October 2014 - Freeradius-Users - lists.freeradius.org

is it possible to setup multiple user definitions with different privileges when using an ldap backend?
by Les Stott 09 Oct '14

09 Oct '14

Hi, I have freeradius 2.1.12 of rhel6 which uses freeipa as an ldap backend. All is working fine. The config I have setup is as follows: Ldap group sys_admins = contains users who get privileges to authenticate and login radius based devices (cisco routers/switches, ucs, f5, brocade). Radius config for ldap module checks group sys_admins for membership. (/etc/raddb/modules/ldap) groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn})))" groupmembership_attribute = sys_admins In /etc/raddb/users I have... DEFAULT Ldap-Group == "cn=sys_admins,cn=groups,cn=accounts,dc=mydomain,dc=com" Auth-Type :=Accept, Service-Type = "NAS-Prompt-User", Cisco-AVPair = "shell:roles*\"admin network-admin vdc-admin\"", Cisco-AVPair += "shell:priv-lvl=15", Fall-Through = No, F5-LTM-User-Role = 0, F5-LTM-User-Info-1 = administrator, F5-LTM-User-Partition = common, F5-LTM-User-Shell = tmsh, Brocade-Auth-Role+= "admin", Brocade-AVPairs1+= "HomeLF=0", Brocade-AVPairs2+= "LFRoleList=admin:0-255", Brocade-AVPairs3+= "ChassisRole=admin" DEFAULT Auth-Type := Reject Reply-Message="You do not have permission to access this device.", Fall-Through = Yes This is all working fine. My problem is that I need to have a user setup in ldap for monitoring purposes (using icinga), which should be a read only based user for the ucs and not have access to the brocade, f5 or other cisco devices. I've tried a lot of different configs and nothing has worked. Adding a specific user definition to /etc/raddb/users with appropriate privilege levels doesn't help as it seems to still require that the user belong to the ldap group sys_admins, which means they get access to all devices. Does anyone know of a way to have multiple user definitions in /etc/raddb/users with ldap backends with differing privilege levels? Could the ldap module be duplicated like the files module which allows a second users file? Is it even possible? Any alternatives? Thanks, Les

1 0

How to get a reply on this list?
by Uzee 09 Oct '14

09 Oct '14

Hi, I don't know what other info to provide but somewhat surprised that I didn't get any response. I think this is the active list for freeradius and I also subscribed to it. I see my post in the list archives but not sure if it went to all the members (it should have) Could someone please let me know if I need to provide any thing else? or any other suggestion... Here's my original post: http://lists.freeradius.org/pipermail/freeradius-users/2014-September/07381… thanks

1 0

radiusclient
by Sushna C 09 Oct '14

09 Oct '14

hi, I am new in freeradius.. can anyone please tell me about radiusclient configurations and the command line options for running radiusclient.... is there any detailed documentation for radiusclient...? please help me.... thank you..!

1 0

strange regex question
by Xin 09 Oct '14

09 Oct '14

Hi Alan Dekok, I'm looking your reply on: http://lists.freeradius.org/pipermail/freeradius-users/2008-April/027737.htm l And I found you give an example as the following below: > e.g. for : DOMAIN\randy.hall > > if (User-Name =~ /^DOMAIN\\(.*)/) { > update request { > Stripped-User-Name := "%{1}" > } > } But it fails in my case: rad_recv: Access-Request packet from host my_ip port 56949, id=250, le ngth=175 User-Name = "Windows Phone\\test" NAS-Port-Type = Virtual .... # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/defau lt +group authorize { ++? if (User-Name =~ /Windows Phone\\(.*)/) ? Evaluating (User-Name =~ /Windows Phone\\(.*)/) -> FALSE ++? if (User-Name =~ /Windows Phone\\(.*)/) -> FALSE I really don't know why it fails. I have tested my case in RegexBuddy, and it worked in POSIX ERE, but POSIX BRE failed. My FreeRadius version is 2.2.5. Appreciate for your help.

3 4

read_group=yes but radgroupreply doesn't work
by Zulzig 08 Oct '14

08 Oct '14

Hello, I use free radius version 2.1.12 for red hat. I set up it with mysql. In the sql.conf file, i have the read_groups settings to yes, i send you the debug from my server in my sql radgroupreply i have: mysql> select * from radgroupreply; +----+---------------------+-------------------------+----+---------------------------------------------------------------------------------------------------------------+ | id | groupname | attribute | op | value | +----+---------------------+-------------------------+----+---------------------------------------------------------------------------------------------------------------+ | 1 | XXXX-VLAN-REGIST | Tunnel-type | = | 13 | | 2 | XXXX-VLAN-REGIST | Tunnel-Medium-Type | = | 6 | | 3 | XXXX-VLAN-REGIST | Tunnel-Private-Group-ID | = | XXX | | 4 | XXXX-VLAN-REGIST | Reply-Message | = | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxXXX XXXX | | 5 | XXXX-VLAN-ISOLATION | Tunnel-type | = | 13 | | 6 | XXXX-VLAN-ISOLATION | Tunnel-Medium-Type | = | 6 | | 7 | XXXX-VLAN-ISOLATION | Tunnel-Private-Group-ID | = | XXX | | 8 | XXXX-VLAN-ISOLATION | Reply-Message | = | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxxxxXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxxxxxxxxx | | 9 | XXXX-VLAN-GUEST | Reply-Message | = | XXxxxXXXXXxxxXXXXXXxxxxxxxxxxxxxXXXXXXXXXX | +----+---------------------+-------------------------+----+---------------------------------------------------------------------------------------------------------------+ 9 rows in set (0.00 sec) mysql> select * from radusergroup; +----------------------------------+------------------+----------+ | username | groupname | priority | +----------------------------------+------------------+----------+ | host/XXXXXXXXXX.XXXXXXXXXXXXXXXX | XXXX-VLAN-REGIST | 1 | | host/XXX-XXX-test | XXXX-VLAN-REGIST | 1 | +----------------------------------+------------------+----------+ mysql> select * from radgroupcheck; +----+---------------------+-----------+----+--------+ | id | groupname | attribute | op | value | +----+---------------------+-----------+----+--------+ | 1 | XXXX-VLAN-REGIST | Auth-Type | := | EAP | | 2 | XXXX-VLAN-ISOLATION | Auth-Type | := | EAP | | 3 | XXXX-VLAN-GUEST | Auth-Type | := | reject | +----+---------------------+-----------+----+--------+ 3 rows in set (0.00 sec) Thank a lot for your help and support.

3 2

encoding of ADSL-Agent-Circuit-Id
by Pshem Kowalczyk 08 Oct '14

08 Oct '14

Hi, I've noticed that encoding of these two attributes: ADSL-Agent-Circuit-Id ADSL-Agent-Remote-Id has been changed from string to octets (from 3.0.3 to 3.0.4), when the RFC (4679) states them as strings: Vendor-Type 1 for Agent-Circuit-Id Vendor-Length <= 65 String and Vendor-Type 2 for Agent-Remote-Id Vendor-Length <= 65 String What was the reason for the change? kind regards Pshem

3 4

Git-v3.0.x FreeRADIUS assertion fails with proxy listener
by Julius Plenz 08 Oct '14

08 Oct '14

Hi, I have a section like this in my FreeRADIUS config: listen { type = "proxy" ipaddr = ... port = ... } But the server startup aborts due to a failed assertion: Listening on proxy address ... port ... ASSERT FAILED src/main/process.c[4355]: sock->home != NULL CAUGHT SIGNAL: Aborted Backtrace of last 9 frames: /server/devel/server/lib/libfreeradius-radius.so(fr_fault+0x11c)[0x7f08d91fb287] /server/devel/server/lib/libfreeradius-server.so(rad_assert_fail+0x53)[0x7f08d944e108] bin/radiusd[0x43f088] bin/radiusd(radius_update_listener+0x21)[0x43532f] bin/radiusd(listen_init+0x936)[0x41f339] bin/radiusd(radius_event_start+0x4db)[0x440092] bin/radiusd(main+0x992)[0x42c35a] /lib/libc.so.6(__libc_start_main+0xfd)[0x7f08d75e7cad] bin/radiusd[0x40e4e9] It seems that proxy_new_listener() is not being used in common_socket_parse(), and thus the rad_listen_t's ->data->home field is zero. I'm not sure what the correct fix is, though. Removing the assertion in question, the server starts just fine. I haven't tested proxying, though. Any help is appreciated, Julius P.S. I'm using the current Git v3.0.x branch, f31d0371f8fe.

2 2

encrypt_key = no in FreeRADIUS snake oil certs
by Stefan Paetow 08 Oct '14

08 Oct '14

Hi, Question to you FR gents (Arran and Alan)... would you object if we popped in a request to set encrypt_key = no in the three CNF files? If there are objections... any reason why? :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net Janet, the UK’s research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

3 3

ArcSight
by Shawn Wiley 08 Oct '14

08 Oct '14

Hello all. Has anyone connected FreeRADIUS to an HP ArcSight SEIM? I found a regex flex connector but I have no idea if it works or how it should be installed. If anyone has fed FreeRADIUS into ArcSight I would greatly appreciate any guidance you can give me. Thanks, Shawn Shawn L. Wiley, CISSP - Information and Application Security Architecture ________________________________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), Euronext or any of their subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired. ________________________________________________________

1 0

Calling eap_md5 to process EAP data in inner-tunnel
by Oleksandr Yermolenko 08 Oct '14

08 Oct '14

Hello, everyone, Environment: freeradius 3.0.4, strongswan 5.2.0. Could someone give me advices or info why it happened? stages how eap-md5 should work in innner-tunnel? I saw http://wiki.freeradius.org/guide/EAPMD5-HOWTO but it's not enough in my scenario. ..... begin cut .... (5) # Executing group from file /etc/raddb/sites-enabled/default (5) authenticate { (5) eap : Expiring EAP session with state 0xea78d7a3ea79d3c6 (5) eap : Finished EAP session with state 0x9da50fdc99a01a4f (5) eap : Previous EAP request found for state 0x9da50fdc99a01a4f, released from the list (5) eap : Peer sent method TTLS (21) (5) eap : EAP TTLS (21) (5) eap : Calling eap_ttls to process EAP data (5) eap_ttls : Authenticate (5) eap_ttls : processing EAP-TLS TLS Length 69 (5) eap_ttls : Length Included (5) eap_ttls : eaptls_verify returned 11 (5) eap_ttls : eaptls_process returned 7 (5) eap_ttls : Session established. Proceeding to decode tunneled attributes (5) eap_ttls : Got tunneled request EAP-Message = 0x020100160410521e6638c06be72697c7697d1a2289b9 (5) eap_ttls : Sending tunneled request (5) server inner-tunnel { (5) Request: EAP-Message = 0x020100160410521e6638c06be72697c7697d1a2289b9 User-Name = 'stu(a)sumix.com' State = 0xea78d7a3ea79d3c6e940fe67ef2f7464 (5) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (5) authorize { (5) [preprocess] = ok (5) [files] = noop (5) eap : Peer sent code Response (2) ID 1 length 22 (5) eap : No EAP Start, assuming it's an on-going EAP conversation (5) [eap] = updated (5) } # authorize = updated (5) Found Auth-Type = EAP (5) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (5) authenticate { (5) eap : Expiring EAP session with state 0xea78d7a3ea79d3c6 (5) eap : Finished EAP session with state 0xea78d7a3ea79d3c6 (5) eap : Previous EAP request found for state 0xea78d7a3ea79d3c6, released from the list (5) eap : Peer sent method MD5 (4) (5) eap : EAP MD5 (4) (5) eap : Calling eap_md5 to process EAP data (5) eap_md5 : Cleartext-Password is required for EAP-MD5 authentication (5) ERROR: eap : Failed continuing EAP MD5 (4) session. EAP sub-module failed (5) eap : Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Login incorrect (eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed): [stu(a)sumix.com/<via Auth-Type = EAP>] (from client aae-vm port 0 via TLS tunnel) (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject : EXPAND %{User-Name} (5) attr_filter.access_reject : --> stu(a)sumix.com (5) attr_filter.access_reject : Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) } # Post-Auth-Type REJECT = updated (5) Reply: EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 (5) } # server inner-tunnel (5) eap_ttls : Got tunneled Access-Reject SSL: Removing session adf6f0ff78ebe6faaa6f3949f499535dc8a21dfc72a066a288b3e0e0bfbc9339 from the cache (5) ERROR: eap : Failed continuing EAP TTLS (21) session. EAP sub-module failed (5) eap : Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Login incorrect (eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed): [stu(a)sumix.com/<via Auth-Type = EAP>] (from client aae-vm port 68 cli 10.20.9.8[4500]) (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject : EXPAND %{User-Name} (5) attr_filter.access_reject : --> stu(a)sumix.com (5) attr_filter.access_reject : Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) eap : Reply already contained an EAP-Message, not inserting EAP-Failure (5) [eap] = noop (5) remove_reply_message_if_eap remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else else { (5) [noop] = noop (5) } # else else = noop (5) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1 seconds ..... users file stu Cleartext-Password := "x3DdEhgN" stu(a)sumix.com Cleartext-Password := "x3DdEhgN" big thanks for your help and advices. Oleksandr

7 14