February 2015 - Freeradius-Users - lists.freeradius.org

Re: radwho gives an empty output
by Mert Uzun 18 Feb '15

18 Feb '15

>> To mention my work detailly, on GNS3, I have one c7200 cisco router as >> NAS(for administration access to router only, not to provide an >> internet connection) and a freeradius server on ubuntu server 14.04. I >> configured my NAS to send accounting update per one minute. In >> /var/log/freeradius/radacct/(ip of the nas)/detail-(date), I can read a >> txt file where some accounting infos are written but when I issue >> "radwho" command, I can not see anything but the titles for non-written >> accounting details. > > Read the debug output, and look for the “radutmp” module. What does it > say when the server receives an Accounting-Request? Unfortunately I saw no output by radutmp module. I only saw auth_log outputs that prompting outputs into a txt file (I tried some configurations on detail.log). I think that I may have not noticed a useful information but I have no idea about what it is. However, because I configured my NAS to request accounting logouts, my server send accounting reply when any user log off on the NAS. > >> I also issued freeradius -X command and got "ready to process request", >> my server can properly process authentication requests also. > > The point is to read the output *after* it says “Ready to process > requests”. That tells you what it’s doing when it processes requests. > I read each row after receiving a request. I couldn't see any radutmp module output as I said above. At least I know what I need to focus on now. >> However, I'm not completely unsuccessful to get any output from radwho. >> I had done some configurations on freeradius and managed to get proper >> outputs with radwho on the same topology and system. Unfortunately, my >> server got disfunctioned when I had tried to configure it for active >> directory authentication. I could only recovered it by re-installing >> then I lost and forgot what I did to use radwho. > > You should use “git” for revision control on the raddb directory. It > helps a lot. I should have learned this function before. Due to malfunctions on my computer, I lost whole topology and virtual machines but I will remember this advice in future thank you a lot. > >> I can't remember what I did to get radwho output before I lost whole >> configuration and what I can't notice now. > > If you send Accounting packets which have useful session data in them, > radwho will “just work”. > After reading this, I read my accounting configuration on the NAS. I suspected of a forgotten accounting command. Then I issued some accounting commands to apply "trial&error". Unfortunately, radwho didn't work again. I will continue to search for any missing accounting commands. In general, those details were all caused from the previous topology which I lost completely recently. I will build it up again in a few days. After a short process of adding clients and users, I will read debug details as you recommend and share results. Thanks for your help. -- Mert Uzun Elektrik Mühendisliği Bölümü-2. Sınıf Öğrencisi

1 0

Users file formatting
by Jonathan Gazeley 18 Feb '15

18 Feb '15

Hi list, This is hopefully a simple question. I've been using a simple users file to authenticate a handful of users that don't exist in AD with entries like this, which works: test-account1 Cleartext-Password := "password", MS-CHAP-Use-NTLM-Auth := no I also want to have a couple of test accounts that are restricted to MAC addresses. test-account2 Cleartext-Password := 'password', Calling-Station-Id == "00:11:22:33:44:55", MS-CHAP-Use-NTLM-Auth := no However radius -XC bombs out with "Unexpected trailing comma in check item list for entry test-account2" According to the manpage for the users file, I've formatted it correctly with commas between each check-item. I wondered if MS-CHAP-Use-NTLM-Auth was a reply-item so I tried to move it onto its own line with a tab, but this throws "Parse error (reply) for entry test-account2 (unknown error)" Can anyone advise on how to format users entries like this, and even if it is possible to require specific mac addresses in this way? Thanks, Jonathan

2 3

Weird message from RADIUS running at debug level
by Clement Ogedengbe 18 Feb '15

18 Feb '15

I am running RADIUS ( has embedded ntlm_auth to authenticate to Windows AD) at debug level. The message below gets occasionally displayed on the screen. The serer continues to authenticate users anyway, but wonder if anyone has any idea of what is going on here. Usage: [OPTION...] --helper-protocol=helper protocol to use operate as a stdio-based helper --username=STRING username --domain=STRING domain name --workstation=STRING workstation --challenge=STRING challenge (HEX encoded) --lm-response=STRING LM Response to the challenge (HEX encoded) --nt-response=STRING NT or NTLMv2 Response to the challenge (HEX encoded) --password=STRING User's plaintext password --request-lm-key Retrieve LM session key --request-nt-key Retrieve User (NT) session key --use-cached-creds Use cached credentials if no password is given --diagnostics Perform diagnostics on the authentictaion chain --require-membership-of=STRING Require that a user be a member of this group (either name or SID) for authentication to succeed --pam-winbind-conf=STRING Require that request must set WBFLAG_PAM_CONTACT_TRUSTDOM when krb5 auth is required Help options: -?, --help Show this help message --usage Display brief usage message Common samba config: --configfile=CONFIGFILE Use alternate configuration file Common samba options: -V, --version Print version

3 2

Git issue
by David Peterson 18 Feb '15

18 Feb '15

When I try to checkout branch 2.x I get this: root@freeradius:/usr/src# git clone git@github.com:FreeRADIUS/freeradius-server.git Cloning into 'freeradius-server'... Warning: Permanently added the RSA host key for IP address '192.30.252.128' to the list of known hosts. Permission denied (publickey). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. David

2 2

mysql, different tables based on NAS
by Miha 18 Feb '15

18 Feb '15

Hi, it is possible/how to insert based on NAS, accouting requests in different table, database? tnx miha

3 4

radperf sources ?
by Chaigneau, Nicolas 18 Feb '15

18 Feb '15

Hello, I'm interested in radperf, and I would like to know if it's possible to have access to the sources ? Thanks, Nicolas. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 1

Which version should I install?
by Angel L. Mateo 18 Feb '15

18 Feb '15

Hi, I'm upgrading my freeradius servers (running freeradius 2.2.0 on ubuntu 10.04) to a newer platform. Now that version 3.0.x is out, which version should I install? 3.0.6? or 2.2.6? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

4 4

How to configure LDAP
by Sautron Nick 17 Feb '15

17 Feb '15

Hello everyone, I want to know, how to configure ldap with freeradius 2 please ? Best regards

4 8

RE: Freeradius-Users Digest, Vol 118, Issue 30
by Sander Eerdekens 17 Feb '15

17 Feb '15

> -----Oorspronkelijk bericht----- > Date: Tue, 17 Feb 2015 09:17:44 -0500 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > Subject: Re: compiling Freeradius v3 on Solaris 11 > > > We are currently migrating to new servers for our freeradius setup, > > And would like to take the opportunity to switch from freeradius v2 to > freeradius v3 as well. > > I am having some problems compiling freeradius v3 on Solaris 11, Though. > > Until now we compiled Freeradius v2 on Solaris 10. > > You could take this opportunity to migrate away from solaris? :) I am stuck on SPARC/Solaris hardware for anything unix-like. Building is hard, but one we get it build I cannot complain. ;) > > Now, we are trying to compile freeradius 3.0.6 on solaris 11.2 (SPARC). > > Mm that's going to be fun. > > > Is there anything I can do to help get this issue fixed? > > From previous notes/rants, you need to define -D_XOPEN_SOURCE to match > the C standard used. Thank, I will look into this. For now I used Alan's suggestion, which seemed to help. > > Some other problems I ran into but managed to circumvent: > > - I have to use gmake, make gives an error on Make.inc, line 33: > Unexpected end of line seen > > Same issue as http://lists.freeradius.org/pipermail/freeradius- > users/2014-June/072411.html > > - I tried using solaris studio's cc, here I get stuck on "checking for > talloc.h", even though I include -- with-talloc-include-dir with configure, cc > does not know the -isystem it seems > > Ok. Well, you're welcome to write a patch to check for -isystem to > enable/disable it. Or use gcc/clang. Just thought I would mentioned it (also helpful for other people trying to compile on solaris in the future), I myself have not the knowledge to write good patches, but I am perfectly happy using this workaround, or using gcc. > > If I try to compile the snippet itself I get a warning that the last return > was not reached. > > Is my compiler broken, of what could be the issue here? > > Hm. Fixed that. It's being extra picky. Thanks! > > With GCC I do not have this issue, but I end up in the problem that gcc > does not know the -KPIC option, > > If I adjust the source to -fPIC, I end up in the same situation above with > the udpfromto error. > > > Solaris is a complete pain to build on. I managed to do with with the ldap > module disabled. > > -Arran It seems with some effort, I managed to build 3.0.6 with rlm_ldap. I do compile my own ldap libraries, I do not use the built-in solaris headers/libs. I'll try to test if the rlm_ldap function actually works, but will have to familiarize myself with the v3 config files first. If the rlm_ldap function actually works I will keep you up-to-date. Thank you, Arran and Alan :) Kind regards Sander Eerdekens

2 1

Re: Info about rlm_yubikey
by Arran Cudbard-Bell 17 Feb '15

17 Feb '15

> On 17 Feb 2015, at 08:54, Stefano Cailotto [EDALab] <stefano.cailotto(a)edalab.it> wrote: > > Hello Arran, > excuse me if I write you directly but I'd need some information asap (due to a customer pressing me). CCing this to FreeRADIUS users, just in case this might help someone. > My situation is as follows: > I've a FreeRadius (FR) server using OpenLDAP as a backend, containing also yubikeys for users (http://www.logix.cz/michal/devel/yubikey-ldap/) > 2Factor Authentication works perfectly in Linux,as users are prompted for Yubikey OTP and then for their ldap passwd. > > I'm trying rlm_yubikey on FR 3.0.6 and a Cisco Router. > I can autheniticate users using yubikey module (passing ldap passwd+otp when prompted for password). > What I can't do is to bind one or more yubikey to a user as it happens for example with pam_yubico (verified also for Linux auth through pam) or rlm-yubico module (I read there's a parameter "Place username → YubiKey mappings in /etc/yubico/rlm/ykmapping" in the doc). At the moment, a user can authenticate with his/her passwd and any valid Yubikey (i.e. validated by Yubico Validation Server). > > I tried also with pam (yubico+ldap), but it seems the pam_yubico module is passed the username as OTP. > > So, my final question (sorry to be very verbose) is: > Is there a way to map yubikey(s) <-> users with rlm_yubikey? Yes. Read the Yubikey config file etc/raddb/yubikey. It documents all the attributes available. The request flow would be something like: authorize { yubikey if (ok) { update control { Auth-Type := yubikey } } } authenticate { auth-type yubikey { yubikey # does decryption of the key ldap # authenticates the user, retrieves key binding attributes, # puts them in control:Yubikey-Private-Id } } post-auth { if (&Yubikey-Private-Id != &control:Yubikey-Private-ID[*]) { update reply { Reply-Message := "Token not allowed for use by user %{User-Name}" } reject } } In the ldap config file, uncomment valuepair_attribute. In LDAP add radiusAttribute values in the format: radiusAttribute: control:Yubikey-Private-ID+='<modhex>' For that attribute to be available you'll need to have loaded the FreeRADIUS schema: https://github.com/FreeRADIUS/freeradius-server/blob/master/doc/schemas/lda… and added objectClass: radiusProfile to the user objects. Or you can use your own attribute instead of radiusAttribute if that's easier. It's all configurable. If you want to do dynamic binding, that's possible too. Just use the Post-Auth stuff in rlm_ldap to update the directory. Use slapo-constraint to prevent the same ID being added multiple times (or not if you want multiple users to share a key). Binding isn't a magical feature. The rlm_yubikey module was written to support multiple user scenarios, that's why all the extracted info is exposed as attributes. They're available for you to implement whatever local restrictions and policies you want. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0