March 2015 - Freeradius-Users - lists.freeradius.org

policy filter_username
by Maja Wolniewicz 05 Mar '15

05 Mar '15

Hello, I have a problem with the filter_username policy in FR 3.0.7 The rules checking double dots and starting / ending dot evaluate to TRUE for a correct username (2) User-Name = 'mgw(a)umk.pl' (2) NAS-IP-Address =... ... (2) # Executing section authorize from file /opt/FR/etc/raddb/sites-enabled/default-umk (2) authorize { (2) policy filter_username { (2) if (!&User-Name) { (2) if (!&User-Name) -> FALSE (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@.*@/ ) { (2) if (&User-Name =~ /@.*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> TRUE (2) if (&User-Name =~ /\.\./ ) { (2) update reply { (2) &Reply-Message += 'Rejected: Username contains ..s' (2) } # update reply = noop (2) [reject] = reject (2) } # if (&User-Name =~ /\.\./ ) = reject (2) } # policy filter_username = reject .. (2) Invalid user: [mgw(a)umk.pl] (from client ... ) Maja -- Maja Gorecka-Wolniewicz mgw(a)umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574

4 6

Challenge-Response in the server
by Alan DeKok 05 Mar '15

05 Mar '15

I’ve added a new virtual server: raddb/sites-available/challenge It implements a sample Challenge-Response protocol in the server. It requires the v3.0.x branch, and won’t work for 3.0.7 unfortunately. This example can be used to create “home brewed” one-time password systems. Alan DeKok.

2 1

Where do you split users in groups.
by jan hugo prins 04 Mar '15

04 Mar '15

Hello, Until yesterday I did not need huntgroups in my radius config because I had basicly only one usage and this was wireless access. We are now implementing 802.1x on the wired network as well, and now we need to split between wireless access and wired access and I have started using huntgroups to do the basic selection when selecting what I have to send back to the user. A part of my users file looks like this: DEFAULT ldap_bedrijf1-Ldap-Group == "werkneme-bedrijf1", Realm == "bedrijf1.com", Huntgroup-Name == "wireless" Aruba-User-Vlan = 101, Aruba-User-Role = "authenticated" DEFAULT ldap_bedrijf1-Ldap-Group == "wireless-bedrijf1", Realm == "bedrijf1.com", Huntgroup-Name == "wireless" Aruba-User-Vlan = 2261, Aruba-User-Role = "guest" DEFAULT ldap_bedrijf2s-Ldap-Group == "bedrijf2", Realm == "bedrijf2.nl", Huntgroup-Name == "wireless" Aruba-User-Vlan = 2268, Aruba-User-Role = "authenticated" DEFAULT ldap_bedrijf3-Ldap-Group == "bedrijf3", Realm == "bedrijf3.nl", Huntgroup-Name == "wireless" Aruba-User-Vlan = 2266, Aruba-User-Role = "authenticated" DEFAULT ldap_bedrijf1-Ldap-Group == "bedrijf1", Realm == "bedrijf1.com", Huntgroup-Name == "wireless", Auth-Type := Reject Reply-Message = "Your account does not have wireless access." DEFAULT FreeRADIUS-Proxied-To == "127.0.0.1", Auth-Type := Reject Reply-Message = "Who are you?" In the huntgroup file I match the Aruba controllers to the wireless huntgroup. I read in the huntgroup file that you can create a huntgroup that is based on both the NAS-IP and the Unix group. I don't know if you can also match a LDAP group in the huntgroups file, but if this is possible I could create something like this: werknemers NAS-IP-Address = 172.30.27.1 ldap_bedrijf1-Ldap-Group == "werkneme-bedrijf1" And then in the users file do something like: DEFAULT Realm == "bedrijf1.com", Huntgroup-Name == "werknemers" Aruba-User-Vlan = 101, Aruba-User-Role = "authenticated" If both is valid, what is the preferred way of doing this? Jan Hugo Prins

2 2

SQL replacement for users file
by HCC Lists 04 Mar '15

04 Mar '15

Hello I know that I can use SQL to replace most of what can be done in the users file. What I want to do is roughly: test Huntgroup-Name != "WAP", Cleartext-Password := "test", Auth-Type := Reject Reply-Message = "Your account is limited to WiFi." test Cleartext-Password := "test", Huntgroup-Name == "WAP" Reply-Message = "WiFi enabled." I have added SQL Huntgroup support by adding the following to sites-enabled/default right after preprocess. update request { Huntgroup-Name := "%{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress='%{Client-IP-Address}'}" } if(Huntgroup-Name == "") { update request { Huntgroup-Name !* ANY } } The idea is to limit some accounts to WiFi only using WPA2-Enterprise. I don't want those accounts to be able to connect to the VPN. I am less worried about the VPN accounts connecting to the WiFi. What I cannot figure out is what combination of entries in the radcheck, radgroupcheck, radgroupreply, and radreply will do this. I have in radcheck: Username | Attribute | op | Value ---------+---------------------+----+--------- test | Cleartext-Password | := | test In radgroupcheck GroupName | Attribute | op | Value ----------+----------------+----+--------- WAP | Huntgroup-Name | == | WAP In radgroupreply GroupName | Attribute | op | Value ----------+---------------+----+---------------- WAP | Reply-Message | = | WiFi enabled. I have nothing specific in radcheck. I have tried more combinations that I can remember with no success. I am hoping I can do this in SQL, but I suppose I can figure out how to do it using unlang. Michael

2 1

Insert accounting data in different tables based on realm
by Francisco Amaral 04 Mar '15

04 Mar '15

Hello, I am trying to insert accounting data from different realms into different tables in MySQL. I would rather not have this run on the database server as a stored procedure, or spin up another pair of radius servers for every realm if possible. For instance I would like to: insert accounting data for user(a)example.org into radiusdb.radacct insert accounting data for user(a)example.com into radiusdb.radaccttemp Could someone point me in the right direction if this is even possible in FreeRADIUS before I call support? It seems to me like this has probably been done somewhere and I would not have to re-invent the wheel. I have been searching quite a bit the last few days and can't find an example. Regards, //F Francisco Amaral Senior Wi-Fi Networks Engineer Phone: (866) 848-5848 x 318 Fax: (866) 762-2250 Mobile: (401) 862-0526 Website: http://www.towerstream.com towerstream

2 2

Howto further debug when freeradius does not respond or log anything?
by Gary Holtkamp 04 Mar '15

04 Mar '15

Hi, I have a problem with a WLAN setup with freeradius 2.1.12 and a Cisco wireless LAN controller (WLC2504 version 7.6.120). There is nothing special configured, just WPA2 Enterprise with certificates on the Windows machines. It seems to me, that from time to time (happened 3x in the past 8 months or so ...) the Cisco WLAN controller sends broken radius packages or something that freeradius doesn't like. At first, I looked into the Cisco WLAN controller logfile, it logs something like "Radius server didn't answer request". Next step was to restart freeradius manually on the console with the "-X" option to see what might be going on. But freeradius didn't log anything. Next try was with "-X -x", but also no output there. I then made sure with wireshark/tcpdump that the Cisco is really sending out radius packets and that they reach the freeradius server. They do and the packets look good in wireshark, nothing that is apparently broken with them. But freeradius is not sending out anything. When I restart the Cisco, the problem goes away, so I'm quite sure that it's the Cisco that is sending broken packets somehow. Does anybody have an idea how to debug this further? I could ask Cisco, but they'll probably blame it on freeradius :-) best regards, Gary _____________________________________________________________ Washington DC's Largest FREE Email service. ---> http://www.DCemail.com ---> A Washington Online Community Member ---> http://www.DCpages.com

2 1

Accept all users?
by Dominik Menke 04 Mar '15

04 Mar '15

Hello list, I'm trying to secure my wireless networks with RADIUS, so that any combination of username/password will let the user in. So far I tried to add this line to my `users` file: DEFAULT Auth-Type := Accept With radtest I could get a positive feedback, but when I wire up the RADIUS server with my wireless AP and try to connect (via EAP-TTLS/MSCHAPv2), no connection is established. This happens on both a TP-Link router with OpenWRT and an Ubiquity UniFy AP as access point. Here's the debug output of freeradius (excerpt, the full log is attached): > rad_recv: Access-Request packet from host 192.168.8.1 port 60199, id=16, length=190 > User-Name = "foousername" > Called-Station-Id = "C2-4A-00-6C-F1-53:use.any.password" > NAS-Port-Type = Wireless-802.11 > NAS-Port = 1 > Calling-Station-Id = "E8-DE-27-1D-04-02" > Connect-Info = "CONNECT 54Mbps 802.11g" > Acct-Session-Id = "54EC901D-00000008" > Framed-MTU = 1400 > EAP-Message = 0x029f001001666f6f757365726e616d65 > Message-Authenticator = 0xd8aca58525e34524e692e7a0d3f6eab9 > # Executing section authorize from file /etc/freeradius/sites-enabled/default > +group authorize { > ++[preprocess] = ok > ++[chap] = noop > ++[mschap] = noop > [eap] EAP packet type response id 159 length 16 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] = updated > [files] users: Matched entry DEFAULT at line 1 > ++[files] = ok > ++[logintime] = noop > [pap] WARNING: Auth-Type already set. Not setting to PAP > ++[pap] = noop > +} # group authorize = updated > Found Auth-Type = Accept > Auth-Type = Accept, accepting the user > # Executing section post-auth from file /etc/freeradius/sites-enabled/default > +group post-auth { > ++[exec] = noop > +} # group post-auth = noop > Sending Access-Accept of id 16 to 192.168.8.1 port 60199 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 0 ID 16 with timestamp +5 The "sites-enabled/default" config is pretty much untouched from installation. For me it seems like a successful user authorization? When running tcpdump on the access point, I only see the outgoing EAP package. I'm a bit clueless now... Greetings, Dominik

4 5

Re: Question about multiple sql databases!
by Haviaras Kostas 04 Mar '15

04 Mar '15

Thanks for your responses Alan, can you guide me where to look? Thanks again

1 0

Re: Question about multiple sql databases!
by Haviaras Kostas 04 Mar '15

04 Mar '15

It matters if the user have the same username in the three databases??

2 1

Re: Question about multiple sql databases!
by Haviaras Kostas 04 Mar '15

04 Mar '15

>> I just tested, you are right, I am getting the same result! You know how to >> solve this ??? > > Configure multiple SQL modules. One for each virtual server. > > Or, update the queries to include a “database table” field. Take that field from a RADIUS >attribute. Probably one you create yourself (see raddb/dictionary). Then, in each virtual server, set > the value of that attribute to the correct database table. And then use the same SQL module in >all 3 virtual servers. > > Alan DeKok. Thanks for your response Alan, I have configure 3 SQL modules in the sql file, one for each virtual server and when I am connecting to one virtual server it is connect also to the other 2. My sql module is like this: /etc/freeradius/mods-enabled/sql: sql{ } sql fordb1{ } sql fordb2{ } sql fordb3{ } And my virtual servers are in the /etc/freeradius/sites-enabled/server1 server server1{ listen { type = auth ipaddr = * port = 50002 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = acct ipaddr = * port = 50003 limit { } } listen { type = auth ipv6addr = :: port = 50002 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 50003 type = acct limit { } } authorize { filter_username preprocess chap mschap digest suffix eap { ok = return } files fordb1 checkthetime1 -ldap expiration logintime pap } authenticate{ Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest eap } preacct { preprocess acct_unique suffix files } accounting { detail unix fordb1 exec attr_filter.accounting_response } session { fordb1 } post-auth { fordb1 exec remove_reply_message_if_eap Post-Auth-Type REJECT { fordb1 attr_filter.access_reject eap remove_reply_message_if_eap } } pre-proxy { } post-proxy { eap } } And similary I have create the other 2 virtual servers. I have to configure anything to radiusd.conf? I don't know if I am missing something here. Thanks

2 1