June 2013 - Freeradius-Users - lists.freeradius.org

call exec when proxy authentication success
by Bill Yuan 19 Jun '13

19 Jun '13

Hi I did google alot and still did not manage to find an answer, so I ask here, hope someone can help on this, my freeradius is running as a proxy, and I want to add a exec command when authentication is successful. so I add exec in the post-proxy { , but how to filter by the authentication result ? I want to trigger it only when Access-Accept, if dont have this filter, then how to pass the Access-Accept or Access-Reject into my script ? thanks very much

3 5

Re: IPv6 Pool
by William DELORAINE 18 Jun '13

18 Jun '13

2 1

(no subject)
by RONAN BLANEY 18 Jun '13

18 Jun '13

1 0

where is the email list
by RONAN BLANEY 18 Jun '13

18 Jun '13

1 0

rlm_sql_freetds / rlm_sql_sybase
by Arran Cudbard-Bell 18 Jun '13

18 Jun '13

In 2.0.0 we had two sql drivers rlm_sql_freetds (db), and rlm_sql_sybase (ct-lib). They used two different APIs but the same protocol, TDS. The reason why they were bundled with the server was to support Sybase and MSSQL servers natively, without an ODBC connector. In 3.0.0 rlm_sql_sybase has been renamed to rlm_sql_freetds as it was more complete and used a newer API, and the old rlm_sql_freetds module has been removed. The following changes were made: * Integrate it into the build system (add configure.in and all.mk.in) * Code cleanup. * Don't leak connection handles or contexts or statements - the old code made no attempt to close connections, or free resources - it had the closure code copy/pasted from rlm_sql_oracle and then commented out. Um... * Pass userdata to message callbacks so they can write potential errors to the connection handle (which are later retrieved via sql_error(), if an actual error occurred). * Log informational messages from the client library and the client (I have no idea why there's this distinction) using INFO() in real time. * Select database on connection spawn. The API had no support for this, so we just issue a 'USE <db_name>;' statement every time a connection is created. The db context change seems to persist across multiple queries, at least with MSSQL. * Switch severity of server messages. During connection establishment they're INFO(), then, if they occur during a query, they're treated as ERROR()s (accessible from sql_error()). The reason for this is that there are no standard severity levels between TDS SQL servers, and so you have absolutely no idea whether the messages returned by the server are errors or not. The nice thing about sql_error() is it's only called when one of the API functions has returned an error code, so hopefully you won't get informational messages showing up as errors. It's the best hack I could think of. Blame Sybase (or whoever they bought the IP off) for coming up with such a shitty protocol. * Better and more consistent logging. To get rlm_sql_freetds you need to have the freetds libraries available (apt-get install freetds-dev), or something else which provides a ct-lib API. The configure script isn't picky so long as it can find ctpublic.h and ct_command in libct it'll build the module. The driver isn't marked as stable (once people test it and provide positive feedback it may be), but will build if you pass --with-experimental-modules or --enable-developer to configure, or build from .git (which automatically enables developer). There's no additional driver options, though there may be some advantage to setting client version dynamically (let me know if you want/need this). -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

1 0

building new module with external library dependencies
by Bill Schoolfield 17 Jun '13

17 Jun '13

Hello all, I have created a new module (using rlm_detail.c as it was closest to my needs). For the building I took the various config files from rlm_example and modified as needed (changed example to xxxxx where xxxxx is my module name). Then used: ./configure xxxxx_cflags="..." xxxxx_ldflags="..." gmake install Where the variables contain the needed includes, libraries, etc. The module links fine. However, when running the server, the linker fails to load (find) the needed third party shared libraries. If I set LD_LIBRARY_PATH, things work fine. However, I would like to use rpath so no runtime setup is needed. I've tried setting rpath in ldflags but this doesn't work. Does anyone know how to accomplish this? Bill

3 4

freeradius using pam_oath doesn't return otp challenge
by Martin Kraus 17 Jun '13

17 Jun '13

Hi. I'd like to have freeradius authenticate users using their password (for simplicity I'm using /etc/shadow now) and TOTP through liboath. I was hoping to use freeradius to centralize this. PAM looked like the easiest way. I'm using freeradius 2.1.12 from debian wheezy. PAM confiuration is simple: auth required pam_unix.so nullok_secure auth requisite pam_oath.so usersfile=/etc/users.oath debug On the testing machine runnning freeradius this works great for su: <root|lex>[pam.d]# su Password: [pam_oath.c:parse_cfg(118)] called. [pam_oath.c:parse_cfg(119)] flags 0 argc 3 [pam_oath.c:parse_cfg(121)] argv[0]=usersfile=/etc/users.oath [pam_oath.c:parse_cfg(121)] argv[1]=window=1 [pam_oath.c:parse_cfg(121)] argv[2]=debug [pam_oath.c:parse_cfg(122)] debug=1 [pam_oath.c:parse_cfg(123)] alwaysok=0 [pam_oath.c:parse_cfg(124)] try_first_pass=0 [pam_oath.c:parse_cfg(125)] use_first_pass=0 [pam_oath.c:parse_cfg(126)] usersfile=/etc/users.oath [pam_oath.c:parse_cfg(127)] digits=0 [pam_oath.c:parse_cfg(128)] window=1 [pam_oath.c:pam_sm_authenticate(157)] get user returned: root One-time password (OATH) for `root': After entering the passord the pam_oath module sends the challenge for OTP and then it authenticates me. SSH works well as well. However when I run freeradius I never get the challenge: pam_pass: using pamauth string <radiusd> for pam.conf lookup [pam_oath.c:parse_cfg(118)] called. [pam_oath.c:parse_cfg(119)] flags 0 argc 3 [pam_oath.c:parse_cfg(121)] argv[0]=usersfile=/etc/users.oath [pam_oath.c:parse_cfg(121)] argv[1]=window=1 [pam_oath.c:parse_cfg(121)] argv[2]=debug [pam_oath.c:parse_cfg(122)] debug=1 [pam_oath.c:parse_cfg(123)] alwaysok=0 [pam_oath.c:parse_cfg(124)] try_first_pass=0 [pam_oath.c:parse_cfg(125)] use_first_pass=0 [pam_oath.c:parse_cfg(126)] usersfile=/etc/users.oath [pam_oath.c:parse_cfg(127)] digits=0 [pam_oath.c:parse_cfg(128)] window=1 [pam_oath.c:pam_sm_authenticate(157)] get user returned: root [pam_oath.c:pam_sm_authenticate(232)] conv returned: karel [pam_oath.c:pam_sm_authenticate(248)] OTP too short: karel [pam_oath.c:pam_sm_authenticate(322)] done. [Authentication failure] pam_pass: function pam_authenticate FAILED for <root>. Reason: Authentication failure It seems it gets passed the first password even though try_first_pass nor use_first_pass are set for the pam_oath module. It looks like freeradius passes it the User-Password attribute. Is this a problem in freeradius or the pam stack or am I doing something wrong? I was expecting to get a radius access-challenge proxying the pam_oath challenge similar to how ssh takes care of this. Is there a way to get this setup working? I'd like to use the ldap passwords for users so I'm trying to avoid plaintext secrets in oath configuration. So far it seems I cannot use more then one authentication method in freeradius so pam or some custom module seem like the only two options. thank for pointers Martin

3 5

initial accept, but then fails
by geebs 16 Jun '13

16 Jun '13

Hello, I'm having an issue with our radius server authorising users. The initial request is fine, the customer connects and receives an IP address.... rad_recv: Access-Request packet from host 10.8.13.254 port 1645, id=5, length=236 Framed-Protocol = PPP User-Name = "michaelr(a)example.com" CHAP-Password = 0x974cfb5d4d64e91407e0c85a3b1611a584 Calling-Station-Id = "GigabitEthernet 14/0/3.31010096:3101-96#587204450###pppoe 00:04:ed:d1:78:85#QTNITE4025M atm 1/1/04/27:8.35#" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 501 NAS-Port-Id = "Uniq-Sess-ID501" Service-Type = Framed-User NAS-IP-Address = 10.8.13.254 Fri Jun 14 11:44:14 2013 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri Jun 14 11:44:14 2013 : Info: +- entering group authorize {...} Fri Jun 14 11:44:14 2013 : Info: ++[preprocess] returns ok Fri Jun 14 11:44:14 2013 : Info: [chap] Setting 'Auth-Type := CHAP' Fri Jun 14 11:44:14 2013 : Info: ++[chap] returns ok Fri Jun 14 11:44:14 2013 : Info: ++[mschap] returns noop Fri Jun 14 11:44:14 2013 : Info: ++[digest] returns noop Fri Jun 14 11:44:14 2013 : Info: [suffix] Looking up realm "example.com" for User-Name = "michaelr(a)example.com" Fri Jun 14 11:44:14 2013 : Info: [suffix] Found realm "example.com" Fri Jun 14 11:44:14 2013 : Info: [suffix] Adding Stripped-User-Name = "michaelr" Fri Jun 14 11:44:14 2013 : Info: [suffix] Adding Realm = "example.com" Fri Jun 14 11:44:14 2013 : Info: [suffix] Authentication realm is LOCAL. Fri Jun 14 11:44:14 2013 : Info: ++[suffix] returns ok Fri Jun 14 11:44:14 2013 : Info: [eap] No EAP-Message, not doing EAP Fri Jun 14 11:44:14 2013 : Info: ++[eap] returns noop Fri Jun 14 11:44:14 2013 : Info: [files] users: Matched entry DEFAULT at line 172 Fri Jun 14 11:44:14 2013 : Info: ++[files] returns ok Fri Jun 14 11:44:14 2013 : Info: [sql] expand: %{Stripped-User-Name} -> michaelr Fri Jun 14 11:44:14 2013 : Info: [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> michaelr Fri Jun 14 11:44:14 2013 : Info: [sql] sql_set_user escaped user --> 'michaelr' Fri Jun 14 11:44:14 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 0 Fri Jun 14 11:44:14 2013 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'michaelr' ORDER BY id Fri Jun 14 11:44:14 2013 : Info: [sql] User found in radcheck table Fri Jun 14 11:44:14 2013 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'michaelr' ORDER BY id Fri Jun 14 11:44:14 2013 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'michaelr' ORDER BY priority Fri Jun 14 11:44:14 2013 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Layer2-L2TP' ORDER BY id Fri Jun 14 11:44:14 2013 : Info: [sql] User found in group Layer2-L2TP Fri Jun 14 11:44:14 2013 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Layer2-L2TP' ORDER BY id Fri Jun 14 11:44:14 2013 : Debug: rlm_sql (sql): Released sql socket id: 0 Fri Jun 14 11:44:14 2013 : Info: ++[sql] returns ok Fri Jun 14 11:44:14 2013 : Info: ++[expiration] returns noop Fri Jun 14 11:44:14 2013 : Info: ++[logintime] returns noop Fri Jun 14 11:44:14 2013 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP Fri Jun 14 11:44:14 2013 : Info: ++[pap] returns noop Fri Jun 14 11:44:14 2013 : Info: Found Auth-Type = Local Fri Jun 14 11:44:14 2013 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Fri Jun 14 11:44:14 2013 : Info: !!! Replacing User-Password in config items with Cleartext-Password. !!! Fri Jun 14 11:44:14 2013 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Fri Jun 14 11:44:14 2013 : Info: !!! Please update your configuration so that the "known good" !!! Fri Jun 14 11:44:14 2013 : Info: !!! clear text password is in Cleartext-Password, and not in User-Password. !!! Fri Jun 14 11:44:14 2013 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Fri Jun 14 11:44:14 2013 : Info: WARNING: Please update your configuration, and remove 'Auth-Type = Local' Fri Jun 14 11:44:14 2013 : Info: WARNING: Use the PAP or CHAP modules instead. Fri Jun 14 11:44:14 2013 : Info: CHAP-Password is correct. Fri Jun 14 11:44:14 2013 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Fri Jun 14 11:44:14 2013 : Info: +- entering group post-auth {...} Fri Jun 14 11:44:14 2013 : Info: [sql] expand: %{Stripped-User-Name} -> michaelr Fri Jun 14 11:44:14 2013 : Info: [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> michaelr Fri Jun 14 11:44:14 2013 : Info: [sql] sql_set_user escaped user --> 'michaelr' Fri Jun 14 11:44:14 2013 : Info: [sql] expand: %{User-Password} -> Fri Jun 14 11:44:14 2013 : Info: [sql] ... expanding second conditional Fri Jun 14 11:44:14 2013 : Info: [sql] expand: %{Chap-Password} -> 0x974cfb5d4d64e91407e0c85a3b1611a584 Fri Jun 14 11:44:14 2013 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( ' michaelr(a)example.com', '0x974cfb5d4d64e91407e0c85a3b1611a584', 'Access-Accept', '2013-06-14 11:44:14') Fri Jun 14 11:44:14 2013 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( ' michaelr(a)example.com', '0x974cfb5d4d64e91407e0c85a3b1611a584', 'Access-Accept', '2013-06-14 11:44:14') Fri Jun 14 11:44:14 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Fri Jun 14 11:44:14 2013 : Debug: rlm_sql (sql): Released sql socket id: 4 Fri Jun 14 11:44:14 2013 : Info: ++[sql] returns ok Fri Jun 14 11:44:14 2013 : Info: ++[exec] returns noop Sending Access-Accept of id 5 to 10.8.13.254 port 1645 Framed-Protocol := PPP Framed-Compression = Van-Jacobson-TCP-IP Framed-IP-Address == 10.8.13.193 Tunnel-Type:0 := L2TP Tunnel-Medium-Type:0 := IPv4 Service-Type := Framed-User Framed-IP-Netmask := 255.255.255.255 Fri Jun 14 11:44:14 2013 : Info: Finished request 20. Fri Jun 14 11:44:14 2013 : Debug: Going to the next request Fri Jun 14 11:44:14 2013 : Debug: Waking up in 4.9 seconds. Fri Jun 14 11:44:19 2013 : Info: Cleaning up request 20 ID 5 with timestamp +734 Fri Jun 14 11:44:19 2013 : Info: Ready to process requests. However then the customer disconnects a 2nd later, and the following comes through, which makes no sense at all to me. rad_recv: Access-Request packet from host 10.8.13.254 port 1645, id=6, length=220 User-Name = "example.com" User-Password = "cisco" Calling-Station-Id = "GigabitEthernet 14/0/3.31010096:3101-96#587204450###pppoe 00:04:ed:d1:78:85#QTNITE4025M atm 1/1/04/27:8.35#" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 501 NAS-Port-Id = "Uniq-Sess-ID501" Service-Type = Outbound-User NAS-IP-Address = 10.8.13.254 Fri Jun 14 11:44:23 2013 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri Jun 14 11:44:23 2013 : Info: +- entering group authorize {...} Fri Jun 14 11:44:23 2013 : Info: ++[preprocess] returns ok Fri Jun 14 11:44:23 2013 : Info: ++[chap] returns noop Fri Jun 14 11:44:23 2013 : Info: ++[mschap] returns noop Fri Jun 14 11:44:23 2013 : Info: ++[digest] returns noop Fri Jun 14 11:44:23 2013 : Info: [suffix] No '@' in User-Name = "example.com", looking up realm NULL Fri Jun 14 11:44:23 2013 : Info: [suffix] No such realm "NULL" Fri Jun 14 11:44:23 2013 : Info: ++[suffix] returns noop Fri Jun 14 11:44:23 2013 : Info: [eap] No EAP-Message, not doing EAP Fri Jun 14 11:44:23 2013 : Info: ++[eap] returns noop Fri Jun 14 11:44:23 2013 : Info: [files] users: Matched entry DEFAULT at line 204 Fri Jun 14 11:44:23 2013 : Info: ++[files] returns ok Fri Jun 14 11:44:23 2013 : Info: [sql] expand: %{Stripped-User-Name} -> Fri Jun 14 11:44:23 2013 : Info: [sql] ... expanding second conditional Fri Jun 14 11:44:23 2013 : Info: [sql] expand: %{User-Name} -> example.com Fri Jun 14 11:44:23 2013 : Info: [sql] expand: %{%{User-Name}:-DEFAULT} -> example.com Fri Jun 14 11:44:23 2013 : Info: [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> example.com Fri Jun 14 11:44:23 2013 : Info: [sql] sql_set_user escaped user --> ' example.com' Fri Jun 14 11:44:23 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Fri Jun 14 11:44:23 2013 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'example.com' ORDER BY id Fri Jun 14 11:44:23 2013 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'example.com' ORDER BY priority Fri Jun 14 11:44:23 2013 : Debug: rlm_sql (sql): Released sql socket id: 3 Fri Jun 14 11:44:23 2013 : Info: [sql] User example.com not found Fri Jun 14 11:44:23 2013 : Info: ++[sql] returns notfound Fri Jun 14 11:44:23 2013 : Info: ++[expiration] returns noop Fri Jun 14 11:44:23 2013 : Info: ++[logintime] returns noop Fri Jun 14 11:44:23 2013 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Fri Jun 14 11:44:23 2013 : Info: ++[pap] returns noop Fri Jun 14 11:44:23 2013 : Info: Found Auth-Type = Local Fri Jun 14 11:44:23 2013 : Info: WARNING: Please update your configuration, and remove 'Auth-Type = Local' Fri Jun 14 11:44:23 2013 : Info: WARNING: Use the PAP or CHAP modules instead. Fri Jun 14 11:44:23 2013 : Info: No "known good" password was configured for the user. Fri Jun 14 11:44:23 2013 : Info: As a result, we cannot authenticate the user. Fri Jun 14 11:44:23 2013 : Info: Failed to authenticate the user. Fri Jun 14 11:44:23 2013 : Info: Using Post-Auth-Type Reject Fri Jun 14 11:44:23 2013 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri Jun 14 11:44:23 2013 : Info: +- entering group REJECT {...} Fri Jun 14 11:44:23 2013 : Info: [attr_filter.access_reject] expand: %{User-Name} -> example.com Fri Jun 14 11:44:23 2013 : Debug: attr_filter: Matched entry DEFAULT at line 11 Fri Jun 14 11:44:23 2013 : Info: ++[attr_filter.access_reject] returns updated Fri Jun 14 11:44:23 2013 : Info: Delaying reject of request 21 for 1 seconds Fri Jun 14 11:44:23 2013 : Debug: Going to the next request Fri Jun 14 11:44:23 2013 : Debug: Waking up in 0.9 seconds. Fri Jun 14 11:44:24 2013 : Info: Sending delayed reject for request 21 Sending Access-Reject of id 6 to 10.8.13.254 port 1645 Fri Jun 14 11:44:24 2013 : Debug: Waking up in 4.9 seconds. Fri Jun 14 11:44:29 2013 : Info: Cleaning up request 21 ID 6 with timestamp +743 Fri Jun 14 11:44:29 2013 : Info: Ready to process requests. Where is this coming from, why does the customer initially connect and then disconnect ? Any assistance would be greatly appreciated thanks.

3 3

Mysql xlat help
by Go WiFi 14 Jun '13

14 Jun '13

Hello i am getting an issue with xlat i tried this sql sql2 { } sql sql_gowifi{ sql_user_name = "%{sql2:select s.* from (select @user<https://github.com/user>:=BINARY '%{User-Name}' p) parm , upm s}" } and using sql_gowifi in sites-enabled/default for mysql based login and accounting again when using sql_user_name = "%{User-Name}" it saves the username entered in login page of hotspot to radpostauth table but with the code above the username remains blank when i run the sql query above in mysql server it returns the correct username please help

4 10

RE: Exec problems in FR3.0
by Franks Andy (RLZ) IT Systems Engineer 14 Jun '13

14 Jun '13

Thanks Arran, If you get a chance, don't suppose you'd be able to check out the : - freetds error I got with unixodbc (get_vtable or something) in v3 Or the lack of makefile.in / configure.in in the rlm_sql_sybase module in v2 (got lots of v2 radius servers and don't want to move them all to 3 just yet) Or the current v2 unixodbc truncation problem. OR none of the above because I'm completely pushing my luck and breaking all the rules? :-) One day I'll teach myself C and get stuck into all this. One day.. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 14 June 2013 12:15 To: FreeRadius users mailing list Subject: Re: Exec problems in FR3.0 On 14 Jun 2013, at 10:09, Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> wrote: > Thanks Phil, I need to get my head around the coding side of this a bit > more! I'll look at this seeing as I broke it. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1