September 2016 - Freeradius-Users - lists.freeradius.org

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Update on 3.0, 3.1, and 3.2.
by Alan DeKok 16 Feb '17

16 Feb '17

We plan on releasing 3.0.12 on Monday. it's stable, and there no new issues being reported for it. This will ideally be the last release of the 3.0 series. Version 3.0 was released almost three years ago, and it's time for a new major version of the server. 3.1 supports a "map" keyword, redis cluster, and many other useful features. Many people have been using the 3.1 branch in production, so we're confident that it is stable and functional. To keep things simple, we don't release an official 3.1 version. Instead, we will call 3.1 a "development / experimental" branch. Once we're ready (later this summer), we'll release an official 3.2 release. The v3.1.x branch will then be frozen, and no further development will occur on it. All new development will then start with a 3.3 branch, which will likely turn into version 4.0. There are enough architecture changes needed that it warrants a 4.0. In summary: 2.1 and earlier: dead. Don't use them. 2.2: Only critical security fixes. We expect this won't happen. 3.0: stable. New installations can use 3.0. 3.1: development. Use it only if you know what you're doing. 3.2: (future stable). Mid 2016 on, new installations should use this. 3.3. (future development), more changes, with a goal of increasing performance substantially.

4 6

freeradius2 + iODBC + Informix
by vanish 28 Nov '16

28 Nov '16

Hello, Please help me set up freeradius2 + iODBC + Informix (I'm newbie in freeradius). - I have a test-machine with Ubuntu 14.04 and Freeradius-server v2.1.12. - I have a server with Informix Database Server v 10.00 Step 1: - I installed unixODBC on test-machine - I installed informix-csdk for connect to Informix Database Server (Driver) - I configured files /etc/odbc.ini and /etc/odbcinst.ini to connect to Informix Database Server - Checking with isql: +++++++++++++++++++++++++++++++++++++++++ root@test:/home/test# isql -v work +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> select 1 from TABLES(SET{1}) 1 +++++++++++++++++++++++++++++++++++++++++ - Everything is allright. Step 2: - I try to install freeradius-iodbc module to connect to Informix Database Server - During install I get next warning: +++++++++++++++++++++++++++++++++++++++++++++ The following packages will be REMOVED: unixodbc unixodbc-dev The following NEW packages will be installed: libiodbc2-dev +++++++++++++++++++++++++++++++++++++++++++++ - so unixodbc and unixodbc-dev packages was removed after install freeradius-iodbc - I included in radiusd.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "iodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ - freeradius -XXX showed me next error: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ... Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test Fri Nov 21 14:53:48 2014 : Debug: rlm_sql (sql): starting 0 Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 Fri Nov 21 14:53:48 2014 : Error: sql_create_socket: SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded Fri Nov 21 14:53:48 2014 : Error: rlm_sql (sql): Failed to connect DB handle #0 ... +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - Error - "SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded." - Where did I go wrong? - I found some information in net with same problem, but clear decision nowhere not found.

4 4

radiusd halts when LDAP bind fails.
by Scott McLane Gardner 12 Oct '16

12 Oct '16

Hi list. I am trying to troubleshoot my radiusd occasionally halts when failing to bind with the LDAP server. I would prefer it to maybe wait a minute and restart rather than halting. Is this usual behavior? The wiki for rlm_ldap says: set the uses, lifetime and idle_timeout settings in the pool section of the LDAP module to zero But I have already set this value. I realize this means the server can't contact the LDAP server to do the auth, but I would prefer the service to be more resilient if possible. Preferably without having to do some cron or nagios scripting magic. (I'm open to it, but I wonder if there's a native handler for this?) Usually LDAP and radiusd are fine even very shortly after halting. https://directory.uark.edu/people/sgardne Senior Network Engineer University of Arkansas, ITS-NET

7 9

LDAP, SASL GSSAPI, and group membership, rebind fails
by Tom Carroll 04 Oct '16

04 Oct '16

Hello list, I'm experiencing difficulties with freeradius-3.0.11 when using Ldap-Group and SASL GSSAPI mechanism. rlm_ldap can successfully query for user accounts,binding anonyously and SASL GSSAPI. But when it queries for group membership, rebind operation fails, erroring: Strong(er) authentication required Server said: SASL:[GSSAPI]: Sign or Seal are required.. A subset of ldapsearch -X output: > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Searching for user in group "IPMI Admins" > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Reserved connection (0) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND TMPL XLAT > Thu Sep 29 11:49:54 2016 : Debug: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) > Thu Sep 29 11:49:54 2016 : Debug: Parsed xlat tree: > Thu Sep 29 11:49:54 2016 : Debug: literal --> (sAMAccountName= > Thu Sep 29 11:49:54 2016 : Debug: if { > Thu Sep 29 11:49:54 2016 : Debug: attribute --> Stripped-User-Name > Thu Sep 29 11:49:54 2016 : Debug: } > Thu Sep 29 11:49:54 2016 : Debug: else { > Thu Sep 29 11:49:54 2016 : Debug: attribute --> User-Name > Thu Sep 29 11:49:54 2016 : Debug: } > Thu Sep 29 11:49:54 2016 : Debug: literal --> ) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: --> (sAMAccountName=johndoe) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND TMPL LITERAL > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Performing search in "DC=example,DC=org" with filter "(sAMAccountName=johndoe)", scope "sub" > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Waiting for search result... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Rebinding to URL ldap://example.org/CN=Configuration,DC=example,DC=org > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Starting SASL mech(s): GSSAPI > SASL/GSSAPI authentication started > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL challenge : Authorization Name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL prompt : Please enter your authorization name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL result : RADIUS1$(a)EXAMPLE.ORG > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : `??? *?H??????? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : ???? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech (null)... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : > SASL username: RADIUS1$(a)EXAMPLE.ORG > SASL SSF: 56 > SASL data security layer installed. > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Bind successful > Thu Sep 29 11:49:54 2016 : Debug: (0) files: User object found at DN "CN=johndoe,CN=Users,DC=example,DC=org" > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Checking for user in group objects > Thu Sep 29 11:49:54 2016 : Debug: (&(cn=IPMI Admins)(objectClass=group)(member=%{control:Ldap-UserDn})) > Thu Sep 29 11:49:54 2016 : Debug: Parsed xlat tree: > Thu Sep 29 11:49:54 2016 : Debug: literal --> (&(cn=IPMI Admins)(objectClass=group)(member= > Thu Sep 29 11:49:54 2016 : Debug: attribute --> LDAP-UserDN > Thu Sep 29 11:49:54 2016 : Debug: literal --> )) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND (&(cn=IPMI Admins)(objectClass=group)(member=%{control:Ldap-UserDn})) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: --> (&(cn=IPMI Admins)(objectClass=group)(member=CN\3djohndoe\2cCN\3dUsers\2cDC\3dexample\2cDC\3dorg)) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND TMPL LITERAL > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Starting SASL mech(s): GSSAPI > SASL/GSSAPI authentication started > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL challenge : Authorization Name > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL prompt : Please enter your authorization name > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL result : RADIUS1$(a)EXAMPLE.ORG > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL response : `??? *?H??????? > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL response : ???? > Thu Sep 29 11:49:54 2016 : ERROR: (0) files: Bind with (anonymous) to ldap://ad1.example.org:389 failed: Strong(er) authentication required > Thu Sep 29 11:49:54 2016 : ERROR: (0) files: Server said: SASL:[GSSAPI]: Sign or Seal are required.. > Thu Sep 29 11:49:54 2016 : Info: rlm_ldap (ldap): Deleting connection (0) > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap: Closing libldap handle 0xb46810 > Thu Sep 29 11:49:54 2016 : Info: rlm_ldap (ldap): Need 6 more connections to reach 10 spares > Thu Sep 29 11:49:54 2016 : Info: rlm_ldap (ldap): Opening additional connection (5), 1 of 28 pending slots used > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://smbdc0.example.org:389 > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): New libldap handle 0xb46810 > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Starting SASL mech(s): GSSAPI > SASL/GSSAPI authentication started > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL challenge : Authorization Name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL prompt : Please enter your authorization name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL result : RADIUS1$(a)EXAMPLE.ORG > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : `??? *?H??????? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : ???? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech (null)... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : > SASL username: RADIUS1$(a)EXAMPLE.ORG > SASL SSF: 56 > SASL data security layer installed. > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Bind successful > Thu Sep 29 11:49:54 2016 : Debug: (0) files: User is not a member of "IPMI Admins"

3 6

Segfault at src/lib/misc.c:1193 in 3.0.4 (3.0.11 looks very similar)
by Mike Ely 04 Oct '16

04 Oct '16

Behavior is similar on two production hosts running Centos 7.2. Radius is setup as proxy only, passes authentication successfully for a time, then abruptly segfaults. Attached gdb to corefile and found this: Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `/usr/sbin/radiusd -d /etc/raddb'. Program terminated with signal 11, Segmentation fault. #0 fr_ipaddr_cmp (a=0x20, b=0x7f3965a30510) at src/lib/misc.c:1193 1193 if (a->af < b->af) return -1; It looks like it's somehow getting the memory address for "a" set to 0x20, which is obviously invalid, and then it segfaults. Where should I look in the configs for where realm acct_pool servers is being set up and what would I expect to see in a configuration that would allow the server to run successfully and then crash abruptly like this? Obviously let me know what other data to provide for debugging this. Thanks, Mike

5 26

AES encrypted passwords
by Dom Latter 01 Oct '16

01 Oct '16

Hi, [tech details at end [1]] some of you may remember me from a couple of months back asking about NTLM hashed passwords. I gave those a brief go but found that some devices just didn't work with them. The requirement - a commercial and marketing requirement, not a technical one - has not gone away and it is that we can say that we do not store the passwords in plain text. I have concocted a scheme whereby we do that - the following goes into dialup.conf and is I hope self-explanatory: authorize_check_query = "SELECT id, username, attribute, value, op \ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ AND attribute != 'AES-Password' \ UNION \ SELECT id, username, 'User-Password', \ AES_DECRYPT(UNHEX(value), 'aeskey'), op \ FROM radcheck \ WHERE username = '%{SQL-User-Name}' \ AND attribute = 'AES-Password' \ ORDER BY id" We replace User-Password with AES-Password, decrypt it in the sql query and pass it back to radius /as/ User-Password. (Or Cleartext-Password is more likely in the final implementation). Yes, the key is now held in /etc/freeradius and if someone gets that as well as the database then it's much the same as storing the passwords in plain text. But we can *say* that they are stored encrypted - and there may be a slight edge in security, as a file in /etc/ *may* be less vulnerable than a mysql database. Any thoughts on this scheme? thanks dom [1] wifi network with aerohive access points; freeradius with mysql data store; WPA2-Enterprise, MSCHAPv2, no control whatsoever over what the users want to connect to the network.

11 23

linelog module crashing freeradius server
by Anirudh Malhotra 30 Sep '16

30 Sep '16

Hi, I have noticed a strange behaviour, I have line log configured to do logging at various steps. In one of the steps i print the username in logs. Now when the username is non english font(any other language viz hindi, arabic, russian, chinese tested with these) it crashes the freeradius application. Debug log is as follows 124456) Received Access-Request Id 164 from 10.198.64.10:54713 to 10.40.125.30:1812 length 319 (124456) User-Name = " रहलहवकह" (124456) Chargeable-User-Identity = 0x0a (124456) Location-Capable = Civix-Location (124456) Calling-Station-Id = "xxxxx" (124456) Called-Station-Id = "xxxx" (124456) NAS-Port = 8 (124456) Cisco-AVPair = "audit-session-id=0a40c60a000653d3eee5ec57" (124456) Acct-Session-Id = "57ece5ee/xxxxx/329431" (124456) NAS-IP-Address = xxxxx (124456) NAS-IPv6-Address = 2001::2001 (124456) NAS-Identifier = "xxxxxx" (124456) Airespace-Wlan-Id = 34 (124456) Service-Type = Framed-User (124456) Framed-MTU = 1300 (124456) NAS-Port-Type = Wireless-802.11 (124456) Tunnel-Type:0 = VLAN (124456) Tunnel-Medium-Type:0 = IEEE-802 (124456) Tunnel-Private-Group-Id:0 = "807" (124456) EAP-Message = 0x0201001b0120e0a4b0e0a4b9e0a4b2e0a4b9e0a4b5e0a495e0a4b9 (124456) Message-Authenticator = 0xf478d56d8c1d498752fbd782302cf884 (124456) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (124456) authorize { (124456) if (!&session-state:unique-session-id) { (124456) if (!&session-state:unique-session-id) -> TRUE (124456) if (!&session-state:unique-session-id) { (124456) update { (124456) Executing: /usr/bin/shuf -n 1 -i 0-99999: (124456) Program returned code (0) and output '42345' (124456) EXPAND %{exec: /usr/bin/shuf -n 1 -i 0-99999} (124456) --> 42345 (124456) &session-state:unique-session-id = 42345 (124456) } # update = noop (124456) } # if (!&session-state:unique-session-id) = noop (124456) policy filter_username { (124456) update control { (124456) linelogvar := "request_attrs" (124456) } # update control = noop (124456) linelog: EXPAND messages.%{%{control:linelogvar}:-default} (124456) linelog: --> messages.request_attrs linelog module config reference = "messages.%{%{control:linelogvar}:-default}" messages { request_attrs = "%{User-Name},%{Calling-Station-Id},%{Called-Station-Id},%{NAS-Port},%{Acct-Session-Id},%{NAS-IP-Address},%{NAS-Identifier},%{Airespace-Wlan-Id},%{Service-Type},%{Framed-MTU},%{NAS-Port-Type},%{Tunnel-Type:0},%{Tunnel-Medium-Type:0},%{Tunnel-Private-Group-Id:0},%T,%{md5:%{Acct-Session-Id},%{session-state:unique-session-id}},Request:,%{EAP-Type}" } policy filter_username update control { linelogvar := "request_attrs" } linelog Although I have made a workaround of rejecting as well as substituting non english font usernames. This is to make the community aware if it is not already. Also I dont think some of us would like to reject non english username do we? BR, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

3 4

Purpose of the inner-eap module
by Graham Clinch 30 Sep '16

30 Sep '16

Hi Folks, In the standard config there's an second instance of the eap module, named 'inner-eap', but it doesn't appear to be referenced anywhere. I've swapped all occurances of 'eap' in the inner-tunnel site to 'inner-eap' and now see PEAP/EAP-MSCHAPv2 authentications complete with one fewer roundtrip, which feels like an improvement. Is there a reason inner-eap is not used in the default inner-tunnel site? As an aside, the wiki's EAP module page says "NOTE: There can only be one instance of the EAP module." (http://wiki.freeradius.org/modules/Rlm_eap) but that doesn't appear to be the case here. Graham

4 4