November 2016 - Freeradius-Users - lists.freeradius.org

Elegant solution to per MAC Framed-IP-Address?
by Toby Walsh 11 Nov '16

11 Nov '16

I'm setting up my network to have a DHCP server with host reservations. I'm using EAP-Auth with PEAP-mschapv2 on each user's device, so they log in with a username and password and CA. I'm using mysql to back Freeradius and in the radreply table when I started configuring I had a username and Framed-IP-Address for my single test device. However, each user may connect with one of several devices, each with a different reserved IP. So I'd prefer to lookup the Framed-IP-Address with a MAC address instead despite using the regular username for authentication. Rather than reinvent the wheel myself, has anyone done this in a nice clean way and is willing to share their custom queries/config? Or can I just ignore the radreply table altogether and delete the Framed-IP-Address? Thanks, Toby

2 2

Re: Logging the debug output
by Brett Randall 11 Nov '16

11 Nov '16

> > Date: Wed, 9 Nov 2016 22:42:37 +0000 > From: Matthew Newton <mcn4(a)leicester.ac.uk> > Subject: Re: Logging the debug output > > On Thu, Nov 10, 2016 at 09:35:06AM +1100, Brett Randall wrote: > > Is there a config setting that allows me to log the same output > > that that the debug mode produces to a file that I can then go > > through at a later stage? > > You can use radmin to select some or all debug output and give a file > for it to be written to. > > Matthew > Perfect, that did just what I needed. Thanks Matthew. Brett.

2 1

Ubiquiti AP Working with FreeRadius
by Jose Quezada 10 Nov '16

10 Nov '16

Hello Everybody, Good Day! I want to make an implementation with an Ubiquiti AP but I have noticed that it does not have VSAs (Dictionaries) ... Has any of you done it? How you did it? I want to Restrict User Session, Bandwidth and some rules like that... Thank you in advance

3 2

Unlang - Adding attribute NAS-Port-Id where response = Access-Accept
by Marcos Vinícius 10 Nov '16

10 Nov '16

Hello guys, I need to add attribute NAS-Port-Id and send this attribute with the same value of attribute UserName. I need to do this, because my accel-ppp needs attribute NAS-Port-Id to set the values of interfaces when client connect. I dont want to add this atrribute NAS-Port-Id in all users (mysql), i know if i do this, the problem is solved. But my freeradius operate together my ERP, and its terrible to contact the support and request this modification. I want to rewrite the Access-Accept adding NAS-Port-Id=UserName using UNLANG. I try to do this, but failed. Someone help me? Thanks :) *Att,* *Marcos Vinicius*

2 2

Two python modules
by Poltorak, Paul (CT DD DS EVO O BFD TM&ISEC 1) 10 Nov '16

10 Nov '16

Hello all, using source FR from github on SLES 12 SP1. I would like to use two python modules. Python with only one module is working fine. Now I just added "python two" and place the two.py into the same place as one.py but get following error message. Looks like for the second module the python path is not taken. I've tested with exported python path and integrated into the config file. Thu Nov 10 08:48:19 2016 : Info: Python version: 2.7.9 (default, Dec 21 2014, 11:02:59) [GCC] Thu Nov 10 08:48:19 2016 : Debug: # Instantiating module "two" from file /usr/local/etc/raddb/mods-enabled/python Thu Nov 10 08:48:19 2016 : Error: python_function_load - Module 'two' not found Thu Nov 10 08:48:19 2016 : Error: <type 'exceptions.SystemError'> (null argument to internal routine) Thu Nov 10 08:48:19 2016 : Error: python_function_load - Failed to import python function 'two.auth' Thu Nov 10 08:48:19 2016 : Error: /usr/local/etc/raddb/mods-enabled/python[20]: Instantiation failed for module "two" EXPORT -> declare -x PYTHONPATH="/usr/local/etc/raddb/mods-config/python:/usr/lib64/python2.7:/usr/lib64/python2.7/site-packages:/usr/lib64/python2.7/lib-dynload" python one{ # python_path="/usr/local/etc/raddb/mods-config/python/:/usr/lib64/python2.7/:/usr/lib64/python2.7/site-packages/:/usr/lib64/python2.7/lib-dynload/" module = one mod_authorize = ${.module} func_authorize = authorize mod_post_auth = ${.module} func_post_auth = post_auth } python two{ # python_path="/usr/local/etc/raddb/mods-config/python/:/usr/lib64/python2.7/:/usr/lib64/python2.7/site-packages/:/usr/lib64/python2.7/lib-dynload/" module = two mod_authorize = ${.module} func_authorize = auth } Hope someone could help me Thanks in advance! Best Regards, Paul

1 0

Logging the debug output
by Brett Randall 09 Nov '16

09 Nov '16

Hi all I have an ongoing issue with a FreeRADIUS third-party module that is very intermittent (only shows up at a random time each day). In the past, running FreeRADIUS in debug mode has been very helpful, but I don't like leaving it running from a command line indefinitely. Is there a config setting that allows me to log the same output that that the debug mode produces to a file that I can then go through at a later stage? I realise this will impact performance and consume space... Thanks Brett.

3 2

FW: Proxy requests
by Hoffer, Kevin 09 Nov '16

09 Nov '16

I am trying to proxy requests from freeradius to another radius server. My obstical is I would like to use the local users file to send the attributes to the devices that it is getting the request from rather then passing along with the proxy servers is sending back Router sends request to Radius Server 1 Radius Server 1 proxies to Radius Server 2 Radius server 2 send back accept and some attributes those then get passed back to the router. I would prefer Radius Server to get the Accept and then use the information in the users file to send back the attributes. I have the files turned on for post proxy however this is what the debug shows. total/active/spare threads = 5/0/5 Wed Nov 9 14:46:10 2016 : Debug: Waking up in 0.9 seconds. Wed Nov 9 14:46:10 2016 : Debug: Thread 5 got semaphore Wed Nov 9 14:46:10 2016 : Debug: Thread 5 handling request 0, (1 handled so far) Wed Nov 9 14:46:10 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Wed Nov 9 14:46:10 2016 : Info: +group authorize { Wed Nov 9 14:46:10 2016 : Info: [preprocess] expand: %{User-Name} -> khoffer(a)domain.com<mailto:khoffer@domain.com> Wed Nov 9 14:46:10 2016 : Info: ++[preprocess] = ok Wed Nov 9 14:46:10 2016 : Info: [auth_log] expand: %{Packet-Src-IP-Address} -> IP_OF_SOURCE_ROUTER Wed Nov 9 14:46:10 2016 : Info: [auth_log] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/IP_OF_SOURCE_ROUTER/auth-detail-20161109 Wed Nov 9 14:46:10 2016 : Info: [auth_log] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/IP_OF_SOURCE_ROUTER/auth-detail-20161109 Wed Nov 9 14:46:10 2016 : Info: [auth_log] expand: %t -> Wed Nov 9 14:46:10 2016 Wed Nov 9 14:46:10 2016 : Info: ++[auth_log] = ok Wed Nov 9 14:46:10 2016 : Info: ++[chap] = noop Wed Nov 9 14:46:10 2016 : Info: ++[mschap] = noop Wed Nov 9 14:46:10 2016 : Info: ++[digest] = noop Wed Nov 9 14:46:10 2016 : Info: [suffix] Looking up realm "domain.com" for User-Name = "khoffer(a)domain.com<mailto:khoffer@domain.com>" Wed Nov 9 14:46:10 2016 : Info: [suffix] Found realm "domain.com" Wed Nov 9 14:46:10 2016 : Info: [suffix] Adding Stripped-User-Name = "khoffer" Wed Nov 9 14:46:10 2016 : Info: [suffix] Adding Realm = "domain.com" Wed Nov 9 14:46:10 2016 : Info: [suffix] Proxying request from user khoffer to realm domain.com Wed Nov 9 14:46:10 2016 : Info: [suffix] Preparing to proxy authentication request to realm "domain.com" Wed Nov 9 14:46:10 2016 : Info: ++[suffix] = updated Wed Nov 9 14:46:10 2016 : Info: [eap] No EAP-Message, not doing EAP Wed Nov 9 14:46:10 2016 : Info: ++[eap] = noop Wed Nov 9 14:46:10 2016 : Info: [files] users: Matched entry DEFAULT at line 264 Wed Nov 9 14:46:10 2016 : Info: ++[files] = ok Wed Nov 9 14:46:10 2016 : Info: ++[expiration] = noop Wed Nov 9 14:46:10 2016 : Info: ++[logintime] = noop Wed Nov 9 14:46:10 2016 : Info: ++[pap] = noop Wed Nov 9 14:46:10 2016 : Info: +} # group authorize = updated Wed Nov 9 14:46:10 2016 : Info: WARNING: Empty pre-proxy section. Using default return values. Wed Nov 9 14:46:10 2016 : Info: Proxying request 0 to home server HOME_PROXY_DEVICE port 1812 Wed Nov 9 14:46:10 2016 : Debug: Going to the next request Wed Nov 9 14:46:10 2016 : Debug: Thread 5 waiting to be assigned a request Wed Nov 9 14:46:10 2016 : Debug: Waking up in 0.9 seconds. Wed Nov 9 14:46:10 2016 : Debug: Thread 4 got semaphore Wed Nov 9 14:46:10 2016 : Debug: Thread 4 handling request 0, (1 handled so far) Wed Nov 9 14:46:10 2016 : Info: # Executing section post-proxy from file /etc/freeradius/sites-enabled/default Wed Nov 9 14:46:10 2016 : Info: +group post-proxy { Wed Nov 9 14:46:10 2016 : Info: ++[files] = noop Wed Nov 9 14:46:10 2016 : Info: [eap] No pre-existing handler found Wed Nov 9 14:46:10 2016 : Info: ++[eap] = noop Wed Nov 9 14:46:10 2016 : Info: +} # group post-proxy = noop Wed Nov 9 14:46:10 2016 : Info: Found Auth-Type = Accept Wed Nov 9 14:46:10 2016 : Info: Auth-Type = Accept, accepting the user Wed Nov 9 14:46:10 2016 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Wed Nov 9 14:46:10 2016 : Info: +group post-auth { Wed Nov 9 14:46:10 2016 : Info: ++[exec] = noop Wed Nov 9 14:46:10 2016 : Info: +} # group post-auth = noop Wed Nov 9 14:46:10 2016 : Info: Finished request 0. Wed Nov 9 14:46:10 2016 : Debug: Going to the next request Wed Nov 9 14:46:10 2016 : Debug: Thread 4 waiting to be assigned a request Wed Nov 9 14:46:11 2016 : Debug: Waking up in 3.9 seconds. Wed Nov 9 14:46:15 2016 : Info: Cleaning up request 0 ID 98 with timestamp +183 Wed Nov 9 14:46:15 2016 : Info: Ready to process requests. Thank You, Kevin Hoffer Manager of Information Technology US Signal Company 201 Ionia Avenue SW Grand Rapids, MI 49503 NOC Phone: (888) 663.1700 Direct: (616) 233.7096 Cell: (269) 251.9202 NOC Email: noc(a)ussignal.com<mailto:noc@ussignal.com> www.ussignal.com<http://www.ussignal.com>

2 1

FreeRADIUS Authentication/Authorization
by Luiz Fernando Mizael Meier 09 Nov '16

09 Nov '16

Hello! We have an enviroment with FreeRADIUS working perfectly. Today, we authenticate users against an Active Directory with domain credentials. Then, in Microsoft NPS, we filter the groups of the user to match the requirements to connect to the WiFi. They must: 1) Have an AD user account joined to an specific group; 2) Have its device's mac address added to a specific list in a MySQL database. This way we can control how many devices each user can connect to our WiFi (whis is important in our company). The thing is: we have a situation where an user will be able to connect to wifi without having an AD credential. In this case I wonder if it possible to ask for the credential only if the machine is not one of these special machines. The logic would be: if (machine is one of the special) { check in the database for the mac and authorize without ad credentials } else { ask for credentials and go on via the normal way } I tried to change this logic in the sites-available/default, but it keeps asking password no matter the order of the validations. Any help would be appreciate. :) Regards, Luiz Fernando

2 4

Active Directory Auth without ntlm.
by Daniel Reif 08 Nov '16

08 Nov '16

Hi guys Is there any way to get FreeRadius to authenticate to an Active Directory without using ntlm and winbind? My intention would be for FreeRadius itself to connect to the AD and check the credentials. Thank you very much. Att Daniel William Reif

4 3

prevent Fall-through to profile in rlm_sql?
by Chen, Christof 08 Nov '16

08 Nov '16

Hello *, can someone give me a hint why freeradius 3.0.12 falls through to profile processing in rlm_sql even if there is "fall-through = No" in the last group reply? Is there a way to tell the server NOT to fall-through to profile processing IF there was a match in the group processing? The "default" profile contains a deny reply which should only be returned if the user was not found in any usergroup. Debug: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id Debug: Parsed xlat tree: Debug: literal --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = ' Debug: attribute --> SQL-User-Name Debug: literal --> ' ORDER BY id Debug: (9) sql1: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id Debug: (9) sql1: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1066876' ORDER BY id Debug: (9) sql1: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1066876' ORDER BY id Debug: (9) sql1: User found in radcheck table Debug: (9) sql1: Conditional check items matched, merging assignment check items Debug: (9) sql1: NT-Password := 0x3566653839666532653838633631653730363765303636616366363632363636 Debug: (9) sql1: ::: FROM 1 TO 3 MAX 4 Debug: (9) sql1: ::: Examining NT-Password Debug: (9) sql1: ::: APPENDING NT-Password FROM 0 TO 3 Debug: (9) sql1: ::: TO in 3 out 3 Debug: (9) sql1: ::: to[0] = Proxy-To-Realm Debug: (9) sql1: ::: to[1] = CC-SSID Debug: (9) sql1: ::: to[2] = Auth-Type Debug: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id Debug: Parsed xlat tree: Debug: literal --> SELECT id, username, attribute, value, op FROM radreply WHERE username = ' Debug: attribute --> SQL-User-Name Debug: literal --> ' ORDER BY id Debug: (9) sql1: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id Debug: (9) sql1: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1066876' ORDER BY id Debug: (9) sql1: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1066876' ORDER BY id Debug: (9) sql1: ... falling-through to group processing Debug: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' AND NOW() between starts and ends ORDER BY priority Debug: Parsed xlat tree: Debug: literal --> SELECT groupname FROM radusergroup WHERE username = ' Debug: attribute --> SQL-User-Name Debug: literal --> ' AND NOW() between starts and ends ORDER BY priority Debug: (9) sql1: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' AND NOW() between starts and ends ORDER BY priority Debug: (9) sql1: --> SELECT groupname FROM radusergroup WHERE username = '1066876' AND NOW() between starts and ends ORDER BY priority Debug: (9) sql1: Executing select query: SELECT groupname FROM radusergroup WHERE username = '1066876' AND NOW() between starts and ends ORDER BY priority Debug: (9) sql1: User found in the group table Debug: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id Debug: Parsed xlat tree: Debug: literal --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = ' Debug: attribute --> sql1-SQL-Group Debug: literal --> ' ORDER BY id Debug: (9) sql1: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id Debug: (9) sql1: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'guest users' ORDER BY id Debug: (9) sql1: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'guest users' ORDER BY id Debug: (9) sql1: Group "guest users": Conditional check items matched Debug: (9) sql1: Group "guest users": Merging assignment check items Debug: (9) sql1: ::: FROM 0 TO 4 MAX 4 Debug: (9) sql1: ::: TO in 4 out 4 Debug: (9) sql1: ::: to[0] = Proxy-To-Realm Debug: (9) sql1: ::: to[1] = CC-SSID Debug: (9) sql1: ::: to[2] = Auth-Type Debug: (9) sql1: ::: to[3] = NT-Password Debug: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id Debug: Parsed xlat tree: Debug: literal --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = ' Debug: attribute --> sql1-SQL-Group Debug: literal --> ' ORDER BY id Debug: (9) sql1: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id Debug: (9) sql1: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'guest users' ORDER BY id Debug: (9) sql1: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'guest users' ORDER BY id Debug: (9) sql1: Group "guest users": Merging reply items Debug: (9) sql1: Session-Timeout = 3600 Debug: (9) sql1: Fall-Through = No Debug: (9) sql1: ::: FROM 2 TO 0 MAX 2 Debug: (9) sql1: ::: Examining Session-Timeout Debug: (9) sql1: ::: APPENDING Session-Timeout FROM 0 TO 0 Debug: (9) sql1: ::: Examining Fall-Through Debug: (9) sql1: ::: APPENDING Fall-Through FROM 1 TO 0 Debug: (9) sql1: ::: TO in 0 out 0 Debug: (9) sql1: ... falling-through to profile processing Debug: (9) sql1: Checking profile DEFAULT Best regards, Christof Chen

2 2