November 2014 - Freeradius-Users - lists.freeradius.org

unlang vs suffix
by Rui Ribeiro 07 Nov '14

07 Nov '14

Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro

7 8

Multi-tenancy setup
by Ilavajuthy Palanisamy 06 Nov '14

06 Nov '14

Hi All, We are hosting an application in the cloud which is managing multiple customers. Customers will be authenticated using the FreeRadius server. We are planning to use the user authentication through the database(PostgreSQL). I have configured the radcheck table and able to make the user authentication successfully. In order to support multiple customers, what are all the options/design available in FreeRadius. One option we are thinking is to modify the schema to introduce customer-id and modify the sql module to support the new schema. If this is possible, please provide pointers in achieving this. If there are other options available, please provide pointers. Thanks, Ila.

5 7

EAP-TLS not initializing
by Ben Tucker 06 Nov '14

06 Nov '14

Not a very affluent Linux user here but this issue is beyond me. I think its something simple to solve but can't figure it out for the life of me. When running radius in debug mode it is giving me a permission denied message when trying to load the certificates. The certs are there in the correct directory. What else am I missing here? [root@lasamiq3 raddb]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1940] Unknown module "eap". radiusd.conf[1887] Failed to parse authenticate section. [root@lasamiq3 raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib64 Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/radius-priv-key.pem" tls: certificate_file = "/etc/raddb/certs/radius-priv-cert.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "mercury" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1940] Unknown module "eap". radiusd.conf[1887] Failed to parse authenticate section. [root@lasamiq3 raddb]# [root@lasamiq3 raddb]# [root@lasamiq3 raddb]# [root@lasamiq3 raddb]# dir -l certs total 64 -rw-r--rwx 1 root radiusd 721 Dec 4 2009 cert-clt.der -rw-r--rwx 1 root radiusd 1741 Dec 4 2009 cert-clt.p12 -rw-r--rwx 1 root radiusd 2452 Dec 4 2009 cert-clt.pem -rw-r--rwx 1 root radiusd 717 Dec 4 2009 cert-srv.der -rw-r--rwx 1 root radiusd 1733 Dec 4 2009 cert-srv.p12 -rw-r--rwx 1 root radiusd 2439 Dec 4 2009 cert-srv.pem drw-r--rwx 2 root radiusd 4096 Nov 4 23:07 demoCA -rw-r--rwx 1 root radiusd 0 Dec 4 2009 dh -rw-r--rwx 1 root radiusd 2913 Dec 4 2009 newcert.pem -rw-r--rwx 1 root radiusd 1753 Dec 4 2009 newreq.pem -rwxr-xr-x 1 root root 3016 Nov 5 18:50 radius-srv-pri-cert.pem -rwxr-xr-x 1 root root 1606 Nov 5 16:59 radius-srv-pri-key.pem -rw-r--rwx 1 root radiusd 1024 Dec 4 2009 random -rw-r--rwx 1 root radiusd 431 Dec 4 2009 README -rw-r--rwx 1 root radiusd 954 Dec 4 2009 root.der -rw-r--rwx 1 root radiusd 1973 Dec 4 2009 root.p12 -rw-r--rwx 1 root radiusd 2764 Dec 4 2009 root.pem [root@lasamiq3 raddb]# dir -l certs/demoCA total 20 -rwxr-xr-x 1 root radiusd 1074 Nov 5 18:48 cacert.pem -rw-r--rwx 1 root radiusd 276 Dec 4 2009 index.txt -rw-r--rwx 1 root radiusd 140 Dec 4 2009 index.txt.old -rw-r--rwx 1 root radiusd 3 Dec 4 2009 serial -rw-r--rwx 1 root radiusd 3 Dec 4 2009 serial.old [root@lasamiq3 raddb]#

4 12

Blank value of temporary variable in Unlang
by Mrinal K 06 Nov '14

06 Nov '14

I am implementing a setup where we return expiry date value as per a user's settings. For this I have added a column in radcheck table called ExpiryDate. I have added following in authorize section in sites-available/defaults update control{ My-Local-Int-1 := "%{sql: select id from radcheck where username='%{User-Name}' order by id desc limit 1}" } update reply{ WISPr-Session-Terminate-Time = "%{sql: select ExpiryDate from radcheck where id = '%{My-Local-Int-1}'}" } The username I am testing with has ExpiryDate value in radcheck table, however mysql query log shows me blank value for '%{My-Local-Int-1}' for query in update reply {.. } section. Please suggest what I am doing wrong. My-Local-Int-1 has been defined in dictionary as integer.

4 6

Multivalued attribute[*] comparisons
by Arran Cudbard-Bell 06 Nov '14

06 Nov '14

Master branch which will become 3.1 now supports multivalued conditions. If an attribute with the '*' index is used in a condition, all values of that attribute will be evaluated against the other operand. If one set of values evaluates to true, no further values are checked and the condition returns true. update request { Tmp-String-0 := 'foo' Tmp-String-0 += 'bar' Tmp-String-0 += 'baz' Tmp-String-1 := 'aaa' Tmp-String-1 += 'bbb' Tmp-String-1 += 'ccc' Tmp-String-1 += 'bar' } # # Yes this is O(N^2) - worse case here is 12 comparisons # if (&Tmp-String-0[*] == &Tmp-String-1[*]) -> TRUE if (&Tmp-String-1[*] =~ /cc$/) -> TRUE If used with capture groups, contents will be from the first value that matched. if (&Tmp-String-1 == 'bar') -> FALSE if (&Tmp-String-1[*] == 'bar') -> TRUE In theory this will allow update request { Admin-Groups := 'admins' Admin-Groups += 'net-admins' Admin-Groups += 'Administrators' } if (LDAP-Group == &Admin-Groups[*]) But I believe the parser's condition rules will currently prevent that (will be fixed before 3.1 is released). It also works for integers: update request { Tmp-Integer-0 := 5 Tmp-Integer-0 += 10 Tmp-Integer-0 += 15 } if (Tmp-Integer-0[*] > 15) -> FALSE if (Tmp-Integer-0[*] < 5) -> FALSE if (Tmp-Integer-0[*] < 10) -> TRUE The evaluation code also avoids many of the temporary mallocs that it previously did, as the cast and comparison functions have been updated to work with value data, as well as value pairs. The main use case for this feature is checking multiple group or authorizational attributes for a value. It also works with tag qualifiers. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

RE: Multivalued attribute[*] comparisons
by Franks Andy (RLZ) IT Systems Engineer 06 Nov '14

06 Nov '14

This is great news for us, will make condition checking much more straightforward. Thanks Arran! .. now waiting for multiple SQL attributes from a single xlat.. :-) :-) :-) -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 05 November 2014 22:59 To: FreeRadius users mailing list Subject: Multivalued attribute[*] comparisons Master branch which will become 3.1 now supports multivalued conditions. If an attribute with the '*' index is used in a condition, all values of that attribute will be evaluated against the other operand. If one set of values evaluates to true, no further values are checked and the condition returns true. update request { Tmp-String-0 := 'foo' Tmp-String-0 += 'bar' Tmp-String-0 += 'baz' Tmp-String-1 := 'aaa' Tmp-String-1 += 'bbb' Tmp-String-1 += 'ccc' Tmp-String-1 += 'bar' } # # Yes this is O(N^2) - worse case here is 12 comparisons # if (&Tmp-String-0[*] == &Tmp-String-1[*]) -> TRUE if (&Tmp-String-1[*] =~ /cc$/) -> TRUE If used with capture groups, contents will be from the first value that matched. if (&Tmp-String-1 == 'bar') -> FALSE if (&Tmp-String-1[*] == 'bar') -> TRUE In theory this will allow update request { Admin-Groups := 'admins' Admin-Groups += 'net-admins' Admin-Groups += 'Administrators' } if (LDAP-Group == &Admin-Groups[*]) But I believe the parser's condition rules will currently prevent that (will be fixed before 3.1 is released). It also works for integers: update request { Tmp-Integer-0 := 5 Tmp-Integer-0 += 10 Tmp-Integer-0 += 15 } if (Tmp-Integer-0[*] > 15) -> FALSE if (Tmp-Integer-0[*] < 5) -> FALSE if (Tmp-Integer-0[*] < 10) -> TRUE The evaluation code also avoids many of the temporary mallocs that it previously did, as the cast and comparison functions have been updated to work with value data, as well as value pairs. The main use case for this feature is checking multiple group or authorizational attributes for a value. It also works with tag qualifiers. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Objections to releasing version 2.2.6?
by Alan DeKok 05 Nov '14

05 Nov '14

The zip file can be downloaded from github: https://github.com/FreeRADIUS/freeradius-server/archive/v2.x.x.zip I'm inclined to avoid making a release candidate. There has been very little changed from 2.2.5. About the only change I think could be added is to allow TLS 1.1 and TLS 1.2. Right now they're forbidden. Alan DeKok.

5 11

Subdomain proxy Local
by Rando Nakarmi 05 Nov '14

05 Nov '14

I have regex in my /etc/raddb/site-enabled/default authorize section as : if (User-Name =~ /^([^@]*)@([-A-Z0-9]+(\\.[-A-Z0-9]+)+)$/i) { # user has a valid-looking realm update request { Stripped-User-Name := "%{1}" #Realm = "%{tolower:%{2}}" Realm = "%{toupper:%{2}}" #Realm = "%{2}" } } else { # malformed NAI update reply { Reply-Message := "malformed username " } reject } if (Realm == example.com) { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := DEFAULT } } This is working well, with example.com. but when user sends user(a)a.example.com then it sends to DEFAULT which send to UPstream radius server. So, what shall I do a.example.com, b.example.com (valid sub-domain) not to send upstream server ? I tried enabling in proxy.conf realm "~(.*\\.)*example\\.com$" { } no luck. any hint or point on this ?

2 1

ldap checkitem
by Nicolas Edel 05 Nov '14

05 Nov '14

Hi list, I am working on upgrading my server using freeradius 2 to freeradius 3. The setup I am using makes use of an LDAP server to store users conf, and for some of them I'd like to use ldap authorization *and* authentication. That was done by both using an ldap.attrmap file on the radius side and setting the radiusAuthType parameter to LDAP into the directory. Now with freeradius 3, although the doc still refers to the dictionary_mapping parameter to load the ldap.attrmap file, it looks the latter is no longer loaded and the server complains the Auth-Type is not set (unless I force it in the autorize section). How is this supposed to work know ? Thanks, :Nicolas

4 7

New features in 3.0.5
by Alan DeKok 05 Nov '14

05 Nov '14

We've been busy. :) One minor but nice feature is that the debug messages are now indented, based on syntax. e.g. previously, for a nested "if" statement, we had: ... if .. if we now have: if (...) if (...) which is a bit easier to read. For people doing CoA, the "session-state" functionality has now been added to the "originate-coa" functionality. This lets you re-authorize a user, without checking passwords. See the following link for details: https://tools.ietf.org/html/rfc5176#section-3.2 When originating a CoA packet, you can do: update session-state { ... attributes ... } When the NAS sends an Access-Request, you can check it: if (Service-Type && (Service-Type == Authorize-Only)) { if (!session-state) { reject } ... re-authorize the user ... he's already authenticated! } That re-authorization was pretty much impossible before. It's now trivial. Alan DeKok.

2 2