February 2016 - Freeradius-Users - lists.freeradius.org

authenticating against local LDAP and Jumpcloud LDAP
by Michael Martinez 20 Feb '16

20 Feb '16

I'm new to Freeradius, so I'm looking either for an actual answer on how to do what I need, or to point me towards the right documentation so I can learn enough about how Freeradius config files are processed so that I can figure out the solution on my own. The situation is this: I've got a Freeradius server that successfully authenticates Wifi devices with EAP-TTLS with PAP for the inner tunnel. The system also works for ssh clients with PAM authentication. I set up it myself following different instructions, half-knowing but not really knowing what I was doing. But it works. Recently I set up an LDAP directory in Jumpcloud. Their instructions for integrating with Freeradius also are for PAP within TTLS, and involve making one change in the sites-available/inner-tunnel file: within the authorize{} block, move the following to the bottom of the block update control { Proxy-To-Realm := LOCAL } and insert Auth-Type := `/bin/bash /opt/RadiusCheck/CheckUser.sh '%{User-Name}' '%{User-Password}'` immediately after the Proxy-to-Realm line. The CheckUser.sh script is just a simple shell script that makes an LDAP query to Jumpcloud and returns a success or fail. Okay, I don't know what "update control" is for. I don't know how the authorize section works, but I made the changes and tested it out and it works fine for my Jumpcloud user. But it doesn't work anymore for my local LDAP users because irying to authenticate all users against jumpcloud. What I'd like is for the local ldap database to be queried first. And if that fails, then to check the Jumpcloud directory. Looking through the inner-tunnel file I see a few references to ldap, but these are all commented out, so I'm not clear how/where the local ldap database is being queried. -- ---

3 13

Accept all Auth requests while replying individual parameters
by Pavel Uhliar 20 Feb '16

20 Feb '16

Hi guys. I am trying to modify existing FreeRADIUS setup (version 2.1.12) to accept all Auth requests, while responding to them with individual parameters (Framed-IP-Address and Framed-Route) based on Calling-Station-Id. I am in a running environment, where until now login requests are authorized by User-Name/Password based on radcheck table and individual parameters are sent based on the User-Name from radreply table and combined with group parameters from radgroupreply table (all MySQL). Users are paired to groups by individual entries in usergroup table I would like to keep intact as much of the structure as possible, I just need to stop verifying User-Name/Password (because now whoever is able to access physical infrastructure is authorized to use it) and change the individual responses to be based on Calling-Station-Id instead of User-Name. I don't care about group, I do not need to distinguish between groups anymore, so I can move group parameters to default response once I solve the major issue with sending the individual parameters. First I thought the solution will be quite simple: 1) I change the SQL query selecting from radreply table to be based on Calling-Station-Id 2) I add "DEFAULT Auth-Type := Accept" and "Fall-Through=Yes" in /etc/raddb/users file Step 1 is OK, no problem (change in /etc/raddb/sql/mysql/dialup.conf) Problem is in Step 2. It does authorize all requests as expected (even those not matching User-Name/Password records in radcheck table), but when the User-Name/Password in request does not match User-Name/Password in radcheck, RADIUS skips querying the radreply table for additional parameters. This results in Auth response containing only parameters from radgroupreply table, but none from radreply. Requests containing User-Name/Password matching to those in radcheck get full responses (with radgroupreply and radreply) Here is comparison of debug output between authorization with valid credentials and invalid ones: Valid: [files] users: Matched entry DEFAULT at line 46 ++[files] returns ok [sql] expand: %{User-Name} -> XXXX [sql] sql_set_user escaped user --> 'XXXX' rlm_sql (sql): Reserving sql socket id: 7 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE ... ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE ... ORDER BY id [sql] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='XXXX' [sql] expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id [sql] User found in group YYYY [sql] expand: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 7 ++[sql] returns ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user expand: Auth-Type: %{control:Auth-Type} -> Auth-Type: Accept Login OK: [XXXX] (from client xxx port xxx cli xxx) Auth-Type: Accept Invalid credentials (output is the same, just the radreply query is missing). [files] users: Matched entry DEFAULT at line 46 ++[files] returns ok [sql] expand: %{User-Name} -> XXXX [sql] sql_set_user escaped user --> 'XXXX' rlm_sql (sql): Reserving sql socket id: 9 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='XXXX' [sql] expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id [sql] User found in group YYYY [sql] expand: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 9 ++[sql] returns ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user expand: Auth-Type: %{control:Auth-Type} -> Auth-Type: Accept Login OK: [XXXX] (from client xxx port xxx cli xxx) Auth-Type: Accept I was trying to find some solution, did try "query_on_not_found" configuration directive, did play with "Fall-Through", but nothing seems to work. I was not able to force RADIUS to do the radreply query for not-matched credentials. As other ways to solve the problem, I was trying to use policy to rewrite User-Name/Password in request to a Calling-Station-Id/<universal-password> to have all request authorized under my control, but this is not feasible as devices do not use only PAP, but also CHAP and MSCHAP, and password rewriting does not work for CHAP/MSCHAP requests. Another way I was trying was to setup policy that will add parameters "by hand" based on SQL query to radreply table. This I can do for Framed-IP-Address (which is only one for each user), but I am not able to do it for Framed-Route, as there can be zero or multiple Framed-Route entries for every user. I am dead stuck, I will appreciate any hints to solve the problem. Thanks a lot, Pavel

3 4

openssl gendh during make install
by Michael Ströder 19 Feb '16

19 Feb '16

HI! Is it really necessary to invoke "openssl gendh" during "make install"? It wastes time on automated build systems, especially when building in VMs for armv6. After installing RPMs one would have to regenerate DH params anyway. Ciao, Michael.

3 3

No Logon Servers error with FreeRADIUS + NTLM
by Stefan Paetow 19 Feb '16

19 Feb '16

Hi, I know this is not a problem with FreeRADIUS, however, there are several people on this list who run FreeRADIUS with Active Directory as a back end and I need their advice on this. I've run into the dreaded "No logon servers (0xc000005e)" error with NTLM. In the past I've found that the computer password for the server expired on AD and that it was either fixed by rejoining, or by tweaking the password's expiry. Do any AD folk on the list know what we can do to get this stable and that this does not occur again? Any ideas will be very useful. :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 1

Simple questiona about RadSec - Freeradius 3.0.10
by Neuton Martins 19 Feb '16

19 Feb '16

Hello Guys, I have a simple question about RadSec, but after a lot of research on the web i cant't figure out the solution. I have a federated FreeRADIUS scenario, where one central server answer requests and N other server who sent them requests. Everything is working fine without RadSec. But for security reasons i'm trying to configure RadSec. In my central server i have setup the RadSec sites-avaiable properly, but at my distributed clients i can't figure out what and where i have to change for client FreeRADIUS to proxy request as RadSec. In my research i found about radsecproxy, but i Think FreeRADIUS 3.0.X don't need that right? I'm using FreeRADIUS 3.0.10 compiled from source. My proxy config is like: realm central { type = auth authhost = centralradius.my.domain secret = secrect nostrip } So guys, what and where i have to change to this scenario works? With regards, Neuton Martins Costa

3 3

Freeradius + mysql in OpenSUSE
by Daniel Lopez 18 Feb '16

18 Feb '16

Here goes a dumb question: After building freeradius 3.0.11 in OpenSUSE 13.1, four .RPM files was created in /usr/src/packages/RPMS/x86_64/ I installed those files: freeradius-server-3.0.11-0.x86_64.rpm freeradius-server-devel-3.0.11-0.x86_64.rpm freeradius-server-libs-3.0.11-0.x86_64.rpm freeradius-server-utils-3.0.11-0.x86_64.rpm I noticed there isn't a freeradius-server-mysql... package. I've readed that SUSE already includes the rlm_sql_mysql module as part of the freeradius-server package. But I'm new in SUSE (and relatively in freeradius too -:)) and maybe there may be differences configuring mysql module in suse and ubuntu, for instance: there isn't an "$INCLUDE sql.conf " line in radius.com file. In short: I need some help with mysql module configuration in SUSE, maybe i'm missing something obvious. Thanks in advance

2 1

Why do some module call have a 'minus' sign in front in the config file ?
by Sylvain Munaut 18 Feb '16

18 Feb '16

Hi, Some of the modules sometimes have a "minus" (-) sign in front of them in config files like -sql -ldap What purpose does it serve ? Can't really find this mentioned anywhere. Cheers, Sylvain

3 3

linelog oddity on 3.1.x
by Jonathan Gazeley 18 Feb '16

18 Feb '16

Yesterday I built 3.1.x from git and today I'm tidying up the rough edges in my config. I spotted that my instantiation of linelog is not behaving quite as I'd expect, as it appears not to tag the syslog_facility, and then rsyslog makes up whatever it feels like. This behaviour has changed since 3.0.11 on the same box. Here's my linelog module: linelog logtosyslog { destination = syslog syslog { syslog_facility = local5 } # Default log message format = "" # Match packet type to blocks below reference = "logtosyslog.%{%{reply:Packet-Type}:-format}" logtosyslog { Access-Accept = "%{Virtual-Server}: Login OK: [%{User-Name}] (from client %S cli %{Calling-Station-Id})" Access-Reject = "%{Virtual-Server}: Login incorrect: [%{User-Name}] (from client %S cli %{Calling-Station-Id})" } } And here's what the server prints when run in -X: # Loading module "logtosyslog" from file /etc/raddb/mods-enabled/logtosyslog linelog logtosyslog { destination = "syslog" delimiter = " " file { permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } Looks like it's just not picking up on the syslog_facility config item. Any pointers for beating it into submission? Thanks, Jonathan

2 1

Migrate "Steel-Belted Radius" to FreeRADIUS.
by Meike Stone 18 Feb '16

18 Feb '16

Hello dear list, I like to migrate from "Steel-Belted Radius" to FreeRADIUS. I've seen, that the user base can exported via XML, but the passwords are encoded. Does anyone did this already and can give any recommendations? ( ..or usable scripts, to convert the User-Database?) Many thanks Meike!

2 1

hints file based rewrite does not work (migration from freeradius 1.1.x to 3.0.x)
by Bernd 18 Feb '16

18 Feb '16

Hi list, we're about to move from a freeradius (freeradius-1.1.3-1.6.el5 on CentOS 5) to a HA freeradius (freeradius-3.0.4-6.el7.x86_64 on CentOS 7) environment. We're almost there, however, I ran into an issue: I have to rewrite an "%" character to "@". My 'hints' file on the old installation did this perfectly well: DEFAULT User-Name =~ "bla\-bla\/([^%]+)%kroenchenstadt.de" User-Name := "%{1}(a)kroenchenstadt.de" However, freeradius BLA throws an error (running as 'radius -X' for debugging purposes): (0) ERROR: preprocess : bla\-bla\/(^%)%kroenchenstadt.de (0) ERROR: preprocess : ^ Invalid variable expansion Any idea what goes possibly wrong here? How could I circumvent the problem? Thanks, Bernd

4 14