- Freeradius-Users - lists.freeradius.org

[ANN] Version 3.0.0-rc0
by Arran Cudbard-Bell 23 Jul '13

23 Jul '13

We are now in feature freeze for 3.0. The configuration format and behaviour for 3.0 will be stable between now and the final release. If you are planning on deploying 3.0 and have an existing 2.x.x configuration you were planning to migrate when the 3.0 is released, now would be a good time to try that, and to report any issues or problematic behaviour changes you notice. To provide a single point to test against, the release_3_0_0_rc0 tag has been created. Features and behaviours changes since release_3_0_0_beta1: * Empty xlat expansions are no longer substituted with "_". * Empty string expansions are no longer treated as failures, though actual failures and invalid operations will continue to bubble up and be translated into return codes. This is a change from 2.x.x where they were ignored. * Update sections support both types of exec, those which use the output of the program to create an attribute value, and those which use the output to create multiple value pairs. * Config item names have now been unified. In most cases the server will tell you the new name of the config item. * rlm_ldap now only registers LDAP-Group for the default instance. It used to register it for every instance which caused inconsistent behaviour. * New raddb structure. See raddb/README.rst for details. * Support for ${.:instance} which returns the instance name of a section and ${.:name} which returns the name of a section. Useful when used with relative paths. * Add support for bulk loading dynamic clients from LDAP. * Don't re-add default symlinks in raddb/sites-enabled/ raddb/mods-enabled/ Bug fixes: * Attribute instance selection [<n>] [#] [*] have been re-added to the xlat parser. * PCRE headers and libraries are now detected in a wider range of locations. * Symbols for PCRE drop in functions are now used in preference to posix functions, previously they weren't and this caused segfaults. * Fixes in the FreeTDS driver to avoid double frees. * Fix list to list copies in update sections. * Fix exec in update statements. * Fix use of double quoted strings in radclient -f files. * Many packaging fixes and cleanups. * Send Access-Rejects when using radsec. * Various radsec fixes to avoid crashes. * -HUP now works again. * Don't wait on execs to finish if they're marked as wait = 'no'. * Remove support for ranges in comparisons with NAS-Port-ID, these were broken, duplicative, and caused crashes. * Don't crash when parsing 64bit integer values from text * Expand ${...} before parsing conditions * Fix foreach * Be more lenient about MS-CHAP identity mismatches. The tarball is available here: https://github.com/FreeRADIUS/freeradius-server/archive/release_3_0_0_beta1… Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

8 44

Authorization failed in cisco switch
by Marco Aresu 23 Jul '13

23 Jul '13

Hi All i am getting some problem with authorization in free radius i configured the users file as below : DEFAULT Auth-Type := System cisco Auth-Type := System Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=15", When i try to login into a switch i receive the errore : Authorization Failed and during the debug i ve got : # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [++[reply_log] returns ok ++[exec] returns noop Can someone help me? thanks Marco Aresu

5 10

Free radius version 3.0.0 rco
by manjunath uthappa ponnachana 23 Jul '13

23 Jul '13

Hi, I want to download free radius version 3.0.0 rco. Please let me know the downlaod link. Also wanted to know whether free radius version 3.0.0 rco is officially released or not. If not when it will be ready for official release. Thanks & Regards Manjunath  

3 3

2.x.x and radtest: no IPv6?
by Stefan Winter 23 Jul '13

23 Jul '13

Hi, while using radtest, I got some strange results: # ./radtest swinter testpwd [::1] 123 testing123 radclient: Failed to find IP address for host ::1: Success # ./radtest swinter testpwd ipv6-localhost 123 testing123 radclient: Failed to find IP address for host ipv6-localhost: Success ipv6-localhost is in my /etc/hosts. I'd expect both of these to work... no brackets also doesn't work, but that was just my last straw and doesn't have to work anyway. Does radtest not support IPv6? I could have sworn it did IPv6 earlier, but not totally sure. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

5 11

User-Name containing a $
by Tena Gore 23 Jul '13

23 Jul '13

Is there a way to tell radius to not do something based on the User-Name containing a "$" ? I am doing dynamic VLAN assignment and I'd like to skip that for computer logins. I looked at unlang and I didn't see a way to check for a character in a username. Tena Gore Senior Network Administrator Technology Support Services Fairfield-Suisun Unified School District tenag(a)fsusd.org 707-399-1200

3 4

authentication by hostname
by Stefan Sticht 23 Jul '13

23 Jul '13

Hi, sorry, I am completely new to Radius … I want to change a FreeRadius server to authenticate a few hosts by their hostnames. The hostnames would be stored in a config file. How could I do this? This is the authentication request: rad_recv: Access-Request packet from host 10.10.10.21 port 54285, id=145, length=347 Framed-MTU = 1480 NAS-IP-Address = 10.10.10.21 NAS-Identifier = "HP-2520-24-PoE" User-Name = "host/MYHOSTNAME" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "84-34-97-de-df-80" Calling-Station-Id = "00-1f-29-98-8d-41" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "201" EAP-Message = 0x0201001401686f73742f544344452d3030303131 Message-Authenticator = 0xe06791a76c819a3dc0f89c8baf2df141 MS-RAS-Vendor = 11 Thanks for any help! Take care, Stefan

3 2

RE: coa
by Okis Chuang 23 Jul '13

23 Jul '13

I think you should read documentation about CoA offered by your NAS. Then see what can likely be about *Missing Attribute* at least. You better know about all of Error-Cause it may occur. In my experience, it might be lack of key on identifying unique host. In other words, could it be your Acct-Session-Id or User-Name cannot be primary key to identify one host on the NAS? Okis. From: Muhammad Nadeem [mailto:mnadeem8327@gmail.com] Sent: Tuesday, July 23, 2013 2:00 PM To: okischuang(a)outlook.com Subject: Re: coa thanks all,,, i am using huawei NAS. here is the complete log echo "Acct-Session-Id=1B1E97C3,User-Name=002682615F4E(a)test_cpe.com,NAS-IP-Address =2.2.2.2" | radclient -x 2.2.2.2:3799 disconnect huaweiaaa Sending Disconnect-Request of id 0 to 2.2.2.2 port 3799 Acct-Session-Id = "1B1E97C3" User-Name = "002682615F4E(a)test_cpe.com" NAS-IP-Address = 2.2.2.2 rad_recv: Disconnect-NAK packet from host 2.2.2.2 port 3799, id=0, length=26 Error-Cause = Missing-Attribute whats wrong??? On Tue, Jul 23, 2013 at 10:58 AM, <okischuang(a)outlook.com> wrote: <quote author='Nadeem'> hi everybody,, I wanna implement COA (Change Of Authorization) in freeradius. I have a live session of a device, I wanna disconnect this device forcefully. I isssued following command echo "Acct-Session-Id=1B1E97C3,User-Name=002682615F4E(a)test_cpe.com,NAS-IP-Address =2.2.2.2" | radclient -x 2.2.2.2:3799 disconnect 'huaweiaaa' but it give the error of "missing attribute". Can anybody tell me what is the issue. Thanks -- What kind of CoA server you are using? In my experiences, coa highly depends on the type of NAS. In my case that I has a WiFi GW as CoA server, it usually gets "Missing Attributes" if I missed some *keys* of identifying unique user. Such as "NAS-IP-Address + NAS-Port-Id" or "Some-VSA-Can-Be-A-Key" or "Acct-Session-Id" and usually with priority. Besides, maybe you can post some more detailed output of your testing so that we can do more help. Okis. _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com -- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University

1 0

coa
by Muhammad Nadeem 23 Jul '13

23 Jul '13

hi everybody,, I wanna implement COA (Change Of Authorization) in freeradius. I have a live session of a device, I wanna disconnect this device forcefully. I isssued following command echo "Acct-Session-Id=1B1E97C3,User-Name=002682615F4E(a)test_cpe.com,NAS-IP-Address=2.2.2.2" | radclient -x 2.2.2.2:3799 disconnect 'huaweiaaa' but it give the error of "missing attribute". Can anybody tell me what is the issue. Thanks -- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University

3 4

Re: LDAP authentication filter based on source SSID
by Gustavo Vieira Oliveira 22 Jul '13

22 Jul '13

Yes it does. We found the solution by creating a rule that maps all the BSSID related to some SSID and then we do a specific filter to LDAP, so we did it for every SSID. Thanks for the help! Atenciosamente, Gustavo Vieira Oliveira GETIC - Gerência de Tecnologia da Informação SUSERV - Superintendência de Serviços Compartilhados Sistema FIESC Rod. Admar Gonzaga, 2765 - Itacorubi - 88034-001 - Florianópolis - SC Fone (48) 32314699 - Ramal 44699 http://www.sistemafiesc.com.br Em 12/07/2013 12:57, Alan Buxey escreveu: > Does it use a different called station id mac for each ssid? > > alan >

1 0

Ignoring request to authentication IPv6address
by Murali Krishnan 22 Jul '13

22 Jul '13

Hi, I want to make all the IPv6 address in a network to access the radius without specifying the individual ips in client.conf, because I am using DHCP server assigned IPs for clients. Whenever I add individual ip’s it’s working fine. But not, with below configuration in clients.conf. Client fd00:1:1:1::/63{ secret=mykey } But it throws the below error when I ran the radius in debug mode Ignoring request to authentication address :: port 1812 from unknown client fd00:1:1:1:191a:ddba:1784:e7c6 port 45297 my radius version is FreeRADIUS Version 2.1.7 Thanks if anyone give solution to this. Regards, MK

1 0