April 2015 - Freeradius-Users - lists.freeradius.org

Proxying between RADIUS servers using TLS
by Stefan Paetow 01 Apr '15

01 Apr '15

Hi, Since FR now supports TLS, how should I configure proxy.conf to specify that I want a specific realm to be handled over TLS (instead of the default UDP)? I can't find anything in the online docs (am happy to submit patches to improve this in 3.0.8 and later once I've tested that here). Alan(x2)? Arran? Any ideas? Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

4 15

which attribute identifies the client?
by Stefano Zanmarchi 01 Apr '15

01 Apr '15

Hallo, I can see in the logs the "client" calling my radius, e.g: Wed Apr 1 13:28:06 2015 : Auth: Login OK: [jsmith(a)unipd.it] (from client radius_garr_1 port 0 cli e4-d5-3d-b2-29-ca) Wed Apr 1 13:28:07 2015 : Auth: Login OK: [anonymous(a)rug.nl] (from client economia.unipd.it port 3 cli 94-eb-cd-6d-e0-ad) which is the attribute containing the "client" (radius_garr_1, economia.unipd.it,...)? I'd like to use it in the %{...} form to perform some filtering in the authorize section of inner-tunnel file. Thanks a lot, Stefano

2 1

FR 3.0.8 sql
by Marcin 01 Apr '15

01 Apr '15

Hi, #v+ if (Framed-Protocol == "PPP") { linelog sql_last_online if (fail){ ok } } #v- #v+ (2) # Executing section accounting from file /etc/freeradius/sites-enabled/default (2) accounting { (2) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (2) detail: --> /var/log/freeradius/radacct/172.21.7.176/detail-20150401 (2) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.21.7.176/detail-20150401 (2) detail: EXPAND %t (2) detail: --> Wed Apr 1 10:07:35 2015 (2) [detail] = ok (2) [unix] = ok (2) radutmp: EXPAND /var/log/freeradius/radutmp (2) radutmp: --> /var/log/freeradius/radutmp (2) radutmp: EXPAND %{User-Name} (2) radutmp: --> bobpppoe (2) [radutmp] = ok (2) if (Framed-Protocol == "PPP") { (2) if (Framed-Protocol == "PPP") -> TRUE (2) if (Framed-Protocol == "PPP") { (2) linelog: EXPAND Accounting-Request.%{%{Acct-Status-Type}:-unknown} (2) linelog: --> Accounting-Request.Start (2) linelog: EXPAND /var/log/freeradius/linelog (2) linelog: --> /var/log/freeradius/linelog (2) linelog: EXPAND %T|C|%{Acct-Unique-Session-ID}|%{Framed-IP-Address}|%{Calling-Station-Id}|%{NAS-IP-Address}|%{NAS-Identifier} (2) linelog: --> 2015-04-01-10.07.35.000000|C|2df2a8590df82d3c84648b7a1b17d357|10.5.4.3|08:00:27:D6:04:2D|172.21.7.176|TestowyMT (2) [linelog] = ok (2) sql_last_online: EXPAND %{tolower:type.%{Acct-Status-Type}.query} (2) sql_last_online: --> type.start.query (2) sql_last_online: Using query template 'query' rlm_sql (sql_last_online): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql_last_online): Opening additional connection (0), 1 of 10 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect to MySQL server myDB@127.0.0.1:myDB rlm_sql_mysql: MySQL error: Can't connect to MySQL server on '127.0.0.1' (111) rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql_last_online): Opening connection failed (0) (2) [sql_last_online] = fail (2) } # if (Framed-Protocol == "PPP") = fail (2) } # accounting = fail (2) Not sending reply to client. (2) Finished request #v- and another reqest is sending by nas. How to configure, that if sql_last_olnie module can't connect to database, then still is 'ok' and generally accounting section reply ok?

1 1

Dynamic vlan with ldap group fail
by Sautron Nick 01 Apr '15

01 Apr '15

Hello everyone, I have a problem concerning the dynamic assignment of VLAN according to ldap groups. Here is my shemas ldap: dc = company, dc = com ou = eduroam ou = groups cn = service cn = personal cn = student cn = users my users files : DEFAULT Ldap-Group == "service" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 5 DEFAULT Ldap-Group == "personnal" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 6 DEFAULT Ldap-Group == "student" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 7 DEFAULT Ldap-Group == "users" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 8 modules/ldap files : ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "********" identity = "cn=admin,ou=eduroam,dc=company,dc=fr" password = ****** basedn = "ou=People,dc=company,dc=fr" filter = "(&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(dialupAccess=true))" base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 ............ # # Group membership checking. Disabled by default. # groupname_attribute = cn groupmembership_filter = "(&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=company,dc=fr))" #groupmembership_attribute = radiusGroupName freeradius -X extract ..... [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=****,dc=fr -> ou=People,dc=*****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ***** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(dialupAccess=true)) -> (&(Login=******)(dialupAccess=true)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*******,dc=fr, with filter (&(Login=*****)(dialupAccess=true)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ****** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) -> (&(Login=******)(isMemberOf=ou=groups,ou=eduroam,dc=******,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*****,dc=fr, with filter (&(cn=service)(&(Login=*****)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group service not found or user is not a member. [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=******,dc=fr -> ou=People,dc=****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ***** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*******,dc=fr)) -> (&(Login=*******)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*****,dc=fr, with filter (&(cn=personnal)(&(Login=*******)(isMemberOf=ou=groups,ou=eduroam,dc=******,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group personnal not found or user is not a member. [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=******,dc=fr -> ou=People,dc=*****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ***** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*******,dc=fr)) -> (&(Login=*****)(isMemberOf=ou=groups,ou=eduroam,dc=*******,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=****,dc=fr, with filter (&(cn=student)(&(Login=*****)(isMemberOf=ou=groups,ou=eduroam,dc=****,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group student not found or user is not a member. [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=******,dc=fr -> ou=People,dc=****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ******* [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) -> (&(Login=****)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*******,dc=fr, with filter (&(cn=users)(&(Login=******)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group users not found or user is not a member. ++[files] returns noop [ldap] performing user authorization for ******* [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ***** [ldap] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(dialupAccess=true)) -> (&(Login=****)(dialupAccess=true)) [ldap] expand: ou=People,dc=******,dc=fr -> ou=People,dc=****,dc=fr [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=******,dc=fr, with filter (&(Login=*****)(dialupAccess=true)) .......... Someone can explain to me, why the freeradius server can not find the groups? Is this the right configuration? Best regards

2 3

Re: Freeradius-Users Digest, Vol 120, Issue 1
by Rui Ribeiro 01 Apr '15

01 Apr '15

Hi Adam, Daloradius is not maintained since 2012, and only supports FR 2.x. Configure MySQL, accounting in FR, and also your APs/controller to send accounting data. I have written some basic python scripts, and tested elastic search. Our federation has done a fantastic job with elastic search too. Regards > Message: 1 > Date: Tue, 31 Mar 2015 15:24:55 -0400 > From: Adam Schappell <aschappell(a)clearedgeit.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: integrating daloradius > Message-ID: > <CAHoRX4K1rKAoTTvs5upkmON24RwJxVaO5LXt8ej-qL= > zys7N3g(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hello, > > Has anyone been successful with integrating freeradius with daloradius? I > have freeradius running and can get to the web interface for daloradius but > do not know how to get the users that are on the wifi to show up? Also is > there any way to import users from AD (since im using MS AD for > authentication). Thanks! > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0