March 2016 - Freeradius-Users - lists.freeradius.org

Re: Freeradius 3 / MSSQL Problem
by Richard J Palmer 14 Mar '16

14 Mar '16

Just an update (working on other issues moving from 2.x to 3.x BUT getting close We are not using redhat here - BUT the link provided the clue - and may be useful to others If you compile (at least the latest) version of UnixODBC you need the --with-included-ltdl configure option and it then just works I hope this could be useful for someone else Richard > --- Original message --- > Subject: Re: Freeradius 3 / MSSQL Problem > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Date: Monday, 14/03/2016 2:28 PM > > On Mar 14, 2016, at 5:58 AM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> >> rlm_sql (sql): Opening additional connection (0), 1 of 32 pending >> slots used >> rlm_sql_unixodbc: 01000 [unixODBC][Driver Manager]Can't open lib >> '/usr/local/lib/libtdsodbc.so' : *?ع\?: undefined symbol: get_table > > See https://bugzilla.redhat.com/show_bug.cgi?id=1267438 > > It's a RedHat bug. > > Alan DeKok. > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Load clients from SQL
by Tornoci Laszlo 14 Mar '16

14 Mar '16

Hi, I am trying to load clients from SQL in addition to using clients.conf. Using -X I can see, that the only record gets loaded from the nas table and gets added to default clients. However, if I use eapol_test from the IP of the client, the server ignores the packets saying the client is unknown. If I enable dynamic_clients in sites_enabled and set the network in it, the server recognizes the client, however it says the shared secret is incorrect. The shared secret is defined in the "nas" sql table as well as the rest of the columns. This happens in 3.0.4. I don't need dynamic_clients, my goal is to load my clients from the "nas" sql table at server startup instead of defining them in clients.conf. What am I doing wrong? Yours: Laszlo

3 6

Freeradius 3 / MSSQL Problem
by Richard J Palmer 14 Mar '16

14 Mar '16

Hi Moving on from my previous email I am building 2 new FR servers to replace a couple of Older FR 2 servers. These connect to a MSSQL server using FreeTDS/UnixODBC I am compiling from source on a Slakeware linux server I've downloaded / compiled the latest FreeTDS / UnixODBC and have tested the connection to the MSSQL Server both work fine. I *think* I have configured radius correctly ---- # Loaded module rlm_sql # Loading module "sql" from file /usr/local/etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_unixodbc" server = "MerulaRadiusDSN" port = 0 login = "meruladbusr" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-Group}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } accounting-off { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', %{%{integer:Event-Timestamp}:-date('now')}, %{%{integer:Event-Timestamp}:-date('now')}, NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = %{%{integer:Event-Timestamp}:-date('now')}, acctinterval = 0, framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0}, acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked ---- However at the end of the startup I am seeing: ---- rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_unixodbc: 01000 [unixODBC][Driver Manager]Can't open lib '/usr/local/lib/libtdsodbc.so' : *?ع\?: undefined symbol: get_vtable rlm_sql_unixodbc: SQL down 08003 [unixODBC][Driver Manager]Connnection does not exist rlm_sql_unixodbc: Can't allocate the stmt rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) rlm_sql (sql): Removing connection pool /usr/local/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" ---- I have seen some mention of this in other posts where it talks about the packages being downloaded - but not where building from source - and I can't spot an obvious option I could have missed (that's not to say I haven't) This is using FreeRadius 3.0.11 source download from the website. I'd be really grateful for any suggestions here - thanks in advance Richard Palmer | Director | Merula Limited Company Registered in England and Wales No. 3243995 5 Avro Court, Huntingdon, Cambridgeshire, PE29 6XS Phone 01480 222940 | Support 0845 330 0666 Support Email support(a)merula.net

2 1

I-D for a new method: EAP-Kerberos
by Rick van Rein 14 Mar '16

14 Mar '16

Hello, I've long wondered how Kerberos integration with RADIUS works; only recently did I understand that it answers to a PAP inquiry that uses the KDC as a password oracle. This is very disappointing. In the symmetric-key discipline of Kerberos, every derived key can be uncovered once the initial password is known. Sending the initial password through RADIUS, it suddenly becomes a third party able to decrypt ALL of a user's traffic! Moreover, directly using the password is a trick and has its limitations -- it won't work with PKINIT for example, as used under Windows smart card logon. I would argue that having a real EAP-Kerberos method is long overdue. Does this list agree that it would be useful to have such a method embedded within EAP? I have written an Internet Draft to define an EAP-Kerberos mechanism, and would be interested in feedback on it. If we establish consensus I would like to register it officially as a new EAP Method. So please, comment on it? https://datatracker.ietf.org/doc/draft-vanrein-eap-kerberos/ Thanks, Rick van Rein OpenFortress.nl / ARPA2.net

2 1

Re: Can Radius pass client ip details to Windows AD during ntlm authentication ?.
by Eby Mani 14 Mar '16

14 Mar '16

@Alan DeKok >AD shows the IP that the login request came from. In this case, that's the RADIUS server. There is no way I know to pass more information in the login request. Now understand why it only show the last user in Single-SignOn client when multiple clients are connected thru RADIUS server. Perhaps another way exist to pass more information after authentication ?. @Matthew Newton >Look at the logs on the RADIUS server RADIUS Accounting log contain client info, included for ref. @Brian Julin & @Scott Armitage >What you may be able to do is set up the WiFi controller to send accounting packets when it discovers the IP, which includes the username, then shell out to a script to do something to inject log entries into the AD server. >The best you can do is configure your wireless to send RADIUS accounting with interim updates. Interesting, RADIUS server is doing the accounting. WLC have the option to set accounting packets to another server. To which Server the WLC should send Accounting packets to ?. When WLC is configured to use Windows NPS for AAA, wireless network access is granted, but only windows-computers joined to the particular domain is able to access certain networks(protected & internet) as those are configured with Single-SignOn. Linux systems joined to domain(realmd / ssssd / likewise open) doesn't even show up in Firewall single-signon agent installed in AD. Here is RADIUS accounting log. *********************************************** Mon Mar 14 13:06:55 2016 Acct-Status-Type = Interim-Update NAS-IP-Address = 10.225.253.10 User-Name = '0129' NAS-Port = 0 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = '***' Called-Station-Id = '####' Framed-IP-Address = 10.225.251.33 Acct-Multi-Session-Id = '***-233931' Acct-Session-Id = 'F05C1986E781-***-39CCB' Acct-Delay-Time = 0 Aruba-Essid-Name = 'VOIP-DEMO' Aruba-Location-Id = '####' Aruba-User-Vlan = 111 Acct-Input-Octets = 22221 Acct-Output-Octets = 5160 Acct-Input-Packets = 341 Acct-Output-Packets = 26 Acct-Session-Time = 277 Event-Timestamp = 'Mar 14 2016 13:06:55 IST' Acct-Unique-Session-Id = '6546072bc6e91077cfb7572486c87dc5' Timestamp = 1457941015 Mon Mar 14 13:07:46 2016 Acct-Status-Type = Interim-Update NAS-IP-Address = 10.225.253.10 User-Name = 'pt1479' NAS-Port = 0 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = '***' Called-Station-Id = '####' Framed-IP-Address = 10.225.251.32 Acct-Multi-Session-Id = '***-482768' Acct-Session-Id = 'F05C1986E261-***-76980' Acct-Delay-Time = 0 Aruba-Essid-Name = 'VOIP-DEMO' Aruba-Location-Id = '####' Aruba-User-Vlan = 111 Acct-Input-Octets = 10912 Acct-Output-Octets = 5416 Acct-Input-Packets = 100 Acct-Output-Packets = 27 Acct-Session-Time = 154 Event-Timestamp = 'Mar 14 2016 13:07:46 IST' Acct-Unique-Session-Id = 'b4cc8c7562777c2569e0ce29e596022e' Timestamp = 1457941066 *********************************************** Eby

2 1

Can Radius pass client ip details to Windows AD during ntlm authentication ?.
by Eby Mani 13 Mar '16

13 Mar '16

Can Radius Server pass client ip details to Windows AD during ntlm authentication ?. Here is the scenario, WirelessLanController is configured to provide access only after authenticating using Radius. Radius server is configured for WPA2 Enterprise with Active Directory integration using samba/winbind (ntlm_auth). I can login to the wireless network using AD username and password. The trouble is, AD doesn't know my real ip. It shows my username, Radius server IP and system name when searching for details. Thanks Eby

7 6

Ldap query
by Franks Andy (IT Technical Architecture Manager) 12 Mar '16

12 Mar '16

Hi all, FR 3.1.0 64aa7f9 I'm trying to get to the bottom of the ldap issues we're seeing with AD within freeradius. Basically when we take down one AD server (we have two sites, doesn't matter which it is), the ldap lookups from Freeradius have massive issues with timeouts, failure to bind errors etc. Now, I'd say this was an issue with AD, but we've tried this with various tools now, both linux and windows based, and we don't see any issues using, for example, ldapsearch, from the same server where FR is struggling. Obviously I would love it if someone would say "oh yes, you need to change /etc/ldap/ ... " but that's not so likely, so I wanted just any information on what ldap libraries FR uses, whether some of the code is internal or not so I can start to try and find a solution as I'm guessing this will be a management reason to go towards clearpass. Thanks! Andy

4 5

Re: rlm_sql_db2 sql server configuration
by Abdurrohman Muhammad 12 Mar '16

12 Mar '16

is there any configuration example to try? since the documentation for db2 is not writen yet abdurrm | Sent from my Huawei Mobile -------- Original Message -------- Subject: Re: rlm_sql_db2 sql server configuration From: Alan DeKok To: FreeRadius users mailing list CC: On Mar 12, 2016, at 7:53 AM, abdurrm(a)ub.ac.id wrote: > > I forced configure to compile rlm_sql_db2 using libdb2 V10.5 instead of IBM DB2 UDB V7 as mention in rlm_sl_db2.c > I have read IBM cli SQLConnect() documentation, about what argument should been sent. (because SQLConnect() using DSN/Data Source instead of Server's IP Address. and my V10.5-libdb2 is works with my php-pecl-db2 module) > is there any special configuration in etc/raddb/mods-enabled/sql for db2? notably "server" and "radius-db"? There should be no special configuration. > I've beed compile both stable 3.0.4 and last master-branch 3.1.x and keep give me error "rlm_sql_db2 - could not connect to DB2 server [idontknowwhatshouldisethere" Is that really the error message? If it can't connect to the SQL server, read the SQL server documentation for what connection parameters are used. > Here is my sql configuration : > > dialect = "db2" > server = "my.db.2.serv" > #server = "(DATABASE=db2admin;HOSTNAME=x.x.x.x;PORT=50000;PROTOCOL=TCPIP;UID=d b2inst1;PWD=xxx)" # i have tried to use PHP-PECL-DB2 DSN based, it also wont work. That shouldn't be hard to figure out. You have a database, hostname, port, etc. in that connection string. And you have similar options in the SQL module configuration. How about using the parameters from PHP-PECL-DB2 in the FreeRADIUS configuration? radius_db = db2admin server = x.x.x. port = 50000 login = db2inst1 password = xxx Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- This email was virus checked by UB Mail Gateway -- This email was virus checked by UB Mail Gateway Secure by Sophos

1 0

rlm_sql_db2 sql server configuration
by abdurrm＠ub.ac.id 12 Mar '16

12 Mar '16

hello everyone, I am trying to connect FR v3 with DB2EC V10.5. I forced configure to compile rlm_sql_db2 using libdb2 V10.5 instead of IBM DB2 UDB V7 as mention in rlm_sl_db2.c I have read IBM cli SQLConnect() documentation, about what argument should been sent. (because SQLConnect() using DSN/Data Source instead of Server's IP Address. and my V10.5-libdb2 is works with my php-pecl-db2 module) is there any special configuration in etc/raddb/mods-enabled/sql for db2? notably "server" and "radius-db"? I've beed compile both stable 3.0.4 and last master-branch 3.1.x and keep give me error "rlm_sql_db2 - could not connect to DB2 server [idontknowwhatshouldisethere" Here is my sql configuration : dialect = "db2" server = "my.db.2.serv" #server = "(DATABASE=db2admin;HOSTNAME=x.x.x.x;PORT=50000;PROTOCOL=TCPIP;UID=db2inst1;PWD=xxx)" # i have tried to use PHP-PECL-DB2 DSN based, it also wont work. port = 50000 login = "db2inst1" password = "xxx" radius_db = "radiusdb" pool { start = 1 min = 0 max = 1 spare = 0 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } # i set to 1 connection only to db2, it is also doesnt work with default configuration CentOS Linux release 7.1.1503 (Core) Linux 3.10.0-229.14.1.el7.x86_64 x86_64 GNU/Linux DB2/LINUXX8664 10.5.5 FreeRADIUS Version 3.1.0, for host x86_64-unknown-linux-gnu, built on Mar 12 2016 at 11:43:10 (my current build) I knew DB2 is an experimental modul, but Alan DeKok said it works, and people using it. Can someone help.. I have no more idea :( -- This email was virus checked by UB Mail Gateway Secure by Sophos

1 0

Stripping prefix with unlang
by Bernd 11 Mar '16

11 Mar '16

Hi, I am pulling my hears for two hours now. I'd like to strip a prefix off a request and I'm trying to use unlang in policy.d/filter to do that. if (User-Name =~ /adsl\-bla\/([^%%]+)%%adsl-bla.kroenchenstadt.de/) { update request { User-Name := "([^%%]+)%%adsl-sbt.kroenchenstadt.de/" } } doesn't work, as if (User-Name =~ /adsl\-bla\/ { update request { User-Name -= "adsl\-bla\/" } } also refuses to be that what I need. I just need to strip ``adsl-bla/'' off the login request. Help much appreciated — thanks! Bernd

3 4