June 2016 - Freeradius-Users - lists.freeradius.org

FR 3.1 NAS-IP-Address
by Scott Armitage 23 Jun '16

23 Jun '16

I noticed an issue using the NAS-IP-Address. This bug (if it is one) did disappear for a while but now seems to be back. Is this a bug or should I retrieve the value in a different way? (26,15) getUserGroupVlan { (26,15) if (!&session-state:Nas-Group) { (26,15) update session-state { (26,15) EXPAND %{sql:SELECT groupid from staffbaseschema.nas where ipaddress = '%{NAS-IP-Address}'::inet} (26,15) Reserved connection (3) (26,15) Executing select query: SELECT groupid from staffbaseschema.nas where ipaddress = ''::inet rlm_sql_postgresql - Status: PGRES_FATAL_ERROR rlm_sql_postgresql - 22P02: INVALID TEXT REPRESENTATION (26,15) ERROR: rlm_sql_postgresql: ERROR: invalid input syntax for type inet: "" (26,15) ERROR: rlm_sql_postgresql: LINE 1: ... groupid from staffbaseschema.nas where ipaddress = ''::inet (26,15) ERROR: rlm_sql_postgresql: ^ (26,15) ERROR: SQL query failed: server error (26,15) Released connection (3) (26,15) Closing connection (4), from 47 unused connections rlm_sql_postgresql - Socket destructor called, closing socket (26,15) --> (26,15) &session-state:Nas-Group := 0 (26,15) } # update session-state (noop) (26,15) } # if (!&session-state:Nas-Group) (noop) (26,15) if ( !&reply:Tunnel-Private-Group-Id && &session-state:Nas-Group > 1) { (26,15) ... (26,15) } (26,15) } # getUserGroupVlan (noop) (26,15) getWiredUserVlan { (26,15) if ("%{client:group}" != "wireless" && !&reply:Tunnel-Private-Group-Id ) { (26,15) EXPAND %{client:group} (26,15) --> wireless (26,15) ... (26,15) } (26,15) if ( &reply:Tunnel-Private-Group-Id == "" ) { (26,15) ... (26,15) } (26,15) } do we now have to specify which tunnel? (13,2) getUserGroupVlan { (13,2) if (!&session-state:Nas-Group) { (13,2) update session-state { (13,2) EXPAND %{sql:SELECT groupid from staffbaseschema.nas where ipaddress = '%{outer.request:NAS-IP-Address}'::inet} (13,2) Reserved connection (1) (13,2) Released connection (1) (13,2) Reserved connection (2) (13,2) Executing select query: SELECT groupid from staffbaseschema.nas where ipaddress = '10.53.253.21'::inet rlm_sql_postgresql - Status: PGRES_TUPLES_OK rlm_sql_postgresql - query affected rows = 0 , fields = 1 (13,2) SQL query returned no results (13,2) Released connection (2) (13,2) --> (13,2) &session-state:Nas-Group := 0 (13,2) } # update session-state (noop) (13,2) } # if (!&session-state:Nas-Group) (noop) (13,2) if ( !&reply:Tunnel-Private-Group-Id && &session-state:Nas-Group > 1) { (13,2) ... (13,2) } (13,2) } # getUserGroupVlan (noop) (13,2) getWiredUserVlan { (13,2) if ("%{client:group}" != "wireless" && !&reply:Tunnel-Private-Group-Id ) { (13,2) EXPAND %{client:group} (13,2) --> wireless Regards Scott

3 5

plain text in answer - class field
by Jacek Wilczyński 23 Jun '16

23 Jun '16

Hello. I use freeradius-3.0.4-6.el7.x86_64 on Centos 7 In config (default) file I have if (Ldap-Group == "some_group") { update reply { Class = "some_group" } } but in answer I get Received Access-Accept Id 146 from 127.0.0.1:1812 to 127.0.0.1:40392 length 40 Class = 0x666f727469676174655f6669726577616c6c Can I get plain text? -- Jacek -----------------------------------------------------

2 1

Correct way to achieve groups of users and confirm access to specific clients
by Bernd 22 Jun '16

22 Jun '16

Hello, I run a FreeRADIUS Ver.:2.1.1. (as it come with SLES11) Configured as User-Source are LDAP (eDir) and the text file (users). There are a lot of clients in the client file. (I assume they are called NAS in RADIUS?!) Now I want to achieve that users are in groups and these groups should access only specific clients. I know that I can setup group(s) in LDAP and restrict RADIUS to search for those users only which are member of this group(s) Q1: But for which words I have to search to group my text file users? Q2: Is it possible to configure more than one LDAP section to achieve that different LDAP groups get access to specific clients? Or what is the correct way? TiA Bernd

2 1

Freeradius v3.0.11 crashes after sql group lookup
by Philippe MARASSE 22 Jun '16

22 Jun '16

Hello, I'm testing FR3.0.11 (on Debian Jessie) as an upgrade to our FR3.0.5 (running on Debian Wheezy). Tests runned fine until I test it with an unknown account : - Auth is EAP/PEAP + MSCHAPv2 - Accounts are stored in sql backend (MySQL) for this SSID. FR crashes with SIGSEGV after : sql_groupcmp finished: User is NOT a member of group wifi-public I've attached freeradius -X output through gdb. Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19

3 5

"Module ... became unblocked" after FR30 upgrade
by Jakob Hirsch 22 Jun '16

22 Jun '16

Hi, I'm getting lots of this since upgrading from 2.2.9 to 3.0.11: > Tue Jun 21 15:21:11 2016 : WARNING: (16279306) WARNING: Module rlm_detail became unblocked for request 16279306 > Tue Jun 21 15:21:11 2016 : WARNING: (16279309) WARNING: Module rlm_detail became unblocked for request 16279309 > Tue Jun 21 15:21:12 2016 : WARNING: (16279322) WARNING: Module rlm_preprocess became unblocked for request 16279322 > Tue Jun 21 15:21:13 2016 : WARNING: (16279341) WARNING: Module rlm_preprocess became unblocked for request 16279341 > Tue Jun 21 15:21:14 2016 : WARNING: (16279362) WARNING: Module rlm_detail became unblocked for request 16279362 > Tue Jun 21 15:21:20 2016 : WARNING: (16279468) WARNING: Module rlm_preprocess became unblocked for request 16279468 > Tue Jun 21 15:21:23 2016 : WARNING: (16279506) WARNING: Module rlm_preprocess became unblocked for request 16279506 > Tue Jun 21 15:23:38 2016 : WARNING: (16281993) WARNING: Module rlm_preprocess became unblocked for request 16281993 The only reference I found was for rlm_sql, where the OP was told that his SQL server is too slow, which is comprehensible. I don't see how rlm_detail or rlm_preprocess could be too slow, though, especially since there were merely 10 requests/s at this time.

3 3

force/require @domain/part
by lejeczek 22 Jun '16

22 Jun '16

hi users, I'm hoping this is possible, having pretty vanilla mschap & pap(ntlm) to tweak radius so it - for eap & pap (basically AD) - would fail if there is no @domain part in the request. Like when AD domain is @private.dom.my / PRIVATE and radius will absolutely need this. At the moment having configs constructed of bits from wikis/howtos, both: "me(a)private.dom.my" and "me" get authenticated. how to tweak? many thanks, L

4 5

amazing
by bunkertor＠tiscali.it 22 Jun '16

22 Jun '16

Hello, It is amazing what one can invent! You're gonna love it, I swear! Read more here <http://paltihywo.newyorktheater101.com/aecoqvgu> See you soon, bunkertor(a)tiscali.it

1 0

rotating detail files
by Jakob Hirsch 20 Jun '16

20 Jun '16

Hi, we want to dump all our requests into files, using the detail module. The files should be rotated (and archived) with the standard logrotate tool, which would need the freeradius daemon to to close and reopen the file (automatically or triggered, e.g. by SIGHUP, like the radius.log). But I found now way to tell the daemon (or the detail module) to do that. As I read from the code, this will only happen when the file is unlinked or nothing was written for 30 seconds. gzip will unlink the file afterwards, but it will complain about the changed file size during compression and there is chance of data loss (as something may be written just before the file is deleted). I know I can tell the detail module to separate the files by hour/day/whatever, but that would require significant changes in the subsequent processing, which I want to avoid (at least for now). Is there something I have missed? Or do I have to live with that (or patch the module)? TIA and regards Jakob

3 14

Authenticate to an external database
by Mauricio 20 Jun '16

20 Jun '16

Hi If someone can help me I'll be very greatful. I have a router with coova-chilli and openwrt, a freeradius virtual server and i have a server with the users database. I need authenticate the users, im trying with the rlm_rest and eap_tls, im in the correct way ? My doubt is because freeradius server not know the users credentials. These ones are stored in an existing database in an external server. Every user need to install a CA ? Thank you.

2 4

Checking Active Directory group membership with winbind
by Matthew Newton 20 Jun '16

20 Jun '16

Hi, There is now code in the rlm_winbind module in v3.1.x that permits checking AD group membership in a similar way that you can currently do with LDAP. So if you don't want to configure LDAP, but do have a need to check AD groups, this might be useful. I haven't done any benchmark tests, so have no idea whether it is any faster than using LDAP or not. For the first group request I suspect it may be slower due to the winbind gid remapping. For subsequent requests, which winbind still has the user's groups cached (a few minutes at least it seems) then group searches are very fast. Usage is similar to rlm_ldap. Enable the winbind module in mods-enabled, then you can: if (Winbind-Group == "my-user-group") { ... } for an instance of rlm_winbind e.g. winbind mywb { ... } you can use: if (mywb-Winbind-Group == "my-user-group") { ... } Running with -Xx gives more debug information including a list of all the groups being checked for the user (until a match is found). In addition, rlm_winbind will now try and find the current windows domain directly from winbind, so there should be no need to configure it with winbind_domain (this is not the case for the same option in rlm_mschap, yet...). Testing and feedback welcome. Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

3 3