November 2014 - Freeradius-Users - lists.freeradius.org

Keeping NAS and RADIUS in sync
by Vegard Svanberg 11 Nov '14

11 Nov '14

Hi, I have a few NAS servers (Mikrotik, PPPoE) using FreeRADIUS. >From time to time, maintenance, faults etc cause certain kinds of disruptions to the network which causes users to be disconnected from a NAS. However, the NAS sometimes also loses access to the RADIUS server, so the stop accounting packet will never get through. This causes various problems for some tools we use. These tools work on the RADIUS SQL database and require the data to be accurate. Is there a recommended way of solving such cases? Thanks in advance. -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

2 1

RE: freeradius 3.0.4 --- unlang --- unknown module
by Bilik.AA＠lsrgroup.ru 11 Nov '14

11 Nov '14

>Do you have the SQL module enabled? > >Look in /etc/raddb/mods-enabled. If 'sql' is not listed, enable it like this: > >cd /etc/raddb/mods-enabled >ln -s ../mods-available/sql > >Then retry. :-) > >Stefan Paetow >Moonshot Industry & Research Liaison Coordinator Stefan thanks a lot! Now it works! Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru www.lsrgroup.ru

1 0

freeradius 3.0.4 --- unlang --- unknown module
by Bilik.AA＠lsrgroup.ru 11 Nov '14

11 Nov '14

Hello everybody! I use unlang incut in „default“ configfile in „post-auth“ subsection and it works fine on 2.1.12 version (FreeBSD 8.3-RELEASE): ------------------------------------------------------------------------------------------------------------- if ("%{sql: SELECT vlan FROM radcheck WHERE username = '%{User-Name}'}" == "voice") { update reply { Cisco-AVPair = "device-traffic-class=voice" } } else { update reply { Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-ID = "%{sql: SELECT vlan FROM radcheck WHERE username = '%{User-Name}'}" } } ------------------------------------------------------------------------------------------------------------- But on 3.0.4 version (FreeBSD 8.4-RELEASE) in doesn’t work. When I execute „radiusd -X“ such lines appear in debug output: /usr/local/etc/raddb/sites-enabled/default[665]: Failed parsing expanded string: /usr/local/etc/raddb/sites-enabled/default[665]: %{sql: SELECT vlan FROM radcheck WHERE username = '%{User-Name}'} /usr/local/etc/raddb/sites-enabled/default[665]: ^ Unknown module How could I manage this issue? Thank you. С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image002.png@01CFFD98.D0D378D0]

2 1

Fwd: Problems updating freeradius on RHEL6
by Tijmen van den Brink 11 Nov '14

11 Nov '14

Dear all, I just tried updating my RHEL6 server with "yum update" and got the following error: --> Finished Dependency Resolution Error: Package: freeradius-ldap-2.1.12-4.el6_3.x86_64 (@rhel-6-server-optional-rpms) Requires: freeradius = 2.1.12-4.el6_3 Removing: freeradius-2.1.12-4.el6_3.x86_64 (@rhel-6-server-rpms) freeradius = 2.1.12-4.el6_3 Updated By: freeradius-2.1.12-6.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.12-6.el6 Available: freeradius-2.1.9-3.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.9-3.el6 Available: freeradius-2.1.10-5.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.10-5.el6 Available: freeradius-2.1.12-3.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.12-3.el6 Error: Package: freeradius-utils-2.1.12-4.el6_3.x86_64 (@rhel-6-server-optional-rpms) Requires: freeradius = 2.1.12-4.el6_3 Removing: freeradius-2.1.12-4.el6_3.x86_64 (@rhel-6-server-rpms) freeradius = 2.1.12-4.el6_3 Updated By: freeradius-2.1.12-6.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.12-6.el6 Available: freeradius-2.1.9-3.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.9-3.el6 Available: freeradius-2.1.10-5.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.10-5.el6 Available: freeradius-2.1.12-3.el6.x86_64 (rhel-6-server-eus-rpms) freeradius = 2.1.12-3.el6 You could try using --skip-broken to work around the problem You could try running: rpm -Va --nofiles --nodigest It looks like the ldap and utils package require the 32bit version. Am I doing something wrong? Any ideas how to fix this? Thanks for your help. Kind regards, Tijmen

3 4

Preserve ldap attributes after proxy
by Tamás Becz 11 Nov '14

11 Nov '14

Hi everyone, I'm trying to wrap my head around this, digging in the archives and the wiki with no luck, so I'm looking for a few pointers. We are currently using freeradius to to proxy requests to a central One-Time-password server (which is outside our control). This is purely authentication, we send the cleartext token we received from the NAS, they check and either reject or reply. (The only reason we do this is because the upstream organization is not willing to deal with the administration of the NASes and we've been asked to aggregate traffic) Now with a new solution I also need to query a central ldap database for authorization info: I need to get a given attribute off of user records and present them to the NAS. I was pointing my finger at Filter-Id, but purely because the NAS docs points at it, it could really be anything. If I omit the proxy part, then it's just a straightforward ldap config with adding the attribute as a reply Item mapped to Filter-ID in the ldap.attrmap with +=, getting rid of reading the userPassword so that no one tries to auth against the password there and enable ldap in the authorize section. However, when I then proxy the request these extra Filter-Ids are lost: they are neither proxied (which is just as well, I really don't know what would the homeserver do about it) nor are they sent in my reply. I've found traces of something like this being discussed that this is because there is a separate data structure, but that is over a decade old, and I'm a bit confused on how this supposed to work. Is there a way to keep does attributes (or to get them after proxying, either in post-proxy or post-auth maybe?) by using rlm_ldap? I could probably write a short perl that queries this directly in post-auth, but basically the reason I want to do this in radius instead of the NAS is because I would need a mild hack on my networking to allow it to directly reach the ldap, so I though that, the radius box can reach the ldap, it can talk ldap, the nas is connected anyway.. But if it's troublesome with radius, then I'd rather not hack it. Does anyone have a pointer on what track should I go down? Thanks! tamas

3 9

statistics with radsniff and collectd
by Louis Munro 10 Nov '14

10 Nov '14

Hello, I am trying to integrate radsniff with collectd as described on the wiki : http://wiki.freeradius.org/guide/stats-with-radsniff#collectd I have compiled radsniff 3 statically (it is to be used on a 2.2.5 server) and it seems to be working fine as long as I don't try to write to the collectd socket. When I do however I get these errors back from collectd: radsniff: Failed PUTVAL "pf-auth1-ddc.net.utah.edu/radsniff-exchanged/radius_count-coa_nak" interval=10 1415655243 : Server error: Type `radius_count' isn't defined. radsniff: Failed PUTVAL "pf-auth1-ddc.net.utah.edu/radsniff-exchanged/radius_latency-coa_nak" interval=10 1415655243 : Server error: Type `radius_latency' isn't defined. radsniff: Failed PUTVAL "pf-auth1-ddc.net.utah.edu/radsniff-exchanged/radius_rtx-coa_nak" interval=10 1415655243 : Server error: Type `radius_rtx' isn't defined. So it looks like I need to define the types for the radius statistics in collectd's Types.db. Has anyone got this working? The question is rhetorical as I assume that the wiki's author (at least) got it to work but I don't seem to have the relevant definitions with my version of collectd (5.4.1). Would anyone care to share their type definitions? I would be much obliged. Regards, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 2

FR 3.0.5 Expected Debug
by Patrick Gawthorne 10 Nov '14

10 Nov '14

Hi All, First time using FR 3, after configuring to authenticate with AD the debug that gets spat out appears quite long. I am just making sure this is normal, expected behaviour and if not what I have done wrong.. I've attached the radiusd -X output of one client (iPad) connecting. Config items should all be default except things like mods-available/mschap, mods-available/eap, as per http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HO… .. Thanks to anyone willing to help. :) Cheers, Pat This email, together with any attachments, is intended for the named recipient(s) only and may contain privileged and confidential information. If received in error, please inform the sender as quickly as possible and delete this email and any copies from your computer network. If not an intended recipient of this email, you must not copy, distribute or rely on it, and any form of disclosure, modification, distribution and/or publication of this email is prohibited. Unless stated otherwise, this email represents only the views of the sender and not the views of Pacific Lutheran College.

4 4

populate a reply with ldap generic attributes
by Nicolas Edel 10 Nov '14

10 Nov '14

Hi, Using LDAP for both autorization and authentification, I learnt how to populate a reply request with generics in the autorize. Works fine. Now I am wondering if it would be possible to populate the reply with generics using a dn specified in an ldap attribute. The goal of this is to have predefined profiles to specify user rights (such as read-only, operator, admin, etc) specified only once and to refer to them into the user profile. Since these are generic attributes (of type radiusAttribute), I can't see anyway to use xlat for this. I would be pleased if someone could provide me any hint. Thanks. :Nicolas

3 5

Dailycounter not working
by Matej Žerovnik 07 Nov '14

07 Nov '14

Hello! I'm trying to use dailycounter on a LDAP authenticated user and it doesn't seem to work. I think I did all steps correctly, but then again, i have been wrong before:) In radcheck table I added: testuser Max-Daily-Session := 600 I enabled dailycounter in counters.conf: sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(`Acct-Session-Time` - \ GREATEST((%b - UNIX_TIMESTAMP(`Acct-Start-Time`)), 0)) \ FROM accounting WHERE `User-Name` = '%{${key}}' AND \ UNIX_TIMESTAMP(`Acct-Start-Time`) + `Acct-Session-Time` > '%b'" } In sites-available/default I have the following: authorize { if (User-Password) { update control { Auth-Type := ldap Ldap-UserDN := "eduPersonPrincipalName=%{User-Name},dc=example,dc=com" } } sql dailycounter } authenticate { Auth-Type LDAP { ldap } } Debug output: rad_recv: Access-Request packet from host 10.10.10.10 port 33651, id=75, length=202 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:24:D7:47:1C:XX" Called-Station-Id = "hs-kit-testing" NAS-Port-Id = "bridge-bralci" User-Name = "testuser" NAS-Port = 2151677975 Acct-Session-Id = "80400017" Framed-IP-Address = 192.168.81.198 Mikrotik-Host-IP = 192.168.81.198 User-Password = "password" Service-Type = Login-User WISPr-Logoff-URL = "http://192.168.81.1" NAS-Identifier = "kit-testing" NAS-IP-Address = 192.168.1.116 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++? if (User-Password) ? Evaluating (User-Password) -> TRUE ++? if (User-Password) -> TRUE ++- entering if (User-Password) {...} expand: eduPersonPrincipalName=%{User-Name},dc=example,dc=comsi -> eduPersonPrincipalName=testuser,dc=example,dc=com +++[control] returns notfound ++- if (User-Password) returns notfound [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User testuser not found ++[sql] returns notfound *rlm_sqlcounter: Entering module authorize code** **rlm_sqlcounter: Could not find Check item value pair** **++[dailycounter] returns noop* Found Auth-Type = LDAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "testuser" with password "password" [ldap] user DN: eduPersonPrincipalName=testuser,dc=example,dc=com [ldap] (re)connect to ldaps.example.com:636, authentication 1 [ldap] setting TLS mode to 1 [ldap] bind as eduPersonPrincipalName=testuser,dc=example,dc=com/password to ldaps.example.com:636 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user testuser authenticated succesfully ++[ldap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 75 to 10.10.10.10 port 33651 Why doesn't radius find Check item value pair? It does exists in radcheck table... Does it only work for local mysql users? Matej -- --- Matej Zerovnik

2 6

Freeradius V1 and V2
by Service Technique AreA 07 Nov '14

07 Nov '14

Hello, I'm currently using version 1.188.2.3 a hotspot system with a captive portal . I am trying to install a new server with Ubuntu 12.04 LTS. Can I use this version 1.188.2.3 this OS or should I spend the 2.2.5 version? They are the differences between the two versions of Freeradius for Hotspot system? Do you have a detailed tutorial to install and configure freeradius? thank you kind regards

4 3