April 2015 - Freeradius-Users - lists.freeradius.org

Locking in rlm_detail
by Nathan Ward 28 Apr '15

28 Apr '15

Hi all, I’m a long time FR user but first time on this list. I’ve got a 3.0.4 system running, though I think that this applies to everything since d9b39f43f620aede773d41a930353926b52e3e68, which first saw release in 3.0.3. This seems to apply to v3.1.x also. The docs, and config parser, support an option in rlm_detail called “locking”. It was my hope that this would lock the file until it was closed, rather than locking the file only while I write was taking place, but I understand now that that’s not how the feature was intended. This is really by the by. However, in investigating this, I found that the “locking” option doesn’t seem to have any effect in 3.0.3+. The last code that I could find that looks at the state of the option is removed in the commit I mention above. It appears (from some quick, non-exhaustive code reading) that the new(ish) logfile API locks for all writes, so this option is no longer, well, optional? I understand that this isn’t relevant to my particular hope for the “locking” option, but, I wanted to try and understand it nonetheless. If the “locking” option and documentation need to be removed, I’m happy to submit PRs for this (against both v3.0.x and v3.1.x of course), but wanted to check first. -- Nathan Ward

2 3

How to Pass multiple Attribute Value Pair of Same Name.
by Amit Butere 28 Apr '15

28 Apr '15

Hi Guys, i am using FreeRADIUS Version 3.0.3 and using perl module when i pass single Attribute to perl script like ie. ( $RAD_CHECK{' Account-Info'} ) .i can get all the values of this variable available in the perl for processing. but when i am trying to pass multiple variable of same name i am not getting those values pass to perl script. in the DB i have following entries Account-Info = "AInternet-Sevice" Account-Info = "NBoD-2Meg" i gone through doc but i am missing something i guess kindly guide me what i am missing . also in previous version of radius 2.2.x . when using perl module i can simply print any variable with print command and variable name. how can i achieve same in this new version of radius. Regards Amit B.

3 4

rlm_perl and checksimul
by d tbsky 28 Apr '15

28 Apr '15

hi: I am using freeradius 3.0.4 comes with rhel 7.1. I want to write a checksimul perl script. but it seems won't be called. I create a rlm_perl instance "check_login", and put it under "default" site: session { check_login } and at perl script I write my code at finction below: sub checksimul { &radiusd::radlog(L_INFO, "check_login: I am here"); return RLM_MODULE_OK; } but "radiusd -X" show my code is not be called after user authentication. the code works fine if I put it at "authroize" or "post-auth" section. I don't know if I miss some steps or I met a bug..

2 3

Mikrotik DHCP and "auth-type := accept"
by Osvaldo T Crispim Filho 27 Apr '15

27 Apr '15

I use Freeradius and Mikrotik. Freeradius 2.1.10+dfsg-3ubuntu0.12.04.2 I want to use DHCP Server of Mikrotik with rlm_sqlippool. DHCP Server on Mikrotik do not send password. I want to use "auth-type := Accept" withou password I receve this on log: Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user How can i do that? Thankyou. -- - Osvaldo T Crispim Filho -

2 5

External script
by Amit Butere 27 Apr '15

27 Apr '15

Hi guys I am trying to write external Php script and return module codes and match those module codes using unlang . My script is being called and I can see that in debug. The error I get here is . Failed parsing output from script.php attributes : expecting operator I am returning values as 1 for success and 0 for fail Ultimately radius says module fail. I would be checking what operators to return value from Php script. Thanks in advance guys Regards Amit B

2 3

rlm_perl CLONE under freeradius 3.x
by d tbsky 26 Apr '15

26 Apr '15

hi: I am writing rlm_perl script under freeradius 3.0.4 which comes with RHEL 7.1. and I am confused about how thread working with rlm_perl. according to the old message at email list, if I want every radius thread to have their own unique variable, I should put the variable at "CLONE" function like below: our ($var); CLONE { $var = ''; } but after testing, I found even if the variable is not put at the CLONE function, they are still unique to each thread. may I ask what is the correct method to make global thread shared variable and thread unique variable under rlm_perl ? Regards, tbskyd

3 3

Printing as Integers in linelog
by Peter Balsianok 25 Apr '15

25 Apr '15

Hi, I want to use "Printing as Integers" %{Attribute-Name#}. Using %{Event-Timestamp#} will return the event timestamp as an unsigned 32-bit decimal number. May i use it in linelog ? Debug output: (0) log_acct_bras: EXPAND Accounting-Request.%{%{Acct-Status-Type}:-unknown} (0) log_acct_bras: --> Accounting-Request.Start (0) log_acct_bras: EXPAND /app_log/radius/acct/loaders/bdsl-%D.log (0) log_acct_bras: --> /app_log/radius/acct/loaders/bdsl-20150425.log (0) log_acct_bras: ERROR: %l|%{Acct-Status-Type}|%{Acct-Session-Id}|%{Acct-Unique-Session-Id}|%{User-Name}|%{NAS-IP-Address}|%{Event-Timestamp#}|%{Acct-Session-Time}|%{Connect-Info}|%{Acct-Input-Octets64}|%{Acct-Output-Octets64}|%{Called-Station-Id}|%{Calling-Station-Id}|%{Acct-Terminate-Cause}|%{%{Framed-IP-Address}:-%{Delegated-IPv6-Prefix}:-Unknown}|%{Acct-Delay-Time}|%{Session-Error-Msg}|%{Session-Error-Code} (0) log_acct_bras: ERROR: ^ No matching closing brace Thx

2 1

unlang question
by Peter Balsianok 25 Apr '15

25 Apr '15

Hi, In documentation (3.0.8) is module if (reject) { ... } But in case of rlm_perl i need to use (this works) perl { reject = 1 } if (reject) { ... } Thx.

2 3

Authenticating users on LDAP based on Group name
by Jose Torres-Berrocal 24 Apr '15

24 Apr '15

I am using the Freeradius2 2.1.12_1/2.2.5_3 pkg v1.6.10 in pfsense 2.1.5 I can't modify the conf files manually. I have to use the pfsense WebGui. I could authenticate the users of the LDAP succesfully but when I try to authenticate using group membership options it fails with the following logs. Wed Mar 25 13:39:09 2015 : Info: Loaded virtual server <default> Wed Mar 25 13:39:09 2015 : Info: Ready to process requests. Wed Mar 25 13:39:27 2015 : Auth: Invalid user ( [ldap] Pairs do not match): [administrator] (from client squid port 111) Wed Mar 25 13:39:33 2015 : Auth: Invalid user ( [ldap] Pairs do not match): [administrator] (from client squid port 111) Wed Mar 25 13:39:34 2015 : Auth: Invalid user ( [ldap] Pairs do not match): [administrator] (from client squid port 111) On pfsense I do not see an option to run in debug mode, but probably you can help me with the pfsense produced ldap conf file. I do not use fancy stuff. After I get it working I may try to add TLS configuration to have encrypted comm or passwords. The LDAP is an Active Directory on a Windows 2003 Server. The group name is InternetAccess. (Is this case sensitive?) I do not have a radiusprofile, where there is mention of radiusprofile is a default generated line. (In pfsense I may change the line but can not removed it or comment it.) LDAP CONF: /usr/pbi/freeradius-i386/etc/raddb/modules/ldap # -*- text -*- # # $ # Lightweight Directory Access Protocol (LDAP) # # This module definition allows you to use LDAP for # authorization and authentication. # # See raddb/sites-available/default for reference to the # ldap module in the authorize and authenticate sections. # # However, LDAP can be used for authentication ONLY when the # Access-Request packet contains a clear-text User-Password # attribute. LDAP authentication will NOT work for any other # authentication method. # # This means that LDAP servers don't understand EAP. If you # force "Auth-Type = LDAP", and then send the server a # request containing EAP authentication, then authentication # WILL NOT WORK. # # The solution is to use the default configuration, which does # work. # # Setting "Auth-Type = LDAP" is ALMOST ALWAYS WRONG. We # really can't emphasize this enough. # ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "jetsms-srv2003.jetdom.local" port = "389" identity = "cn=pfsense,cn=Users,dc=jetdom,dc=local" password = Mypassword basedn = "cn=Users,dc=jetdom,dc=local" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 # # LDAP_OPT_TIMELIMIT is set to this value. timelimit = 3 # # seconds to wait for response of the server. (network # failures) default: 10 # # LDAP_OPT_NETWORK_TIMEOUT is set to this value. net_timeout = 1 # # This subsection configures the tls related items # that control how FreeRADIUS connects to an LDAP # server. It contains all of the "tls_*" configuration # entries used in older versions of FreeRADIUS. Those # configuration entries can still be used, but we recommend # using these. # tls { # Set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # # The StartTLS operation is supposed to be # used with normal ldap connections instead of # using ldaps (port 689) connections start_tls = no cacertfile = /usr/pbi/freeradius-i386/etc/raddb/certs/ca_ldap1_cert.pem cacertdir = /usr/pbi/freeradius-i386/etc/raddb/certs/ certfile = /usr/pbi/freeradius-i386/etc/raddb/certs/radius_ldap1_cert.crt keyfile = /usr/pbi/freeradius-i386/etc/raddb/certs/radius_ldap1_cert.key randfile = /usr/pbi/freeradius-i386/etc/raddb/certs/random # Certificate Verification requirements. Can be: # "never" (don't even bother trying) # "allow" (try, but don't fail if the certificate # can't be verified) # "demand" (fail if the certificate doesn't verify.) # # The default is "allow" require_cert = "never" } ### default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" ### ### profile_attribute = "radiusProfileDn" ### ### access_attr = "dialupAccess" ### # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap ################## THE BELOW IS NOT COMPILED WITH FREERADIUS ################################# # Set password_attribute = nspmPassword to get the # user's password from a Novell eDirectory # backend. This will work ONLY IF FreeRADIUS has been # built with the --with-edir configure option. # # See also the following links: # # http://www.novell.com/coolsolutions/appnote/16745.html # https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.S… # # Novell may require TLS encrypted sessions before returning # the user's password. # # password_attribute = userPassword # Un-comment the following to disable Novell # eDirectory account policy check and intruder # detection. This will work *only if* FreeRADIUS is # configured to build with --with-edir option. # edir_account_policy_check = no ################## THE ABOVE IS NOT COMPILED WITH FREERADIUS ################################# # # Group membership checking. Disabled by default. # groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = InternetAccess compare_check_items = yes do_xlat = yes access_attr_used_for_allow = yes # # The following two configuration items are for Active Directory # compatibility. If you see the helpful "operations error" # being returned to the LDAP module, uncomment the next # two lines. # ### MS Active Directory Compatibility is disabled ### # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # THIS WILL ONLY WORK FOR PAP AUTHENTICATION. # # THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes # ldap_debug: debug flag for LDAP SDK # (see OpenLDAP documentation). Set this to enable # huge amounts of LDAP debugging on the screen. # You should only use this if you are an LDAP expert. # # default: 0x0000 (no debugging messages) # Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS) #ldap_debug = 0x0028 # # Keepalive configuration. This MAY NOT be supported by your # LDAP library. If these configuration entries appear in the # output of "radiusd -X", then they are supported. Otherwise, # they are unsupported, and changing them will do nothing. # keepalive { # LDAP_OPT_X_KEEPALIVE_IDLE idle = 60 # LDAP_OPT_X_KEEPALIVE_PROBES probes = 3 # LDAP_OPT_X_KEEPALIVE_INTERVAL interval = 3 } }

4 24

3.0.8: Request log filename for virtual servers with a hythen
by Lai Fu Keung 24 Apr '15

24 Apr '15

Hi, I configured my 3.0.8 to have a separate log for all requests based on virtual servers. That is, in radiusd.conf, I uncomment the following line: requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log For "inner-tunnel" virtual server, the filename turns out to be "radiusd-inner----tunnel-20150424.log" (3 more hythens between "inner" and "tunnel"). The filename was fine in 3.0.7. Bug? My mistake? Fu

2 1