April 2014 - Freeradius-Users - lists.freeradius.org

Which attribute-name is needed for group-filtering?
by Stefan Kuegler 30 Apr '14

30 Apr '14

Hello all. I have a short question. I want to use multiotp as an authentication-module in freeradius on a debian-wheezy system. multiotp itself works properly. The authentication works as expected. But now the question: I want to filter the different users to groups using the "users"-file of freeradius, for example: DEFAULT Auth-type = multiotp, Group-Name := "allowed-users" Reply-Message = "Your multiotp-account has been enabled." DEFAULT Auth-type = multiotp, Group-Name := "forbidden-users" Reply-Message = "Your multiotp-account has been disabled." We are very free for setting an attribute-name in multiotp - but I don't know, which attribute-name do I have to set. I tested with different attribute names (like "Group-Name" in the example above). But nothing works. I only get the reply-message "Your multiotp-account has been enabled", everytime - even if the user is member of the group "allowed-users" or "forbidden-users". These are the last lines of debug-output. The user is member of the group "forbidden-users": [...] rad_recv: Access-Request packet from host 127.0.0.1 port 46615, id=111, length=77 User-Name = "testuser" User-Password = "1234740472" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0xdff73ff20f7d54045b999eae4cc891be # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 58 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++- entering policy multiotp.authorize {...} +++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> FALSE +++? if (!control:Auth-Type) -> FALSE ++- policy multiotp.authorize returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = multiotp # Executing group from file /etc/freeradius/sites-enabled/default +- entering group multiotp {...} [multiotp] expand: %{User-Name} -> testuser [multiotp] expand: %{User-Password} -> 1234740472 [multiotp] expand: -src=%{Packet-Src-IP-Address} -> -src=127.0.0.1 [multiotp] expand: -chap-challenge=%{CHAP-Challenge} -> -chap-challenge= [multiotp] expand: -chap-password=%{CHAP-Password} -> -chap-password= [multiotp] expand: -ms-chap-challenge=%{MS-CHAP-Challenge} -> -ms-chap-challenge= [multiotp] expand: -ms-chap-response=%{MS-CHAP-Response} -> -ms-chap-response= [multiotp] expand: -ms-chap2-response=%{MS-CHAP2-Response} -> -ms-chap2-response= Exec-Program output: Group-Name = "forbidden-users" Exec-Program-Wait: value-pairs: Group-Name = "forbidden-users" Exec-Program: returned: 0 ++[multiotp] returns ok Login OK: [testuser] (from client localhost port 0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 111 to 127.0.0.1 port 46615 Class = 0x656e61626c6564 Reply-Message = "Your multiotp-account has been enabled." Finished request 0. Going to the next request Waking up in 4.9 seconds. So, I think I am using the wrong attribute-keyword. Can anybody tell me, which keyword do I have to use? Regards, Stefan

2 2

Re: Is LDAP + EAP Possible For Me?
by Ethan Chrisawn 30 Apr '14

30 Apr '14

>Will your LDAP server give FreeRADIUS the cleartext password, or >the NTLM password? I'm using eDirectory, and I do not think my passwords are clear text. Surprisingly, when I put in a ticket asking Novell about it, the engineer seemed to know nothing about configuring eDir for clear text. It looks like my best bet is probably TTLS/PAP. Is there a good guide that you would recommend for getting that set up, or should I just start googling. I really appreciate the pointers, by the way. Ethan Chrisawn Systems Administrator www.ecrs.com echrisawn(a)ecrs.com Phone: 828.265.2907 ext:5018

4 11

Simultaneous user check
by Muhammad Usman 30 Apr '14

30 Apr '14

Hi, I want to enable check that multiple sessions of same users donnot exist at parallel, I have enabled the two simultaneous check queries in dialup.conf. Can some body suggest me what changes are required to bring that configuration in practise, as currently multiple users can login with same credentials, radius is not calling simultaneous check queries while authenticating user. Thanks

3 6

ip address allocated but soon released
by yata 30 Apr '14

30 Apr '14

Hi! I wanna freeradius2 as a dhcp-server When I connect to freeradius-server from laptop (Windows Vista) via ERX310 by using PPPoE Following massages appeared. On the laptop I saw an error message "*Error 734: The PPP link control protocol was terminated."* What's wrong with my configuration? Please suggest to me what information should I provide you. ---------------------------raius.log---------------------------------- Mon Apr 28 01:05:03 2014 : Info: ... adding new socket proxy address * port 36233 Mon Apr 28 01:05:03 2014 : Info: Ready to process requests. Mon Apr 28 01:06:11 2014 : Auth: Login OK: [user(a)mondomaine.fr] (from client GGSN1 port 369098752 cli #ERX-40-b0-7a#E16#0) Mon Apr 28 01:06:11 2014 : Info: Allocated IP: 192.168.0.1 from pool1 (did cli #ERX-40-b0-7a#E16#0 port 369098752 user user(a)mondomaine.fr) Mon Apr 28 01:06:18 2014 : Info: Released IP 192.168.0.1 (did cli #ERX-40-b0-7a#E16#0 user user(a)mondomaine.fr) Mon Apr 28 01:06:22 2014 : Info: Signalled to terminate Mon Apr 28 01:06:22 2014 : Info: Exiting normally. Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 14 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 13 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 12 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 11 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 10 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 9 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 8 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 7 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 6 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 5 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 4 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 3 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 2 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 1 Mon Apr 28 01:06:22 2014 : Info: rlm_sql (sql): Closing sqlsocket 0 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect to userfreeradius@localhost:/freeradius Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #0 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #1 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #2 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #3 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #4 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #5 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #5 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #6 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #6 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #7 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #7 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #8 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #8 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #9 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #9 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #10 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #10 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #11 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #11 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #12 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #12 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #13 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #13 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 Mon Apr 28 01:06:25 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #14 Mon Apr 28 01:06:25 2014 : Info: rlm_sql (sql): Connected new DB handle, #14 Mon Apr 28 01:06:25 2014 : Info: Loaded virtual server <default> Mon Apr 28 01:06:25 2014 : Info: Loaded virtual server inner-tunnel Mon Apr 28 01:06:25 2014 : Info: ... adding new socket proxy address * port 47655 Mon Apr 28 01:06:25 2014 : Info: Ready to process requests. ------------------------------------------ Thanks.

2 5

reject users when not found in directory
by Khapare Joshi 29 Apr '14

29 Apr '14

I tried adding following in sites-enabled/default authorize section to reject the users if notfound in ldap. What is the exact name I should put in the if statement ? ldap #User Bill get punished here if ( reply = notfound){ update reply { Reply-Message = "User doesnot seem to be in the directory please talk to Bill gates" } reject } K

2 1

New in v3
by Alan DeKok 29 Apr '14

29 Apr '14

There have been a lot of changes since v3.0.2 was released. We've done more cleanups, added more tests, better error messages, and fixed a number of minor bugs. We plan on releasing v3.0.3 soon. After that, we'll put the 3.0 series into "maintenance" mode, and start on 3.1. The goal is to get 3.0 stable for long-term support, and to gradually deprecate version 2. There are some major changes we plan on making to the server internals. Those changes will enable us to add more features, and to make FreeRADIUS better. The major change between 3.0.2 and 3.0.3 is a more consistent approach to attribute references. Some parts of the server accepted "User-Name", others "&User-Name", and others disallowed "&User-Name". We've made everything prefer "&User-Name", but also accept "User-Name" for backwards compatibility. The benefit of this approach is that attribute references can be used in more situations than before. We now allow attribute references in statements like foreach, switch, case, etc. They weren't consistently allowed (or used) before. Alan DeKok.

1 0

IEEE 802.1X EAP configuration simple AND secure - https://802.1x-config.org
by Rui Ribeiro 29 Apr '14

29 Apr '14

Hi, Dont get me wrong, I find this a fantastic initiative, however I would like to explain and voice my concern. We in the academic/EDUROAM community have had CAT in the web format for quite a while. The problem is the service provides executables in the form of installers for the Windows plataforms, and even run-time additions to your client/SO software. Nonetheless, this service provided by Dante, and somewhat, that in itself is a seal of guarantee and peace of mind. The interface of this service seems similar, maybe the codebase is the same too. What guarantee I would have on this situation about installing foreign binaries in our workstations? Even if I am not making myself the question, I know for sure, someone will ask me. Regards, Rui Ribeiro http://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > Message: 4 > Date: Tue, 29 Apr 2014 07:04:21 +0200 > From: 1x-config Info <info(a)1x-config.org> > To: freeradius-users(a)lists.freeradius.org > Subject: IEEE 802.1X EAP configuration simple AND secure - > https://802.1x-config.org > Message-ID: <535F32D5.8050208(a)1x-config.org> > Content-Type: text/plain; charset=ISO-8859-15; format=flowed > > Hello list, > > on this list, people somewhat regularly lament that they can't get their > WPA2-Enterprise WiFi RADIUS server setup deployed to clients easily. > > That is understandable. Especially in a BYOD context, getting all of > your users to "do the right thing" usually involves an error-prone > process in lengthy PDF instructions: click through a madness of options > here, import CA there, don't disable cert validation, etc. > > Earlier this month, a new web service was launched which is called > "Enterprise Network Configuration Assistant Tool (CAT)" which allows > RADIUS / network admins to make deployment of IEEE 802.1X simple and easy. > > Visit: > > https://802.1x-config.org > > (and especially take the tour at https://802.1x-config.org/tour1.php ) > > As a network admin, you upload the characteristics of your network > (issuing CA, expected server name in server cert, supported EAP types, > SSIDs to configure...) and in return get a mostly automatic installer > for that network, which you can hand out to your users. None of the > information you need to upload is a secret. > > And the best is: the base functionality is *free*. Only if you are a > business or enterprise that cares about branding, helpdesk hints, or > digital signatures for the generated installers, then you'll need to > purchase one of the paid upgrades. > > I hope I can do something good to the community of IEEE 802.1X / EAP > users out there by making sure that a secure deployment can be achieved > with ease, and for free. Especially now that some/many people need to > replace their EAP deployment profiles due to a possible Heartbleed > compromise. > > Thanks for tolerating this ad ;-) > > The good folks of https://802.1x-config.org > > >

3 2

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

IEEE 802.1X EAP configuration simple AND secure - https://802.1x-config.org
by 1x-config Info 29 Apr '14

29 Apr '14

Hello list, on this list, people somewhat regularly lament that they can't get their WPA2-Enterprise WiFi RADIUS server setup deployed to clients easily. That is understandable. Especially in a BYOD context, getting all of your users to "do the right thing" usually involves an error-prone process in lengthy PDF instructions: click through a madness of options here, import CA there, don't disable cert validation, etc. Earlier this month, a new web service was launched which is called "Enterprise Network Configuration Assistant Tool (CAT)" which allows RADIUS / network admins to make deployment of IEEE 802.1X simple and easy. Visit: https://802.1x-config.org (and especially take the tour at https://802.1x-config.org/tour1.php ) As a network admin, you upload the characteristics of your network (issuing CA, expected server name in server cert, supported EAP types, SSIDs to configure...) and in return get a mostly automatic installer for that network, which you can hand out to your users. None of the information you need to upload is a secret. And the best is: the base functionality is *free*. Only if you are a business or enterprise that cares about branding, helpdesk hints, or digital signatures for the generated installers, then you'll need to purchase one of the paid upgrades. I hope I can do something good to the community of IEEE 802.1X / EAP users out there by making sure that a secure deployment can be achieved with ease, and for free. Especially now that some/many people need to replace their EAP deployment profiles due to a possible Heartbleed compromise. Thanks for tolerating this ad ;-) The good folks of https://802.1x-config.org

3 2

Version 2.2.5 has been released
by Alan DeKok 29 Apr '14

29 Apr '14

This release is mainly for the heartbleed bug. Package maintainers: Please check the value of "allow_vulnerable_openssl" in raddb/radiusd.conf. Feature improvements * Update dictionary.terena. * expose server version via %v. Patch from Alan Buxey. * Forbid running with vulnerable versions of OpenSSL. See "allow_vulnerable_openssl" in the "security" subsection of "radiusd.conf" * Catch underlying "heartbleed" problem, so that nothing bad happens even when using a vulnerable version of OpenSSL. * Add dictionary.zte Bug fixes * Minor changes to build on Sun. * Print non-ASCII characters as octal in linelog. Closes #578 * close stdout in daemon mode. * Fix zombie period calculation. Closes #579

2 1