- Freeradius-Users - lists.freeradius.org

EAP-SIM on 2.2.0
by Francois Gaudreault 14 Sep '12

14 Sep '12

Hi, I am playing with EAP-SIM on 2.2.0, but I am facing an issue I cannot even understand :S Not because I don't want to, but the error messages are not talking much. I did compute SRES/Kc for my SIM, but after the third triplet, I just have: rlm_perl: Added pair EAP-Sim-Rand3 = 0xff626ed6104164234aabebecafecafe3 rlm_perl: Added pair EAP-Sim-Rand2 = 0x771634015641aabcd4e5a2a3ab521242 rlm_perl: Added pair EAP-Sim-SRES1 = 0xa0a116fe rlm_perl: Added pair EAP-Sim-SRES2 = 0xc891c365 rlm_perl: Added pair EAP-Sim-KC1 = 0x603c63ecd59340cb rlm_perl: Added pair EAP-Sim-Rand1 = 0xab521824610aca27814bbde2810347a1 rlm_perl: Added pair EAP-Sim-KC3 = 0xa62f0f3aca277041 rlm_perl: Added pair EAP-Sim-KC2 = 0xbdaf3f47b1fc2520 rlm_perl: Added pair EAP-Sim-SRES3 = 0x6daeb494 rlm_perl: Added pair Auth-Type = EAP rlm_perl: Added pair EAP-Type = SIM ++[packetfence] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. I am using sim_files to populate the attributes. Anyone can enlight me? By the way, the same config works on 2.1.12 (just tested it): rlm_perl: Added pair EAP-Sim-Rand3 = 0xff626ed6104164234aabebecafecafe3 rlm_perl: Added pair EAP-Sim-Rand2 = 0x771634015641aabcd4e5a2a3ab521242 rlm_perl: Added pair EAP-Sim-SRES1 = 0xa0a116fe rlm_perl: Added pair EAP-Sim-SRES2 = 0xc891c365 rlm_perl: Added pair EAP-Sim-KC1 = 0x603c63ecd59340cb rlm_perl: Added pair EAP-Sim-Rand1 = 0xab521824610aca27814bbde2810347a1 rlm_perl: Added pair EAP-Sim-KC3 = 0xa62f0f3aca277041 rlm_perl: Added pair EAP-Sim-KC2 = 0xbdaf3f47b1fc2520 rlm_perl: Added pair EAP-Sim-SRES3 = 0x6daeb494 rlm_perl: Added pair Auth-Type = EAP rlm_perl: Added pair EAP-Type = SIM ++[packetfence] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim MAC check succeed [eap] Underlying EAP-Type set EAP ID to 27 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group post-auth {...} ++[exec] returns noop ++[reply] returns noop } # server packetfence Sending Access-Accept of id 34 to 10.0.0.24 port 1051 Thanks! -- Francois Gaudreault, ing. jr fgaudreault(a)inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

5 26

building FR3.0 jlibtool problem
by Scott Armitage 13 Sep '12

13 Sep '12

All, is anyone else having problems with using building FR3.0 I get the following: [root@boppity-new freeradius-server]# ./configure --prefix=/usr --with-large-files --with-raddbdir=/etc/raddb --with-experimental-modules --enable-developer | grep WARN configure: WARNING: snmpget not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: snmpwalk not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: pcap library not found, silently disabling the RADIUS sniffer. configure: WARNING: silently not building rlm_counter. configure: WARNING: FAILURE: rlm_counter requires: libgdbm. configure: WARNING: FAILURE: rlm_dbm requires: (ndbm.h or gdbm/ndbm.h or gdbm-ndbm.h) (libndbm or libgdbm or libgdbm_compat). configure: WARNING: silently not building rlm_dbm. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: silently not building rlm_eap_pwd. configure: WARNING: FAILURE: rlm_eap_pwd requires: EC_GROUP_free. configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: silently not building rlm_ippool. configure: WARNING: FAILURE: rlm_ippool requires: libgdbm. configure: WARNING: silently not building rlm_opendirectory. configure: WARNING: FAILURE: rlm_opendirectory requires: membership.h. configure: WARNING: silently not building rlm_pam. configure: WARNING: FAILURE: rlm_pam requires: libpam. configure: WARNING: silently not building rlm_python. configure: WARNING: FAILURE: rlm_python requires: Python.h libpython2.6. configure: WARNING: hiredis libraries not found. Use --with-redis-lib-dir=<path>. configure: WARNING: hiredis headers not found. Use --with-redis-include-dir=<path>. configure: WARNING: silently not building rlm_redis. configure: WARNING: FAILURE: rlm_redis requires: libhiredis hiredis.h. configure: WARNING: hiredis libraries not found. Use --with-redis-lib-dir=<path>. configure: WARNING: hiredis headers not found. Use --with-redis-include-dir=<path>. configure: WARNING: silently not building rlm_rediswho. configure: WARNING: FAILURE: rlm_rediswho requires: libhiredis hiredis.h. configure: WARNING: silently not building rlm_rest. configure: WARNING: FAILURE: rlm_rest requires: curl/curl.h. configure: WARNING: silently not building rlm_ruby. configure: WARNING: FAILURE: rlm_ruby requires: ruby-binary. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: Sqlite libraries not found. Use --with-sqlite-lib-dir=<path>. configure: WARNING: Sqlite headers not found. Use --with-sqlite-include-dir=<path>. configure: WARNING: silently not building rlm_sql_sqlite. configure: WARNING: FAILURE: rlm_sql_sqlite requires: libsqlite3 sqlite.h. configure: WARNING: silently not building rlm_sql_db2. configure: WARNING: FAILURE: rlm_sql_db2 requires: libdb2 sqlcli.h. configure: WARNING: oracle headers not found. Use --with-oracle-include-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. configure: WARNING: silently not building rlm_sql_firebird. configure: WARNING: FAILURE: rlm_sql_firebird requires: libfbclient ibase.h. configure: WARNING: MySQL libraries not found. Use --with-mysql-lib-dir=<path>. configure: WARNING: MySQL headers not found. Use --with-mysql-include-dir=<path>. configure: WARNING: silently not building rlm_sql_mysql. configure: WARNING: FAILURE: rlm_sql_mysql requires: libmysqlclient_r mysql.h. [root@boppity-new freeradius-server]# make Making all in src... Making all in src/include... gmake[4]: Nothing to be done for `all'. Making all in src/lib... CC dict.c gmake[4]: /usr/local/src/freeradius-server/libtool: Command not found gmake[4]: *** [dict.lo] Error 127 gmake[3]: *** [lib] Error 2 gmake[2]: *** [all] Error 2 gmake[1]: *** [src] Error 2 make: *** [all] Error 2 Even if I try: [root@boppity-new freeradius-server]# echo 'BOILER=yes' >> Make.inc [root@boppity-new freeradius-server]# make Making all in src... Making all in src/include... gmake[4]: Nothing to be done for `all'. Making all in src/lib... CC dict.c gmake[4]: /usr/local/src/freeradius-server/libtool: Command not found gmake[4]: *** [dict.lo] Error 127 gmake[3]: *** [lib] Error 2 gmake[2]: *** [all] Error 2 gmake[1]: *** [src] Error 2 make: *** [all] Error 2 Am I being an idiot? Regards Scott Armitage

4 4

how to add two ip pool
by ranjan kumar 13 Sep '12

13 Sep '12

Hi All, I am trying to add two default entries in users file for two ip pool. can it is possible to add two entries of default in users file ? If yes then how ? Please help me its very critical. I have configured two ippool which looks like: =================================================================== In Users file: DEFAULT Auth-Type := aag, Service-Type == Framed-User, Framed-Protocol == 7, Pool-Name := myippool Service-Type == Framed-User, Framed-Protocol == 7, Fall-Through == no, Acct-Interim-Interval = 500 DEFAULT Auth-Type := aag, Service-Type == Framed-User, Framed-Protocol == 7, Pool-Name := my_sec_ippool Service-Type == Framed-User, Framed-Protocol == 7, Acct-Interim-Interval = 500 In radiusd.conf ippool myippool { range-start = 192.168.2.129 range-stop = 192.168.182.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } ippool my_sec_ippool { range-start = 192.168.1.1 range-stop = 192.168.182.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool1 ip-index = ${raddbdir}/db.ipindex1 override = no maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } ==================================================================== When i am executing ./radiusd -X always getting IPs for only one ggsn. Please help me its very critical. Thanks in Advance. Regards Ranjan

2 1

Problem in configuring multiple IP pool
by ranjan kumar 13 Sep '12

13 Sep '12

Hi, I have created two ip pool in radiusd.conf which looks like below: ======================================================= In radiusd.conf ippool myippool { range-start = 192.168.182.129 range-stop = 192.168.182.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool1 ip-index = ${raddbdir}/db.ipindex1 override = yes maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } ippool my_sec_ippool { range-start = 192.168.182.129 range-stop = 192.168.182.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool1 ip-index = ${raddbdir}/db.ipindex1 override = yes maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } --------------------------------------------------------------------------------------------------------------- In user updated like below: DEFAULT Auth-Type := aag, Service-Type == Framed-User, Framed-Protocol == 7, Pool-Name := myippool Service-Type == Framed-User, Framed-Protocol == 7, Acct-Interim-Interval = 500 DEFAULT Auth-Type := aag, Service-Type == Framed-User, Framed-Protocol == 7, Pool-Name := my_sec_ippool Service-Type == Framed-User, Framed-Protocol == 7, Acct-Interim-Interval = 500 ======================================================= When I am executing radius server in debug mode i.e ./radiusd -X then getting the below error ======================================================= radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_aag Module: Instantiating module "aag" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/aag aag { integer = 1 boolean = no ipaddr = * } openfile opened /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/data//admin/log/error/startup.log LoggingLevel.conf path...../export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/data//config/logginglevel.conf alarminglevel.conf path...../export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/data//config/alarminglevel.conf Loggerportno conf file path..../export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/data//config/loggerportno.conf } radiusd: #### Loading Virtual Servers #### server { # from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = aag Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/unix unix { radwtmp = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/var/log/radius/radwtmp" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/preprocess preprocess { huntgroups = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/huntgroups" hints = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/files files { usersfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/users" acctusersfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/acct_users" preproxy_usersfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/detail detail { detailfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/radutmp radutmp { filename = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server server coa { # from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/sites-enabled/coa modules { Module: Checking recv-coa {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking send-coa {...} for more modules to load } # modules } # server server originate-coa.example.com { # from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/sites-available/originate-coa modules { Module: Creating Post-Proxy-Type = Fail-CoA Module: Creating Post-Proxy-Type = Fail-Disconnect Module: Checking pre-proxy {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } # modules } # server WARNING: Server originate-coa.example.com is empty, and will do nothing! server Access_Gateway { # from file /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking accounting {...} for more modules to load /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/radiusd.conf[890]: Failed to load module "myippool". /export/home/lebraaag/ACCESS_GATEWAY/FSS_AAG/RADIUS_STACK/etc/raddb/radiusd.conf[877]: Errors parsing accounting section. ===================================================================================================== Please look into my problem and guide me to come out of this problem. Thanks, Regards Ranjan

2 1

Re: In Access-Request h323-remote-address Multiple times How to get it in SQL query
by Blake Covarrubias 13 Sep '12

13 Sep '12

On Sep 12, 2012, at 11:57 PM, "Ankur - BillCall" <ankur.kalavadia(a)billcall.net> wrote: > We are getting h323-remote-address multiple times. How can I get both attribute in sql query for authentication? > > I set sql_user_name = "%{h323-remote-address}". But I get sql_user_name = Trunk ID (000111) only. How can I get IP XXX.105.4.197? You probably want this. sql_user_name = "%{h323-remote-address[1]}" Read "man unlang". Specifically section "String lengths and arrays". -- Blake Covarrubias

1 0

In Access-Request h323-remote-address Multiple times How to get it in SQL query
by Ankur - BillCall 13 Sep '12

13 Sep '12

Hi All, We have configure freeradius on centos with mysql. We are developing solution for Wholesale VOIP. We need to authenticate user on basis of Trunk Id & IP. We are getting Trunk Id and IP in h323-remote-address attribute. Please find my Access-Request. Packet-Type = Access-Request User-Name = "bk" User-Password = "8888891990942XXXX" h323-conf-id = "377BE9DC FC071910 90FB000C 290E95CC" Cisco-AVPair = "remote-media-address=XXX.105.4.197" Cisco-AVPair = "session-protocol=cisco" Cisco-AVPair = "gw-rxd-cdn=88888919974063392" h323-remote-address = "000111" h323-remote-address = "XXX.105.4.197" Calling-Station-Id = "bk" Called-Station-Id = "88888919974063392" Service-Type = Login-User NAS-IP-Address = 79.99.198.YYY remote-media-address = "XXX.105.4.197" session-protocol = "cisco" gw-rxd-cdn = "8888891997406XXXX" We are getting h323-remote-address multiple times. How can I get both attribute in sql query for authentication? I set sql_user_name = "%{h323-remote-address}". But I get sql_user_name = Trunk ID (000111) only. How can I get IP XXX.105.4.197? Thanks & Regards, Ankur

1 0

[ANN] Version 3.0.0-beta0
by Arran Cudbard-Bell 12 Sep '12

12 Sep '12

The v2.1.x branch was created almost exactly 3 years ago (14/09/2009), and has diverged from the master branch significantly. The majority of the potentially disruptive code changes have now been completed for 3.0 and it is at a stage where community testing would be helpfull. To provide a single point to test against, the release_3_0_0_beta0 tag has been created. The tarball is available here: https://github.com/alandekok/freeradius-server/tarball/release_3_0_0_beta0 Instructions for converting existing 2.1.x configurations are available here: https://github.com/alandekok/freeradius-server/blob/release_3_0_0_beta0/rad… Please post any defects to http://bugs.freeradius.org. The interim changelog for 3.0 is as follows: FreeRADIUS 3.0.0 Mon 01 Jan 8:00:00 CEST 2010, urgency=medium Feature improvements * Largely configuration file compatible with 2.1.x. * Documentation for upgrading from 2.x is in raddb/README.rst Please follow it. Do not just install 3.0. * Updated packet encode/decoder. The resulting code is much simpler and easier to extend. * Updated internal API to support new attributes and formats * Added RADIUS over TLS (i.e. RadSec). See raddb/sites-available/tls * Added "extended attributes" using the new encoder/decoder. * Added the "integer64" data type. * Added full WiMAX support, using the new encoder/decoder. The old code could not handle some unusual corner cases. * Added code to send SNMP Traps. See raddb/trigger.conf. * Added support for Apple's Grand Central Dispatch * Added for MS-CHAP Change Password from Phil Mayers. See raddb/mods-available/mschap, "passchange" subsection. * Added provisions for raddb/dictionary.local, for local changes. See raddb/dictionary for more details. * Added EAP-PWD implementation from Dan Harkins * Added packet/s tracking. See max_pps in the "listen" sections, and auto_limit_acct in the "thread pool" section. * Moved configuration entries in radiusd.conf to make more sense. * Moved raddb/modules/ to raddb/mods-available, and raddb/mods-enabled, following the examples of other projects. * Moved eap.conf to mods-available/eap * Moved sql.conf to mods-available/sql * Moved TLS configuration for EAP into a common subsection. See raddb/mods-available/eap, tls-config section. * Added internal connection pool API, this consolidates connection management code that was previously spread across many modules. Advantages are that it actually works, well, under nearly all conditions, supports triggers, and has 'elastic' limits on the numbers of connections. * SQL now uses the connection pool. * SQL query config has changed to support arbitrary Acct-Status-Types, this change breaks config compatibility with 2.1.x. Configurations must be updated. Bug fixes * All known bug fixes from 2.1.x are included. * Removed "addport" functionality. All features and bug fixes from 2.2.0 are also included.

1 0

Radius Config and Router
by George Innocent 12 Sep '12

12 Sep '12

Hello; I have configured the radius and some servers to authenticate through the Radius. I can authenticate well from the servers but the same is not working on the routers. Users have been created on the router as a test before implementation. The log file has credentials that i have not created. Thanks to assist -- Regards: George Innocent.

4 7

Multiple EAP config
by BILLOT 12 Sep '12

12 Sep '12

Hi, We have a config with 3 virtual servers, running on a different port. Each virtual server must have a particular config (different LDAP server, different SQL server). However, each one uses EAP auth and so the inner-tunnel which is unique. Thus in the inner-tunnel config, default modules are used (ldap and SQL). How can we use a different EAP config for each server and so one particular config for each inner-tunnel ? BR,

3 5

Re: freeradius OTP with OATH
by Thomas Glanzmann 12 Sep '12

12 Sep '12

Hello Henk, > I've looked closely at your video and accomplishment with smsotp, > congrats! thank you. However the video shows something that is outdated. I now wrote a perl module for rlm_perl which does it much better without all the moving parts. > Did you also had a look at OATH TOTP instead of SMS authentication? > This is a RFC (http://tools.ietf.org/html/rfc6238) as you may know. A > user installs an app on their phone which implements this RFC (e.g. > Google Authenticator) and it acts as a soft token. I did and evaluated it together with RADIUS. > I've got this running with freeradius and the google authenticator PAM > module. The downside of PAM is the lack of challenge-access and > response support (AFAIK). If you want a challenge response integration like the user first needs to authenticate with username and password and than gets a challenge and needs to answer with a response that is possible. You could also tweak it that you leave the first step out. Just have a look at the rlm_perl implementation in http://thomas.glanzmann.de/smsotpd.2012-08-16.tar.bz2 > Do you know of anything that supports OATH and TOTP natively with > freeradius and can be used with the access-challenge/response system > (or am I wrong about PAM not supporting that feature)? I think there was a module, but I don't recall, maybe ask the FreeRadius List, or grep in the modules directory. I take it on CC. Cheers, Thomas

2 3