October 2010 - Freeradius-Users - lists.freeradius.org

unlang post-auth group-name
by Cameron Wood 02 Oct '10

02 Oct '10

Hi I'm trying to obtain the Group-Name for the requested user and use it with unlang in the Post-Auth section of my sites-available/default config. This hasn't work thus far, and I have tried a number of other ideas, such as getting it whilst in the Authorize section and creating new variable to hold it there and then referencing that, but still with no success. Can someone tell me how I can accomplish this, below is a snippet of my config so you can see what I am trying to accomplish, any help would be greatly appreciated. post-auth { > switch "%{client:vendor}" { > > case adva { > switch "%{Group-Name}" { > > case net_ro { > update reply { > ADVA-UUM-User-Level := "Monitor" > } > } > > case net_rw { > update reply { > ADVA-UUM-User-Level := "Admin" > } > } > > case net_su { > update reply { > ADVA-UUM-User-Level := "Root" > } > } > } > } > > case cisco { > ... > } > > case netscreen { > ... > } > } > } > Cheers Cam. --

6 26

Wipe existing reply attributes in rlm_files
by Brian Candler 02 Oct '10

02 Oct '10

Hello, I'm using freeradius 2.1.7. I would like to know if there's a simple way, within a users file, to *replace* the entire set of reply attributes with some others. For example, NONE Foo = "bar", Baz = "bap" # FIXME: delete all reply attributes which have accumulated so far Framed-IP-Address = 1.1.1.1 The idea is that I've already done a database dip using something like rlm_sql, which may have added some reply attributes; but then later logic requires that I need to remove those reply attributes and replace them with a different set (e.g. to L2TP tunnel them somewhere else) I know I could remove specific attributes using -=, but I don't know which attributes might have been added by this point. My current solution is very messy, using two users files. Firstly I set a temporary control list attribute: NONE Foo = "bar", Baz = "bap", Postauth-Action := "XXX" and then next in the authorize { } config I have: if ("%{control:PostAuth-Action}" =~ /./) { deleteall # invoke custom module to clear reply list postauth_attrs # invoke second users file } and finally, in a second users file, I add the new attributes: XXX Framed-IP-Address = 1.1.1.1 I can't even use the standard attr_filter module to delete the existing reply attributes, because when it's invoked in the authorize { } section it acts on the request list, not the reply list. Have I missed an easier way to do this? Thanks, Brian.

3 4

Unfinished Request no Database
by João Romariz 01 Oct '10

01 Oct '10

Hi, We are facing a strange issue with freeradius 2.1.9 running in a VM with Fedora Core 13. As soon as we start the server we get around 30 anthentication requests per second from a client. The first 30 to 40 request get a quick reply but from there on only very few replies are seen on the log file, all the other requests get this error: Fri Oct 1 05:06:28 2010 : Error: Discarding duplicate request from client GGs port 65035 - ID: 117 due to unfinished request 4 Searching the mailing list I found lots of references to this error as cause by "slow database server". The problem here is that we are not using any database on this server, we authenticate any user and don´t care for username or password. The server assigns IP addresses to the users by an ippool. Any ideas of what could be the causing the problem? Thanks for any help. Regards, Joao.

2 1

FreeRADIUS ECCN code ?
by Fabrizio Rossi 01 Oct '10

01 Oct '10

Hi all, Is somewhere declared the FreeRADIUS ECCN code ? (http://en.wikipedia.org/wiki/ECCN) I've looked in the WIKI and in the mailing list archives but I could not find this info. Thanks, Fabrizio

3 7

Freeradius + EAP_TLS + Cisco AP
by Esteban TALAVERA 01 Oct '10

01 Oct '10

Hi I configured a freeradius server with EAP_TLS to authenticate clients that connects to Cisco AP. When I run freeradius -X I got a lot of activity output but the client is still trying to authenticate I post last lines from the server's output I see the port of Access-request es 1645 but I did configure 1812 in both server and Cisco AP The line "[tls] eaptls_process returned 13 " means something wrong? What should be the correct output when successful authentication occurs? Thanks ==== rad_recv: Access-Request packet from host 192.168.X.X port 1645, id=51, length=143 User-Name = "etalaveran" Framed-MTU = 1400 Called-Station-Id = "aca0.16ba.89f2" Calling-Station-Id = "0021.63ca.fdbe" Service-Type = Login-User Message-Authenticator = 0x32824bc17cf2b4b4920577cc57e00177 EAP-Message = 0x020700060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 285 NAS-Port-Id = "285" State = 0x732b0744702c0abef63c2dd8a2b9de35 NAS-IP-Address = 192.168.1.82 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "etalaveran", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry etalaveran at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 51 to 192.168.X.X port 1645 EAP-Message = 0x0108000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x732b074477230abef63c2dd8a2b9de35 Finished request 19. Going to the next request Waking up in 4.8 seconds. Cleaning up request 15 ID 47 with timestamp +117 Cleaning up request 16 ID 48 with timestamp +117 Cleaning up request 17 ID 49 with timestamp +117 Cleaning up request 18 ID 50 with timestamp +117 Cleaning up request 19 ID 51 with timestamp +117 Ready to process requests. ================= -- *Esteban Talavera*

3 7

Install FR 2.1.10 on OS X 10.4.11
by Wolfgang Burger 01 Oct '10

01 Oct '10

Hello, I´m using version of 1.1.7 on a production system and it was working quite well for me. For severall reasons I want to update my setup now. When I startet to try the new versions some days ago, the "Frontpage"- Version was 2.1.9. I'm running my server under Mac OS X 10.4.11 PPC. 2.1.9 was building nicely but I was suffering the bug mentioned here: http://lists.freeradius.org/mailman/htdig/freeradius-users/2010-June/msg001… I tried to install the newest git version or the 2.1.10 release on this system, but failed. Part of output, created by "make" below. More on request. Is there a way to install 2.1.10 on this system? Thank you very much. Best regards, Wolfgang Making all in main... /usr/bin/make -C main all /Users/system/Desktop/freeradius-server-2.1.10/libtool --mode=link gcc -o radsniff radsniff.lo /Users/system/Desktop/freeradius- server-2.1.10/src/lib/libfreeradius-radius.la -framework DirectoryService -lresolv -lpthread -lpcap gcc -o radsniff radsniff.o -framework DirectoryService /Users/system/ Desktop/freeradius-server-2.1.10/src/lib/.libs/libfreeradius-radius.a - lresolv -lpthread -lpcap /usr/libexec/gcc/powerpc-apple-darwin8/4.0.1/ld: Undefined symbols: _pcap_dump_fopen _pcap_fopen_offline collect2: ld returned 1 exit status make[4]: *** [radsniff] Error 1 make[3]: *** [main] Error 2 make[2]: *** [all] Error 2 make[1]: *** [src] Error 2 make: *** [all] Error 2

2 2

inside Auth-Type has different rules
by Iliya Peregoudov 01 Oct '10

01 Oct '10

Hello, I have following configuration: authenticate { Auth-Type CHAP { chap db_backend chap { ok = 1 } db_backend } } First chap module call should handle cases when Cleartext-Password already set (for example, by files module). If there is Cleartext-Password, chap module returns *ok* or *reject*, so authentication should stop on these return codes. If there is no Cleartext-Password, chap module returns *invalid*, so authentication should proceed further. db_backend is a custom module that uses backend database. First db_backend call returns: - *ok* if backend database do not want password checking, - *reject* if backend database want to reject authentication, - *handled* if Proxy-To-Realm returned from backend database, - *updated* if Cleartext-Password returned from backend database. Authentication should stop on *ok*, *reject*, and *handled* return codes, and should proceed on *updated* return code. Second chap module call should check CHAP-Password against Cleartext-Password. Return code *ok* handling changed to proceed with authentication if password is correct. Second db_backend call returns *ok*, *reject*, or *handled* like first db_backend call. In freeradius 1.1.x this configuration works fine. In freeradius 2.1.x it doesn't work. I found that in freeradius 2.0.2 return code handling in Auth-Type subsections was changed. In freeradius 1.1.x return code handling was: - return notfound, ok, reject, userlock, handled - save noop, updated, fail, invalid (all with priority 1) In freeradius 2.1.x (starting with 2.0.2) return code handling is identical to authorize section: - save notfound (prio 1), noop (prio 2), ok (prio 3), updated (prio 4) - return fail, reject, userlock, invalid, handled This change was committed by commit id 4719ed0ce65f19586364. What is the reason for the change? It changes requirements for module return codes. Moreover, return code handling was changed only in Auth-Type subsections, not in authenticate section. When module's authenticate hook is called module has no clue is it called from authenticate section or from Auth-Type subsection. Regards, Iliya Peregoudov

2 1

Radius+Ldap:Allow the same host in multiple vlans
by Ramon Escriba 01 Oct '10

01 Oct '10

Hi I'm trying to organize my net using 802.1x able switches with freeradius 2.1.1+Openldap2-2.4+OpenSuse11.1 The system is running, at least @ test level but not yet deployed, but I reach a cross road and finally I've to choose. Or having one ldap subtree per vlan, filled with all host that bellong to this one, or store inside the host attributes all vlans it's allowed or may get in. The first "road" it's the one I've working actually, because I don't know how to implement the second, the elegant one. I have multiple devices that may belong to multiple vlans, so I shall have duplicated hosts, which I don't like @ all. In order to keep things easy I only use mac-"authentication", later 802.1x EAP wit user+pass ( EAP Mschapv2 or TTLS). The idea is to declare in one single place the vlans one host may be able to connect, from the first top priority vlan to try up to the last option.. Well, I'm using the radiusprofile attribute radiusTunnelGroupId to store the Vlan name or tag. If I set one host/user with the next "vlan tag" attributes: Uid=John.Cleese,ou=People,ou=Radius,xxxxxxxxxxxxxx ... radiusTunnelGroupId: 666 (Mad Scientist) radiusTunnelGroupId: 128 (Nut Engineers) radiusTunnelGroupId: 256 (Nerd IT guys) radiusTunnelGroupId: 51 ( blackhole control) ... userPassword XXXXXXXXXXXXXXXXX Or Uid=<mac-address>,ou=Devices,ou=Radius,xxxxxxxxxxxxxx cn: stupid.device.001 ... radiusTunnelGroupId: 666 (Mad scientist) radiusTunnelGroupId: 999 (FusionCore) ... The host/user, may have rights to connect to those vlans, from let say top prority (666) to the lesser one (51) [ldap attribute order], in the first case, and only 666 or 999 in the second. Some areas are restrited so only the ones with physical access may get connection to the right vlan. The problem is how may I configure radius so it may choose the "correct" vlan. Or try one and if not possible keep trying until no more choices are available. I also have "hungroups", but I realized, if I'm not wrong, that freeradius only gets the first match, never tries the others, so: BlackHoleCore NAS-IP-Address == 10.0.0.1 VacuumCleaner NAS-IP-Address == 10.0.0.1 CoffeeMachine NAS-IP-Address == 10.0.0.1 When in freeradius "users" file I try "DEFAULT Huntgroup-Name == CoffeeMachine, Auth-Type = LDAPCoffee" it will never get in, because NAS-IP 10.0.0.1 will always match BlackHoleCore, never the others.( It's ok?? Or I'm wrong or may I have to change something to get/force/allow multiple target??) A "problem" I found,I'm a newby in radius, is that I'm not able to choose between the diferent vlans, as radius always try to match first value of multivaluated attributes (radiusTunnelGroupId). I'm wrong again? Freeradius send the ACK-OK to the NAS-switch with the target Vlan for this device. If the "sent" vlan is not extended to that switch-NAS there fails silently( @ least seems so in Extreme networks), so the device is not connected. I was trying to use the "checkval" module, but I don't know it's the way it was thinked off. As far as I undertand I can not use it, maybe I'm wrong again. There's any elegant way to do it? Is that aproach, try the "next vlan" if exists @ ldap, possible, how? Many Thanks.

3 6

Default ldap fallthrough but no Auth-Type set
by Harry Hoffman 01 Oct '10

01 Oct '10

Hi All, I'm running freeradius 2.1.8 on a Redhat 5.x box. We're setup to authenticate against LDAP and AD using the how-tos and wiki on the freeradius website. Users might be in LDAP, or AD, or both. I've stuck with the default config and enabled both ldap and ntlm_auth (after making sure that both sources can authenticate per the docs). Both sources of authentication work. It seems that when enabling the ldap module, it become the default if nothing else sets the Auth-Type. Now I'm trying to walk through the exercise of getting AD auth to work if a user is present in AD, or getting LDAP auth to work if the user is present in LDAP. In the authorize { ... } section of sites-enabled/default I have the following: ntlm_auth ldap { notfound = return } In the authenticate { ... } section of sites-enabled/default I have the following Auth-Type: # ntlm_auth authentication. Auth-Type ntlm_auth { ntlm_auth } Auth-Type LDAP { group{ ldap{ reject = 1 ok = return } ntlm_auth{ reject = 1 ok = return } } } If the user has a entry in the LDAP database then the Auth-Type is set to LDAP and the authorization jumps to Auth-Type LDAP and goes through the groups stanza trying to authenticate to ldap or ntlm_auth. However if the user is not in LDAP then it seems as though Auth-Type is never set so the default authentication is attempted via ldap, which fails. I don't understand why it doesn't try the Auth-Type LDAP definition. Everywhere I read, the docs say not to specifically set Auth-Type but to let the server figure it out. So, how do I let the server figure out that the Auth-Type should be ntlm_auth when the authorize { ... } section matches ntlm_auth? rad_recv: Access-Request packet from host 127.0.0.1 port 55874, id=200, length=63 User-Name = "admin" User-Password = "password" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20100930 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m %d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20100930 [auth_log] expand: %t -> Thu Sep 30 10:32:05 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "admin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "admin", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=admin [ntlm_auth] expand: --password=%{User-Password} -> --password=password Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok [ldap] performing user authorization for admin [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> admin [ldap] expand: (&(uid= %{%{Stripped-User-Name}:-%{User-Name}})(!(inetCOS=802.1x_disabled))) -> (&(uid=admin)(!(inetCOS=802.1x_disabled))) [ldap] expand: ou=People,dc=ip-solutions,dc=net,o=internet -> ou=People,dc=ip-solutions,dc=net,o=internet [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.ip-solutions.net:389, authentication 0 [ldap] starting TLS [ldap] bind as / to ldap.ip-solutions.net:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=People,dc=ip-solutions,dc=net,o=internet, with filter (&(uid=admin)(!(inetCOS=802.1x_disabled))) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect ( [ldap] User not found): [admin] (from client localhost port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> admin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.7 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 200 to 127.0.0.1 port 55874 Waking up in 4.9 seconds. Cleaning up request 0 ID 200 with timestamp +3 Ready to process requests. Cheers, Harry

2 1

vmps switch-port shutdown
by Habegger Lukas, ERZ-AZD-AID-NOC 01 Oct '10

01 Oct '10

hi I try to shutdown (errdisabled) a port of a cisco3560 with the vmps-shutdown response. i use freeradius 2.1.10 and rlm_perl. Could someone tell me how the response should look like. so fare i have: $RAD_REPLY{'VMPS-Packet-Type'} = "VMPS-Join-Response"; $RAD_REPLY{'VMPS-Error-Code'} = "VMPS-Shutdown"; $RAD_REPLY{'VMPS-Sequence-Number'} = $RAD_REQUEST{'VMPS-Sequence-Number'}; i can set the vlan on a port for a specific mac but the port does not go to errdisabled when i use the above. Thanks for help Lukas

2 1