November 2013 - Freeradius-Users - lists.freeradius.org

Reply with Access-Reject from exec
by Adnan Miljkovic 01 Dec '13

01 Dec '13

Hello, I am using exec to check users again an external script. Up until now I am able to successfully authenticating the user and send back several attributes that are used by the NAS. So when user data are OK, everything is fine. My problem is how to deny access to the user, how to send "Access-Reject"? What should I send back in my exec program. Possible my setup is wrong? my current setup: authorize { ..... update control { Auth-Type := CheckUser } ..... } authenticate { .... Auth-Type CheckUser { checkuser } ..... } The output "Access-Accept" is always send back to NAS: ================================================== ++[sql] = notfound ++update control { ++} # update control = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok Found Auth-Type = CheckUser # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group CheckUser { [checkuser] expand: %{User-Name} -> student.name [checkuser] expand: %{User-Password} -> password Exec output: fail = 1 Exec plaintext: fail = 1 [checkuser] Exec: program returned: 0 ++[checkuser] = ok +} # group CheckUser = ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 117 to 127.0.0.1 port 57009 ================================================== I am using version 2.2.2. All help is much appreciated.

2 1

Freeradius DHCP problem
by Csőke János 01 Dec '13

01 Dec '13

Hi Everybody! I would like to use Freeradius as a DHCP server, but it's not working. I'm seen this in debug mode: ======================================================================= Received DHCP-Discover of id c38d6dab from 0.0.0.0:68 to 255.255.255.255:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 3280825771 DHCP-Number-of-Seconds = 7424 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 14:da:e9:bf:1c:da DHCP-Message-Type += DHCP-Discover DHCP-Client-Identifier += 14:da:e9:bf:1c:da DHCP-Hostname += "csovike10pc" DHCP-Vendor-Class-Identifier += "MSFT 5.0" DHCP-Parameter-Request-List += DHCP-Subnet-Mask DHCP-Parameter-Request-List += DHCP-Domain-Name DHCP-Parameter-Request-List += DHCP-Router-Address DHCP-Parameter-Request-List += DHCP-Domain-Name-Server DHCP-Parameter-Request-List += DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List += DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List += DHCP-NETBIOS DHCP-Parameter-Request-List += DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List += DHCP-Static-Routes DHCP-Parameter-Request-List += DHCP-Classless-Static-Route DHCP-Parameter-Request-List += 249 DHCP-Parameter-Request-List += DHCP-Vendor server dhcp { Trying sub-section dhcp DHCP-Discover {...} +group DHCP-Discover { ++update reply { ++} # update reply = noop ++update reply { sql_xlat expand: %{User-Name} -> sql_set_user escaped user --> '' expand: SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Subnet-Mask' -> SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '14:da:e9:bf:1c:da' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Subnet-Mask' rlm_sql (sql): Reserving sql socket id: 9 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 9 expand: %{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Subnet-Mask'} -> 255.255.255.0 sql_xlat expand: %{User-Name} -> sql_set_user escaped user --> '' expand: SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Router-Address' -> SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '14:da:e9:bf:1c:da' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Router-Address' rlm_sql (sql): Reserving sql socket id: 8 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 8 expand: %{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Router-Address'} -> 152.66.235.254 sql_xlat expand: %{User-Name} -> sql_set_user escaped user --> '' expand: SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Domain-Name' -> SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '14:da:e9:bf:1c:da' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Domain-Name' rlm_sql (sql): Reserving sql socket id: 7 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 7 expand: %{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Domain-Name'} -> teteny.bme.hu sql_xlat expand: %{User-Name} -> sql_set_user escaped user --> '' expand: SELECT host FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) -> SELECT host FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '14:da:e9:bf:1c:da' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) rlm_sql (sql): Reserving sql socket id: 6 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 6 expand: %{sql:SELECT host FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)} -> csovike10pc sql_xlat expand: %{User-Name} -> sql_set_user escaped user --> '' expand: SELECT ip FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) -> SELECT ip FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '14:da:e9:bf:1c:da' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) rlm_sql (sql): Reserving sql socket id: 5 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 5 expand: %{sql:SELECT ip FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)} -> 152.66.235.32 ++} # update reply = noop ++[ok] = ok +} # group DHCP-Discover = ok DHCP: Reply will be broadcast } # server dhcp Encoding DHCP-Offer of id c38d6dab from 10.42.128.0:67 to 255.255.255.255:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 3280825771 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 152.66.235.32 DHCP-Server-IP-Address = 10.42.128.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 14:da:e9:bf:1c:da DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 152.66.235.254 DHCP-Domain-Name-Server = 10.42.128.0 DHCP-Domain-Name-Server = 10.42.128.2 DHCP-Hostname = "csovike10pc" DHCP-Domain-Name = "teteny.bme.hu" DHCP-Interface-MTU-Size = 1400 DHCP-NTP-Servers = 10.42.128.0 DHCP-NETBIOS-Name-Servers = 10.42.128.15 DHCP-IP-Address-Lease-Time = 14400 DHCP-DHCP-Server-Identifier = 10.42.128.0 DHCP-Renewal-Time = 7200 DHCP-Rebinding-Time = 12600 Sending DHCP-Offer of id c38d6dab from 10.42.128.0:67 to 255.255.255.255:68 Finished request 2. Cleaning up request 2 ID -1014141525 with timestamp +35 Going to the next request Ready to process requests. ======================================================================= It's great, because all sql query run succesful, found my client's IP address and sent correct DHCP-Offer message. But the DHCP request failed in my Windows 7 client. My dhcp configuration file: ======================================================================= server dhcp { listen { broadcast = yes ipaddr = 255.255.255.255 port = 67 interface = eth0.42 type = dhcp } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = 10.42.128.0 DHCP-Domain-Name-Server = 10.42.128.2 DHCP-Subnet-Mask = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Subnet-Mask'}" DHCP-Router-Address = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Router-Address'}" DHCP-Domain-Name = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Domain-Name'}" DHCP-IP-Address-Lease-Time = 14400 DHCP-Renewal-Time = 7200 DHCP-Rebinding-Time = 12600 DHCP-Hardware-Type = Ethernet DHCP-DHCP-Server-Identifier = 10.42.128.0 DHCP-Interface-MTU-Size = 1400 DHCP-NETBIOS-Name-Servers = 10.42.128.15 DHCP-NTP-Servers = 10.42.128.0 DHCP-Hostname = "%{sql:SELECT host FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)}" DHCP-Your-IP-Address = "%{sql:SELECT ip FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)}" } ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = 10.42.128.0 DHCP-Domain-Name-Server = 10.42.128.2 DHCP-Subnet-Mask = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Subnet-Mask'}" DHCP-Router-Address = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Router-Address'}" DHCP-Domain-Name = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Domain-Name'}" DHCP-IP-Address-Lease-Time = 14400 DHCP-Renewal-Time = 7200 DHCP-Rebinding-Time = 12600 DHCP-Hardware-Type = Ethernet DHCP-DHCP-Server-Identifier = 10.42.128.0 DHCP-Interface-MTU-Size = 1400 DHCP-NETBIOS-Name-Servers = 10.42.128.15 DHCP-NTP-Servers = 10.42.128.0 DHCP-Hostname = "%{sql:SELECT host FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)}" DHCP-Your-IP-Address = "%{sql:SELECT ip FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)}" } ok } # If there's no named section for the packet type, then the packet # is processed through this section. dhcp { # send a DHCP NAK. reject } } ======================================================================= Freeradius version: freeradius: FreeRADIUS Version 2.2.3 (git #077a373), for host x86_64-pc-linux-gnu, built on Nov 25 2013 at 09:17:09 ======================================================================= Operating System: Debian 7 ======================================================================= Can you help me? Thanks, János

2 1

(no subject)
by Adnan Miljkovic 30 Nov '13

30 Nov '13

Hello, I am trying to use exec to check if a user in valid in a custom PHP script, what I would like is to get multiple attributes returned. I created a module as: ======================================================================= exec checkuser { wait = yes input_pairs = request output_pairs = reply program = "/etc/raddb/check-user.php -log -debug '%{User-Name}' '%{User-Password}'" shell_escape = yes } ======================================================================= and then activated it in the "authorize" section. The check-user.php script I would like to output the following: ======================================================================= <?php echo "Access-Accept = Accept"; // I used also commas.. same error echo "Mikrotik-Group = student"; echo "Mikrotik-Rate-Limit = 1564k/6400k"; So howevery I am echo-ing these I just get: "Exec format error" ======================================================================== [checkuser] expand: '%{User-Name}' -> 'AC:81:F3:63:7D:07' [checkuser] expand: '%{User-Password}' -> '' Exec-Program output: Exec-Program: FAILED to execute /etc/raddb/check-user.php: Exec format error Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute /etc/raddb/check-user.php: Exec format error Exec-Program: returned: 1 ++[checkuser] returns reject ====================================================================== What is the correct way to return multiple attributes in PHP All help is appreciated, that you. Adnan

3 2

Throttle Authentication Requests
by Fahad Saleem 30 Nov '13

30 Nov '13

Greetings All, What would be the best way to rate limit the number of authentication requests. Our current setup has one server doing 150 Auths per sec but under certain circumstances during GGSN migrations the auths per seconds go up to 1000 for a 20 to 30 minute period before things start to calm down. So I was wondering if this was possible in anyway from the freeradius end, kind of as a safe guard. I've looked at the rlm_cache module and the idea of getting packets dropped is a bit scary. Any thoughts about this will be appreciated! Regards

2 1

mySQL SSL Support
by Scott Pettit - Vorco 29 Nov '13

29 Nov '13

Hi, We¹re running FreeRADIUS 2.1.10 on Ubuntu. We¹d like to have the mySQL connections running over SSL. I can¹t find anything in the documentation about it but I found this patch from a long time ago http://dev.gentoo.org/~wschlich/src/freeradius-1.0.2-mysql-ssl.patch Is SSL supported on the mySQL driver and if so how do I specify the location of my SSL CA Cert and enable SSL? -Scott ________________________________ The content of this message and any attachments may be privileged, confidential or sensitive. Any unauthorised used is prohibited. Views expressed in this message are those of the individual sender, except where stated otherwise with appropriate authority. All pricing provided is valid at the time of writing only and due to factors such as the exchange rate, may change without notice. Sales are made subject to our Terms & Conditions, available on our website or on request. ________________________________

2 2

Possible to check certain SQL values in freeradius?
by Muhammad Nuzaihan Bin Kamal Luddin 29 Nov '13

29 Nov '13

Hi, Typically, FreeRADIUS would be using selects by using one value - %{Packet-Src-IP-Address}. I would like to know the secret it is using to communicate with the freeradius to compare on our user database. (the user actually generates these secrets and implement it into their NAS) Is there other ways to do it (even using other than secrets?) or do i have to depend solely on Packet-Src-IP-Address? I am doing more development than doing implementation myself and i am seeing all the secret values seemed to be transparent to the freeradius configuration itself (for building applications on top of it) Thanks, Muhammad Nuzaihan -- Taqi Systems 269-J Jalan Panji Kampung Chempaka, Kota Bharu, Kelantan 16100 Phone: +6097738657 Mobile: +60199788657 pub 4096R/4C77F88C 2013-04-06 [expires: 2015-04-06] Key fingerprint = 2FE1 87FA E775 2E05 CC0F B3F6 3CB7 C65F 4C77 F88C uid Muhammad Nuzaihan Bin Kamal Luddin <muhammad(a)taqisystems.com>

2 1

Max length of SQl return string?
by Alexander Silveröhrt 29 Nov '13

29 Nov '13

Hello, We are doing a query which are supposed to comeback with a bunch of subscriber accounts. update request { Subscriber-Accounts := "%{sql-cisco-bng:SELECT GROUP_CONCAT(username SEPARATOR ';') FROM radcheck WHERE username LIKE '%{User-Name}%%'}" } But it seems that there is a limit on how long the return string can be? In this case a query for acccount for user "10.33.2.3_GigabitEthernet0/0/2" did return below accounts but the return query cuts off after a while. (And yes port 1 and port 2 also gets account for 10-19 and 20-22 which is why we noticed this bugg/feature..?) 10.33.2.3_GigabitEthernet0/0/21 10.33.2.3_GigabitEthernet0/0/20 CH_VoIP 10.33.2.3_GigabitEthernet0/0/20 CH_IPTV 10.33.2.3_GigabitEthernet0/0/20 10.33.2.3_GigabitEthernet0/0/2 KAL_IPTV 10.33.2.3_GigabitEthernet0/0/20 KAL_IPTV 10.33.2.3_GigabitEthernet0/0/2 Here is from the debug where one can see where it gets cut off rlm_perl: sub-pre-auth: Debug: RAD_REQUEST in sub authorize: Subscriber-Accounts = 10.33.2.3_GigabitEthernet0/0/21;10.33.2.3_GigabitEthernet0/0/20 CH_VoIP;10.33.2.3_GigabitEthernet0/0/20 CH_IPTV;10.33.2.3_GigabitEthernet0/0/20;10.33.2.3_GigabitEthernet0/0/2 KAL_IPTV;10.33.2.3_GigabitEthernet0/0/20 KAL_IPTV;10.33.2.3_GigabitEth And and after splitted rlm_perl: sub-pre-auth: i = 0, SQL Found Account[0]: 10.33.2.3_GigabitEthernet0/0/21 rlm_perl: sub-pre-auth: i = 1, SQL Found Account[1]: 10.33.2.3_GigabitEthernet0/0/20 CH_VoIP rlm_perl: sub-pre-auth: i = 2, SQL Found Account[2]: 10.33.2.3_GigabitEthernet0/0/20 CH_IPTV rlm_perl: sub-pre-auth: i = 3, SQL Found Account[3]: 10.33.2.3_GigabitEthernet0/0/20 rlm_perl: sub-pre-auth: i = 4, SQL Found Account[4]: 10.33.2.3_GigabitEthernet0/0/2 KALEJDO_IPTV rlm_perl: sub-pre-auth: i = 5, SQL Found Account[5]: 10.33.2.3_GigabitEthernet0/0/20 KALEJDO_IPTV rlm_perl: sub-pre-auth: i = 6, SQL Found Account[6]: 10.33.2.3_GigabitEth So my question is if there is a limitation can i change it somewhere and why is there one in the first place? We temporary fixed it by a better matched SQL query which doesnt give us accounts we are not asking for.. Subscriber-Accounts := "%{sql-cisco-bng:SELECT GROUP_CONCAT(username SEPARATOR ';') AS FOO_RID FROM radcheck WHERE username LIKE '%{User-Name} %' OR username = '%{User-Name}'}" but it is still going to give us problems in the future since users can have more than above exemples of accounts. Thanks for your time. Alex ********* DISCLAIMER ********* This message and any attachment are confidential and may be privileged or otherwise protected from disclosure and may include proprietary information. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person

3 3

Yet another Freeradius+openldap eap-ttls pap issue
by Work 28 Nov '13

28 Nov '13

Hi there, this is my first post on the list and It's always a shame to start with a problem :) . I woul like to implement a freeradius authentication server that uses openldap as backend and supports both pap authentication (for the VPN client) and eap -ttls pap for the wi-fi lan. I think I've successfullyconfigured freeradius for the pap authentication with openldap since the radtest returns ok. In the ldap module I've also enabled the groupcheck since in my company they want to restrict vpn access through ldap group membership. This works great. To to this I've removed the comment from the groupcheck and added to the user file thinks like this: 188:DEFAULT LDAP-Group=="vpntest" 189: Reply-Message="Test per VPN", 190: Class="vpntest", 191: Fall-Through = Yes is this ugly? My company does not want to add radiuschema to the users. Ok now just forget for the small OT and let's focus on the real problem. These are the configs: root@ldap:/etc/freeradius# egrep -v '(#|^\s*$)' modules/ldap ldap { server = "test-ldap.newenergygroup.com" identity = "cn=admin,dc=newenergygroup,dc=com" password = XXXXXXXXX basedn = "dc=newenergygroup,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" password_attribute = userPassword ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = radiusGroupName } egrep -v '(#|^\s*$)' sites-enabled/default authorize { preprocess chap mschap suffix eap { ok = return } files ldap expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } root@ldap:/etc/freeradius# egrep -v '(#|^\s*$)' eap.conf eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no max_entries = 255 } } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } I'm testing the eap eapol_test -c eap_pool_test_config -a 127.0.0.1 -p 1812 -s testing123 -r1 and the config is: network={ eap=TTLS ssid="example" eapol_flags=0 key_mgmt=WPA-EAP identity="atest" password="atest" #ca_cert="/etc/freeradius/certs/ccaa.pem" phase2="auth=PAP" } the debug from radius is: rad_recv: Access-Request packet from host 127.0.0.1 port 33653, id=0, length=118 User-Name = "atest" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000a016174657374 Message-Authenticator = 0xf57a3eb5217b5475fcd4acf2ab929c6c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "atest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: dc=newenergygroup,dc=com -> dc=newenergygroup,dc=com [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> atest [files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=atest) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to test-ldap.newenergygroup.com:389, authentication 0 [ldap] bind as cn=admin,dc=newenergygroup,dc=com/Ld4pPa$$w0rD to test-ldap.newenergygroup.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=newenergygroup,dc=com, with filter (uid=atest) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=newenergygroup,dc=com, with filter (&(cn=vpnfullaccess)(|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in uid=atest,ou=people,dc=newenergygroup,dc=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 [ldap] Entering ldap_groupcmp() [files] expand: dc=newenergygroup,dc=com -> dc=newenergygroup,dc=com [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=newenergygroup,dc=com, with filter (&(cn=vpnlowaccess)(|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in uid=atest,ou=people,dc=newenergygroup,dc=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 [ldap] Entering ldap_groupcmp() [files] expand: dc=newenergygroup,dc=com -> dc=newenergygroup,dc=com [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=newenergygroup,dc=com, with filter (&(cn=vpntest)(|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in uid=atest,ou=people,dc=newenergygroup,dc=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 [ldap] Entering ldap_groupcmp() [files] expand: dc=newenergygroup,dc=com -> dc=newenergygroup,dc=com [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=newenergygroup,dc=com, with filter (&(cn=vpntestadmin)(|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom)))) rlm_ldap::ldap_groupcmp: User found in group vpntestadmin [ldap] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 193 ++[files] returns ok [ldap] performing user authorization for atest [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> atest [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=atest) [ldap] expand: dc=newenergygroup,dc=com -> dc=newenergygroup,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=newenergygroup,dc=com, with filter (uid=atest) [ldap] Added User-Password = {MD5}tQzXLan1f4v2iAMD/1t2Ig== in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user atest authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = LDAP +- entering group LDAP {...} [ldap] Attribute "User-Password" is required for authentication. You seem to have set "Auth-Type := LDAP" somewhere. THAT CONFIGURATION IS WRONG. DELETE IT. YOU ARE PREVENTING THE SERVER FROM WORKING PROPERLY. ++[ldap] returns invalid Failed to authenticate the user. Login incorrect: [atest] (from client localhost port 0 cli 02-00-00-00-00-01) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> atest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 127.0.0.1 port 33653 Reply-Message = "Test per VPN ADMIN" Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +23 Ready to process requests. Thank you :), hope I'm not missing somithing stupid, I've read a lot of documentation here and there. ps. password on the LDAP are stored in hash form.

5 9

[v3] LDAP access_attribute
by Hachmer, Tobias 28 Nov '13

28 Nov '13

Hello list members, what are the considerations to change the behavior regarding "access_attribute" in ldap from the "access_attr" in v2? >From a ldap perspective is it easier to administer user objects in ldap when you can see directly if a user has access or not. Is there a chance to get the simple boolean test back in v3? Kind regards, Tobias Hachmer

2 4

FreeRADIUS 3 LDAP Questions
by Hachmer, Tobias 28 Nov '13

28 Nov '13

Hello list members, I am migrating here from FreeRADIUS v2 to v3 and have some questions regarding the ldap module. As I understand everyone has to do the LDAP Attribute Mapping manually: - It would be much easier if the old ldap.attrmap would be translated already, maybe commented. - All checkItems have to defined with "control: ... := ..."? valuepair_attribute - Can I define multiple valuepair attributes? I just want radiusCheckItem and radiusReplyItem By default there are no hardcoded attribute mappings? Our servers here just asking a read-only ldap server. The new accounting options of the ldap module need to write to ldap. - Would it be sufficient just to comment the whole accounting and post-auth section if we do not need them? Kind regards, Tobias Hachmer

2 6