September 2015 - Freeradius-Users - lists.freeradius.org

custom message for ldap authentication
by Daniele Mantovani 19 Sep '15

19 Sep '15

Hi, I've started using freeradius (current version 2.2.5) on a debian machine to authenticate user on a wifi hotspot. I'm currently using it without any problem, and it work greats! At the moment I'm using ldap (on a windows server 2008 active directory), pop and exec module to authenticate different realm. I only need to improve a little bit the replay message when an authentication fail. Currently I've a generic replay message on the end of the users file, but I want to make some specific message for the ldap user: I'm checking if a user is part of an ldap group to give them access. Here's a little bit of configuration users file DEFAULT Realm == NULL, osdbLDAP-Ldap-Group =="InternetAccess",Autz-Type := osdbLDAP, Auth-Type := osdbLDAP DEFAULT Auth-Type := Reject Reply-Message = "You are not authorized" radiusd.conf ldap osdbLDAP{ dictionary_mapping = ${raddbdir}/ldap.attrmap server = "*****" basedn = "cn=Users,dc=osdbsesto,dc=local" filter = "(sAMAccountName=%{Stripped-User-Name})" identity = "cn=ldap-proxy,cn=Users,dc=osdbsesto,dc=local" password = "****" #groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" groupmembership_filter = "(&(objectcategory=group)(member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn}))" groupmembership_attribute = "memberOf" chase_referrals = yes rebind =yes } My goal is to have an error message for not valid user credential, and one message for user not in group. I've red the documentation about the ldap module, and I've seen 2 possible way of get this: -using the post-auth in the virtual server, and checking the group: I've seen in the ldap module documentation that I can check the group in the post-auth of my virtual server, but it's not documented well, so I've many questions: --to do that, I simply need to remove the 'osdbLDAP-Ldap-Group == "InternetAccess"' part in users file, and add something like this in post-auth block? if (osdbLDAP-Ldap-Group == "InternetAccess") { noop } else { reject } -- can I user the unlang in this block? for example, can I do this? else { Reply-Message = "You aren't in the right group" reject } -- does this check work with the recursive group filter? (I'm checking if user is in the group, or in a sub group) (groupmembership_filter = "(&(objectcategory=group)(member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn}))") -- can I catch somewhere the "not authenticate" state? (where I can set a custom message) - the other way I've found to do this is add a second line in the users file, after the line that authenticate if user is valid and in the group, and to the same check as before, but without the group. In that case, I can set a custom replay message (the user is valid but not in the group) and, stopping the fall trough, I think I can reject the user. This should work, but, if I'm not wrong, this will do another call to the ldap server Any suggestion, tip, link or documentation I can read? Thanks to all Best Regards Mix

2 1

problem solved: "Couldn't connect socket to PostgreSQL server"
by Kurt Weiß 19 Sep '15

19 Sep '15

Hi Community. I spent about two hours to figure out following problem: although my configuration was correct, freeradius didn't connect with my postgres database. following error was logged: Info: rlm_sql (sql): Attempting to connect to radius@127.0.0.1:5432/radius Info: rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radius@127.0.0.1:radius Error: rlm_sql (sql): Failed to connect DB handle #0 after searching for (not existent) configuration failures i looked into the postgres log. (wow, what for an idea!) There was an entry: CEST LOG: could not accept SSL connection: EOF detected Postgres was configured to work over SSL. Freeradius does not seem to support Postgres over SSL. I deactivated SSL in Postgres and the freeradius server connected. Because no such info seems to exist in Internet, i decided to write it into this list. greetings...

4 3

Hourly qouta problem
by kasra kazempour 18 Sep '15

18 Sep '15

Hi everyone, I am using freeradius 3.0.8 and i configured sql and sqlcounter with sqlite. I have counters for max_daily_session and max_session and working probably. I have a scenario to qouta work with hours. For example: i want to qouta only work from 8:00 to 16:00 or or qouta disable after 16:00! Is it possible to do this?! Please help me to solve this issue. Thanks. -- -- *Kasra Kazempour * Technical Manager/CTO Of OANC Co. *Tel:*+98(21) 88970926-7 *Cell:*+98(912) 276 5330 *www.oanc.ir* <http://www.oanc.ir/> *www.mitautm.ir <http://www.mitautm.ir>* -------------------------------------------------------------------------------------------------- This e-mail contains material that is confidential for the sole use of the intended recipient. Any review, reliance or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies. Please consider the environment before printing this email

3 3

radiusd segfault (3.0.8/RHEL7)
by Mohamed Lrhazi 18 Sep '15

18 Sep '15

Hello, I have FreeRADIUS 3.0.8 running on three servers for a couple of months now... today one of them crashed with this single error in the log... Sep 18 15:25:29 radius-prod-3 kernel: radiusd[13672]: segfault at 130 ip 000000000043a29d sp 00007fde65139c30 error 4 in radiusd[400000+5f000] I imagine that not much log to work with, but have to ask anyways :) Any similar known issues? [root@radius-prod-3 ~]# radiusd -v radiusd: FreeRADIUS Version 3.0.8, for host x86_64-redhat-linux-gnu, built on Jul 25 2015 at 00:56:22 Thanks, Mohamed.

2 1

Dropping NAS-Port AVP from Acct-Unique-Session-Id by default
by Nick Lowe 18 Sep '15

18 Sep '15

I noticed looking through the commits in FreeRADIUS 3.1 that the Acct-Unique-Session-Id is now using the Acct-Multi-Session-Id in its construction. Awesome! :) I wondered while looking at the commit if there has been consideration about dropping the NAS-Port in the construction so that FreeRADIUS interoperates, in its default configuration, with wireless controllers that keep the same Acct-Session-Id when a roam occurs from one BSS/AP to another BSS/AP? In that scenario, it is, of course, the controller that is the NAS, not the APs. Some controllers set the value of the NAS-Port attribute on per AP or BSS basis and this therefore changes where a roam occurs. In my opinion, vendors should be sending a Stop and a Start when a roam occurs with a constant Acct-Multi-Session-Id being used to allow sessions to be correlated, but this not the case today. This has been written about by others too: http://daniele.albrizio.it/how-to_/freeradiusacct-unique-session-idfix I was looking in to this area of FreeRADIUS more closely as I have been engaging with Aerohive on their Acct-Session-Ids. The upcoming HiveOS releases will have Acct-Session-Ids that have the properties of a GUID/UUID. At the moment, they're just incremented and are therefore not guaranteed to be unique across reboots. Cheers, Nick Lowe

3 17

AW: FR 3.0.9 RADSEC with TLS 1.2
by Stabla, Daniel 18 Sep '15

18 Sep '15

Hi, I installed openssl 1.0.1p, but the error still exists. Another user mentioned to try FR 3.0.10 from github, what I did, but the error appears with this version too. Any other ideas? Kind regards. D. Stabla On Sep 17, 2015, at 6:11 AM, Stabla, Daniel <dstabla(a)materna.de <mailto:dstabla@materna.de>> wrote: > we are testing FR 3.0.9 with radsec, but it seems not to work > if our access point uses TLS 1.2. > > Environment: > FR 3.0.9 on SLES 12 > OpenSSL 1.0.1j (selfcompiled, configured with --prefix=/opt/openssl1.0.1j -fPIC shared linux-x86_64) > LANCOM L-1302acn / Firmware 9.10 I'd say upgrade OpenSSL. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Freeradius with CISCO Port Security
by Victor Sokphak 17 Sep '15

17 Sep '15

Dear All, I'm not sure if cisco port security support with radius authentication base on MAC address or not. If anyone used to do that, please give me some clue. Thanks, Sokphak

3 3

Info: No Pool-Name defined. Trying to add new APN
by Sophie Loewenthal 17 Sep '15

17 Sep '15

Hi guys, I have been trying to work out why our new APN cannot have any IP addresses allocated. The IP addresses should come from an existing pool already in use by other APNs. I've inherited this from since departed colleagues. I did post this a earlier but thought I should start a fresh thread with debug infomation. FreeRadius package is : freeradius-2.1.12-1.el6.x86_64 / Centos 6 The user name is 0TESTUSER1 The new APN is m2m.vod.trim.com In the users file I added , DEFAULT NAS-IP-Address == 195.123.123.0, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.50, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.51, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.52, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.53, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.54, Pool-Name := vodafone The first line already worked with another APN with IP addresses assigned. When I tried to authenticate with our new SIM and APN log in worked but no pool was defined. Tue Sep 15 09:42:25 2015 : Auth: Login OK: [0TESTUSER1] (from client vodafone-nas-m2m-51 port 511026 cli 882393728079768) Tue Sep 15 09:42:25 2015 : Info: No Pool-Name defined (did m2m.vod.trim.com cli 882393728079768 port 511026 user 0TESTUSER1) Debug: I ran in debug to see if I could get any more info and you'll find thus below. I'd be grateful if somebody would let me know how I mend this, or point me the right direction? Thanks and kind regards, Sophie [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2015-09-15 09:46:13', acctsessiontime = '510', acctinputoctets = '0' << 32 | '2643', acctoutputoctets = '0' << 32 | rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 000005a8a attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Finished request 128. Going to the next request Thread 4 waiting to be assigned a request Waking up in 0.6 seconds. Thread 5 got semaphore Thread 5 handling request 129, (17 handled so far) [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default [<thread>] +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[digest] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 228 ++[files] returns ok [sql] expand: %{User-Name} -> 0TESTUSER1 [sql] sql_set_user escaped user --> '0TESTUSER1' rlm_sql (sql): Reserving sql socket id: 23 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0TESTUSER1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '0TESTUSER1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '0TESTUSER1' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'm2m.vod.trim.com' ORDER BY id [sql] User found in group m2m.vod.trim.com [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'm2m.vod.trim.com' ORDER BY id rlm_sql (sql): Released sql socket id: 23 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "F8BB45FCDC59995EE2C12A96E10B1091" [pap] Using clear text password "F8BB45FCDC59995EE2C12A96E10B1091" [pap] User authenticated successfully ++[pap] returns ok Login OK: [0TESTUSER1] (from client vodafone-nas-m2m-51 port 443593 cli 882393728079768) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sqlippool] No Pool-Name defined. [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No Pool-Name defined (did m2m.vod.trim.com cli 882393728079768 port 443593 user 0TESTUSER1) No Pool-Name defined (did m2m.vod.trim.com cli 882393728079768 port 443593 user 0TESTUSER1) ++[sqlippool] returns noop [sql] expand: %{User-Name} -> 0TESTUSER1 [sql] sql_set_user escaped user --> '0TESTUSER1' [sql] expand: %{User-Password} -> F8BB45FCDC59995EE2C12A96E10B1091 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '0TESTUSER1', 'F8BB45FCDC59995EE2C12A96E10B1091', 'Access-Accept', '2015-09-15 09:46:13') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '0TESTUSER1', 'F8BB45FCDC59995EE2C12A96E10B1091', 'Access-Accept', '2015-09-15 09:46:13') rlm_sql (sql): Reserving sql socket id: 22 rlm_sql (sql): Released sql socket id: 22 ++[sql] returns ok ++[exec] returns noop Finished request 129. Going to the next request Thread 5 waiting to be assigned a request Waking up in 0.5 seconds. Thread 6 got semaphore Thread 6 handling request 130, (17 handled so far) [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default [<thread>] +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[digest] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok [sql] expand: %{User-Name} -> 357541001195173 [sql] sql_set_user escaped user --> '357541001195173' rlm_sql (sql): Reserving sql socket id: 21 ------------------------------------- END OF EMAIL ---------------------------------------------------

3 12

Transferring policy to v3.0.10
by David Aldwinckle 17 Sep '15

17 Sep '15

Hi All, In version 2.1.12 I had some unlang in /etc/raddb/policy.conf which I referenced in a number of virtual servers. In version 3.0.10, I notice that there is no more policy.conf. I found policy.d/filter but I was unsure if this was the correct place to put the config, and if I need to link it to mods-enabled. Any advice on where to put legacy policy.conf things, like the one I've included below? remote_netid_reject { if ((Realm == "netid.uwaterloo.ca") && \ (("%{Client-Shortname}" == "prod1-west.eduroam.ca") || \ ("%{Client-Shortname}" == "prod2-west.eduroam.ca") || \ ("%{Client-Shortname}" == "prod1-east.eduroam.ca") || \ ("%{Client-Shortname}" == "prod2-east.eduroam.ca") || \ ("%{Client-Shortname}" == "moose.bc.net") || \ ("%{Client-Shortname}" == "grizzly.bc.net"))) { reject } } Thanks, Dave

2 2

FR 3.0.9 RADSEC with TLS 1.2
by Stabla, Daniel 17 Sep '15

17 Sep '15

Hello, we are testing FR 3.0.9 with radsec, but it seems not to work if our access point uses TLS 1.2. Environment: FR 3.0.9 on SLES 12 OpenSSL 1.0.1j (selfcompiled, configured with --prefix=/opt/openssl1.0.1j -fPIC shared linux-x86_64) LANCOM L-1302acn / Firmware 9.10 If we use RADSEC with TLS 1.0/1.1 it works, but with TLS 1.2 we get this FR output: (0) Initiating new EAP-TLS session (0) Setting verify mode to require certificate from client (0) (other): before/accept initialization (0) TLS_accept: before/accept initialization (0) <<< TLS 1.2 [length 007e] (0) TLS_accept: SSLv3 read client hello A (0) >>> TLS 1.2 [length 0059] (0) TLS_accept: SSLv3 write server hello A (0) >>> TLS 1.2 [length 18c4] (0) TLS_accept: SSLv3 write certificate A (0) >>> TLS 1.2 [length 024d] (0) TLS_accept: SSLv3 write key exchange A (0) >>> TLS 1.2 [length 0096] (0) TLS_accept: SSLv3 write certificate request A (0) TLS_accept: SSLv3 flush data (0) TLS_accept: Need to read more data: SSLv3 read client certificate A (0) TLS_accept: Need to read more data: SSLv3 read client certificate A (0) In SSL Handshake Phase (0) In SSL Accept mode Waking up in 0.5 seconds. (0) <<< TLS 1.2 [length 0002] (0) ERROR: TLS Alert read:fatal:handshake failure (0) ERROR: TLS_accept: Failed in SSLv3 read client certificate A (0) ERROR: SSL says: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (0) ERROR: SSL_read failed inside of TLS (-1), TLS session failed (0) FAILED in TLS handshake receive Closing TLS socket from client port 11906 Client has closed connection ... shutting down socket auth from client (10.0.0.2, 11906) -> (*, 2083, virtual-server=radsec-guests) A debug output from our access point shows us this: *[RADSEC] 2015/09/17 11:36:29,316 Devicetime: 2015/09/17 11:37:26,575* *Beginning to establish RADSEC connection to 10.0.0.1:2083[INTRANET]* *->establishment begins, local port is 11163* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,577* *Creating connection 890 with peer 10.0.0.1:2083 for requester 'RB':* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,577* *Sending Client Hello on connection 890:* *-> adding renegotiation_info extension to client hello* *-> all fine, receive Server Hello* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,604* *Receiving Server Hello on connection 890:* *-> protocol version is TLSv1.2* *-> server refuses session resumption* *-> selected cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384* *-> parsing TLS extensions* *-> selected elliptic curve point format is uncompressed* *-> all fine, receive Certificate(s)* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,605* *Receiving Certificate(s) on connection 890:* *-> read certificate of CN=radius.materna.de (2182 bytes)* *-> read certificate of DC=com, DC=materna, CN=MATERNA Information & Communications (Root) (1887 bytes)* *-> read certificate of DC=com, DC=materna, CN=MATERNA-INFRASTRUCTURE-CA (2255 bytes)* *-> verification succeeded* *-> all fine, receiving Server Hello Done* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,614* *Receiving Server Key Exchange on connection 890:* *-> selected elliptic curve is secp256r1* *-> selected signature method is (sha256,rsa)* *-> signature match* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,618* *Receiving Certificate Request on connection 890:* *-> my own certificate's issuer is DC=com, DC=materna, CN=MATERNA-INFRASTRUCTURE-CA* *-> truncated CA name, exiting* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,618* *Preparing records to send on connection 890:* *-> not in application state, bailing out* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,618* *Closing connection 890 (broken packet received):* *--> application state not reached (ClientRcvServerHelloDone)* *--> sending failure to requester* ** *[RADSEC] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,619* *RADSEC connection to 10.0.0.1:2083[INTRANET] failed: Handshake failure* *->marking connection as dead* So is this a error created through FR or does the access point something wrong? Kind regards. D. Stabla

2 1