November 2017 - Freeradius-Users - lists.freeradius.org

LB layer - Issue with shared secret.
by Andrea Mucci 22 Nov '17

22 Nov '17

Hi all, I would like to use a load balance as the first layer proxy the requests on more than one radius server. In this way, the radius packet will always be sent from the same IP address, so we would have a problem with the shared secret. Can I do that freeradius retrieves client's information via NAS-IP-Address attribute and not via Sender IP Address? I use freeradius-server-3.0.15 on RHEL 7. Best regards Andrea

2 1

Why does 'switch' and case don't work?
by luckydog xf 22 Nov '17

22 Nov '17

Hi, switch statement in post-auth section doesn't work, see below. ============= switch &LDAP-Group { case "network-admins" { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "3", Login-Service = 50, } } case "network-0" { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "0", Login-Service = 50, } } case { reject } } ========================= It always comes down to the 'default' reject part, it looks like <LDAP-Group > match nothing. where if/elsif/else works as expected. What's wrong with my statement above?

3 3

FreeRadius rate limit + CISCO ASR9001
by Yahn do Amaral Almeida Pinheiro 21 Nov '17

21 Nov '17

Can someone tell me how to configure a user's bandwidth limit by the database? I use a Cisco ASR9001. The only attribute I found was: *radgroupreply* | groupname | attribute | op | value ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | 128KB | Cisco-Avpair | := | lcp:interface-config#1=rate-limit input 2000 8000 8000 conform-action transmit exceed-action drop ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | 128KB | Cisco-Avpair | := | lcp:interface-config#1=rate-limit output 2000 8000 8000 conform-action transmit exceed-action drop *radusergroup* username | groupname --------------------------------- user | 128KB But it does not work.

2 1

Operator being rewritten - rlm_python
by Fraser McGlinn 20 Nov '17

20 Nov '17

Hi Guys, Trying to get rlm_python going on 3.0.13 on Centos 7. Got everything working correctly although I am finding that the reply tuple does not appear to be accepting my operator +=. See debug below: authorize - 'reply:Framed-IP-Address' = '192.0.2.0' authorize - 'reply:Cisco-AVPair' += 'ip:dns-servers=192.0.2.255 192.0.2.254' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#10=deny udp any any eq domain' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#20=deny udp any any eq snmp' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#30=deny udp any any eq 1900' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#40=deny tcp any any eq 80' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#50=deny udp any any eq 80' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#60=deny tcp any any eq 443' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#70=deny udp any any eq 443' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#80=permit ip any any' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#10=deny udp any any eq domain' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#20=deny udp any any eq snmp' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#30=deny udp any any eq 1900' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#40=deny tcp any any eq 80' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#50=deny udp any any eq 80' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#60=deny tcp any any eq 443' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#70=deny udp any any eq 443' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#80=permit ipv6 any any' authorize - 'config:Cleartext-Password' = 'test' (0) [python] = ok (0) } # authorize = ok (0) Found Auth-Type = CHAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type CHAP { (0) chap: Comparing with "known good" Cleartext-Password (0) chap: CHAP user "test(a)domain.com" authenticated successfully (0) [chap] = ok (0) } # Auth-Type CHAP = ok (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Login OK: [test(a)domain.com] (from client localhost port 0) (0) Sent Access-Accept Id 121 from 127.0.0.1:1812 to 127.0.0.1:54848 length 0 (0) Framed-IP-Address = 192.0.2.0 (0) Cisco-AVPair = "ip:dns-servers=192.0.2.255 192.0.2.254" (0) Cisco-AVPair = "ip:outacl#10=deny udp any any eq domain" (0) Cisco-AVPair = "ip:outacl#20=deny udp any any eq snmp" (0) Cisco-AVPair = "ip:outacl#30=deny udp any any eq 1900" (0) Cisco-AVPair = "ip:outacl#40=deny tcp any any eq 80" (0) Cisco-AVPair = "ip:outacl#50=deny udp any any eq 80" (0) Cisco-AVPair = "ip:outacl#60=deny tcp any any eq 443" (0) Cisco-AVPair = "ip:outacl#70=deny udp any any eq 443" (0) Cisco-AVPair = "ip:outacl#80=permit ip any any" (0) Cisco-AVPair = "ipv6:outacl#10=deny udp any any eq domain" (0) Cisco-AVPair = "ipv6:outacl#20=deny udp any any eq snmp" (0) Cisco-AVPair = "ipv6:outacl#30=deny udp any any eq 1900" (0) Cisco-AVPair = "ipv6:outacl#40=deny tcp any any eq 80" (0) Cisco-AVPair = "ipv6:outacl#50=deny udp any any eq 80" (0) Cisco-AVPair = "ipv6:outacl#60=deny tcp any any eq 443" (0) Cisco-AVPair = "ipv6:outacl#70=deny udp any any eq 443" (0) Cisco-AVPair = "ipv6:outacl#80=permit ipv6 any any" Note in the authorize reply output provided by rlm_python shows the op as +=, but the op in the access accept show =. I note that in the source there is a sanity check to verify the operator passed to rlm_python, but I'm not seeing any logs even in -XX showing that its being rewritten as per the source. Any ideas? Thanks, Fraser

2 2

Error: Discarding duplicate request from client
by Krauss International 20 Nov '17

20 Nov '17

hello I am getting lot of error messages in radius logs saying Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 59350 - ID: 202 due to unfinished request 12 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 36510 - ID: 205 due to unfinished request 17 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 33750 - ID: 207 due to unfinished request 18 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 41954 - ID: 206 due to unfinished request 19 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 60427 - ID: 209 due to unfinished request 21 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 36208 - ID: 210 due to unfinished request 22 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 57888 - ID: 211 due to unfinished request 24 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 59072 - ID: 213 due to unfinished request 26 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 45146 - ID: 214 due to unfinished request 32 in component post-auth module exec. When users are trying to loh=gin in the NAS I can see in NAS logs that radius is timing out, what could be the reason for this? Thanks & regards Mankomal Singh Krauss International P: +91-9910416231 E: ms(a)kc-india.com PS: Send all bulk emails to sanman.krauss(a)gmail.com ONLY

3 4

FreeIPA- FreeRius--authenticate by One-time-password. DON'T USE users.
by luckydog xf 20 Nov '17

20 Nov '17

Hello, I asked this soluation several days ago, but right now I figure out how, so I write down here just FYI. 1. install FreeIPA and FreeRADIUS, refer to this link, https://www.freeipa.org/page/Using_FreeIPA_and_FreeRadius_as_a_RADIUS_based… 2. Critical part of `module-enabled/ldap` ldap { server = 'localhost' base_dn = 'dc=xxx,dc=com' user { base_dn = "cn=accounts,${..base_dn}" ========================================== group { base_dn = "cn=compat,${..base_dn}" filter = '(objectClass=posixGroup)' name_attribute = cn membership_filter = "(memberUid=%{%{Stripped-User-Name}:-%{User-Name}})" =================================== 3. Grant privileges with post-auth section of site-enabled/default =============================================== if (LDAP-Group == "network-admins") { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "3", Login-Service = 50, } } elsif (LDAP-Group == "network-operators") { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "2", Login-Service = 50, } } else { reject } 4. Create Group named 'network-admins', etc. add Users.. and enable OTP, test by 'radtest user password localhost 0 testing123' 5. That's all, good luck.

1 0

Any way to implement privileges-granting as I configure in 'users'
by luckydog xf 20 Nov '17

20 Nov '17

Hello, Currently I'm using 'users file to authorize users against login on our network device like Switches. e.g # /etc/raddb/users ...... h3c Cleartext-Password := "netadmin" Service-Type = NAS-Prompt-User, Huawei-Exec-Privilege = "3", Login-Service = 50 ...... But I want to intergrate it with FreeIPA( which provides a LDAP service), which brings the benefit of using one-time-password(see this https://www.freeipa.org/page/Using_FreeIPA_and_FreeRadius_as_a_RADIUS_based… ) Apparently it's easy to configure user's account, but is there any way to handle the privileges related stuff like 'Huawei-Exec-Privilege = "3",' in LDAP? And by the way, how is 'authenticate section' in 'site-enabled/default' called? I'm a littble bit confused. Can I say that 'authenticate section is useless and would NEVER be called unless I add "Auth-Type:= FOO" in the 'authorize section' ? I guess this from the comment of 'default' . Thanks,

3 3

Zombie proxies with RadSec
by Neuton Martins 18 Nov '17

18 Nov '17

Hello, I am having some problems with zombie proxies using TLS (RadSec) connections im my environment. Seems like the status-server won't work with TLS. What is the right way to solve this? I have tweaked the proxy TLS zombie settings but i am not sure if my settings are good. Here are my home server config distributed to several locations im my mpls network: https://pastebin.com/2nhkAb7D Thanks. With regards, Neuton

3 5

Unable to start RADIUS (Permissions)
by Smith, James 17 Nov '17

17 Nov '17

Hello, I've attached output from a radius -X command in a text file to provide more information as to what's going on. I'm receiving the following error: # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" Unable to open file "/etc/raddb/mods-config/files/authorize": Permission denied } /etc/raddb/mods-enabled/files[9]: Invalid configuration for module "files" For /etc/raddb/mods-config/files/authorize I tried to make the permissions r-w-x for root and radius group and read for all other users... so 774 but I'm not having any luck getting radius to start. When I try to give full permission for testing (777), I get the same error. I also tried to change /etc/raddb/mods-available/files to 777 just to test and I receive the following: Configuration file /etc/raddb/mods-enabled/files is globally writable. Refusing to start due to insecure configuration. Errors reading or parsing /etc/raddb/radiusd.conf Makes sense since it's insecure. Hopefully there is enough information to pin point what's actually going on. Thanks, Jim This message is intended only for the addressee and may contain information that is company confidential or privileged. Any technical data in this message may be exported only in accordance with the U.S. International Traffic in Arms Regulations (22 CFR Parts 120-130) or the Export Administration Regulations (15 CFR Parts 730-774). Unauthorized use is strictly prohibited and may be unlawful. If you are not the intended recipient, or the person responsible for delivering to the intended recipient, you should not read, copy, disclose or otherwise use this message. If you have received this email in error, please delete it, and advise the sender immediately.

5 6

Python meets oauth2
by FARRAHE RM. FARRAHE 17 Nov '17

17 Nov '17

Hello, I want to implement a Freeradius module with Python to authenticate and authorize the user through Oauth2. Can somebody give me advise or idee for starting. ob this is feasible. What are the constraints? What do I have to consider for the safety aspect? Thanks

3 2