October 2017 - Freeradius-Users - lists.freeradius.org

is there a way to identify the very first ACCESS-REQUEST
by Michael Hocke 16 Mar '18

16 Mar '18

Hi there, I want to improve our logging and want to keep track of authentication attempts that do not complete. I was thinking of logging the very first ACCESS-REQUEST and then later on the result. Is there a good way to identify the very first ACCESS-REQUEST from the client with unlang? Maybe by checking the contents of the session-state list or some such? Any ideas? Thanks! - Michael

4 6

Cisco-AVPair regex
by Kylián Martin 23 Feb '18

23 Feb '18

Hi all, I'm trying to save some of the Cisco-AVPair attributes into sql while acounting. Specifically, I'm interested in the dhcp-options and http-tlv attributes. WLC describes the connected device in these. Unfortunately, Freeradius 3.12 expands these values unregexable way. (With_cisco_vsa_hack = yes in preprocess the result is the same) Correctly expanded is just Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859" Policy file: device_regex = '^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)' () fill_device_type { if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) { update request { &Calling-Device += "%{8} " } } } } } Processing: (98) Received Accounting-Request Id 28 from 192.168.241.30:57614 to 172.31.12.101:1813 length 482 (98) User-Name = "martin" (98) NAS-Port = 8 (98) NAS-IP-Address = 192.168.241.30 (98) Framed-IP-Address = 10.252.136.9 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = fe80::/64 (98) NAS-Identifier = "d4-wlc5520" (98) Airespace-Wlan-Id = 20 (98) Acct-Session-Id = "5968a7cb/34:ab:37:ed:a2:bb/90671" (98) NAS-Port-Type = Wireless-802.11 (98) Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859" (98) Acct-Authentic = RADIUS (98) Tunnel-Type:0 = VLAN (98) Tunnel-Medium-Type:0 = IEEE-802 (98) Tunnel-Private-Group-Id:0 = "595" (98) Event-Timestamp = "Jul 14 2017 14:47:01 CEST" (98) Cisco-AVPair = "dhcp-option=\000\014\000\0056spMK" (98) Cisco-AVPair = "http-tlv=\000\001\000\030iPhone8,2/10.3.2 (14F89)" How to regex these ? (98) Acct-Status-Type = Interim-Update (98) Acct-Input-Octets = 699538 (98) Acct-Input-Gigawords = 0 (98) Acct-Output-Octets = 2957172 (98) Acct-Output-Gigawords = 0 (98) Acct-Input-Packets = 5974 (98) Acct-Output-Packets = 5319 (98) Acct-Session-Time = 5494 (98) Acct-Delay-Time = 0 (98) Calling-Station-Id = "34-ab-37-ed-a2-bb" (98) Called-Station-Id = "d4-air1702-ap-1:UI MK tst" (98) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (98) preacct { (98) [preprocess] = ok (98) policy rewrite_called_station_id { (98) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { (98) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> FALSE (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) { (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) -> TRUE (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) { (98) update request { (98) EXPAND %{1} (98) --> d4-air1702-ap-1 (98) &Called-Station-Id := d4-air1702-ap-1 (98) EXPAND %{3} (98) --> UI MK tst (98) &Called-Station-SSID := UI MK tst (98) } # update request = noop (98) [updated] = updated (98) } # elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) = updated (98) ... skipping else: Preceding "if" was taken (98) } # policy rewrite_called_station_id = updated (98) policy fill_device_type { (98) if (&Cisco-AVPair) { (98) if (&Cisco-AVPair) -> TRUE (98) if (&Cisco-AVPair) { (98) foreach &Cisco-AVPair (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> audit-session-id=1ef1a8c000014809cba76859 (98) EXPAND %{Foreach-Variable-0} (98) --> audit-session-id=1ef1a8c000014809cba76859 (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> dhcp-option= (98) EXPAND %{Foreach-Variable-0} (98) --> dhcp-option= (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> http-tlv= (98) EXPAND %{Foreach-Variable-0} (98) --> http-tlv= Both attributes are expanded till first whitespace char (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) } # foreach &Cisco-AVPair = updated (98) } # if (&Cisco-AVPair) = updated How to get text values following whitespaces? I've already tried if ("unescape:%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) with no luck Martin Kylián

4 11

Username with dot issue
by Satish Patel 01 Nov '17

01 Nov '17

I have setup freeradius with LDAP and we have may user account starting with "dot" example "foo.bar" but i found somewhere it getting strip off and only showing "foo" in logs. I have this setting in hint file, we are doing proxy to other radius too. I have check policy file too but nothing matching there. DEFAULT User-Name =~ "^([a-z]{1,25})" User-Name := "%{1}@EXAMPLE" Tue Oct 31 17:12:57 2017 : Debug: (2) Cleaning up request packet ID 11 with timestamp +110 Tue Oct 31 17:12:57 2017 : Info: Ready to process requests Tue Oct 31 17:13:01 2017 : Debug: (3) Received Access-Request Id 147 from 127.0.0.1:58804 to 127.0.0.1:1812 length 77 Tue Oct 31 17:13:01 2017 : Debug: (3) User-Name = "foo.bar" Tue Oct 31 17:13:01 2017 : Debug: (3) User-Password = “password123” Tue Oct 31 17:13:01 2017 : Debug: (3) NAS-IP-Address = 10.5.3.31 Tue Oct 31 17:13:01 2017 : Debug: (3) NAS-Port = 1812 Tue Oct 31 17:13:01 2017 : Debug: (3) Message-Authenticator = 0x07a42e3b1de836e011b2a15c196f8486 Tue Oct 31 17:13:01 2017 : Debug: (3) session-state: No State attribute Tue Oct 31 17:13:01 2017 : Debug: (3) # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Oct 31 17:13:01 2017 : Debug: (3) authorize { Tue Oct 31 17:13:01 2017 : Debug: (3) policy filter_username { Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name) { Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name) -> TRUE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name) { Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ / /) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ / /) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /@[^@]*@/ ) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.\./ ) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.\./ ) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.$/) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.$/) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /(a)\./) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /(a)\./) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) } # if (&User-Name) = notfound Tue Oct 31 17:13:01 2017 : Debug: (3) } # policy filter_username = notfound Tue Oct 31 17:13:01 2017 : Debug: (3) modsingle[authorize]: calling preprocess (rlm_preprocess) Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: Adding 2 matches Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: hints: Matched DEFAULT at 65 Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: ::: FROM 1 TO 6 MAX 7 Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: ::: Examining User-Name Tue Oct 31 17:13:01 2017 : Debug: %{1}@EXAMPLE Tue Oct 31 17:13:01 2017 : Debug: Parsed xlat tree: Tue Oct 31 17:13:01 2017 : Debug: regex-var --> 1 Tue Oct 31 17:13:01 2017 : Debug: literal --> @EXAMPLE Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: 1/2 Found: foo (4) Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: EXPAND %{1}@EXAMPLE Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: --> foo@EXAMPLE

2 1

Class attributes
by Satish Patel 31 Oct '17

31 Oct '17

I am configuring freeradius for Cisco ASA VPN and i have create multiple Group Policy on ASA now i want to send those group name back to NAS using Class Attributes #25 as per following document (they are using Windows IAS) http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logo… Same setup i want to do in Linux Freeradius so where should i definite that attribute? Should i use that in /etc/raddb/user or /etc/raddb/sites-enabled/default file in post-auth section? I did following and i am getting following result but not sure i am doing it right or not post-auth { update reply { Class := OU=Group_VPN; } } Sent Access-Request Id 40 from 0.0.0.0:35534 to 127.0.0.1:1812 length 76 User-Name = "user1" User-Password = "password1" NAS-IP-Address = 10.5.3.31 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "password1" Received Access-Accept Id 40 from 127.0.0.1:1812 to 0.0.0.0:0 length 35 Class = 0x4f553d47726f75705f56504e3b

5 12

Help with ippool-dhcp servers (two in redundancy)
by Nataniel Klug 30 Oct '17

30 Oct '17

Hello, I got into a problem and I am not been able to find a solution. I have a scenario where I have two Freeradius IPPool DHCP servers that serve the same network. When an equipment send an request for DHCP both servers get the same request and one of them reply to it. I want to make a delayed response in one of them so I can keep the IP allocation more reliable. I am getting deadlocks in MySQL when running with two servers and I think this is caused by the multiple request in those servers. Atenciosamente, *Nataniel Klug* | nataniel.klug(a)gmail.com

3 4

Setting internal attributes per client
by Nathan Ward 30 Oct '17

30 Oct '17

Hi, We have some RADIUS servers handling clients from 3 different vendors/models of BNGs and so on, and have to return different attributes to each (Cisco-AVPair to Ciscos, etc. etc.). Right now I have some policies that match request:NAS-IP-Address against a list of IPs. It’s a bit annoying to have to add clients in clients.conf and in the policy config. Manageable sure, but, I’m wondering if there’s a better way. Is there a way to have some sort of per-client policy, other than matching NAS-IP-Address or similar? Can I look at shortname as configured in clients.conf (I could add tokens to this, for example, ‘iosxrbng_<original hostname>’. I considered multiple virtual servers, which is still something I’m considering but not sure that’s the best solution either. Open to suggestions! It occurred to me that a useful thing would be setting attributes in clients.conf, i.e.: client example.org { ipaddr = radius.example.org secret = testing123 Tmp-String-0 = BNGFlavourPurple } Maybe. :-) -- Nathan Ward

4 5

ldap group membership check issue
by Евгений Подберезкин 30 Oct '17

30 Oct '17

Hello. I'm trying to check a group of user in Active directory (Win2008) using rlm_ldap. While we have several domains in transitive relations, I should send username with domain part. When domain name is a suffix ( epodberezkin(a)chtpz.ru) it is working, prefix - not (when windows uses login username and domain automatically - f.e. CHTPZ0\epodberezkin) part of mods-enabled/ldap user { base_dn = "dc=chtpz,dc=ru" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } Output of radiusd -X shows, that "DOMAIN\" part is not removed, so sAMAccountname is incorrect Fri Oct 27 14:48:39 2017 : Debug: (7) files: Searching for user in group "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru" Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Reserved connection (0) Fri Oct 27 14:48:39 2017 : Debug: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) Fri Oct 27 14:48:39 2017 : Debug: Parsed xlat tree: Fri Oct 27 14:48:39 2017 : Debug: literal --> (sAMAccountName= Fri Oct 27 14:48:39 2017 : Debug: XLAT-IF { Fri Oct 27 14:48:39 2017 : Debug: attribute --> Stripped-User-Name Fri Oct 27 14:48:39 2017 : Debug: } Fri Oct 27 14:48:39 2017 : Debug: XLAT-ELSE { Fri Oct 27 14:48:39 2017 : Debug: attribute --> User-Name Fri Oct 27 14:48:39 2017 : Debug: } Fri Oct 27 14:48:39 2017 : Debug: literal --> ) Fri Oct 27 14:48:39 2017 : Debug: (7) files: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) Fri Oct 27 14:48:39 2017 : Debug: (7) files: --> ( *sAMAccountName=CHTPZ0\5c5cepodberezkin*) Fri Oct 27 14:48:39 2017 : Debug: (7) files: Performing search in "dc=chtpz,dc=ru" with filter "(sAMAccountName=CHTPZ0\5c5cepodberezkin)", scope "sub" Fri Oct 27 14:48:39 2017 : Debug: (7) files: Waiting for search result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Rebinding to URL ldap://DomainDnsZones.chtpz.ru/DC=DomainDnsZones,DC=chtpz,DC=ru Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Waiting for bind result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Rebinding to URL ldap://ForestDnsZones.chtpz.ru/DC=ForestDnsZones,DC=chtpz,DC=ru Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Waiting for bind result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Rebinding to URL ldap://chtpz.ru/CN=Configuration,DC=chtpz,DC=ru Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Waiting for bind result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Bind successful Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Bind successful Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Bind successful Fri Oct 27 14:48:39 2017 : Debug: (7) files: Search returned no results How can I fix this??

3 5

Re: Freeradius-Users Digest, Vol 150, Issue 60
by dahili.network＠gmail.com 28 Oct '17

28 Oct '17

Dear friends i am looking paid help on freeradius to offer unpaid page to ppoe customers my email is dahili.network(a)gmail.com unpaid page on real ip web server page is php and curently working for mac auth users but unpaid ppoe disconnected that is why unuseable to ppoe users freeradius may default accept connection ider user paid or unpaid but if unpaid with route to unpaid section if paid than route to paid section ----- Original Message ----- From: <freeradius-users-request(a)lists.freeradius.org> To: <freeradius-users(a)lists.freeradius.org> Sent: Saturday, October 28, 2017 1:00 PM Subject: Freeradius-Users Digest, Vol 150, Issue 60 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: ldap group membership check issue (Alan DeKok) > 2. Re: Radius proxy request to other radius for OTP auth > (Satish Patel) > 3. Re: Radius proxy request to other radius for OTP auth (Alan DeKok) > 4. Re: Radius proxy request to other radius for OTP auth > (Satish Patel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 27 Oct 2017 08:48:03 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: ldap group membership check issue > Message-ID: <3A589B8E-AF8B-46C5-B9FA-9344D95BDA1C(a)deployingradius.com> > Content-Type: text/plain; charset=utf-8 > > On Oct 27, 2017, at 7:49 AM, Евгений Подберезкин <epodber(a)gmail.com> > wrote: >> >> Thanks for the reply. I 've already added the realms to proxy.conf , but >> adding ntdomain module wasn`t obvious for me (suffix is enabled by >> default, >> so I did not care of it). > > Yes, that's not obvious. > >> I have one more question, could you give me hint. >> >> If check LDAP-Group in etc/raddb/users, it works. >> >> DEFAULT chtpzldap-LDAP-Group == >> "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru" >> >> DEFAULT Auth-Type := Reject >> Reply-Message = "Group do not match" >> >> But if I need to set an attribute in post-auth, it does not >> >> F.e. in sites-enabled/default or sites-enabled/inner-tunnel > > That sets the attribute in the *inner-tunnel*. You still need to get it > to the outer, default server. > > See raddb/mods-available/eap. Look for "use_tunneled_reply". > >> post-auth { >> >> if (chtpzldap-LDAP-Group == >> "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") { >> Tunnel-Private-Group-ID := "165" >> } >> >> >> radiusd -X : >> >> (9) # Executing section post-auth from file >> /opt/freeradius3/etc/raddb/sites-enabled/default >> (9) post-auth { >> (9) if (chtpzldap-LDAP-Group == >> "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") { >> (9) *if (chtpzldap-LDAP-Group == >> "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") -> FALSE* > > Which means it doesn't match. Find out why, first. > > See the comments at the top of the "inner-tunnel" virtual server for how > to debug it. > > Alan DeKok. > > > > > ------------------------------ > > Message: 2 > Date: Fri, 27 Oct 2017 12:05:24 -0400 > From: Satish Patel <satish.txt(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Radius proxy request to other radius for OTP auth > Message-ID: > <CAPgF-for5jSuCE3anKQ+sUdvaXC548c6JSHS27oMQ2CTOM8PHA(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > In short this is what i am planning to do with FreeRadius instead of > IAS windows > http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logo… > > We have Multi Factor authentication (password+OTP) for VPN login, and > MFA (multi factor auth) provided by onelogin company, in my Cisco ASA > i tell my RADIUS server is onlogin in cloud and my asa authenticate > users from there, but that company doesn't support Attribute Class 25 > which i posted in link, so i was thinking to build Freeradius in-house > and do whatever i want there for grouping and then proxy request to > onlogin for OTP stuff. In short my local radius will act like Proxy > and forward request to onelogin in cloud for OTP. > > I am not sure it's possible or not so just trying to see what people > think about it or any other way out. > > On Fri, Oct 27, 2017 at 8:43 AM, Alan DeKok <aland(a)deployingradius.com> > wrote: >> On Oct 26, 2017, at 10:58 PM, Satish Patel <satish.txt(a)gmail.com> wrote: >>> Recently we decided to create multiple Group Policy for VPN and every >>> group will have own permission to access application, like Sales, >>> Finance and contractor etc, In short contractor can't access Finance >>> related application etc. >> >> I'm not sure that's possible in RADIUS. You can send policies to the >> VPN (maybe), but the VPN may ignore them. >> >>> After reading found ASA support RADIUS attribute Class 25 where i can >>> create OU=sales and implement policy base on whatever LDAP memberOf >>> list users. >> >> That's vague... what, exactly are you doing? What piece of the network >> is doing what? >> >>> But unfortunately onelogin doesn't support that kind of attributes >>> mapping and now we stuck here so only solution is to deploy on radius >>> server and integrate with google authenticator. >> >> How does deploying a RADIUS server help with controlling access to >> applications? >> >>> So i have question is there anyway i can use FreeRadius locally and >>> use attributes Class 25 and then proxy authentication to onlelogin >>> RADIUS? >> >> FreeRADIUS can use Class. So? What does it *do* with it? >> >>> What should i do and what you guys suggest here? >> >> First, you have to describe what you're doing. Which network machines >> are involved? What are they doing? What information do they exchange? >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 3 > Date: Fri, 27 Oct 2017 12:10:28 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Radius proxy request to other radius for OTP auth > Message-ID: <17B7D2F9-A785-487D-B691-38EEDE050FAC(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > >> On Oct 27, 2017, at 12:05 PM, Satish Patel <satish.txt(a)gmail.com> wrote: >> >> In short this is what i am planning to do with FreeRadius instead of >> IAS windows >> http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logo… > > You just configure FreeRADIUS to send the Class attribute back. That > should be simple. > >> We have Multi Factor authentication (password+OTP) for VPN login, and >> MFA (multi factor auth) provided by onelogin company, in my Cisco ASA >> i tell my RADIUS server is onlogin in cloud and my asa authenticate >> users from there, but that company doesn't support Attribute Class 25 >> which i posted in link, > > Then you can't do it. > >> so i was thinking to build Freeradius in-house >> and do whatever i want there for grouping and then proxy request to >> onlogin for OTP stuff. In short my local radius will act like Proxy >> and forward request to onelogin in cloud for OTP. > > That still isn't clear. If the VPN doesn't support Class, then adding > FreeRADIUS won't help. > > Alan DeKok. > > > > > ------------------------------ > > Message: 4 > Date: Fri, 27 Oct 2017 12:37:12 -0400 > From: Satish Patel <satish.txt(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Radius proxy request to other radius for OTP auth > Message-ID: > <CAPgF-fqKM-Jq1WteajY3h+aC1f8vGxazSUdTVT-bftG4v7dbpg(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > >> That still isn't clear. If the VPN doesn't support Class, then adding >> FreeRADIUS won't help. > > VPN does support that Class > > On Fri, Oct 27, 2017 at 12:10 PM, Alan DeKok <aland(a)deployingradius.com> > wrote: >> >>> On Oct 27, 2017, at 12:05 PM, Satish Patel <satish.txt(a)gmail.com> wrote: >>> >>> In short this is what i am planning to do with FreeRadius instead of >>> IAS windows >>> http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logo… >> >> You just configure FreeRADIUS to send the Class attribute back. That >> should be simple. >> >>> We have Multi Factor authentication (password+OTP) for VPN login, and >>> MFA (multi factor auth) provided by onelogin company, in my Cisco ASA >>> i tell my RADIUS server is onlogin in cloud and my asa authenticate >>> users from there, but that company doesn't support Attribute Class 25 >>> which i posted in link, >> >> Then you can't do it. >> >>> so i was thinking to build Freeradius in-house >>> and do whatever i want there for grouping and then proxy request to >>> onlogin for OTP stuff. In short my local radius will act like Proxy >>> and forward request to onelogin in cloud for OTP. >> >> That still isn't clear. If the VPN doesn't support Class, then adding >> FreeRADIUS won't help. >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 150, Issue 60 > ************************************************* > --- Bu e-posta, AVG tarafından virüslere karşı kontrol edildi. http://www.avg.com

1 0

Radius proxy request to other radius for OTP auth
by Satish Patel 27 Oct '17

27 Oct '17

Let me explain what we are trying to do, we have Cisco anyconnect VPN and we are using onelogin RADIUS (https://www.onelogin.com/) for OTP, we have our own OpenLDAP server and onelogin sync our directory service and provide Auth with OTP solution. Recently we decided to create multiple Group Policy for VPN and every group will have own permission to access application, like Sales, Finance and contractor etc, In short contractor can't access Finance related application etc. After reading found ASA support RADIUS attribute Class 25 where i can create OU=sales and implement policy base on whatever LDAP memberOf list users. But unfortunately onelogin doesn't support that kind of attributes mapping and now we stuck here so only solution is to deploy on radius server and integrate with google authenticator. So i have question is there anyway i can use FreeRadius locally and use attributes Class 25 and then proxy authentication to onlelogin RADIUS? What should i do and what you guys suggest here?

2 4

rlm_winbind group membership check
by Евгений Подберезкин 27 Oct '17

27 Oct '17

Hi. I need to authenticate wifi users via PEAP(mschap) with group checking against windows active directory. We have several domains in transitive relations. Basic authentication via winbind works fine. But since the groups may be in different domains, I must check group membership with domain prefix. And I can not set up rlm_winbind to work correctly. Could you help me, please. root@chtpzfreeradius:/opt/sbin# cat /opt/etc/raddb/users | grep -v "#" DEFAULT Winbind-Group == "CHTPZ0\\wifi_chtpz" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID := "165" DEFAULT Auth-Type := Reject Reply-Message = "Groups do not match" root@chtpzfreeradius:/opt/sbin# cat /opt/etc/raddb/mods-enabled/winbind | grep -v "#" winbind { winbind_username = "%{%{Stripped-User-Name}:-%{User-Name}}" group { group_search_username = "%{%{Stripped-User-Name}:-%{ User-Name}}" group_add_domain = no } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } } Output of radiusd -Xx shows, that module strips domain part of group name. Thu Oct 26 09:58:52 2017 : (7.0) files - EXPAND %{%{Stripped-User-Name}:-%{User-Name}} Thu Oct 26 09:58:52 2017 : (7.0) files - %{%{Stripped-User-Name}:-%{ User-Name}} Thu Oct 26 09:58:52 2017 : (7.0) files - Parsed xlat tree: Thu Oct 26 09:58:52 2017 : XLAT-IF { Thu Oct 26 09:58:52 2017 : (7.0) files - attribute --> Stripped-User-Name Thu Oct 26 09:58:52 2017 : } Thu Oct 26 09:58:52 2017 : XLAT-ELSE { Thu Oct 26 09:58:52 2017 : (7.0) files - attribute --> User-Name Thu Oct 26 09:58:52 2017 : } Thu Oct 26 09:58:52 2017 : (7.0) files - --> CHTPZ0\\epodberezkin Thu Oct 26 09:58:52 2017 : (7.0) files - Reserved connection (4) Thu Oct 26 09:58:52 2017 : (7.0) files - Trying to find user "CHTPZ0\epodberezkin" in group "CHTPZ0\wifi_chtpz" Thu Oct 26 09:58:53 2017 : (7.0) files - Successfully retrieved user's groups Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10004 to name "CHTPZ0\domain users" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "domain users" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10026 to name "CHTPZ0\msk2_docs_инструкции_r" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "msk2_docs_инструкции_r" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10027 to name "CHTPZ0\bad_sites" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "bad_sites" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10028 to name "CHTPZ0\wallpaper_disable" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wallpaper_disable" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10029 to name "CHTPZ0\ucc-archive-read" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "ucc-archive-read" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10030 to name "CHTPZ0\acs_administrartor" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "acs_administrartor" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10020 to name "CHTPZ0\wwwg" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wwwg" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10031 to name "CHTPZ0\h239_xray_read" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "h239_xray_read" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10032 to name "CHTPZ0\administrators-chtpzsfbfe1" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "administrators-chtpzsfbfe1" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10033 to name "CHTPZ0\administrators-chtpzsfbdb1" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "administrators-chtpzsfbdb1" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10034 to name "CHTPZ0\цит-интернет" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "цит-интернет" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10035 to name "CHTPZ0\password policy high" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "password policy high" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10036 to name "CHTPZ0\csadministrator" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "csadministrator" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10037 to name "CHTPZ0\rtcuniversalserverreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name " rtcuniversalserverreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10038 to name "CHTPZ0\rtcuniversalglobalwritegroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "rtcuniversalglobalwritegroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10039 to name "CHTPZ0\csserveradministrator" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "csserveradministrator" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10040 to name "CHTPZ0\rtcuniversalglobalreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name " rtcuniversalglobalreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10041 to name "CHTPZ0\rtcuniversalserveradmins" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "rtcuniversalserveradmins" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10042 to name "CHTPZ0\rtcuniversaluserreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name " rtcuniversaluserreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10043 to name "CHTPZ0\vpn_1ceh_video" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "vpn_1ceh_video" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10016 to name "CHTPZ0\1с chtpzfile2" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "1с chtpzfile2" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10044 to name "CHTPZ0\wi-fi_dip" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wi-fi_dip" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10045 to name "CHTPZ0\vpndip" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "vpndip" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10046 to name "CHTPZ0\wifi local" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wifi local" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10015 to name "CHTPZ0\proxyusers" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "proxyusers" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10014 to name "CHTPZ0\управление по работе с соц.объектами(чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "управление по работе с соц.объектами(чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10047 to name "CHTPZ0\серверные (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "серверные (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10012 to name "CHTPZ0\rever1" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "rever1" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10048 to name "CHTPZ0\dhcp users" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "dhcp users" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10011 to name "CHTPZ0\день информирования (чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "день информирования (чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10049 to name "CHTPZ0\wifi vip" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wifi vip" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10050 to name "CHTPZ0\zavod" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "zavod" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10051 to name "CHTPZ0\zip(запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "zip(запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10010 to name "CHTPZ0\охрана труда_ цех №1(чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "охрана труда_ цех №1(чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10052 to name "CHTPZ0\asa_vpn_users" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "asa_vpn_users" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10053 to name "CHTPZ0\_система технического учета (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "_система технического учета (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10054 to name "CHTPZ0\департамент по тк (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "департамент по тк (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10055 to name "CHTPZ0\users chtpz-cit" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "users chtpz-cit" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10008 to name "CHTPZ0\l(чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "l(чтение)" *Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10056 to name "CHTPZ0\wifi_chtpz"* *Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wifi_chtpz"* Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10057 to name "CHTPZ0\vnc_access" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "vnc_access" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10058 to name "CHTPZ0\vnc_moscow" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "vnc_moscow" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10059 to name "CHTPZ0\ciscoms" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "ciscoms" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10006 to name "CHTPZ0\ts2008" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "ts2008" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10060 to name "CHTPZ0\ооо универсальные системы" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "ооо универсальные системы" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10061 to name "CHTPZ0\oss_members" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "oss_members" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10001 to name "BUILTIN\users" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "users" *Thu Oct 26 09:58:53 2017 : (7.0) files - No groups found that match* Thu Oct 26 09:58:53 2017 : (7.0) files - Released connection (4) P.S. and could you also tell me the recommended (more stable) version of freerad with rlm_windind root@chtpzfreeradius:/opt# cat /etc/debian_version 9.2

2 2