January 2015 - Freeradius-Users - lists.freeradius.org

freeradius2 + iODBC + Informix
by vanish 19 Mar '15

19 Mar '15

Greeting, Fajar A. Nugraha-2, Alan DeKok-2. After yours answers i tried to rebuild freeradius with unixodbc module. 1. Install unixodbc and unixodbc-dev 2. Download 2.1.12 package: freeradius_2.1.12+dfsg-1.2ubuntu8.debian.tar.gz freeradius_2.1.12+dfsg-1.2ubuntu8.dsc freeradius_2.1.12+dfsg.orig.tar.bz2 2. Edit debian/rules : --prefix=/usr \ --exec-prefix=/usr \ --mandir=$(mandir) \ --sysconfdir=/etc \ --libdir=$(libdir) \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ !! --without-rlm_sql_iodbc \ !! --with-rlm_sql_unixodbc \ --with-system-libtool 3. Build package: dpkg-buildpackage -d -rfakeroot 4. Install deb packet: dpkg -i freeradius_2.1.12+dfsg-1.2ubuntu8_amd64.deb 5. Change sql.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "unixodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ 6. freeradius -X showed me: rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql_unixodbc: Connection failed rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. 7. On test.server.ru i used tcpdump utils to see incoming packets from my machine with freeradius - but the entering packets was not detected. Please, help me find the mistake. -- ============================================ С уважением, Богучарский Иван Владимирович. Начальник СУТС ОРЭТС и ШПД ЗАО "Коламбия-Телеком". тел. 8-937-084-25-89.

7 10

Re: Expansion of \t and \n in message with linelong module
by paul.moser＠bt.com 13 Mar '15

13 Mar '15

(apologies if I've broken the threading - I shouldn't have subscribed using digest mode, now corrected) On Tue, Dec 23, 2014 at 11:05:23AM -0500, Alan DeKok wrote: > The reason is that attributes can have embedded \n in them, either as binary or a as a string "\n". Using those attributes in the "linelog" module would then cause spurious new lines, and break your assumptions about what the log files mean. Very good point. Because the set of attributes we happen to use in the log entry don't include end user inputted data and the source of those packets we are safe from unexpected expansion for now, but our future intended use and as a general use case this is certainly what's known as a bad idea. Time to rethink. >Not with 3.0.6. We can take a look at correcting it for the next release. We’ve made other fixes in 3.0 which made it easier to separate the "literal" strings passed in from the config files, and the “end user” strings taken from a RADIUS packet. We can have the linelog module convert \n -> CR for literal strings you enter, but not do that expansion for strings taken from RADIUS packets. Certainly that would help, but I should probably the end result we are trying to achieve in case linelog was completely the wrong approach. It sound like we are doing much the same as Matthew Newton, in addition to performing some normal authentication/authorization/accounting we also send information from those to another radius server as accounting packet - in some cases this is for additional auditing, sometimes as it enables other functionality - using the linelog module we could write out a file in the standard detail format but with just the attributes we wanted (and the type as accounting even if it had originally been an access request), and use a detail listener to pick that up and send them on. Is there some other way to do this that I've missed? I suspect the reason in our case that accounting packets are always used is just because historically it was more convenient to do so. Given we own the systems that the packets get sent onto it's possible that we may be able to change those systems to handle access request or response packets as well as accounting, and modify the source systems to use a detail writer/read and Proxy-to-realm setup rather linelog Paul ------------------------------ Message: 2 Date: Tue, 23 Dec 2014 11:05:23 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <E5F57FCB-CC38-4386-B922-3F36D37A3F88(a)deployingradius.com> Content-Type: text/plain; charset=windows-1252 On Dec 23, 2014, at 10:38 AM, paul.moser(a)bt.com wrote: > I have a 3.0.3 FR instance to which some additional logging has been added using the linelog module. The log messages that are written are multi-line and tab indented with \n and \t used in the format option in the linelog modules configuration file. That?s not really the intended use of the ?linelog? module. It logs lines of text.. not multiple lines. > I have also tried migrating another, older (v2.x) FR instance to v3.0.6. I started with a vanilla 3.0.6 configuration and successfully slowly modified that to give the same behaviour as the v2.x version. However when I finally attempted to add the additional logging that had been added to the 3.0.3 instance the log statements appearing in the log file are not multi-line or tab indented, neither the newline \n nor the tab \t have been expanded, \n and \t appear in the log file where I'd expected newlines and tabs to appear. > > I note in the changelog that for v3.0.5 correct_escapes was introduced and in a vanilla 3.0.6 configuration this is set to true It?s correct, and it creates many other simplifications of the source tree. > Taking my 3.0.3 configuration as is and running it against a 3.0.6 server it behaves just as it does with a 3.0.3 server - expanding \t and \n . However if I modify the configuration to set correct_escapes to true then literal \t and \n appear in the log file rather than tabs and newlines. Yes. That?s really the correct behaviour. The reason is that attributes can have embedded \n in them, either as binary or a as a string ?\n?. Using those attributes in the ?linelog? module would then cause spurious new lines, and break your assumptions about what the log files mean. > With 3.0.6, with correct_escapes=true, is it possible to use backslash escape sequences, or some equivalent to format linelog log messages? Not with 3.0.6. We can take a look at correcting it for the next release. We?ve made other fixes in 3.0 which made it easier to separate the ?literal? strings passed in from the config files, and the ?end user? strings taken from a RADIUS packet. We can have the linelog module convert \n -> CR for literal strings you enter, but not do that expansion for strings taken from RADIUS packets. > It maybe that the expansion of \n and \t in 3.0.3 was just undocumented behaviour that we stumbled upon and utilised rather than expected behaviour, the fact that the module is called line (singular) log may indicated we should not expect it to write multi-line log statements. Both. > I realise that I could just set correct_escapes=false in my 3.0.6 instances, I have briefly tried this however much of the default configuration now appears to assume the correct escapes and I'd have to unwind all those changes. I suspect if I did this I'd just be storing up trouble for myself some point in the future. I?d recommend keeping the new behaviour. It?s *much* more intuitive. Alan DeKok. ------------------------------ Message: 3 Date: Tue, 23 Dec 2014 23:27:27 +0000 From: Matthew Newton <mcn4(a)leicester.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <20141223232727.GA19006(a)rootmail.cc.le.ac.uk> Content-Type: text/plain; charset=utf-8 On Tue, Dec 23, 2014 at 11:05:23AM -0500, Alan DeKok wrote: > That?s not really the intended use of the ?linelog? module. > It logs lines of text.. not multiple lines. Of course, "intended" and "what's useful" are two different things. We're also (ab-)using linelog to write out detail log format. These are then picked up by the detail reader and fed (as accounting packets) across to a central RADIUS server for common logging. It means we can set exactly which attributes to forward. Because of the way the logging and detail reader works it is also reliable if the central server goes away for some reason. I guess the alternative would be to have an "include" option for the detail module, countering the "suppress" option. But that's only for our use case. > Not with 3.0.6. We can take a look at correcting it for the > next release. We?ve made other fixes in 3.0 which made it > easier to separate the ?literal? strings passed in from the > config files, and the ?end user? strings taken from a RADIUS > packet. We can have the linelog module convert \n -> CR for > literal strings you enter, but not do that expansion for > strings taken from RADIUS packets. That would seem the more sensible option - expand \n, \t etc in the string first, then expand %{..}. But I get that string expansion is pretty tricky in the ordering it needs to be done to get a sane output for all cases. Cheers Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> ------------------------------ Message: 4 Date: Tue, 23 Dec 2014 23:48:11 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>, Matthew Newton <mcn4(a)leicester.ac.uk> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <ABEC402F-CA0B-418A-A14F-C7F97692988B(a)lboro.ac.uk> Content-Type: text/plain; charset="utf-8" buffered_sql with extra attr_filter rule? alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

3 5

ipaddr, ipv4addr ipv6addr
by Arran Cudbard-Bell 06 Mar '15

06 Mar '15

The behaviour of the ipaddr config item has changed slightly for 3.0.4. If the ipaddr value contains ':' or '[' or ']', it will be treated as an IPv6 address. If it fails to parse as an IPv6 address the server will refuse to start. If the ipaddr value does not contain any ipv6 chars the server will first check to see if it looks like an ipv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else if a AAAA record is available else the server will refuse to start. If instead of the ipaddr config item the ipv4addr config item is used the server will check if it looks like an IPv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else the server will refuse to start. If instead of the ipaddr config item the ipv6addr config item is used the server will check if it looks like an IPv6 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching AAAA record is available it will be used, else the server will refuse to start. The behaviour is similar for the client, home_server and listen sections. Though those config items in client sections may have an optional /[0-9]{1,3} suffix to map clients to ranges of IP addresses. This should also work with things like example.org/96 though i'm not entirely sure why you'd ever want to do that. 'netmask' is now deprecated but will still function as expected until 3.1.0. These changes should make it slightly easier to manage v4/v6 transitions. Wildcard clients 0.0.0.0 <ipaddr>/0 '*' are not supported. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 15

VSA Processing embedded values
by Ben Gatewood 01 Mar '15

01 Mar '15

Hi All, I am processing Accounting records from a vendor who overloads VSA 255 to extend the range of available attributes. For instance, they may send something like this: VENDOR-Attr-255 = "272=Yes” Which really means VSA 272 = “Yes” I am struggling a bit to figure out how to process these effectively. I found rlm_attr_rewrite but I can’t see a way to make it split the string and drop the “272=“ part. Is there a way to do this in unlang at all or am I going to need to bring in rlm_python or similar? Thanks in Advance, Ben

6 21

Is it possible to have different TLS configurations per EAP type?
by Louis Munro 02 Feb '15

02 Feb '15

Hello, I have a set of FR 2.2.5 servers which are currently handling PEAP connections. We now want to add EAP-TLS authentication, which is pretty straightforward. The only stumbling block I have is that the EAP-TLS client certs are signed by a root CA different from the one that signed the server certificate currently used for PEAP authentication. While that is not a problem in itself it makes client devices configuration more troublesome than I would like because it forces the user to install two root CA certs. So I am trying to write a configuration that would support two eap configurations. Instantiating two modules is not the problem, it’s more a matter of finding how to select a configuration to be used while maintaining backwards compatibility for the existing PEAP clients. Assuming the following modules: eap { […] tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file =${certdir}/server.key certificate_file = ${certdir}/server.crt CA_file = ${certdir}/ca_PEAP.crt dh_file = ${certdir}/dh random_file = /dev/urandom cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap” […] } eap eap-tls { [..] tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/ca.key private_key_password = whatever certificate_file = ${certdir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" CA_file = ${certdir}/ca.pem […] } This does not seem to work: authorize { # assuming an instance called eap-tls eap-tls { updated = return } # else eap { ok = return } […] } And since things like EAP-Type are detected by the eap module itself I also can’t seem to do if (EAP-Type && (EAP-Type == EAP-TLS)) { eap-tls { ok = return } } else { eap { ok = return } } Which leaves me with a chicken and egg type of situation. Is this doable in FR 2? Am I just missing the obvious? Thank you for your help. -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

3 3

AW: Re: using external script in virtual server config
by the2nd 01 Feb '15

01 Feb '15

I already have implemented mschap authentication im OTPme and use it from within the mschap module as a ntlm_auth replacement. But it would be great if i could also handle this in rlm_python. If if i could get challenge and response from authData just like its done with username and password i could verify it and return the nt_key on success. regards the2nd <div>-------- Ursprüngliche Nachricht --------</div><div>Von: Alan DeKok <aland(a)deployingradius.com> </div><div>Datum:01.25.2015 21:32 (GMT+01:00) </div><div>An: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> </div><div>Betreff: Re: using external script in virtual server config </div><div> </div>On Jan 25, 2015, at 1:15 PM, the2nd(a)otpme.org wrote: > today i've written an python module for use with rlm_python and it works great for clear-text requests. but i dont know how to handle ntlm/mschap requests. You don’t. FreeRADIUS implements MS-CHAP. You don’t want to re-implement that in python. What do you want to do with the OTP and MS-CHAP? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 14

freeradius will not start when SELINUX is enabled
by Jorge Valdes 30 Jan '15

30 Jan '15

Hi, I use daemontool's supervise to manage the RADIUS service, and have been doing it for years. Now that I am migrating freeradius to another server, I am using Centos6 RPM to install the software versus compiling from source, and I am getting the following: 2015-01-30 10:52:42.518 server backbone { # from file etc/sites-enabled/backbone 2015-01-30 10:52:42.518 modules { 2015-01-30 10:52:42.518 Module: Creating Auth-Type = digest 2015-01-30 10:52:42.518 Module: Checking authenticate {...} for more modules to load 2015-01-30 10:52:42.518 Module: Linked to module rlm_digest 2015-01-30 10:52:42.518 Module: Instantiating module "digest" from file etc/modules/digest 2015-01-30 10:52:42.518 Module: Checking authorize {...} for more modules to load 2015-01-30 10:52:42.518 Module: Instantiating module "files_backbone" from file etc/radiusd.conf 2015-01-30 10:52:42.518 files files_backbone { 2015-01-30 10:52:42.518 usersfile = "etc/backbone/users" 2015-01-30 10:52:42.518 acctusersfile = "etc/backbone/acct_users" 2015-01-30 10:52:42.518 preproxy_usersfile = "etc/backbone/preproxy_users" 2015-01-30 10:52:42.518 compat = "no" 2015-01-30 10:52:42.518 } 2015-01-30 10:52:42.518 etc/backbone/users[171]: Could not open included file /home/crm/local-users/monitor: Permission denied 2015-01-30 10:52:42.519 Errors reading etc/backbone/users 2015-01-30 10:52:42.519 etc/radiusd.conf[681]: Instantiation failed for module "files_backbone" 2015-01-30 10:52:42.519 etc/sites-enabled/backbone[177]: Failed to load module "files_backbone". 2015-01-30 10:52:42.519 etc/sites-enabled/backbone[87]: Errors parsing authorize section. After this, the program stops, and supervise tries again and again to restart, always failing here. I have double-checked permissions, and do not see where I could be denying [root@dhcp1 radius]# ls -ld /home drwxr-xr-x. 6 root root 4096 Jan 30 09:49 /home [root@dhcp1 radius]# ls -ld /home/crm/ drwxr-xr-x. 7 crm crm 4096 Jan 30 10:22 /home/crm/ [root@dhcp1 radius]# ls -ld /home/crm/local-users/ drwxr-xr-x. 2 crm crm 4096 Nov 17 2010 /home/crm/local-users/ [root@dhcp1 radius]# ls -l /home/crm/local-users/ total 28 -rw-r--r--. 1 crm crm 253 Oct 8 15:25 admin -rw-r--r--. 1 crm crm 252 Jan 21 2011 monitor -rw-r--r--. 1 crm crm 943 Oct 8 15:25 noc -rw-r--r--. 1 crm crm 131 Oct 8 15:25 ps -rw-r--r--. 1 crm crm 668 Oct 8 15:25 super_tech -rw-r--r--. 1 crm crm 436 Oct 8 15:25 vpn Now, when I execute the server from the command-line manually, the server starts out without problems: ... server backbone { # from file etc/sites-enabled/backbone modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file etc/modules/digest Module: Checking authorize {...} for more modules to load Module: Instantiating module "files_backbone" from file etc/radiusd.conf files files_backbone { usersfile = "etc/backbone/users" acctusersfile = "etc/backbone/acct_users" preproxy_usersfile = "etc/backbone/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server ... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address * port 1645 Listening on accounting address * port 1646 Ready to process requests. The only issue is that SELINUX is enabled. After I disabled SELINUX, and restarted the server, and now the service starts without issues. After looking at the audit log, I see that: type=AVC msg=audit(1422637776.619:4172): avc: denied { search } for pid=9101 comm="radiusd" name="home" dev=dm-0 ino=261125 scontext=system_u:system_r:radiusd_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir type=SYSCALL msg=audit(1422637776.619:4172): arch=c000003e syscall=2 success=no exit=-13 a0=7fffedebf240 a1=0 a2=1b6 a3=0 items=0 ppid=31859 pid=9101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="radiusd" exe="/usr/sbin/radiusd" subj=system_u:system_r:radiusd_t:s0 key=(null) So, access is being denied to /home. Since my SELINUX knowledge is limited, I will run with SELINUX disabled, but I still do not understand why it would block access only on non-interactive executions. Maybe there should be mention in the FAQ regarding configuration files residing inside /home, or that SELINUX can make the deamon fail to start due to targeted policies using non standard configuration settings. -- Jorge Valdes

2 1

Radius Engineer / Wireless Network Engineer position (Pune)
by Sanju 30 Jan '15

30 Jan '15

We are a Pune, India based company looking for Radius Engineer on contract basis. Interrested candidates can forward their resume to simplemail9 at gmail.com Role & Responsibility: - Join a multidiscipline technical team that is developing an innovative product for users who use high level of roaming data on their mobile phones. The product will help users to connect to WIFI hotspots. - The primary responsibility is to build the connection of AAA/RADIUS servers (freeRadius) of large telecom aggregators and the company. - Develop the system architecture to manage end-to-end process including AAA/Radius server configuration for various EAP methods, manage user authentication and accounting, PKI/CA certificates generation, integrate Radius with the existing NAS servers. Required Skills: - A Network Specialist/System Administrator working at Architect level having experience in AAA/RADIUS, NAS and certificates management. - Enterprise level experience designing, implementing, and operating RADIUS server. - Expertise in Linux OS administration. - Depth of knowledge and experience administering wireless networks. - Detailed understanding of wireless protocols and network security standards. - Strong hands on experience using and troubleshooting mobile devices running on all popular OS platforms (iOS, Android, Windows & Linux) - Ensure network access control systems meet compliance and auditing requirements. Preferred Skills: - Experience in building or maintaining the connection manager. - Analytical problem-solver, able to anticipate issues and create new systems that streamline operations, resolves concerns and improves efficiency. - User Acceptance Test Plan to verify that the hardware and software has been configured according to Network System Design document. - Execute functional tests as per UAT Plan.

1 0

successful authentication (peap and TTLS), but internet access that for 5 seconds
by Sautron Nick 30 Jan '15

30 Jan '15

Hello everyone, I have a problem with my freeradius server (or maybe switch), the problem is that : I connected a customer on a switch port (Cisco 2940) configured 802.1X Authentication is successful, but I have access to the internet that for 5 seconds and after nothing. I wonder if there is no configuration to avoid this kind of problem. Best regards S.Nick

4 4

authenticating against a remote SAMBA
by Rui Ribeiro 30 Jan '15

30 Jan '15

Hi, Out of curiosity, has anyone managed to authenticate remotely with MS-CHAPv2 against a remote SAMBA? Or only PAP will do? I am doing it fine against an a MS AD, however with the SAMBA one, I only managed to put ntlm_auth working, but not the actual mschap module. -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 2