- Freeradius-Users - lists.freeradius.org

OpenSSL issue released tomorrow
by Alan DeKok 31 Oct '22

31 Oct '22

OpenSSL is releasing a critical vulnerability tomorrow. https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html We suggest upgrading OpenSSL immediately when a new package is released. There should not be a need to upgrade or change FreeRADIUS. We'll know more tomorrow. Alan DeKok.

1 0

Network RADIUS packages and LDAP/SASL
by Adam Bishop 26 Oct '22

26 Oct '22

I'm working on rebuilding our internal RADIUS systems, using the Network RADIUS packages rather than our own. Our LDAP configuration uses SASL to authenticate to 389ds via a UNIX socket - works OK on RHEL 7. The RHEL 8 hosts though (with the LTB packages) fail with: ... rlm_ldap: libldap vendor: OpenLDAP, version: 20459 Configuration item 'sasl.mech' not supported. Linked libldap does not provide ldap_sasl_interactive_bind function ... As far as I can tell, the ltb LDAP does export that symbol: # nm -gD /usr/local/openldap/lib64/libldap.so | grep ldap_sasl_interactive_bind 0000000000017760 T ldap_sasl_interactive_bind 00000000000178c0 T ldap_sasl_interactive_bind_s So I'm guessing that the ltb libldap isn't being linked at runtime? If that's the case, is there a way to configure FreeRADIUS to use the ltb versions, or do I need to start overriding LD_PRELOAD_PATH/hand edit ld.conf? I'm not 100% sure how it would be linking at the moment, as I don't see the ltb so's in the output of ldconfig. Or am I just completely wrong and the ltb packages don't support SASL :) Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice

2 2

Remove dots from client-mac-address
by Steven Walters 25 Oct '22

25 Oct '22

Hi I am using the below loop to extract client-mac-address from Cisco AVP and write it to the Telkom-CPE attribute. The format of the client-mac-address is "340a.3394.7291". Is there a way to remove the dots from the mac address like "340A33947291" before writing it the attribute? foreach Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /^client-mac-address=(.+)/ ) { update request{ Telkom-CPE := "%{1}" } } } Regards Steven

2 1

Re: Freeradius-Users Digest, Vol 210, Issue 25
by Michael A Hawkins 24 Oct '22

24 Oct '22

Alan, sorry about that repeated question about TACACS+. Missed that other email, my bad. /Mike On Mon, 2022-10-24 at 12:00 +0000, freeradius-users- request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. FreeRadius support for TACACS+ (Michael A Hawkins) > 2. Re: FreeRadius support for TACACS+ (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 23 Oct 2022 16:04:24 -0400 > From: Michael A Hawkins <mhawkins.consultant(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: FreeRadius support for TACACS+ > Message-ID: > <5903add9102edd4cb0129d0fc63b7bf287b7a887.camel(a)gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hello all, > > I've been searching the docs to see if TACACS+ is supported by > FreeRadius out-of-the-box. I've read a lot of the doc. It appears > that > TACACS+ is not supported and there is no built in module for it. > > Is that true? > Are there any third party TACACS+ modules that FreeRadius suggests I > look at? > > Many thanks, > > /Mike > > > ------------------------------ > > Message: 2 > Date: Sun, 23 Oct 2022 16:44:15 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRadius support for TACACS+ > Message-ID: > <E56D2DB0-98C1-4736-A0EB-8DEC8CE3B980(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Oct 23, 2022, at 4:04 PM, Michael A Hawkins > <mhawkins.consultant(a)gmail.com> wrote: > > I've been searching the docs to see if TACACS+ is supported by > > FreeRadius out-of-the-box. I've read a lot of the doc. It appears > > that > > TACACS+ is not supported and there is no built in module for it. > > > > Is that true? > > Already asked and answered. > > Please read the messages on this list. > > There are no super-secret features which get disclosed only when > people ask "pretty please". All of the documentation is in the open, > as is all of the source. > > Alan DeKok. > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 210, Issue 25 > *************************************************

1 0

FreeRadius support for TACACS+
by Michael A Hawkins 23 Oct '22

23 Oct '22

Hello all, I've been searching the docs to see if TACACS+ is supported by FreeRadius out-of-the-box. I've read a lot of the doc. It appears that TACACS+ is not supported and there is no built in module for it. Is that true? Are there any third party TACACS+ modules that FreeRadius suggests I look at? Many thanks, /Mike

2 1

Re: Freeradius-Users Digest, Vol 210, Issue 23
by Michael Hawkins 22 Oct '22

22 Oct '22

Hi there all, Quick question. Does freeradius support TACACS+ "out of the box". Or do I have to find and use a plug in from a third party? Many thanks, /Mike On Sat, Oct 22, 2022 at 8:00 AM <freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: MD5 auth failed (Ihsan) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 22 Oct 2022 05:13:32 +0200 > From: Ihsan <ihsan(a)ihsansoft.nl> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: MD5 auth failed > Message-ID: <E20C8D26-9F32-4C0F-B40A-1C9CF6715572(a)ihsansoft.nl> > Content-Type: text/plain; charset=utf-8 > > OMG So obvious ?. I?m sorry haha. > > Thank You! > E-maildisclaimer: Aan dit bericht, waaronder ook de eventuele bijlagen worden bedoeld, kunnen geen rechten worden ontleend. Dit bericht is uitsluitend bestemd voor de geadresseerde en bevat persoonlijke en vertrouwelijke informatie. Het bekend maken, kopieren en verspreiden van een bericht dat niet voor u bestemd is, is niet toegestaan. Als u dit bericht per ongeluk heeft ontvangen, verzoeken wij u vriendelijk het direct te vernietigen en de afzender te informeren. Twijfelt u over de juistheid of volledigheid van dit bericht? Neem dan contact op met de afzender.? > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 210, Issue 23 > ************************************************* -- Michael A Hawkins 203-550-5502

2 1

MD5 auth failed
by Ihsan 22 Oct '22

22 Oct '22

Hi, I get this error (0) pap: ERROR: MD5 digest does not match "known good" digest when i try to logon with name test and password testing123 sudo radtest test testing123 localhost 1812 testing123 this is inside the users : "test" MD5-Password :=“c1fae6c8a0fc99eef1f026f556ce1b58" E-maildisclaimer: Aan dit bericht, waaronder ook de eventuele bijlagen worden bedoeld, kunnen geen rechten worden ontleend. Dit bericht is uitsluitend bestemd voor de geadresseerde en bevat persoonlijke en vertrouwelijke informatie. Het bekend maken, kopieren en verspreiden van een bericht dat niet voor u bestemd is, is niet toegestaan. Als u dit bericht per ongeluk heeft ontvangen, verzoeken wij u vriendelijk het direct te vernietigen en de afzender te informeren. Twijfelt u over de juistheid of volledigheid van dit bericht? Neem dan contact op met de afzender.

6 9

Questions about particular uses of line log module
by Coy Hile 20 Oct '22

20 Oct '22

Good morning, I have an interesting use case for the linelog module. I want to get information about successful and unsuccessful authentication attempts in one place in a format that is easily consumable by, e.g. log shipping tools. So far, I’ve found that I can do a config snippet such as Access-Accept = "%T Accepted User: %{User-Name} NAS-IP-Address %{NAS-IP-Address} Access-Level: %{Tmp-String-0}” to get the user, device and access level granted to the engineer. Is there any way that we could get the VSAs that get returned so we could log them here as well? Sure, we get them in the detailed reply_logs, but those aren’t the most useful thing for a log aggregation tool to parse. If I know the device is, e.g. Cisco or Juniper, I’d just log %{Cisco-AVPair} or %{JunOS-Local-User-Name}, but I’d rather do that in a more vendor-agnostic way if I can. Worst case, I can just use the detail files if necessary and let the log-shipping tool figure it out. Thanks, -- Coy Hile coy.hile(a)coyhile.com

4 5

Re: Allow all MAC address
by Alan DeKok 20 Oct '22

20 Oct '22

On Oct 20, 2022, at 3:09 AM, Pascal Legrand <pascal.legrand(a)univ-orleans.fr> wrote: > > Hello and thank you for your answer, > Is there a solution more simlpe to allow all stations to access the network punctually? > Authorize punctually all MAC addresses? You want a solution which is simpler than 10 lines of text? I'm curious how you think you can write complex policies in extremely simple terms. Alan DeKok.

1 0

Data type returned by sql query
by Tianchen Tang 19 Oct '22

19 Oct '22

Hi, What is the data type returned by sql query using module syntax? Does freeradius support 8 byte integers for sql query result? What will happen if the sql returns 8 byte integer? Will it overflow? Regards, Tianchen

2 1