... } What am I doing wrong? Dominique

5 13