July 2016 - Freeradius-Users - lists.freeradius.org

Multiple ippools and assigning them depending on realms
by Uwe Freier 20 Jul '16

20 Jul '16

Hello, basically I got my freeradius (v 2.1.10, Ubuntu 14.04) working through the documentation but I reached a point where I don't know how to continue and therefore dare to ask for help here. The radius does actually authentication of dial-in users and accounts their traffic. Some users have a static IP as a reply attribute, the others get dynamic IP addresses directly from the MX104 and this works without problems so far. Now the IP assignment should be switched to the radius and the IP addresses shall be assigned depending on the users' realms. The recent users with static IP addresses shall keep them, I hope to reach this with "override = no" in the ippool settings. Therefore I set up 3 ippools (for 3 realms) as described in "Custom configuration" of the docs (-> modules/Rlm_ippool) but I'm not sure about the settings in ./sites-available/default concerning multiple ippools: ### accounting { ... # Return an address to the IP Pool when we see a stop record. # main_ippool ### Should all 3 ippools be listed here? iIppool1 iIppool2 iIppool3 and in the same file: ### post-auth { # Get an address from the IP Pool. # main_pool ### This I don't really understand - is this an alternative to assigning ip addresses via ./users or is this a switch to enable the pool(s) generally? Should I list all ippools here? iIppool1 iIppool2 iIppool3 Because the 3 ippools shall be assigned to users depending on 3 realms, so my ./users at the end looks like: DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP, Framed-IP-Address = 255.255.255.254, Fall-Through = Yes [...] DEFAULT Realm == "realm1", Pool-Name:= ippool1 DEFAULT Realm == "realm2", Pool-Name:= ippool2 DEFAULT Realm == "realm3", Pool-Name:= ippool3 Is this a viable option? I'm a bit confused because In "guide/Ippool and radius clients" there is an example where an ippool is assigned but no Framed-IP-Address: DEFAULT Called-Station-Id == "testdhcpserver", Auth-Type := Accept, Pool-Name := "main_pool" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Isn't the setting "Framed-IP-Address = 255.255.255.254" necessary, can it be left out or assumes this example from the docs that it is already defined as a reply attribute at the users' definitions ? Many thanks in advance, each hint is appreciated! Uwe Freier

2 1

server error in 3.0.11/ unknown column
by Wegener, Norbert 20 Jul '16

20 Jul '16

I have my users in a local mysql database and want to send logs to a central mysql database via sql-relay. This works fine. Now as the central log db uses a radpostauth table with an extended structure compared to the default table available on every radius server installation, I want to provide additional information for the service desk people. Unfortunately, when I change the default post-auth in mods-config/sql/main/mysql/queries.conf from: post-auth { # Write SQL queries to a logfile. This is potentially useful for bulk inserts # when used with the rlm_sql_null driver. # logfile = ${logdir}/post-auth.sql query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, authdate) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%S')" To: post-auth { # Write SQL queries to a logfile. This is potentially useful for bulk inserts # when used with the rlm_sql_null driver. # logfile = ${logdir}/post-auth.sql query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, authdate, nasname, nasipaddress,radiusip,switchtype,machinetype,nasport,modulefailmes,csi,vlan) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%S','%{NAS-Identifier}','%{Client-IP-Address}','${RADIP}','%{request:Virtua l-Server}','%{request:usergroup}','%{NAS-Port-Id}','%{Module-Failure-Message }','%{Calling-Station-Id}','%{control:switchvlan}')" } I get a server error: ... (0) sqldef: --> INSERT INTO radpostauth (username, pass, reply, authdate, nasname, nasipaddress,radiusip,switchtype,machinetype,nasport,modulefailmes,csi,vlan) VALUES ( '000d60d11c1e', '000d60d11c1e', 'Access-Accept', '2016-07-20 07:34:36','','123.45.163.93','sapold','cisco','other','','MAC based auth','','') (0) sqldef: EXPAND /usr/local/freeradius-3.0.11/var/log/radius/post-auth.sql (0) sqldef: --> /usr/local/freeradius-3.0.11/var/log/radius/post-auth.sql (0) sqldef: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate, nasname, nasipaddress,radiusip,switchtype,machinetype,nasport,modulefailmes,csi,vlan) VALUES ( '000d60d11c1e', '000d60d11c1e', 'Access-Accept', '2016-07-20 07:34:36','','123.45.163.93','sapold','cisco','other','','MAC based auth','','') (0) sqldef: ERROR: rlm_sql_mysql: ERROR 1054 (Unknown column 'nasipaddress' in 'field list'): 42S22 (0) sqldef: SQL query returned: server error This could probably be solved by modifying the radpostauth table on every radius server, but this is something I really would like to avoid if possible on production systems. Any other idea? Norbert Wegener

2 1

NTLM hashed passwords.
by Dom Latter 19 Jul '16

19 Jul '16

Hi all, for a couple of years now we have been using freeradius to support a Wifi network. We are using WPA2-Enterprise. We need to support clients running any and every operating system. Currently we store passwords as plain text in a "radcheck" table in the database. I am experimenting with replacing "User-Password" (yes, I know it should be "Cleartext-Password") with an "NT-Password" generated by smbencrypt. So far it seems mostly okay with Windows, Android, iOS and MacOS. And Linux. Are there any pitfalls or gotchas to watch out for? Any systems that only do MSCHAPv1 (which I believe requires the plain text password). thanks dom

4 8

RE: Freeradius-Users Digest, Vol 135, Issue 39
by Peter Hutchison 18 Jul '16

18 Jul '16

>> e.g. >> Mon Jul 18 08:38:00 2016 : Auth : [U1234567(a)hud.ac.uk] (from client roaming0.ja.net port 0 via TLS tunnel). >> Instead of >> Mon Jul 18 08:38:00 2016 : Auth : [U1234567(a)hud.ac.uk] (from client qsa.n2k-mc01 port 0 via TLS tunnel). > umm, the only difference there is the NAS client name >and this doesnt look like linelog - this looks like the default FreeRADIUS log file (in terms of layout and format >- ie /var/log/radius/radius.log or whereever your debian/ubuntu variant logs to/from. >yuor question seems to have a level of confusion with it...the former entry could appear if a user logged in from a remote site (ie >requests came from one of the national proxies). the later would be a local login...in which case what do you currently see? >for custom logging, use line log module, ensure the strings contain the things you need and call it where needed in the config as >required. if you need several types of logging formats, use named modules eg >instead of >linelog { >stuff here >} >do >linelog internal-log { >stuff here >} >and call >internal-log in whichever virtual server you needed that to be called (perhaps eg inner-tunnel post-auth section). I already have a custom linelog module called eduroam-logging with these entries Linelog f_ticks { ... } Linelog eduroam_log { ... } Linelog inner_auth_log { .... } The eduroam_log modules is called from the eduroam site in three places: Accounting Post-auth Post-Auth-Type REJECT If it's using the default logging, how do I stop it from using that? Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Infrastructure Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 1

Machine auth LDAP group checking
by Dave Aldwinckle 18 Jul '16

18 Jul '16

Hi All, I've just successfully configured machine authentication with PEAP. As a final step, I am trying to assign a specific VLAN ID in sites-enabled/default post-auth. The problem I am having is that when I try to use the attribute "ldap.host-LDAP-Group", the LDAP search does not run. If I use "LDAP-Group" the search runs, but the group is not found due to a difference in the filter. I've configured a second instance of the ldap module like so: ldap ldap.host { ... } Then in sites-enabled/default: post-auth { ldap #uncommented if (ldap.host-LDAP-Group == "uw-WiFi-Managed") { update reply { Aruba-User-Vlan := 1025 } } I can see that ldap.host-LDAP-Group is created when the server starts, so I know I'm checking the right attribute. Examples: Using ldap.host-LDAP-Group (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [ldap.host] = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) if (&Realm == "uwaterloo.ca" ) { (9) if (&Realm == "uwaterloo.ca" ) -> FALSE (9) if (&Realm == "host") { (9) if (&Realm == "host") -> TRUE (9) if (&Realm == "host") { (9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") { (9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") -> FALSE (9) } # if (&Realm == "host") = noop (9) } # post-auth = noop (9) Login OK: [host/machine1 Using LDAP-Group (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [ldap.host] = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) if (&Realm == "uwaterloo.ca" ) { (9) if (&Realm == "uwaterloo.ca" ) -> FALSE (9) if (&Realm == "host") { (9) if (&Realm == "host") -> TRUE (9) if (&Realm == "host") { (9) if (LDAP-Group == "uw-WiFi-Managed") { (9) Searching for user in group "uw-WiFi-Managed" rlm_ldap (ldap): Reserved connection (0) (9) EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) (9) --> (samaccountname=machine1) (9) Performing search in "OU=People,dc=domain,dc=uwaterloo,dc=ca" with filter "(samaccountname=machine1)", scope "sub" (9) Waiting for search result... (9) Search returned no results rlm_ldap (ldap): Released connection (0) (9) if (LDAP-Group == "uw-WiFi-Managed") -> FALSE (9) } # if (&Realm == "host") = noop (9) } # post-auth = noop (9) Login OK: [host/machine1 -- Dave Aldwinckle Network Services Information Systems & Technology University of Waterloo (519)-888-4567, x41145

3 4

FreeRadius logging for Eduroam
by Peter Hutchison 18 Jul '16

18 Jul '16

I have FreeRadius 12.1.12 on Ubuntu 14.04 LTS and we have it configured for our Wireless network. We have a normal internal wireless network configured for AD authenticated users and we also use Eduroam. I am using a Linelog module to record logins and for Eduroam entries,, I would like it to log the eduroma name instead of the Switch the user it authenticated to e.g. Mon Jul 18 08:38:00 2016 : Auth : [U1234567(a)hud.ac.uk] (from client roaming0.ja.net port 0 via TLS tunnel). Instead of Mon Jul 18 08:38:00 2016 : Auth : [U1234567(a)hud.ac.uk] (from client qsa.n2k-mc01 port 0 via TLS tunnel). The date and time is provided by variable %t, user name by %{username} and the client by %{client:shortname}. The names are provided in the clients.conf e.g. Client ipaddress { Secret = secret-string Shortname = switch-name Virtual_server = switches } Client roaming0.ja.net { Secret = secret-string Shortname = roaming0.ja.net Nastype = other Virtual_Server = eduroam Shortname = eduroam } Any ideas how to update logging config to record what I need? Peter Hutchison MCP Senior Network Systems Specialist * 01484 473716 Infrastructure Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 1

Problem Get Array
by تعلم البرمجة 16 Jul '16

16 Jul '16

Hello ! I Can`t Get array in db by SELECT * update control { Tmp-String-1 = "{sql:SELECT * FROM profiles Where id=1 } expend :%{sql:SELECT * .... } ->1 ++[control] returns noop expend : %{control:Tmp-string-1[2] -> Empy Results Why ?

3 2

linelog csv quoting problem
by Adamczak Krzysztof 15 Jul '16

15 Jul '16

Hey guys, I've another question. I need csv accounting - I used linelog for this. Basically I have: linelog csv_acct_log { ... Accounting-Request { Start = "\"%m/%d/%Y\",\"%H:%G\",\"%{Acct-Status-Type}\",\"%{User-Name}\",\"%{Auth-Type}\",\"%{User-Name}\",\"%{NAS-IP-Address}\",\"%{NAS-Port}\",\"%{Service-Type}\",\"%{Framed-Protocol}\",\"%{Framed-IP-Address}\",\"%{Framed-IP-Netmask}\"..." ... } It works great - the only problem is that I want to use double quotes when there's attribute and don't use them when attribute is not present. In CSV file it should like this "07/14/2016","10:59:16","Interim","login(a)mycompany.com.pl",,,"some other value" The best solution would be to do it directly in linelog module - maybe using conditional syntax? I tried it but I haven't succeed yet. Otherwise I have to do it in unlang outside linelog. I tried something like that: %{%{Framed-Compression}:-%{control:empty}} but it doesn't allow me to introduce quoting. Any ideas? thanks, Chris

4 6

Load-balancing LDAP
by Jonathan Gazeley 15 Jul '16

15 Jul '16

Hi folks, We're using an instantiation of the ldap module to check group membership, currently calling in an xlat[1] way like this: switch "%{uobldap:ldap:///DC=ads,DC=bris,DC=ac,DC=uk?objectCategory?sub?(Name=%{reply:User-Name})}" { ... } At the moment the ldap config itself specifies multiple ldap servers and we've been using this for load-balancing, but we have found it unsatisfactory as the openldap client doesn't seem to fail over properly when the ldap servers go away. So I want to start using FreeRADIUS's redundant-load-balance section[2] but at the moment I can't see how to use this with the xlat style of calling the ldap module. Can I do something like wrap it in a policy and load-balance between policies? [1] http://wiki.freeradius.org/modules/rlm_ldap#ldap-xlat [2] http://wiki.freeradius.org/config/load-balancing Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

6 8

unlang foreach loop
by Fabrice Durand 14 Jul '16

14 Jul '16

Hi all, On my freeradius server i want to be able to have access to each attributes/values of the reply. (to save one attribute/value per line in a database) I tried to implement foreach loop, i have access to the value but i don't know if it's possible to have access to the attribute name. Here my unlang syntax: foreach &reply { update reply { # insert into ... attribute_name , "%{Foreach-Variable-0}" Reply-Message += "%{Foreach-Variable-0}" } } Is there any way to fetch the attribute name ? Thanks Regards Fabrice -- Fabrice Durand fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence (http://packetfence.org)

1 0