August 2016 - Freeradius-Users - lists.freeradius.org

rlm_smsotp
by Arran Cudbard-Bell 15 Aug '16

15 Aug '16

Is this actually used by anyone, anymore? I hunted pretty hard, but couldn’t find a download link for smsotpd… Seems like it’d be better just to use a rest service for modern deployments. If no one speaks up, i’m going to remove rlm_smsotp from the v4.0.x branch. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2

Running out of file descriptors
by Jens Rantil 15 Aug '16

15 Aug '16

Hi, I've been running 2.1.10+dfsg-3ubuntu0.12.04.2 for ~165 days now on a low-volume machine (~20-30 authentication requests per day). FreeRadius delegates authentication requests to the PAM (which uses Yubico's PAM module). Yesterday, FreeRadius suddenly stopped working. Looking into the issue I noticed that FreeRadius failed to reload configuration with Error: Unable to open file "/etc/freeradius/proxy.conf": Too many open files Inspecting open files for the process showed me there were ~1012 open /dev/urandom: root@tink-auth-vpn-production:/var/log# lsof|grep freerad|grep /dev/urandom|wc -l 1012 Looks like a classic file resource leak. After restarting the process, no new /dev/urandom file resources are open. Making two authentication requests opens up two /dev/urandom. I'm fairly new to FreeRadius. Should I expect /dev/urandom file descriptors to be pooled between requests? Or should they be closed between requests? Anyone with input whether this is a bug in FreeRadius or simply a misconfiguration on my part? Also, let me know if you'd like me to debug this further. Thanks, Jens -- Jens Rantil Backend Developer @ Tink Tink AB, Wallingatan 5, 111 60 Stockholm, Sweden For urgent matters you can reach me at +46-708-84 18 32.

3 3

some helpful articles
by bunkertor 14 Aug '16

14 Aug '16

Dear friend! I've been looking for some information and came across these nice articles, they ma be helpful for you.You may read them here <http://frychyfrovu.americancranesystems.com/oidfvr> Rushing, bunkertor

2 2

disable LDAP referrals not working
by tirili＠web.de 12 Aug '16

12 Aug '16

I have /etc/openldap/ldap.conf TLS_CACERTDIR /etc/openldap/cacerts SASL_NOCANON on URI ldaps://dcdc0011.domain.local:636 ldaps://dcdc0021.domain.local:636 SCOPE one BASE dc=domain,dc=local REFERRALS off Freeradius ldap tells TLS: hostname (DomainDnsZones.domain.local) does not match common name in certificate (dcdc0020.domain.local). TLS: can't connect: TLS: hostname does not match CN in peer certificate. Unable to chase referral "ldaps://DomainDnsZones.domain.local/DC=DomainDnsZones,DC=domain,DC=loc al" (-1: Can't contact LDAP server) TLS: hostname (ForestDnsZones.domain.local) does not match common name in certificate (dcdc0020.domain.local). TLS: can't connect: TLS: hostname does not match CN in peer certificate. Unable to chase referral "ldaps://ForestDnsZones.domain.local/DC=ForestDnsZones,DC=domain,DC=loc al" (-1: Can't contact LDAP server) TLS: hostname (domain.local) does not match common name in certificate (dcdc0011.domain.local). TLS: can't connect: TLS: hostname does not match CN in peer certificate. Unable to chase referral "ldaps://domain.local/CN=Configuration,DC=domain,DC=local" (-1: Can't contact LDAP server) Why is REFERRALS off not taken into account - or how can these chase-referrals being disabled? Thanks for your help in advance T

2 1

EAP-AKA`
by Ravisankar 11 Aug '16

11 Aug '16

Hi, Could anyone please let me know if EAP-AKA and EAP-AKA`( prime) are supported in the latest freeradius version. Thanks, Ravisankar

5 6

Equivalent of Packet-Src-IP-Address for DHCP
by Бен Томпсон 11 Aug '16

11 Aug '16

Hi Everyone I have a DHCP server which listens on multiple interfaces and would like to run the requests thought different bits of unlang depending on the incoming interface. Could anyone advise whether there is a way to get this info from an attributes like we do in RADIUS (e.g Packet-Src-IP-Address). I guess one way to do this would be to configure separate virtual servers, but I just wondered if there was any way to do it using attributes. Thanks Ben

2 2

per instance Ldap-Group attribute does not work
by Oleg Palij 10 Aug '16

10 Aug '16

I'm switching from 2.2.5 to 3.0.12. Users are in Active Directory. I found that per instance Ldap-Group attribute does not work. I simplified working config to: authorize { ldap if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } } authenticate { Auth-Type LDAP { ldap } } post-auth { if !(LDAP-Group == 'vpdn') { update reply { Reply-Message += "no vpdn group" } reject } ... } With default ldap module name it searches in ldap and works as expected: (2) post-auth { (2) if !(LDAP-Group == 'vpdn') { (2) Searching for user in group "vpdn" … (2) User found in group object "...." (2) if !(LDAP-Group == 'vpdn') -> FALSE But as soon as I change default ldap module to named (per instance) one: mods-enabled/ldap: ldap { ... } -> ldap ldapdomain1 { ... } and replace in config 'ldap' with 'ldapdomain1' and 'LDAP-Group' with 'ldapdomain1-LDAP-Group' it stop searching in ldap, stripped debug log: # Loading module "ldapdomain1" from file /etc/freeradius/mods-enabled/ldap ldap ldapdomain1 { ... Creating attribute ldapdomain1-LDAP-Group ... (0) post-auth { (0) if !(ldapdomain1-LDAP-Group == 'vpdn') { (0) if !(ldapdomain1-LDAP-Group == 'vpdn') -> TRUE (0) if !(ldapdomain1-LDAP-Group == 'vpdn') { (0) update reply { (0) Reply-Message += "no vpdn group" (0) } # update reply = noop (0) [reject] = reject (0) } # if !(ldapdomain1-LDAP-Group == 'vpdn') = reject (0) } # post-auth = reject full debug log - https://gist.github.com/paleg/4041dfbfd2bfe997ce5b1e0345b2d232 <https://gist.github.com/paleg/4041dfbfd2bfe997ce5b1e0345b2d232> I was able to obtain the same effect when intend made mistake in named ldap group name. But I double check that registered paircompare name is correct. I tried different cases of lower/upper of ldap group name without success: - ldapdomain1-LDAP-Group (as in sources) - ldapdomain1-Ldap-Group (as in online docs) Could you please explain what I am doing wrong?

2 2

returning user and primary group (or any other ldap attribute) with radius response
by Thomas Schweikle 10 Aug '16

10 Aug '16

Hi! After searching for long with google, or in the manuals, i was not able to find any cookbook recipe to advice freeradius to respond with username and primary group for an authenticated user. The access-point needs this to sort out users into guest or internal networks. So how can I set up freeradius to return username and primary group (or any other ldap attribute) with the OK-response? -- Thomas

2 3

Update control in Post-Auth
by Randeep 09 Aug '16

09 Aug '16

Hi everyone, I want to check two things in pre-auth. 1. Whether the user's network plan subscription is active or not. 2. Whether the data usage has crossed the Max-Data cap or not. In post-auth, update control { # 1. Checks whether the plan subscription is active or not. #Getting the subscription_from value from the radcheck table. Tmp-String-2 := "%{sql:select subscription_from from radcheck where radcheck.username='%{User-Name}'}" #Checking its been how many days from the date of subscription Tmp-Integer-3 := "%{sql:SELECT DATEDIFF(CURDATE(),subscription_from) FROM radcheck where radcheck.username = '%{User-Name}'}" #Getting validity(actual subscription duration) Tmp-Integer-2 := "%{sql:select validity from radcheck where radcheck.username='%{User-Name}'}" # 2. Checks whether the data usage has crossed the Max-Data or not. # Getting the current data usage (Data usage from subscription_from to current date) Tmp-Integer-0 := "%{sql:SELECT COALESCE((SUM(acctoutputoctets)-SUM(iptv_usage)),0) AS Total FROM radacct where (acctstarttime between DATE_FORMAT(NOW() ,(select subscription_from from radcheck where username='%{User-Name}')) AND NOW() ) AND radacct.username='%{User-Name}'}" #Value of Max-Data from the radgroupcheck for the group of the user Tmp-Integer-1 := "%{sql: SELECT radgroupcheck.value FROM radusergroup INNER JOIN radgroupcheck ON radusergroup.groupname = radgroupcheck.groupname WHERE radusergroup.username='%{User-Name}' AND radgroupcheck.attribute='Max-Data'}" #Getting the Mikrotik rate limit for applying FUP Tmp-String-1 := "%{sql: SELECT radgroupcheck.value FROM radusergroup INNER JOIN radgroupcheck ON radusergroup.groupname = radgroupcheck.groupname WHERE radusergroup.username='%{User-Name}' AND radgroupcheck.attribute='Mikrotik-Rate-Limit'}" } #check1 #Checking condition for plan subscription expiry (days from subscription > plan duration) if ("%{control:Tmp-Integer-3}" > "%{control:Tmp-Integer-2}") { update { control:Auth-Type := "Reject" reply:Reply-Message := "Your subscription has expired. Please renew your subscription to continue the service" } } #check2 #Checking whether usage exceeded the Max-Data cap if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-Integer-1}") { update reply { Reply-Message := "Your Bandwidth Limit has been reached" Mikrotik-Rate-Limit := "%{control:Tmp-String-1}" } } But in check1 I am always getting Access-Accept Also, is it possible to give two checks in update control? In logs I can see this. Mon Aug 8 16:13:24 2016 : Debug: (1) if ("%{control:Tmp-Integer-3}" > "%{control:Tmp-Integer-2}") { Mon Aug 8 16:13:24 2016 : Debug: (1) EXPAND TMPL XLAT STRUCT Mon Aug 8 16:13:24 2016 : Debug: (1) EXPAND %{control:Tmp-Integer-3} Mon Aug 8 16:13:24 2016 : Debug: (1) --> 47 Mon Aug 8 16:13:24 2016 : Debug: (1) EXPAND TMPL XLAT STRUCT Mon Aug 8 16:13:24 2016 : Debug: (1) EXPAND %{control:Tmp-Integer-2} Mon Aug 8 16:13:24 2016 : Debug: (1) --> 30 Mon Aug 8 16:13:24 2016 : Debug: (1) if ("%{control:Tmp-Integer-3}" > "%{control:Tmp-Integer-2}") -> TRUE Mon Aug 8 16:13:24 2016 : Debug: (1) if ("%{control:Tmp-Integer-3}" > "%{control:Tmp-Integer-2}") { Mon Aug 8 16:13:24 2016 : Debug: (1) update { Mon Aug 8 16:13:24 2016 : Debug: (1) control:Auth-Type := Reject Mon Aug 8 16:13:24 2016 : Debug: (1) Overwriting value "PAP" with "Reject" Mon Aug 8 16:13:24 2016 : Debug: (1) reply:Reply-Message := "Your subscription has expired. Please renew your subscription to continue the service" Mon Aug 8 16:13:24 2016 : Debug: (1) } # update = noop Mon Aug 8 16:13:24 2016 : Debug: (1) } # if ("%{control:Tmp-Integer-3}" > "%{control:Tmp-Integer-2}") = noop Mon Aug 8 16:13:24 2016 : Debug: (1) modsingle[post-auth]: calling exec (rlm_exec) for request 1 Mon Aug 8 16:13:24 2016 : Debug: (1) modsingle[post-auth]: returned from exec (rlm_exec) for request 1 Mon Aug 8 16:13:24 2016 : Debug: (1) [exec] = noop Mon Aug 8 16:13:24 2016 : Debug: (1) policy remove_reply_message_if_eap { Mon Aug 8 16:13:24 2016 : Debug: (1) if (&reply:EAP-Message && &reply:Reply-Message) { Mon Aug 8 16:13:24 2016 : Debug: (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Mon Aug 8 16:13:24 2016 : Debug: (1) else { Mon Aug 8 16:13:24 2016 : Debug: (1) modsingle[post-auth]: calling noop (rlm_always) for request 1 Mon Aug 8 16:13:24 2016 : Debug: (1) modsingle[post-auth]: returned from noop (rlm_always) for request 1 Mon Aug 8 16:13:24 2016 : Debug: (1) [noop] = noop Mon Aug 8 16:13:24 2016 : Debug: (1) } # else = noop Mon Aug 8 16:13:24 2016 : Debug: (1) } # policy remove_reply_message_if_eap = noop Mon Aug 8 16:13:24 2016 : Debug: (1) } # post-auth = ok Mon Aug 8 16:13:24 2016 : Debug: (1) Sent Access-Accept Id 69 from 127.0.0.1:1812 to 127.0.0.1:53474 length 0 Mon Aug 8 16:13:24 2016 : Debug: (1) Framed-Protocol = PPP Mon Aug 8 16:13:24 2016 : Debug: (1) Framed-MTU = 1500 Mon Aug 8 16:13:24 2016 : Debug: (1) Framed-Routing = Broadcast-Listen Mon Aug 8 16:13:24 2016 : Debug: (1) Framed-Compression = Van-Jacobson-TCP-IP Mon Aug 8 16:13:24 2016 : Debug: (1) Idle-Timeout = 300 Mon Aug 8 16:13:24 2016 : Debug: (1) Service-Type = Framed-User Mon Aug 8 16:13:24 2016 : Debug: (1) Acct-Interim-Interval = 60 Mon Aug 8 16:13:24 2016 : Debug: (1) Mikrotik-Rate-Limit = '6144k/6144k' Mon Aug 8 16:13:24 2016 : Debug: (1) Reply-Message := 'Your subscription has expired. Please renew your subscription to continue the service' Mon Aug 8 16:13:24 2016 : Debug: (1) Finished request Mon Aug 8 16:13:24 2016 : Debug: Waking up in 4.9 seconds. Please advice. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 2

repeated re-auth attempts from OSX
by Dave Hanlon 09 Aug '16

09 Aug '16

Hi, I have configured a freeradius (v2.2.0) server under Ubuntu server 16.04.1 which is connected to the domain and can successfully authenticate users in AD as checked with radtest, wbinfo and ntlm_auth tests along with 2 windows workstations using difference versions of OS. I’m using PEAP with certificate authentication added through group policy and all working fine with Windows. I have created an 802.1x profile using OSX Server and installed the profile onto a macbook pro using El Capitan. The profile installs the trusted root CA and the certificate of the Ubuntu freeradius server. All seems well and while watching the output of ‘freeradius –X’ I see the output ‘Access-Accept’ when testing. However, on first connection from the macbook, it seems to request re-authentication a random number of times (10 or so?), each time receiving an ‘Access-Accept’ message. It will then become stable and settle and remain connected after these initial attempts. I guess there may be an issue with the supplicant on OSX but wondered if this was a known issue (couldn’t find anything on searching though), or whether there is something specific I am missing in the freeradius configuration (doubt it since the client is sending a request which works, followed by another request...). I have tried different settings in the profile but to be honest it is very limited and is straightforward. Please note, I am not asking for help with OSX/Apple/Profile Manager since this seems to be configured and does work, but is this behaviour recognisable to anyone? Any help appreciated. ------------------------------ # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< Unknown TLS version [length 0005] [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 181 to 192.168.200.171 port 58503 MS-MPPE-Recv-Key = 0xdc8844116c10c664e023ae931983a5a6dbdf7e88627fb494b32b1b755d005932 MS-MPPE-Send-Key = 0xd0baa5f2a44c337197bb77c5eb8f89d3ae6b6e163e95c07edf1a801826985d19 EAP-Message = 0x03400004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "xxxxxxxxxxxxx" Finished request 98. Going to the next request Waking up in 4.7 seconds. ------------------------------ Dave Hanlon Solutions Architect Nomical Networks 0344 3843 000 www.nomical.com Moss Bridge Road, Rochdale, Lancs OL16 5LX This email and any attachments are intended for the named recipient only. Its unauthorised use, distribution, disclosure, storage or copying is not permitted. If you have received it in error, please destroy all copies and notify the sender. In messages of a non-business nature, the views and opinions expressed are the author's own and do not necessarily reflect those of the organisation from which it is sent. All emails may be subject to monitoring. Nomical Ltd - Registered in England No: 06035958, VAT Reg No: 900363074, Registered Office: 1 Norman Villas, Barrack Lane, Ringwood, Hampshire, BH24 3ES

3 2