June 2015 - Freeradius-Users - lists.freeradius.org

Problem with Hints file
by Craig Nattrass 30 Jun '15

30 Jun '15

Hi, I have just upgraded to version 3.0.8 from 3.0.0 My goal is to combine the User-Name and the Mikrotik-Realm in the hints into the following: User-Name := "%{User-Name}@%{Mikrotik-Realm}" This would be for the Authentication and the Accounting. I version 3.0.0 this part worked. However the username did not pass correctly SQL-User-Name but with fiddling with the strip username seemed to resolve this. When the Accounting packets came in I ended up with User-Names looking like this: ai:=28=5B0-9a-f=5D=7B32=7D=29 which was expanded from: (122) sql : expand: "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" -> 'ai:([0-9a-f]{32})' (122) sql : SQL-User-Name set to "ai:([0-9a-f]{32})" this was when I decided to upgrade to 3.0.8 version 3.0.0 sample log: Called-Station-Id = 'hotspot1' NAS-Port-Id = 'wlan2' User-Name = 'craign' MS-CHAP-Domain = 'wifi.co' NAS-Port = 2148532316 Acct-Session-Id = '8010005c' Framed-IP-Address = 10.254.2.245 Mikrotik-Host-IP = 10.254.2.245 User-Password = 'mmmm' Service-Type = Login-User WISPr-Logoff-URL = 'http://10.254.2.1/logout' NAS-Identifier = 'MikroTik' Mikrotik-Realm = 'wifi.co' NAS-IP-Address = 10.99.0.16 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) ? if (User-Name != "%{tolower:%{User-Name}}") (0) expand: "%{tolower:%{User-Name}}" -> 'craign' (0) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE (0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE (0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE (0) ? if (User-Name =~ /(a)\\./) (0) ? if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) preprocess : hints: Matched DEFAULT at 19 (0) preprocess : expand: "%{User-Name}@%{Mikrotik-Realm}" -> 'craign(a)wifi.co' (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) [files] = noop (0) sql : expand: "%{%{User-Name}:-DEFAULT}" -> 'craign' (0) sql : SQL-User-Name set to "craign" This is the logs from version 3.0.8 The below shows the preprocess from the hints adding neither the User-Name Nor the Mikrotik-Realm to the User-Name: the values of %{User-Name} and %{Mikrotik-Realm} are being dropped. Called-Station-Id = 'hotspot1' (0) NAS-Port-Id = 'wlan2' (0) User-Name = 'craign' (0) MS-CHAP-Domain = 'wifi.co' (0) NAS-Port = 2148532315 (0) Acct-Session-Id = '8010005b' (0) Framed-IP-Address = 10.254.2.245 (0) Mikrotik-Host-IP = 10.254.2.245 (0) User-Password = 'mmmm' (0) Service-Type = Login-User (0) WISPr-Logoff-URL = 'http://10.254.2.1/logout' (0) NAS-Identifier = 'MikroTik' (0) Mikrotik-Realm = 'wifi.co' (0) NAS-IP-Address = 10.99.0.16 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") { (0) EXPAND %{tolower:%{User-Name}} (0) --> craign (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) { (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) { (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) { (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) { (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (User-Name =~ /\\.$/) { (0) if (User-Name =~ /\\.$/) -> FALSE (0) if (User-Name =~ /(a)\\./) { (0) if (User-Name =~ /(a)\\./) -> FALSE (0) } # policy filter_username = notfound (0) preprocess: hints: Matched DEFAULT at 19 (0) preprocess: EXPAND %{User-Name}@%{Mikrotik-Realm} (0) preprocess: --> @ (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) [files] = noop (0) sql: EXPAND %{%{User-Name}:-DEFAULT} (0) sql: --> craign (0) sql: SQL-User-Name set to 'craign' Regards Craig

3 5

Delayed bind options?
by Franks Andy (IT Technical Architecture Manager) 29 Jun '15

29 Jun '15

Hi all, Am using freeradius 3.1.0 (compiled from source). Is there any way with this versions (or previous) to prevent the initial bind to at least ldap and/or mysql databases when the service starts? The situation is that sometimes a resource that is initially bound (one of our 5 AD servers for example) is unavailable, which prevents being able to restart the freeradius service. If we do, it will not start. If the resource isn't around when the service is already started, it doesn't cause too many issues since we use redundant-load-balance etc features on that module or just force-allow a connection failure, so that failure to write logging information to a DB doesn't cause rejection. I've hit this happen a couple of times, and since we're looking to relocate some AD servers with expected downtime I'd rather avoid the risk. I could remove the configuration for that server on each FR box, but it's a bit of a job as we have quite a few now. I did search for 30mins or so, but it didn't turn much up, so apologies if I've overlooked the most heavily documented feature going.. Thanks Andy

3 3

PAM authentication with Eduroam
by Kristoffer Dalby 29 Jun '15

29 Jun '15

Hi I am researching the possibility of using freeradius/eduroam as authentication backend through PAM for SSH. This far in my research, i have run into a few questions that i cant quite find the correct answer to. Currently i cannot understand if the PAM module is able to handle the password as a hash, or if it is able to use secure communication such as EAP-TLS. Also, as eduroam is a hierarchy of radius servers, where the authentication request is forwarded until it reaches the right server, it requires the credentials are encrypted so only the user and the correct server can "see" them. I do quite understand if this is even possible to achieve from the PAM side of my use case. Can anyone provide some clarification on these cases? My English is not the best, so if my explanations is hard to understand, please let me know, and i will try again. -- Kristoffer Dalby Summer intern Abels gt. 5- Teknobyen NO-7465 Trondheim

5 7

LDAP draft-wahl-ldap-session
by Michael Ströder 29 Jun '15

29 Jun '15

HI! Recently I appreciated very much that some LDAP clients send the Session Track Control [1] along with their LDAP requests. draft-wahl-ldap-session was written especially with RADIUS in mind. Any chance to see this implemented? [1] https://tools.ietf.org/html/draft-wahl-ldap-session Unfortunately I'm not a C programmer so I can only give some pointers and promise to test the feature later. Example code in OpenLDAP tools: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=clients/to… I guess the structs are here: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries/… Ciao, Michael.

2 14

freeradius Expiration attribute
by Stoian Mishev 29 Jun '15

29 Jun '15

Hi All, I have a very old installation of freeradius (1.1.4) on my production server. As I know the “Expiration” attribute disconnects the user at 00:00 at the expiration day. I want to change this to be at 12:00 for example as at 00:00 there is no support personnel at the office. I tried to change the Value of the attribute from “29 June 2015” to “29 June 2015 12:00” but it did not work. Maybe my installation is too old and it supports only date format for Expiration. I saw somewhere in this list that when the Expiration time comes the radius server sends Session-Timeout to the NAS. If so is it possible to offset this with 12 hours? Is there anyone that can help me with this. Thanks. -- Stoian Mishev NetWave Ltd. Varna, Bulgaria

2 1

Re: radiusd debug understanding help needed (EAP session for state 0x... did not finish)
by Rui Ribeiro 29 Jun '15

29 Jun '15

I confirm I am running 802.1X in a very similar equipment, a in a 2950 series. The setup has some caveats, but it is relatively simple to put it to work. > > From: "Zeus Panchenko" <zeus(a)ibs.dn.ua> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Subject: Re: radiusd debug understanding help needed (EAP session for > state 0x... did not finish > > absolutely do not know why didn't I provided this info yet ... > > the switch FR and supplicant connected to is: > > Cisco SF300-24 24-Port 10/100 Managed Switch > > > -- > Zeus V. Panchenko jid:zeus@im.ibs.dn.ua > IT Dpt., I.B.S. LLC GMT+2 (EET) >

1 0

Trying to understand change in behaviour between 2.1.12 and 2.2.5 (ok = reject) or Bug?
by Timothy White 29 Jun '15

29 Jun '15

Hey everyone I'm the main developer behind the Grase hotspot project, that internally uses Freeradius and Coova Chilli for a Captive portal hotspot. On my testing system, Freeradius recently upgraded to 2.2.5, which seems to have some strange new behaviour with my configs. I'm using the below snippit to get custom reply messages for rejections. authorize { ... logintime { reject = 1 } if(reject){ update reply { Reply-Message := "Your are not allowed to login at this time" } ok = reject } ... } This was working nicely in 2.1.12, detecting when the logintime module had returned a reject code, and then updating the Reply-Message with a nicer message. I've been doing this since at least 2012 without problems. I also use this for many other sections to return custom Reply-Messages when rejecting a user. However, in 2.2.5, it appears to be ignoring the ok = reject part, and it sends back an Accept-Accept with the Reply-Message, instead of an Access-Reject. Complete configs are available at https://github.com/GraseHotspot/grase-conf-freeradius/blob/master/freeradiu… (these configs have an extra "reject" under each ok = reject, something I tried which seems to have made no difference) My reading of the changelogs doesn't reveal anything obvious to me about a change in behaviour, so I'm starting to wonder if it's a bug? Has anyone else come across this problem/change? Regards Tim

4 4

Rejected: Realm does not have at least one dot separator
by Mohamed Lrhazi 27 Jun '15

27 Jun '15

Hello, I am redeploying 3.0.8 on a new system using the same config files as my existing prod systems... but in the new system, I get this error... Username does have a dot in the realm... but the expression somehow fails... (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") { (0) EXPAND %{tolower:%{User-Name}} (0) --> *georgetown_test(a)eduroamus.edu <georgetown_test(a)eduroamus.edu>* (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) { (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) { (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) { (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) { (0) * if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> TRUE* (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) { (0) update reply { (0) Reply-Message += "*Rejected: Realm does not have at least one dot separator*" (0) } # update reply = noop (0) [reject] = reject (0) } # if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) = reject (0) } # policy filter_username = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject In the config, the rule looks like so: sudo grep -A4 -B5 -r "dot separator" /etc/raddb /etc/raddb/policy.d/filter- # must have at least 1 string-dot-string after @ /etc/raddb/policy.d/filter- # e.g. "user(a)site.com" /etc/raddb/policy.d/filter- # /etc/raddb/policy.d/filter- if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) { /etc/raddb/policy.d/filter- update reply { /etc/raddb/policy.d/filter: Reply-Message += "Rejected: Realm does not have at least one dot separator" /etc/raddb/policy.d/filter- } /etc/raddb/policy.d/filter- reject /etc/raddb/policy.d/filter- } /etc/raddb/policy.d/filter- Thanks, Mohamed.

2 4

Attribute NOT being returned in access-accept but is returned in Access-Challenge
by Jake He 27 Jun '15

27 Jun '15

Hi, I have a problem where Attribute MT-Recv-Limit is returned in Access-Challenge but not in Access-Accept. This is my setup. FR 3.0.8 I have configured following in the eap.conf file in the ttls section : copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" /etc/freeradius/sites-available/inner-tunnel. post-auth block, uncommented. update { &outer.session-state: += &reply: } update outer.session-state { MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY } I have a fixed radreply attribute Session-Timeout in the database. This is sent in the Access-Accept. MT-Recv-Limit is sent by a perl script <https://raw.githubusercontent.com/zhex900/radius-config/master/version.3/mo…>. This script add a new radreply $RAD_REPLY{'Mikrotik-Recv-Limit'}. This is called in the site-available/default authorize block. Mikrotik-Recv-Limit does appear in the Access-Challenge but not in the Access-Accept. Any ideas? Jake

3 8

Re: Using AD and SQL to authenticate Wi-Fi users
by Andrés Gómez 26 Jun '15

26 Jun '15

Hi Bruno. Can you help me with the configuation to Active Directory to authenticate WiFi users? is it different to this guide? http://wiki.freeradius .org/guide/FreeRADIUS-Active-Directory-Integration-HOWTO Regards. 2015-06-18 12:34 GMT-05:00 Bruno de Paula Larini < bruno.larini(a)riosoft.com.br>: > Hi guys, > I've been using FR (3.0.4) to authenticate Wi-Fi users against Active > Directory and it is working fine. But now I need to check users in SQL > database too, like this: > > SSID1 -> check for users in AD > SSID2 -> check for users in SQL database > > I've managed to get it working, but only if the other authentication > method is disabled. Only one would work at a time. > To get SQL working, I've either commented the ntlm_auth from > mods-enabled/mschap or added the following to the authorize section in > sites-enabled/inner-tunnel: > > ... > update control { > MS-CHAP-Use-NTLM-Auth := No > } > mschap > ... > > Removing the above and/or uncommenting the ntlm_auth line, users from AD > are authenticated successfully but SQL users are not. > > I wanted to use unlang to check if the request came from a specific > Called-Station-Id, but the inner-tunnel doesn't bring this information and > always return false. > > Is there some check I can use to know where the request came from? > > Thank you! > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html -- *C. Andrés Gómez R.*

2 1