August 2015 - Freeradius-Users - lists.freeradius.org

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

freeradius2 + iODBC + Informix
by vanish 28 Nov '16

28 Nov '16

Hello, Please help me set up freeradius2 + iODBC + Informix (I'm newbie in freeradius). - I have a test-machine with Ubuntu 14.04 and Freeradius-server v2.1.12. - I have a server with Informix Database Server v 10.00 Step 1: - I installed unixODBC on test-machine - I installed informix-csdk for connect to Informix Database Server (Driver) - I configured files /etc/odbc.ini and /etc/odbcinst.ini to connect to Informix Database Server - Checking with isql: +++++++++++++++++++++++++++++++++++++++++ root@test:/home/test# isql -v work +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> select 1 from TABLES(SET{1}) 1 +++++++++++++++++++++++++++++++++++++++++ - Everything is allright. Step 2: - I try to install freeradius-iodbc module to connect to Informix Database Server - During install I get next warning: +++++++++++++++++++++++++++++++++++++++++++++ The following packages will be REMOVED: unixodbc unixodbc-dev The following NEW packages will be installed: libiodbc2-dev +++++++++++++++++++++++++++++++++++++++++++++ - so unixodbc and unixodbc-dev packages was removed after install freeradius-iodbc - I included in radiusd.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "iodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ - freeradius -XXX showed me next error: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ... Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test Fri Nov 21 14:53:48 2014 : Debug: rlm_sql (sql): starting 0 Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 Fri Nov 21 14:53:48 2014 : Error: sql_create_socket: SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded Fri Nov 21 14:53:48 2014 : Error: rlm_sql (sql): Failed to connect DB handle #0 ... +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - Error - "SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded." - Where did I go wrong? - I found some information in net with same problem, but clear decision nowhere not found.

4 4

No Logon Servers error with FreeRADIUS + NTLM
by Stefan Paetow 19 Feb '16

19 Feb '16

Hi, I know this is not a problem with FreeRADIUS, however, there are several people on this list who run FreeRADIUS with Active Directory as a back end and I need their advice on this. I've run into the dreaded "No logon servers (0xc000005e)" error with NTLM. In the past I've found that the computer password for the server expired on AD and that it was either fixed by rejoining, or by tweaking the password's expiry. Do any AD folk on the list know what we can do to get this stable and that this does not occur again? Any ideas will be very useful. :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 1

buffered_sql problem
by Ricardo Larrañaga 29 Sep '15

29 Sep '15

Hello Guys: I was wondering if you could help me with an issue that i am having with my buffered_sql configuration. I am using freeradius 3.0.4, under centos 7, and with buffered sql configuration, and since 3 days ago, no accounting records are being imported into my database. detail and detail.work files are in the proper directory, but detail.work keeps growing and it does not look like it is offloading any data to the DB, Almost like buffered_sql would not be reading the detail.work file anymore. Now, i did run the server in debug mode, and i see the detail.work file being read. I do see one problem with the db insertion of some accounting records. It looks like it looks like some acct records are coming with a acctuniqueid that is already in the db, so those fail, but my question is, will the server keep trying to insert that record and not try any others in the detail.work file? My buffered_sql config is pretty standard: server buffered-sql { listen { type = detail filename = "/buffer_disk/detail" load_factor = 10 poll_interval = 1 retry_interval = 30 } preacct { preprocess acct_unique files } accounting { sql_radacct } The first packet in the detail.work file fails with a db error for having a duplicated acctuniqueid. Will the server continue processing other packets? Will that packet stay in the file? At this point i have a really big amount of packets in the file, and no accounting records on my db, so i am really looking forward to fix this issue. Thanks for any help you could provide. Regards

5 14

Rest API for authentication
by Randeep 22 Sep '15

22 Sep '15

Hi Alan, We have two types of IPTV boxes. One has pppoe support and other one doesn't have pppoe support. We are using FreeRadius 3.0.8 for authentication. I remember you mentioning that authentication can be done via a rest api also. So we can use this api for authentication for the device which doesn't have the pppoe support. Can you please help in configuring this. I couldn't find the details in documentation. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 4

Specific, complicated, detailed user rights possibility?
by Mart Pirita 14 Sep '15

14 Sep '15

Hi, We have idea to use radius for rights and ldap for authentication. So that radius acts proxy for external ldap and this part is working. But we need more detailed setup, for example, the idea is to allow user1 access some switches and disable user1 to access some other switches. And then even more specific rights, for example, switches which user1 can access, he have some switch with read-only and some other switch with read-write rights. And do it with groups, not using different configuration for every user, for example, so that users are listed in as groups, and these groups are used in access configurations? Huntgroups may be the solution, but as far I know, huntgroups are for device, and not for user rights. Also I don't know, can one and same device IP exist in many different huntgroups and can one huntgroup include other huntgroups? Is such setup possible and if yes, then how? -- Mart

2 5

Respond to DHCP Lease Query requests using rlm_cache
by Бен Томпсон 06 Sep '15

06 Sep '15

Hi Everyone I have configured FreeRADIUS to as a DHCP server which offers IP addresses based on the option 82 values added by a DHCP relay. In cases where the client sends a unicast renew request bypassing the relay, the option 82 values are queried from an instance of rlm_cache which have configured to keep a record of leases. (This replicates the option 82 "Stash" functionality in ISC DHCP Server). A bit of unlang is involved to check that the lease is valid and take care of clearing out the cache, but it is all fairly simple. The aformentioned server is working well, but I would also like it to be able to respond to Lease Query requests, and wondered if it would be possible to make it work in a similar way using rlm_cache. I would envisage that configuration might look something like this: dhcp DHCP-Lease-Query { # look in the cache to see if there is an active lease cache # check to see if we know about this IP ...some unlang lookup the IP from our usual auth source/DB ... ... some unlang to figure out if the lease(s) are valid, etc. ... # work out which type of reply packet is requred and add the relevant options if (result of above says lease is active) { update reply { DHCP-Message-Type := DHCP-Lease-Active ... add some other stuff to the reply... } } elsif (result of above says lease is unassigned) { update reply { DHCP-Message-Type := DHCP-Lease-Unassigned ... add some other stuff to the reply... } } elsif (result of above says lease is unknown) { update reply { DHCP-Message-Type := DHCP-Lease-Unknown ... add some other stuff to the reply... } } } I am guessing that the source code would need to be modified, and if so, it may be too much for me as I am not a skilled C programmer. I would be able to test it however. If it is possible without editing the code I would be grateful to find out how. Thanks Ben

3 17

Auth-Type LDAP and "WARNING: Unknown value specified for Auth-Type. Cannot perform requested action"
by José Ignacio Siles Rueda 03 Sep '15

03 Sep '15

Hi, I'm well aware about not setting Auth-Type and let freeradius choose properly auth method, but I need LDAP authentication, and IT staff of LDAP server is very hostile to give freeradius userPassword info. So, my only choice is binding user to LDAP, and pray for the best... AFAIK, if I can't get proper userPassword (stored in SHA1 in LDAP), I'll never reach PAP module, and my only way out is using LDAP binding in authorize and authenticate sections of inner-tunnel. I'm using 2.1.12 version, and my inner-tunnel is as follows: server inner-tunnel { authorize { suffix eap { ok = return } switch "%{Realm}" { case "alumno.upo.es" { LDAP_estudiantes } case "upo.es" { LDAP_docentes } } } authenticate { eap Auth-Type LDAP_estudiantes { LDAP_estudiantes } Auth-Type LDAP_docentes { LDAP_docentes } Auth-Type PAP { pap } } session { radutmp } post-auth { reply_log Post-Auth-Type REJECT { attr_filter.access_reject } update outer.reply { User-Name = "%{request:User-Name}" } } And modules/ldap is as follows: ldap LDAP_estudiantes { server = "ldap.XXX.XX" basedn = "o=XXX, c=XX" filter = (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@alumno.XX.XX)(mailAlternateAddress=%{Stripped-User-Name}@alumno.XX.XX))<mailto:mail=%25%7bStripped-User-Name%7d@alumno.XX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@alumno.XX.XX))> (IrisUserEntitlement=urn:mace:XXX.XX:XX.XX:entitlement:ServiciosRed:wifi:estudiantes) base_filter = "(objectclass=irisperson)" groupname_attribute = "IrisUserEntitlement" groupmembership_attribute = "IrisUserEntitlement" ldap_connections_number = 100 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile=/etc/raddb/certs/SCSChain.XX.XX } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } ldap LDAP_docentes { server = "ldap.XXX.XX" basedn = "o=XXX, c=XX" filter = (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@XX.XX)(mailAlternateAddress=%{Stripped-User-Name}@XX.XX))<mailto:mail=%25%7bStripped-User-Name%7d@XX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@XX.XX))> (IrisUserEntitlement=urn:mace:XXX.XX:XX.XX:entitlement:ServiciosRed:wifi:Docentes) base_filter = "(objectclass=irisperson)" groupname_attribute = "IrisUserEntitlement" groupmembership_attribute = "IrisUserEntitlement" ldap_connections_number = 100 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile=/etc/raddb/certs/SCSChain.XX.XX } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } And, if I try one user with "alumno.XX.XX" realm, I'm getting: [ttls] Got tunneled request User-Name = "uwifialumno(a)alumno.XX.XX<mailto:uwifialumno@alumno.XX.XX>" User-Password = "XXXX" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "uwifialumno(a)alumno.XX.XX<mailto:uwifialumno@alumno.XX.XX>" User-Password = "XXXXX" FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} [suffix] Looking up realm "alumno.XXX.XX" for User-Name = "uwifialumno(a)alumno.XXX.XX<mailto:uwifialumno@alumno.XXX.XX>" [suffix] Found realm "alumno.XXX.XX" [suffix] Adding Stripped-User-Name = "uwifialumno" [suffix] Adding Realm = "alumno.XXX.XX" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop expand: %{Realm} -> alumno.XXX.XX ++- entering switch %{Realm} {...} +++- entering case alumno.XXX.XX {...} [LDAP_estudiantes] performing user authorization for uwifialumno [LDAP_estudiantes] expand: (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@alumno.XXX.XX)(mailAlternateAddress=%{Stripped-User-Name}@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:mail=%25%7bStripped-User-Name%7d@alumno.XXX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> -> (&(|(uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> [LDAP_estudiantes] expand: o=XXXXXX, c=XX -> o=XXXXX, c=XX [LDAP_estudiantes] ldap_get_conn: Checking Id: 0 [LDAP_estudiantes] ldap_get_conn: Got Id: 0 [LDAP_estudiantes] performing search in o=XXXXX, c=XX, with filter (&(|(uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> [LDAP_estudiantes] looking for check items in directory... [LDAP_estudiantes] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [LDAP_estudiantes] Setting Auth-Type = LDAP_estudiantes [LDAP_estudiantes] user uwifialumno authorized to use remote access [LDAP_estudiantes] ldap_release_conn: Release Id: 0 ++++[LDAP_estudiantes] returns ok +++- case alumno.upo.es returns ok ++- switch %{Realm} returns ok Found Auth-Type = LDAP_estudiantes WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. Login incorrect: [uwifialumno] (from client RedAPs-oviwan port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Why am I getting "Unknown value specified for Auth-Type", if I define: Auth-Type LDAP_estudiantes { LDAP_estudiantes } In my inner-tunnel config file? Thanks in advance, Ignacio Siles Jefe de Proyecto- Infraestructuras / Sol. y Prod. Wireless Dirección de Servicios y Soluciones I.T. Teléfono: +34 672.283.836 Skype jisiles.ingenia C/Severo Ochoa, 43 Parque Tecnológico de Andalucía 29590. Málaga Tel: +34 952029300 | Fax: +34 952029309 www.ingenia.es<http://www.ingenia.es>

2 5

stale session
by Sergio Diaz 02 Sep '15

02 Sep '15

Hello Guys, I am simulating the problem on what if the AP goes down (due to various reasons). I observed that user is not properly disconnected and result is stale session. When the AP is up and when the previous user tries to log in he/she gets login failed message because "Simultaneous-Use" is in effect while previous session is still ticking. How can prevent and fix this? Saludos Cordiales, Sergio Diaz Infraestructura TI 01(55) 5265.0145 (044) 55.28.99.95.71 sdiazf(a)logitel.com.mx www.logitel.com.mx

3 10