August 2015 - Freeradius-Users - lists.freeradius.org

Does Attribute virtual-server exist?
by Timmy 14 Aug '15

14 Aug '15

Dear All Freeradius Developers and Users, My servers are running Freeradius v2.2.7 and 2.2.8. Is there any existing attribute related to virtual_server? 1. If yes, to which dictionary does it belong? 2. If no, how do I define it? I think I am in need of it. I want to bind each subscriber login ID to his virtual server, so that if he logs in from other servers to which he has not subscribed, he will be kicked. Thanks for your precious opinion in advance. Yours Faithfully, Timmy

3 5

Proxy PEAP to one Radius Server - EAP-TLS to another Radius Server
by Basile Bluntschli 14 Aug '15

14 Aug '15

Hi All I would like to anwser PEAP radius requests on the receiving radius server and proxy EAP-TLS radius requests to another home server via the proxy function. Is this possible with unlang? Thanks Basile

6 15

ipppol error
by vilpalu 14 Aug '15

14 Aug '15

hello, I am trying to set dynamically ip addressees to different users groups. added pool name in accounting and post-auth sections. after authentication I got this error: (82) accounting { (82) detail: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (82) detail: --> /usr/local/var/log/radius/radacct/83.171.9.50/detail-20150813 (82) detail: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/83.171.9.50/detail-20150813 (82) detail: EXPAND %t (82) detail: --> Thu Aug 13 13:04:59 2015 (82) [detail] = ok (82) [unix] = ok (82) main_pool: This is not an Accounting-Stop (82) [main_pool] = noop (82) [exec] = noop (82) attr_filter.accounting_response: EXPAND %{User-Name} (82) attr_filter.accounting_response: --> kazkas (82) attr_filter.accounting_response: Matched entry DEFAULT at line 15 (82) [attr_filter.accounting_response] = updated (82) } # accounting = updated

2 3

User-Name missing realm in Access-Accept
by David Aldwinckle 13 Aug '15

13 Aug '15

Hi List, FreeRADIUS Version 2.1.12 It has been brought to my attention that my FreeRadius servers are responding to proxied requests from eduroam without the suffix portion of the user name. This is causing accounting issues for other institutions. In inner-tunnel, I have tried to add: post-auth { update outer.reply { User-Name = "%{request:User-Name}" } } I also have use_tunneled_reply = yes in eap.conf I see the Access-Accept messages going out, without the suffix: Sending Access-Accept of id 62 to 142.231.112.1 port 53243 MS-MPPE-Recv-Key = 0xd720476081b3ec7b8f7529a32f4c2c06f786a2c39aa888c7f157784db7673b47 MS-MPPE-Send-Key = 0x593de7fcae5ba512dec5d348b4500dea9ba73044c2c68ee661f7214a073377dd EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Proxy-State = 0x4f53432d457874656e6465642d49643d3138323338 What I want to see is: Sending Access-Accept of id 62 to 142.231.112.1 port 53243 MS-MPPE-Recv-Key = 0xd720476081b3ec7b8f7529a32f4c2c06f786a2c39aa888c7f157784db7673b47 MS-MPPE-Send-Key = 0x593de7fcae5ba512dec5d348b4500dea9ba73044c2c68ee661f7214a073377dd EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1(a)realm.com" Proxy-State = 0x4f53432d457874656e6465642d49643d3138323338 What am I missing? Thanks, Dave

6 14

AAA configuration
by Anisa Allahdadi 13 Aug '15

13 Aug '15

Hi all, I installed FreeRADIUS on Ubuntu, configured the database (mysql), performed radtest from the localhost and NTradPing from a remote WIN machine. Now I want to make this process automatic, so that every connection/disconnection to/from the Internet put a record in *radacct* table. I realized that I should configure my AP and I found some guides here: http://wiki.freeradius.org/vendor/Cisco I have 2 specific questions: 1. How and where exactly I can run the AAA configuration commands? 2. What if my NAS is not of Cisco family? Does that make any difference? Any help will be very appreciated. Thanks, Anisa

1 0

2 Independent MYSQL schemas for 2 independent groups of users
by Timmy 13 Aug '15

13 Aug '15

Dear All Freeradius Developers and Users, My server is running a Freeradius v2.2.7 with a single mysql server. I have been able to set up radius virtual servers listening on different ports. The next step is to configure 2 Independent MYSQL schemas for 2 independent groups of users AAA through their own virtual servers. This scenario is similar to 2 physically separate radius servers. In my case, I can reduce the operational cost to 1 physical server. In the era of rapid global warming, everybody should be responsible for it, right? Then, the policy will become: user group1 ==> port 1 ==> virtual server 1 ==> sql instance with schema radius1 user group2 ==> port 2 ==> virtual server 2 ==> sql instance with schema radius2 Other policy with not be altered. I have gone through many information but none of them tells which file or conf are responsible for 2 independent sql instances. Could anybody give me direction or share your experience? Thanks in advance. Yours Faithfully, Timmy

3 4

Re: Freeradius-Users Digest, Vol 124, Issue 27, Addition to the Re: OS X Mavericks not connecting to Debian FreeRADIUS Thread
by Edward Ulrich 13 Aug '15

13 Aug '15

Ha ha! I just realized I made a mistake in one of my postings.. I shouldn’t have been confused about what the WAN IP is as opposed to the LAN IP.. I forgot the WAN IP is the IP address for the internet connection over the internet— the “WIDE” area network, as opposed to “LOCAL” area network being the LAN of course.. For some reason it was in my mind that it meant “WIRELESS” area network when I typed that message, even though I should have known better. So no wonder you were face-palming themselves about that.. Also I did make another IP address goof in an early posting as well, but I do think most of the other points I made are valid. Laugh if you want, but one other issue I was confused about with potentially using the LAN address of the router is the fact that since it is used to access the router admin page, I thought that perhaps it is dedicated to only doing that and would have caused conflicts when used for other purposes. Like I said before, I think it would have been helpful to have a wireless router example in the config file and for it to mention the word LAN IP for that specific instance. Normally trial and error would clarify such issues, but the nature of FreeRAIDUS being a chain where any misconfiguration along the way breaks the entire process makes configuration a challenge. I do know how to read the log files and I try to use them the best that I can. Anyway, as you can see, I’m not a career sys admin.. But I do know my way around computers and I know Linux well enough. I realize how deep and complex FreeRADIUS can get, but I think I will eventually be able to implement it just fine for my purposes. You have been helpful so far despite the ribbings.. ;-) I’m determined to get a basic secure setup running. I thank you for your help so far. Edward

1 0

radiusd exits on signal 6
by Zeus Panchenko 12 Aug '15

12 Aug '15

hi, is it intentional behaviour? FR v.3.0.9 configured with LDAP, exiting on signal 6 when more than one user comply with filter ... I expected log file error or warning record but not exit ... ---[ `radiusd -X | tee /tmp/radiusd-X.log' output quotation start ]--- ... (1) files: Waiting for search result... (1) files: ERROR: Ambiguous search result, returned 2 unsorted entries (should return 1 or 0). Enable sorting, or specify a more restrictive base_dn, filter or scope (1) files: ERROR: The following entries were returned: (1) files: ERROR: uid=rad-visitor,authorizedService=802.1x-eap-tls@xyz,uid=jdoe,ou=People,dc=xyz Assertion failed: (entry != NULL), function ldap_next_entry, file getentry.c, line 48. zsh: abort radiusd -X | zsh: done tee /tmp/radiusd-X.log ---[ quotation end ]------------------------------------------------ and what sorting it means? I didn't find any sorting related option in ldap module config -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)

3 4

Re: Freeradius-Users Digest, Vol 124, Issue 23
by Rui Ribeiro 12 Aug '15

12 Aug '15

Hi Zeus, When I migrated from 2 to 3, I also had your problem and I gave up on users altogether, and coded everything in unlang. I could swear there are differences in the user files processing from 2 to 3, although I will have to go look to detail the specifics. There is also the advantage it is easier to control exactly where the rules are applied. Regards, > Message: 2 > Date: Wed, 12 Aug 2015 01:22:27 -2100 > From: "Zeus Panchenko" <zeus(a)ibs.dn.ua> > To: "Alan DeKok" <aland(a)deployingradius.com> > Cc: Buxey Alan <A.L.M.Buxey(a)lboro.ac.uk>, FreeRadius users mailing > list <freeradius-users(a)lists.freeradius.org> > Subject: Re: why is Called-Station-SSID not processed? > Message-ID: <20150812012227.8162(a)smtp.new-ukraine.org> > Content-Type: text/plain; charset="utf-8" > > Alan DeKok <aland(a)deployingradius.com> wrote: > > On Aug 8, 2015, at 10:48 PM, Zeus Panchenko <zeus(a)ibs.dn.ua> wrote: > > > and in general ... what is the LDAP equivalent to users file > configuration? > > > > There is no LDAP equivalent to the "users" file configuration. If > there was, it would be documented. > > > > ok, finally I have checked my v.2.x "users" file configuration against > v.3.0.9 installation and found, that in my case, > > User-Profile, set for DEFAULT user in "users" is not applied at all > ... though group check is passed successfully > > and I am unable to find anything what could shade light on the cause > ... so, help me to see it please ... > > here is what I receive: > > ---[ -X debug start ]------------------------------------------- > ... > (6) files: No group membership attribute(s) found in user object > rlm_ldap (ldap): Released connection (8) > (6) files: User is not a member of "wifi-lcu" > (6) files: Searching for user in group "visitor" > rlm_ldap (ldap): Reserved connection (9) > (6) files: Using user DN from request > "uid=rad-visitor,authorizedService=802.1x-eap-tls@xyz > ,uid=fo02-admin,ou=People,dc=xyz" > (6) files: Checking for user in group objects > (6) files: EXPAND > (&(cn=visitor)(memberUid=%{%{Stripped-User-Name}:-%{User-Name}})) > (6) files: --> (&(cn=visitor)(memberUid=rad-visitor)) > (6) files: Performing search in "ou=groups,ou=RADIUS,dc=xyz" with filter > "(&(cn=visitor)(memberUid=rad-visitor))", scope "sub" > (6) files: Waiting for search result... > (6) files: User found in group object "ou=groups,ou=RADIUS,dc=xyz" > rlm_ldap (ldap): Released connection (9) > (6) files: users: Matched entry DEFAULT at line 95 > (6) files: EXPAND User-Profile is %{User-Profile} > (6) files: --> User-Profile is > (6) [files] = ok > rlm_ldap (ldap): Reserved connection (10) > ... > ---[ -X debug end ]------------------------------------------- > > > > ---[ "users" file starting from L95 quotation start ]----------- > DEFAULT Ldap-Group == 'visitor', User-Profile := > "cn=visitor,ou=profiles,ou=RADIUS,dc=ibs" > Reply-Message := "User-Profile is %{User-Profile}", > Fall-Through = no > ---[ "users" file quotation end ]----------------------------- > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

2 1

Re: OS X Mavericks not connecting to Debian FreeRADIUS
by Edward Ulrich 12 Aug '15

12 Aug '15

I think configuring FreeRadius can be more within the grasp of people who aren’t career sys admins if the instructions were more clear. For example when finding the value to use as “ipaddr” in clients.conf, the instructions in the config file only mention to use the IP of the client, it does not mention if I should use the LAN IP or the WAN IP of my wireless router, for example. Now, obviously I would be able to figure that out through trail and error, but when there is a problem someplace else in the chain I want to know for certain that this value has been set exactly to what it needs to be right from the start.. A career systems administrator may already know which value to use but others would not, so why don’t they just give a specific example of using a wireless router in the lengthy docs of the config file and mention the name LAN IP or WAN IP? Also it is annoying to me how often the wireless router is referred to as the “client” in all sorts of instructions that I see, it is confusing terminology for the process even if it is technically correct. Anyway, with the ipaddr set to be the WAN IP of the router (and I also tried using the LAN IP, since the instructions don’t specify!) and the “Auth Server Address” set to be the IP of the server computer, the OS X client computer still gives me the “Invalid password” error. (Previously I have already tried all combinations of the IP addresses even before posting to this forum, I just wanted to clarify once and for all when I asked..) I have seen varying instructions which explain differing optimum addresses to set the static address of the server computer to be. I realize that it is important to set this to ensure that it doesn't change over time, but you did not really answer my question when I asked if it is crucial to set that for testing purposes when I know what the address of the server computer is in the meantime. Are you familiar with using XLM profiles for configuring networking on Mac Computers on newer OS X operating systems? I have seen information about that associated with WPA2-Enterprise and some sources even seem to suggest that it is mandatory with the newer Operating systems. As far as using the default method for creating the certificates in “raddb/certs,” almost all of the online sources I have seen have said not to use that method and give instructions for clearing that out and using custom openssl commands instead. Do you know of success creating certificates that work with OS X Mavericks using that default method? And can that method be automated using scripting? Right now that directory has been wiped out on my computer according to online instructions I have followed, so I can’t read any instructions that may have been included with it. Do you know if there has there been recent upgrades to the “raddb/certs” method in the newer versions of FreeRADIUS which would give it greater compatibility with newer versions of OS X? Thank you for your help! > freeradius-users-request(a)lists.freeradius.org > <mailto:freeradius-users-request@lists.freeradius.org> > August 11, 2015 at 6:00 AM > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: OS X Mavericks not connecting to Debian FreeRADIUS > (Alan DeKok) > 2. Re: Proxy (check status of the 3rd party server) (Alan DeKok) > 3. Re: Proxy (check status of the 3rd party server) (Alan Buxey) > 4. MAC Auth tied to user (johan firdianto) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 11 Aug 2015 09:41:28 +0200 > From: Alan DeKok<aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: OS X Mavericks not connecting to Debian FreeRADIUS > Message-ID:<471E3D86-06A1-45EA-AA7B-F79FBBA6F423(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Aug 10, 2015, at 9:57 PM, Edward Ulrich<email(a)edwardulrich.com> wrote: >> Question #1. As for the RADIUS requests not getting to the server, I have a question about the value of "ipaddr" in the "clients.conf" file. All of the instructions that I have seen have been unclear about what this value this should be set to specifically.. > > I don't see how the instructions are unclear. The IP address is the address of the RADIUS client. i.e. the Access Point, etc. > >> Should it be the IP address of the computer hosting the Radius server (192.168.1.113), or the IP address of the router (192.168.1.1), or some other value? I have tried all values and still get the same error message. Note that I have not yet set the ip address of the server computer to be static in the "/etc/network/interfaces" file. > > You will need a static IP for the RADIUS server. > >> Question 1a: What is the best value to use for the "ipaddr" variable in "clients.conf"? Such as the ip address of the server computer, ect.. > > The client. The file is called "clients.conf" for a reason. It defines clients. It doesn't define servers. > >> Question 1b: What is the best value to use for the "Radius Auth Server Address" setting in the router (using DD-WRT)? Presumably it is the same value as 1a? > > No. It is the address of the server. I have no idea how this can be confusing. > >> Question 1c: How important is setting the IP address of the server computer to be static while testing even though I am sure that the IP address of the server computer is currently 192.168.1.113 for the time being? > > It is important to have a static IP. > >> Question 1d: What is the best source of information about this issue if the answer is complex? > > The answer is simple. The meaning of the fields are clearly defined in the configuration files. > >> Question #2. Version 2.1.12 of FreeRADIUS is the one that was installed when I entered the "apt-get update" and "apt-get install freeradius" commands. What would be the biggest benefits of upgrading to a newer version? Presumably I would need to reconfigure from scratch if I upgraded, am I correct? I have a feeling my problems are elsewhere for the time being if the user client computer is not connecting to the server though. > > I would suggest getting the basics right first, before trying something complicated. > >> Question #3. When you say "Users cannot manually configure their 802.1x settings" on Mac computers starting with OS X Lion, do you mean that it is mandatory to configure Mavericks using the XML method? > > I have no idea what that means. Which "You" are you referring to? Where did you get this information from? > >> Question #4. As for the certificates, they are being created using the "sha1" method like you suggested (typed like that rather than "sha-1" if that makes any difference.) The "default_bits" are set to 2048. Following is the command I used to create the DH file: "openssl dhparam -check -text -5 1024 -out dh". I have seen some instructions that say to trim sections out of the certificates using a text editor before using them with a Mac, would it be helpful to do that at all? > > You should create certificates using the instructions and tools in raddb/certs/. That is set up to be simple and painless. > > Alan DeKok. > > > > > ------------------------------ > > Message: 2 > Date: Tue, 11 Aug 2015 09:42:44 +0200 > From: Alan DeKok<aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Proxy (check status of the 3rd party server) > Message-ID:<C0DDDB63-57F2-44B7-9067-D2CF85D7B530(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Aug 11, 2015, at 9:14 AM, Peter Balsianok<balsianok.peter(a)gmail.com> wrote: >> Could you please tell me, why my RADIUS server doesnt find reply >> (status-check via using "request" ) from 3rd party RADIUS server ? > > Post the debug output as suggested in the FAQ, "man" pages, web pages, and daily on this list. > > Alan DeKok. > > > > > ------------------------------ > > Message: 3 > Date: Tue, 11 Aug 2015 08:51:31 +0100 > From: Alan Buxey<A.L.M.Buxey(a)lboro.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org>, Peter Balsianok > <balsianok.peter(a)gmail.com> > Subject: Re: Proxy (check status of the 3rd party server) > Message-ID:<CE9E3C49-75F0-4E64-BA6E-B6E2B343ECF0(a)lboro.ac.uk> > Content-Type: text/plain; charset="UTF-8" > >> Could you please tell me, why my>RADIUS server doesnt find reply >> (status-check via using "request" ) from>3rd party RADIUS server ? > > Does that other server support status-server? What do the logs on that other server show? What does the debug on that other server show and what does the debug on your server show? > > alan > > ------------------------------ > > Message: 4 > Date: Tue, 11 Aug 2015 02:25:22 -0700 > From: johan firdianto<johanfirdi(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: MAC Auth tied to user > Message-ID: > <CAAFGz8esR2iTHeURyNj_ZOaLD9RN2yejZZ83PYrpMYebCO6FZQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > anyone here have experience to implement > authorization and accounting from mac to user ? > For example: > User john is tied to mac aa-bb-cc-dd-ee-ff. > every authorization comes from this mac, > radius will check session for user john. > and do accounting for user john also. > So, every packet auth/acct come from NAS, username 'mac' will be replaced > to 'user' subsquent process. > i think unlang is the solution. > anyone here could give us suggest/idea ? > Cheers. > > Johan > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 124, Issue 20 > *************************************************

7 9