November 2016 - Freeradius-Users - lists.freeradius.org

Status of pam_radius_auth
by Michael Weissenbacher 22 Nov '16

22 Nov '16

Dear List! I wanted to ask about the status of the pam_radius_auth Module found at http://freeradius.org/pam_radius_auth/ Does this have it's own mailing list? Bugtracker? It it currently unmaintained? The reason i am asking is because i found a few issues and would like to submit patches and/or find people who are willing to test them. Unfortunately it seems that the module didn't have much activity in recent years. Also, most distros (at least Debian, Ubuntu and Gentoo) still package the old version 1.3.17 and not 1.4.0. And please point me to the right place, in case it's not here :-) thanks, Michael

2 1

Building FR 4.0 on Ubuntu 16.04.1
by Alex Sharaz 21 Nov '16

21 Nov '16

Trying to build FR 4.0 on This flavour of Ubuntu and I get root@prodn2:/usr/local/src/freeradius-server-4.0.x# make scripts/boiler.mk:628: src/modules/rlm_lua/rlm_lua.mk: No such file or directory scripts/boiler.mk:628: src/modules/rlm_lua/libfreeradius-lua.mk: No such file or directory make: *** No rule to make target 'src/modules/rlm_lua/libfreeradius-lua.mk'. Stop. What do I need to install to get a bit further? A

3 6

missing is missing --is-lightweight?
by Peter Lambrechtsen 21 Nov '16

21 Nov '16

Noticed something pretty minor but thought I might point it out. When building on Debian on 3.0.x checking for rusers... /usr/bin/rusers /freeradius/freeradius-server/missing: Unknown `--is-lightweight' option Try `/freeradius/freeradius-server/missing --help' for more information configure: WARNING: 'missing' script is too old or missing checking for locate... /usr/bin/locate In the aclocal.m4 is pointing to the script. # Use eval to expand $SHELL if eval "$MISSING --is-lightweight"; then am_missing_run="$MISSING " else am_missing_run= AC_MSG_WARN(['missing' script is too old or missing]) fi Meh no biggie.. but if anyone was poking around aclocal or missing it might be worth sorting.

2 1

Re: Freeradius-Users Digest, Vol 139, Issue 55
by firing neurons 19 Nov '16

19 Nov '16

I read in mods-available/cache that "The module can cache a fixed set of attributes per key. It can be listed in "authorize", "post-auth", "pre-proxy" and "post-proxy". " This means that I can't update cache inside accounting section and read it back later? Message: 8 Date: Fri, 18 Nov 2016 17:01:42 -0500 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Store a attribute in session-state list till the next interim update? Message-ID: <5F646959-9FB0-4F1B-96CF-E9FDB746CD6A(a)freeradius.org> Content-Type: text/plain; charset="utf-8" > On Nov 18, 2016, at 4:35 PM, firing neurons <firingneurons(a)mail.com> wrote: > > Hi, > > I want to store a Tmp-String-0 attribute in session-state list and > retrive it and use it in a conditional in the next interim update. Can > this be done? Yes, with the cache module. -Arran

1 0

LDAP Group Default
by Albert K 19 Nov '16

19 Nov '16

Hi, I have want to the login user to be authorized according to their user grouping in Microsoft AD and also a catch all default. At the moment I am testing with two DEFAULT. Is it possible to do a Catch all DEFAULT. My example below only catch non hod group. Any help would be much appreciated. Thank you. /users DEFAULT Ldap-Group == "cn=hod,cn=users,dc=smartoptz,dc=com" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "30" DEFAULT Ldap-Group != "cn=hod,cn=users,dc=smartoptz,dc=com" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "40"

5 7

How is User-Name getting into reply?
by Brian Candler 18 Nov '16

18 Nov '16

I don't understand how a User-Name attribute is being added into the *reply* when using EAP. To replicate this, I have the default 3.0.12 config with the "steve" user uncommented, and with radtest it behaves as expected: no User-Name in the reply. But if I exercise this account using eapol_test, I see the outer User-Name attribute is in the Access-Accept: (29) Sent Access-Accept Id 10 from 127.0.0.1:1812 to 127.0.0.1:38985 length 0 (29) MS-MPPE-Recv-Key = 0xb581e1ac47471ad3952989c90595a23d8b851827abebc4089ef09574e9d69246 (29) MS-MPPE-Send-Key = 0x244f2954e441937015fa8aa44a36fc94d3c473fbb86ae9498b93f3524b126d37 (29) EAP-Message = 0x030a0004 (29) Message-Authenticator = 0x00000000000000000000000000000000 (29) User-Name = "anonymous" << HERE And if I uncomment these sections from inner-tunnel: update { &outer.session-state: += &reply: } update outer.session-state { MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY } then the reply has *two* User-Name attributes: (10) Sent Access-Accept Id 10 from 127.0.0.1:1812 to 127.0.0.1:53750 length 0 (10) MS-MPPE-Recv-Key = 0x0bd13ceb1f41f1cd7acbc81339d64f6a5411d5c507153eacefe6f7b51201956c (10) MS-MPPE-Send-Key = 0x619ca77357791b4b88a270e610dd8716cce3faebd7973dc07b18aa2cb625611a (10) EAP-Message = 0x030a0004 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) User-Name = "anonymous" << HERE (10) Service-Type += Framed-User (10) Framed-Protocol += PPP (10) Framed-IP-Address += 172.16.3.33 (10) Framed-IP-Netmask += 255.255.255.0 (10) Framed-Routing += Broadcast-Listen (10) Framed-Filter-Id += "std.ppp" (10) Framed-MTU += 1500 (10) Framed-Compression += Van-Jacobson-TCP-IP (10) User-Name += "steve" << HERE Any clues as to what's going on here? RFC2865 (section 5.44) says that an Access-Accept may only contain 0 or 1 User-Name attributes. I could filter them both out, but I'd like to understand how they are getting there in the first place. Thanks, Brian.

2 1

Store a attribute in session-state list till the next interim update?
by firing neurons 18 Nov '16

18 Nov '16

Hi, I want to store a Tmp-String-0 attribute in session-state list and retrive it and use it in a conditional in the next interim update. Can this be done? FN

2 1

Version 3.0.12 reply:Packet-Type not set to Access-Reject in Post-Auth-Type REJECT section
by Thor Spruyt 18 Nov '16

18 Nov '16

Hi, I stumbled upon a possible issue with v3.0.12 when rejecting a previously accepted user in de post-auth section. Here's my linelog module instance and post-auth section configuration: linelog linelog_auth { filename = ${logdir}/radius.log reference = "%{reply:Packet-Type}" format = "" Access-Accept = "%t : Access-Accept: User-Name=%{User-Name}" Access-Reject = "%t : Access-Reject: User-Name=%{User-Name}" } post-auth { # ACCEPT { reject linelog_auth # } Post-Auth-Type REJECT { linelog_auth } } And here's the debugging output: (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known-good" SSHA-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/raddb/server.conf (0) post-auth { (0) [reject] = reject (0) } # post-auth = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/server.conf (0) Post-Auth-Type REJECT { (0) linelog_auth: EXPAND %{reply:Packet-Type} (0) linelog_auth: --> Access-Accept (0) linelog_auth: EXPAND %t : Access-Accept: User-Name=%{User-Name} (0) linelog_auth: --> Fri Nov 18 15:12:54 2016 : Access-Accept: User-Name=x (0) linelog_auth: EXPAND /var/log/radius/radius.log (0) linelog_auth: --> /var/log/radius/radius.log (0) [linelog_auth] = ok (0) } # Post-Auth-Type REJECT = ok (0) Sent Access-Reject Id 48 from x.x.x.x:1812 to x.x.x.x:1814 length 0 (0) Finished request So using the always reject module in post-auth works to get an Access-Reject at the end. But for some reason, it looks like the reply:Packet-Type is not changed to Access-Reject when entering the Post-Auth-Type REJECT section. Am I forgetting to set something in addition to just "reject" or should the reply:Packet-Type value have been updated when the linelog module is called ? My workaround would be to set reply:Packet-Type in the Post-Auth-Type REJECT section before calling the linelog module. Like so and then it works ok: post-auth { # ACCEPT { reject linelog_auth # } Post-Auth-Type REJECT { update reply { Packet-Type := Access-Reject } linelog_auth } } Would that be a good workaround or are there better workarounds ? -- Regards, Thor

2 2

FreeRadius 3.0.11 and Winbind
by Albert K 18 Nov '16

18 Nov '16

Hi, I am doing a setup has the following criteria. I have setup as per instruction from freeradius wiki but stuck with the Dynamic VLAN part. May I know where can I get further information on Authorization for VLAN setup? Thank you for helping. https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind Existing Setup 1) Windows 2012R2 Acitive Directory Server Proposed Setup 1) Unifi AP-Lite with Unifi Controller 5.2.9, FreeRadius 3.0.11, Samba 4.3 2) WAP-Enterprise with PEAP-MSCHAPv2 3) Dynamic VLAN Assignment by user group

4 8

No TLS 1.2
by David Ward 17 Nov '16

17 Nov '16

We are looking into how to change TLS behavior on radiusd. This is for testing purpose, so I want to intentionally only allow TLS 1.0. Currently running: FreeRADIUS Version 3.0.12. Is there a way to make this version only accept TLS 1.0, right now we are using older 2.x version to test this. -David

3 3