May 2014 - Freeradius-Users - lists.freeradius.org

Re: VSA attributes sent with Access-Reject response
by Contact (COEXSI) 20 May '14

20 May '14

> Date: Thu, 15 May 2014 10:53:06 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: VSA attributes sent with Access-Reject response > Message-ID: <5374D4D2.2070504(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Contact (COEXSI) wrote: > > Doing some tests with FreeRADIUS Version 2.2.3, we have noticed that > > the VSA attributes normally sent with an Access-Accept response were > > also sent on Access-Reject response. > > This was also observed with the Access-Challenge response sent by the > > server when doing EAP exchange. > > > > This doesn't seem normal as per the FAQ : > > http://wiki.freeradius.org/guide/faq#VSA-in-Access-Reject > > "According RFC 2865 (section 5.44) Vendor-Specific Attributes aren't > > allow in Access-Reject packets." > > You edited the default configuration, and broke it. > > The default configuration has the following: > > Post-Auth-Type REJECT { > # log failed authentications in SQL, too. > # sql > attr_filter.access_reject > } > Thank you Alan, this solve the problem for the Access-Reject response! The default configuration explanation wasn't that clear for me. > There is a similar line for EAP and Access-Challenge. The debug log > shows you've removed the "attr_filter.access_reject" line. Which is why > you're getting VSAs in the Access-Reject. > For filtering the Access-Challenge response when doing EAP, I've these lines (commented) in the default configuration: # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } When uncommenting them, I've a configuration parsing error: Failed to find "handled" in the "modules" section. Failed to parse "handled" entry. Failed to parse "if" subsection. The parsing error seems to be linked to the line "handled # override the "updated" code from attr_filter". I didn't find a definition of the "handled" keyword to understand the error. > Alan DeKok. >

4 8

Re: FR 3.0.1 and LDAP group membership
by Arran Cudbard-Bell 20 May '14

20 May '14

> > Note that your profile attribute could be the same as your group > attribute i.e. memberOf, in which case you'd just need to add the > group objects to the radiusprofile object. *objectClass Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Get access to User-Password in rlm_sql_mysql
by Lars Timmann 19 May '14

19 May '14

Hello freeradius users, I am working on an implementation of one time passwords in radius. I know there are many solutions for that, but I don't want to grant the freeradius-mysql-user too much. So I made three functions and a view in my database that freeradius just have to set two variables with username and one time password in the mysql session to get the needed results. In my freerardius mysql config I want to call it like this: authorize_check_query = "\ set @username='%{SQL-User-Name}'; \ set @otp='%{User-Password}'; \ SELECT id, username, attribute, value, op \ FROM ${authcheck_table}" The variable username is filled with the User-Name but the variable otp stays empty. I tried several variations of User-Password like Chap-password, SQL-User-Password and so on. Maybe I am to stupid to find it in the documentation, but can you please tell me what I have to do or point me at the right part of the documentation? Or am I completely on the wrong way? Thank in advance, Lars

1 1

RLM_Perl not seeing huntgroup-name
by Graeme Hinchliffe 19 May '14

19 May '14

Hi I am working to update our old FreeRADIUS 1.x.x installation to the FreeRADIUS 2.x.x version, purely for maintainability, current platform has been running happily for over 10 years. We use a custom Perl module to perform some logic for some of our products (mainly providing L2TP tunnel selection), during the testing of the newly configured system running FreeRADIUS 2.1.12 (Debian Wheeze package) I have discovered that the Huntgroup-Name attribute doesn't seem to be being passed to the Perl module in the data structures which is required by the module. To confirm this I have added Data::Dumper and dumped the various structures and cannot see it anywhere. The RLM_PERL module is called after preprocess module which returns OK also. Is there something I have missed? Thanks Graeme -- Graeme Hinchliffe Senior Designer - Systems, Zen Internet T: 01706 902000 F: 01706 902005 W: zen.co.uk We have been nominated Which? Best Telecoms Provider. http://www.zen.co.uk/latest-news.aspx?page=11939 This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. Zen Internet Limited may monitor email traffic data to manage billing, to handle customer enquiries and for the prevention and detection of fraud. We may also monitor the content of emails sent to and/or from Zen Internet Limited for the purposes of security, staff training and to monitor quality of service. Zen Internet Limited is registered in England and Wales, Sandbrook Park, Sandbrook Way, Rochdale, OL11 1RY Company No. 03101568 VAT Reg No. 686 0495 01

3 7

Letting a user in only if Authorize and Authenticate pass
by Phyo Wai Soe 19 May '14

19 May '14

Hi All, We are running Freeradius 2.1.10 and MySQL in an ISP environment. I would like to find out if it's possible to let a user use our services only if he passes both Authorization and Authentication stages. To describe the situation in detail, we have a noreset counter to track users' bytes usages and won't let a user use Internet if he has no byte credit left. When a user's credit is finished (when the reply is "Your maximum never usage has been reached"), we would still like to allow the user to log in so that he can check his account and tops up. The issue we have is that when a user's byte credit is finished, he can still see his account's info and tops up even if he supplies a wrong password or no password at all, because Authorize comes before Authenticate. I tried to change this by following this advice (http://tim.purewhite.id.au/2011/04/coova-chilli-freeradius-reply-message/) and doing like this in the authorize section sql noresetcounter{ reject = 1 } The outcome is that if the noresetcounter returns reject and the password is wrong, he will be rejected. But if he enters correct password, he can still use the internet. Can you please give us some pointers to configure it the way we need? Thank you. Regards, Phyo Wai Soe

1 0

Profanity
by John Dennis 17 May '14

17 May '14

Civility is a cornerstone of effective communication. Could we please exercise some restraint and eliminate the profanity on the FreeRADIUS lists. It's offensive without adding any content. -- John

5 5

No EAP session matching the State variable
by Contact (COEXSI) 16 May '14

16 May '14

Dear all, I'm trying to setup EAP-MD5 authentication with a NAS that's looking bogus in my opinion. The exchange start correctly, the NAS is sending an Access-Request packet with an EAP Response giving its identity The server is responding by an Access-Challenge and a state variable. Then, the NAS is send an second Access-Request with the challenge and the state variable. The server is responding by an Access-Reject because there is "No EAP session matching the State variable". After comparing the exchange with the provided test tool "radtest -t eap-md5", I have noticed a difference in the message EAP identifiers used (not the RADIUS identifier) With the "radtest" client, the first sent Access-Request message contains a random EAP identifier generated by the client. The server answer with an "Access-Challenge" changing the EAP identifier to its own identifier (different from the one provided by the client) and the state variable. The "radtest" client then send the challenge response using the EAP identifier received from the server (and forgetting the one it has used for its first message). The server keep the EAP identifier in the last message sent (Access-Accept). In the case of the bogus NAS I'm testing, it's quite different. The NAS send the first message with its own EAP identifier (normal). The server respond with a new EAP identifier that it has generated (seems normal). The NAS send the second message with a newly EAP identifier (different from the first one it has used and from the one received from the server) The server then complains about "No EAP session matching the State variable" and send a "Access-Reject" I think this message is because of EAP identifier mismatch as the NAS didn't use the EAP identifier chosen by the server. Can someone can confirm that the EAP identifier to be used in the exchange is the one chosen by the server? Best regards, Sebastien.

2 2

Foreach-Variable-X and =~
by Phil Mayers 16 May '14

16 May '14

Does this work for anyone else? I'm running 3.0.x HEAD, and finding that this: if (Cisco-AVPair) { foreach &Cisco-AVPair { if (Foreach-Variable-0 =~ /^audit-session-id=(.+)$/) { update request { IC-Cisco-ASID := "%{1}" } } } } ...doesn't work; with a packet of: Received Access-Request Id 10 from ... Cisco-AVPair = 'blah=foo' Cisco-AVPair = 'audit-session-id=foo' ...I get: (10) if (Cisco-AVPair) (10) if (Cisco-AVPair) -> TRUE (10) if (Cisco-AVPair) { (10) foreach &Cisco-AVPair (10) update request { (10) EXPAND %{Foreach-Variable-0} (10) --> blah=foo (10) Tmp-String-0 := '"blah=foo"' (10) } # update request = noop (10) if (Foreach-Variable-0 =~ /^audit-session-id=(.+)$/) (10) if (Foreach-Variable-0 =~ /^audit-session-id=(.+)$/) -> FALSE (10) update request { (10) EXPAND %{Foreach-Variable-0} (10) --> audit-session-id=foo (10) Tmp-String-0 := '"audit-session-id=foo"' (10) } # update request = noop (10) if (Foreach-Variable-0 =~ /^audit-session-id=(.+)$/) (10) if (Foreach-Variable-0 =~ /^audit-session-id=(.+)$/) -> FALSE (10) } # foreach &Cisco-AVPair = noop (10) } # if (Cisco-AVPair) = noop ...but it works if I copy Foreach-Variable-0 to Tmp-String-0 and do the regexp against that. Before I dig any deeper, just wanted to see if it actually works for anyone?

4 4

How to link to openssl if two versions of libssl are on the system, when building FreeRadius on Debian wheezy 7.4?
by Rani Ahmed 16 May '14

16 May '14

Hi. This is what I have: I have from Debian wheezy repository : OpenSSL 1.0.1*e* as a binary package. Already installed on the normal location /usr/lib. => Heartbleed bug. I did build from tar.gz file, OpenSSL 1.0.1*g *and installed it on /usr/local/ . This is the default --prefix in the ./config of OpenSSL I built freeradius using the following configure command : ./configure --with-openssl-includes=/usr/local/ssl --with-openssl-libraries=/usr/local/ssl/lib and without the allow_vulnerable_openssl = yes I still get freeradius want to run on OpenSSL 1.0.1e instead of 1.0.1g , and of course it will refuse, then, to run beacause of the heartbleed bug. Also, I did tell ldconfig in /etc/ld.so.conf about the path "/usr/local/ssl/lib" just to make freeradius use OpenSSL 1.0.1g , I still get it from /usr/lib instead.. So how should I exactly link it to 1.0.1g?

4 5

rlm_sqlcounter: Max-Daily-Session.
by * 16 May '14

16 May '14

Hi, I have to follow this tutorial to get the the session limit working. But looking at the debug output it seems the sql counter is not executed. No Session-Timeout is sent to NAS as well. Accounting is working fine. I can see all the accounting information radacct time. Here is my configuration. Please let me know if I should provide more information. Jake He FreeRADIUS V. 3 mods-enabled/sqlcounter sqlcounter noresetcounter { sql_module_instance = sql #dialect = ${sql_module_instance}.dialect dialect = mysql counter_name = Daily-Session-Time check_name = Max-Daily-Session reply_name = Session-Timeout key = User-Name reset = never query = “SELECT SUM(AcctSessionTime) FROM radacct where UserName=’%{%k}’” } sites-enabled/default: authorize { preprocess chap mschap suffix eap files sql pap noresetcounter } radcheck: Max-Daily-Session:=60 for the user bob

5 22