- Freeradius-Users - lists.freeradius.org

SQL changes
by Arran Cudbard-Bell 08 Mar '13

08 Mar '13

Hi All, A few changes to the SQL drivers. * Biggest change is there are now no longer any socket close/free functions in the driver API these are now all handled by talloc destructors. If you suspect sockets aren't being closed properly, run with the extra -x and it'll print out a message when the destructor is called. * All the drivers now (optionally) can provide an instantiate method to do their own config parsing. This method gets passed in the config sub section (if it exists) matching the driver name. So for sqlite it'd be sql { sqlite { <this section> } } This will let us do driver specific configuration. If there are any client side options for MySQL / PostgreSQL that are useful for tuning/debugging feel free to submit patches. * Sqlite code has been pretty much rewritten so it works for everything (not just clients), and a new set of schemas created for sqlite. Yes the S is for simple not standardised *sigh*. * The 'filename' config item in the main sql config (which specified where the sqlite db was) has been moved into the sqlite {} section (where it should have always been). * There's a new bootstrap config item for sqlite. If bootstrap is set, and the specified sqlite database doesn't exist, it'll be created, then the sql file specified by bootstrap will be split on ;\n and each statement executed in turn to create the schema for the boostrapped database. The idea is to ship with a working configuration for sqlipool, so the DHCP just works after you've configured the ranges. If you're writing example configurations/modules that depend on SQL for persistent storage, it'd probably be a good idea to use the sqlite driver and bootstrap the database/schema that's required, then the examples work out of the box, so long as you have sqlite available. -Arran

1 0

Failed to load module "jradius" freeradius server
by Iftakhul Anwar 08 Mar '13

08 Mar '13

HI All, I just installed free radius server using apt-get on my ubuntu machine. Now i want to configure jradius on my freeradius server. I follow step by step from http://coova.org/JRadius/FreeRADIUS. Firstly my freeradius server running well, whereas i've configure it with mysql and coovachilli. Then i configure with jradius, i inserted module on radius.conf file on module section like bellow : # configure the rlm_jradius module jradius { name = "radius" # The "Requester" name (a single # JRadius server can have # multiple "applications") primary = "localhost" # Uses default port 1814 secondary = "192.168.2.3" # Fail-over server tertiary = "192.168.2.3:8002" # Fail-over server on port 8002 timeout = 1 # Connect Timeout onfail = NOOP # What to do if no JRadius # Server is found. Options are: # FAIL (default), OK, REJECT, NOOP keepalive = yes # Keep connections to JRadius pooled connections = 8 # Number of pooled JRadius connections } Then i add some authorization on /etc/freeradius/site-avalaible/default like bellow authorize { ... jradius } post-auth { ... jradius Post-Auth-Type REJECT { jradius } } preacct { ... jradius } accounting { ... jradius } Finally i try to running on foreground to know that my configuration has been success, but i get error message like bellow : Thu Mar 7 13:56:15 2013 : Debug: } # modules Thu Mar 7 13:56:15 2013 : Debug: } # server Thu Mar 7 13:56:15 2013 : Debug: server { # from file /etc/freeradius/radiusd.conf Thu Mar 7 13:56:15 2013 : Debug: modules { Thu Mar 7 13:56:15 2013 : Debug: Module: Checking authenticate {...} for more modules to load Thu Mar 7 13:56:15 2013 : Debug: (Loaded rlm_digest, checking if it's valid) Thu Mar 7 13:56:15 2013 : Debug: Module: Linked to module rlm_digest Thu Mar 7 13:56:15 2013 : Debug: Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Thu Mar 7 13:56:15 2013 : Debug: Module: Checking authorize {...} for more modules to load Thu Mar 7 13:56:15 2013 : Debug: (Loaded rlm_preprocess, checking if it's valid) Thu Mar 7 13:56:15 2013 : Debug: Module: Linked to module rlm_preprocess Thu Mar 7 13:56:15 2013 : Debug: Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess Thu Mar 7 13:56:15 2013 : Debug: preprocess { Thu Mar 7 13:56:15 2013 : Debug: huntgroups = "/etc/freeradius/huntgroups" Thu Mar 7 13:56:15 2013 : Debug: hints = "/etc/freeradius/hints" Thu Mar 7 13:56:15 2013 : Debug: with_ascend_hack = no Thu Mar 7 13:56:15 2013 : Debug: ascend_channels_per_line = 23 Thu Mar 7 13:56:15 2013 : Debug: with_ntdomain_hack = no Thu Mar 7 13:56:15 2013 : Debug: with_specialix_jetstream_hack = no Thu Mar 7 13:56:15 2013 : Debug: with_cisco_vsa_hack = no Thu Mar 7 13:56:15 2013 : Debug: with_alvarion_vsa_hack = no Thu Mar 7 13:56:15 2013 : Debug: } Thu Mar 7 13:56:15 2013 : Error: /etc/freeradius/radiusd.conf[644]: Failed to link to module 'rlm_jradius': file not found Thu Mar 7 13:56:15 2013 : Error: /etc/freeradius/sites-enabled/default[71]: Failed to load module "jradius". Thu Mar 7 13:56:15 2013 : Error: /etc/freeradius/sites-enabled/default[62]: Errors parsing authorize section. What this error ? How i can solve this issue ? Thanks -- *M.Iftakhul Anwar* Meruvian Integrator High Performance Computing / Cloud Computing (HPC/CC) Office Phone : 021-93586577 Mobile Phone : 085215331477 Blog : http://blog.mervpolis.com/roller/anwar FB : http://www.facebook.com/troya.adromeda Website : www.meruvian.org

4 14

Re: Freeradius-Users Digest, Vol 95, Issue 30
by David Bird 08 Mar '13

08 Mar '13

The most recent (which hasn't changed in some time now) can be found: http://dev.coova.org/svn/cjradius/trunk/freeradius/rlm_jradius/rlm_jradius.c Cheers, David > Date: Thu, 7 Mar 2013 11:02:17 -0500 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Failed to load module "jradius" freeradius server > Message-ID: <C9EB7AE3-492A-4D59-BE04-1645044DC3E8(a)freeradius.org> > Content-Type: text/plain; charset=iso-8859-1 > > > On 7 Mar 2013, at 10:55, Iftakhul Anwar <anwar(a)meruvian.org> wrote: > > > Actually i install freeradius from apt-get , > > Right, so jradius won't have been built. > > jradius support is going away, it will *NOT* be in Version 3 unless someone contributes a new version of the module which works with the updated jradius protocol. > > -Arran > > >

2 1

LDAP authorization
by Matthew Ceroni 07 Mar '13

07 Mar '13

I am using LDAP authorization. What I am looking to accomplish is to reject/deny (so not even attempt authentication) for disabled users. I am authentication against AD (use LDAP for authorize and ntlm for authentication). If I were to search for all none disabled users using ldapsearch, the filter query for this would be: !(userAccountControl:1.2.840.113556.1.4.803:=2) That is the part that limits the results to only enabled users. Wondering how I would do this in FreeRadius? Even on a more general level how I would reject based off certain returned attributes. Thanks

3 5

PHP MD5 with appended salt
by René Klomp 07 Mar '13

07 Mar '13

Hi all, I am trying to connect my freeradius server to a mysql database containing all users. I created a new view to represent the table structure needed by freeradius, but I a problem with validating the passwords. The passwords of my users are (from a PHP application) concatenated with a salt, which is the same for all passwords, and stored using the regular php md5 function: md5($userpass . ':' . $salt) How can I make freeradius to append this salt to the password as well and validate the password in the correct way? Is there a default way to do this? Or should I create a module to do this? Regards, René

4 6

EAP-TLS testing, occasional errors
by Bertalan Voros 07 Mar '13

07 Mar '13

Hello All, I have configured a server to test EAP-TLS. Created the CA, a server and one client certificate. The same client certificate was then installed on three different devices; OSX, Windows 7 and an Android 4.2. All is well, all the devices can authenticate successfully, however, every now and again I can see similar entries in the log like the one below. A failure. Thu Mar 7 14:30:57 2013 : Error: TLS Alert write:fatal:handshake failure Thu Mar 7 14:30:57 2013 : Error: TLS_accept: error in SSLv3 read client certificate B Thu Mar 7 14:30:57 2013 : Error: rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate Thu Mar 7 14:30:57 2013 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Thu Mar 7 14:30:57 2013 : Auth: Login incorrect (TLS Alert write:fatal:handshake failure): [wifiuser] (from client CiscoAP port 289 cli 10-68-3F-48-41-46) Then a success soon after from the same device (this is the Android one) Thu Mar 7 14:32:10 2013 : Auth: Login OK: [wifiuser] (from client CiscoAP port 291 cli 10-68-3F-48-41-46) Very occasionally the Android device would give up and not attempt to reauthenticate. The AP is set to reauthenticate clients every 10 minutes. (a rickety old Cisco Aironet 1200). Has anyone seen this before? Thanks in advance, Bertalan

2 1

Authentication Using "Framed-IP-Address"
by Russell Mike 07 Mar '13

07 Mar '13

Dear Alan. De. & List Greetings May i please ask your opinion, if it possible to accept & reject users base on "Framed-IP-Address". Thanks / Regards RM --

2 2

Child is hung for request … message
by Alex Sharaz 07 Mar '13

07 Mar '13

Hi, I've just downloaded,compiled and installed the latest version of 2.2 (2.2.1?) from git.freeradius.org. Installed it on an internal server and things seemed to work o.k. I then upgraded another server that deals with our external ( eduroam) connectivity and within a few mins am seeing Thu Mar 7 10:25:58 2013 : Error: WARNING: Unresponsive child for request 16, in component <core> module <thread> Thu Mar 7 10:25:59 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:00 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:03 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:06 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:11 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:16 2013 : Auth: Login OK: [lw09ea(a)leeds.ac.uk] (from client nasaaa2 port 0 cli 40-A6-D9-B9-A8-A6) Thu Mar 7 10:26:19 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:26 2013 : Auth: Login OK: [zszz5238(a)kclad.ds.kcl.ac.uk] (from client nasaaa2 port 0 cli 58-1F-AA-53-87-B4) Thu Mar 7 10:26:30 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:47 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:27:13 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:27:29 2013 : Auth: Login OK: [nagios(a)york.ac.uk] (from client systems0 port 0) Thu Mar 7 10:27:51 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:28:18 2013 : Error: Discarding duplicate request from client nasaaa2 port 1814 - ID: 255 due to unfinished request 88 Thu Mar 7 10:28:24 2013 : Error: Discarding duplicate request from client nasaaa2 port 1814 - ID: 255 due to unfinished request 88 Thu Mar 7 10:29:04 2013 : Error: WARNING: Unresponsive child for request 88, in component <core> module <thread> Thu Mar 7 10:29:05 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:06 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:08 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:12 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:17 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:25 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:36 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. The server is basically proxying off auth requests to remote RADIUS servers. Is the above just telling me that the other end is taking a while to reply or is there some underlying issue? Rgds A

4 7

Get Stop in accounting do some action
by Mehdi Ravanbakhsh 06 Mar '13

06 Mar '13

Hello everyone I need to update some check and replay attribute in database when get stop in accounting and the session is finish i need to know in which section of virtual server file ( sites-enabled/default) i need to put unlang script (and/or perl script) ? and how i can check in script if accounting get stop packet , read some radacct fild of that session to do some calculate and do some query in database in radcheck and radreplay . Best regards.

2 3

Value-pairs from exec script
by Brian Wallen 06 Mar '13

06 Mar '13

I have an exec script that returns a User-Name. FreeRADIUS passes the User-Name to my script (ie MyOldUsername) and my script changes it (ie MyNewUsername). In my logs I see Exec-Program-Wait: value-pairs: User-Name = MyNewUsername so I know my script is working and returning correctly. My problem is that FreeRADIUS doesn't take MyNewUsername from the script and MyOldUsername gets inserted into the radacct table. Below is my exec config. My script is a PHP script on a web server that gets called via wget. One thing that I'm not sure of is what input_pairs and output_pairs should be set to. I see that "config" and "reply" are valid options, but what is the difference between them? What other information is needed in order to troubleshoot this problem? exec { wait = yes program = `/usr/bin/wget -q -O - 127.0.0.1/%{Calling-Station-Id}` shell_escape = yes input_pairs = config output_pairs = config }

3 8