November 2017 - Freeradius-Users - lists.freeradius.org

Building from source with postgres support
by Toby Walsh 06 Nov '17

06 Nov '17

Hi list, I am a reasonable long-time user of Freeradius on a single monolithic host but I'm setting up a new server and putting my services in containers. I have postgres in a Docker container running nicely, fully configured with my old user base migrated from MySQL. I am compiling Freeradius 3.0.15 on a separate container and hoping to use Postgres as the store. radtest with bob/hello works fine. However I realised when I tried to set up Postgres support that it fails with rlm_sql_postgresql.so not found. I'm guessing that the compile process detects database support and only builds in binding libraries if it finds that database on the same system? Can you tell me what the requirements are that Freeradius' build process builds rlm_sql_postgresql.so for me? One that is hopefully compatible with driving Freeradius on that end but independent of Postgres on the other container? Freeradius is on a Centos 7.4 container, Postgres 10 is on Debian container. Thanks

3 5

two questions about migration from FR 2.X to 3.X
by Anton Kiryushkin 03 Nov '17

03 Nov '17

Hello. I have two question about migration from oldest to newest version. 1. After migration, the process authorization by MSCHAP-V2 wrote that can't make NT-password: Fri Nov 3 10:27:52 2017 : WARNING: (4) mschap: No Cleartext-Password configured. Cannot create NT-Password Fri Nov 3 10:27:52 2017 : WARNING: (4) mschap: No Cleartext-Password configured. Cannot create LM-Password Fri Nov 3 10:27:52 2017 : Debug: (4) mschap: Client is using MS-CHAPv1 with NT-Password Fri Nov 3 10:27:52 2017 : ERROR: (4) mschap: FAILED: No NT/LM-Password. Cannot perform authentication Fri Nov 3 10:27:52 2017 : ERROR: (4) mschap: MS-CHAP2-Response is incorrect This happened in inner-tunnel site with config: server inner-tunnel { authorize { chap mschap suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } eap } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } } But I have the same config on FR 2.X in it worked. Could tell me why? The second question with another client. I've got the next error message: Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: Failed in __FUNCTION__ (SSL_read): s3_srvr.c[1240]:error:1408A0E3:SSL routines:ssl3_get_client_hello:parse tlsext Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: System call (I/O) error (-1) Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: TLS receive handshake failed during operation Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: [eaptls process] = fail Thu Nov 2 21:44:19 2017 : ERROR: (159) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed This is printer Canon 5240i and I can't change his software. As well as in the previous question, all work with FR 2.X. -- Best regards, Anton Kiryushkin

2 6

How Radperf increase values of "Acct-Input-Octets" and "Acct-Output-Octets" fields
by Claudio Carvalho 02 Nov '17

02 Nov '17

Hi, I'm testing radperf and i need manipulate the values of fields "Acct-Input-Octets" and "Acct-Output-Octets". Is it possible for each "Interim-Update" the software increase the values of these fields? Thanks, Claudio.

2 2

Freeradius and Role based access control
by Tony Pedley 02 Nov '17

02 Nov '17

Sorry, this is a bit of a newbie question, but something I have been trying to work out for a while IEC 62351 specifies that access permission to a device is based on the authentication of the user and also the role(s) associated with that user. To allow us to use RADIUS to authenticate an access request, we would the radius server to authenticate both the user name password, but also whether the the user has the rights to the role requested. Their does not seem to be any obvious attribute to pass requested role information to a freeradius server, so what is generally the merthod to implement Role Based access control via Radius?

2 1

Proxying MS-CHAPv2
by Norman Elton 02 Nov '17

02 Nov '17

We've been running FreeRADIUS for our wireless 802.1x infrastructure for years, without problem (thanks!). FreeRADIUS basically proxies back to our Windows NPS servers, then injects a VLAN assignment using unlang on the Access-Accept. Now we're deploying the same architecture for our wired infrastructure. I've noticed that the authentication requests between the FreeRADIUS servers and NPS for our wired infrastructure is all EAP, which is getting rejected since our NPS servers are expecting PEAP. I'm assuming I need to specifically tell FreeRADIUS that the back-end authentication needs to take place over PEAP, but don't see where that would be configured. It's basically the same config as our wireless infrastructure, but in that case, PEAP/MS-CHAPv2 is configured on the access points. Am I missing something obvious here? Thanks, Norman Elton

2 1

Username with dot issue
by Satish Patel 01 Nov '17

01 Nov '17

I have setup freeradius with LDAP and we have may user account starting with "dot" example "foo.bar" but i found somewhere it getting strip off and only showing "foo" in logs. I have this setting in hint file, we are doing proxy to other radius too. I have check policy file too but nothing matching there. DEFAULT User-Name =~ "^([a-z]{1,25})" User-Name := "%{1}@EXAMPLE" Tue Oct 31 17:12:57 2017 : Debug: (2) Cleaning up request packet ID 11 with timestamp +110 Tue Oct 31 17:12:57 2017 : Info: Ready to process requests Tue Oct 31 17:13:01 2017 : Debug: (3) Received Access-Request Id 147 from 127.0.0.1:58804 to 127.0.0.1:1812 length 77 Tue Oct 31 17:13:01 2017 : Debug: (3) User-Name = "foo.bar" Tue Oct 31 17:13:01 2017 : Debug: (3) User-Password = “password123” Tue Oct 31 17:13:01 2017 : Debug: (3) NAS-IP-Address = 10.5.3.31 Tue Oct 31 17:13:01 2017 : Debug: (3) NAS-Port = 1812 Tue Oct 31 17:13:01 2017 : Debug: (3) Message-Authenticator = 0x07a42e3b1de836e011b2a15c196f8486 Tue Oct 31 17:13:01 2017 : Debug: (3) session-state: No State attribute Tue Oct 31 17:13:01 2017 : Debug: (3) # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Oct 31 17:13:01 2017 : Debug: (3) authorize { Tue Oct 31 17:13:01 2017 : Debug: (3) policy filter_username { Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name) { Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name) -> TRUE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name) { Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ / /) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ / /) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /@[^@]*@/ ) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.\./ ) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.\./ ) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.$/) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.$/) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /(a)\./) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /(a)\./) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) } # if (&User-Name) = notfound Tue Oct 31 17:13:01 2017 : Debug: (3) } # policy filter_username = notfound Tue Oct 31 17:13:01 2017 : Debug: (3) modsingle[authorize]: calling preprocess (rlm_preprocess) Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: Adding 2 matches Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: hints: Matched DEFAULT at 65 Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: ::: FROM 1 TO 6 MAX 7 Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: ::: Examining User-Name Tue Oct 31 17:13:01 2017 : Debug: %{1}@EXAMPLE Tue Oct 31 17:13:01 2017 : Debug: Parsed xlat tree: Tue Oct 31 17:13:01 2017 : Debug: regex-var --> 1 Tue Oct 31 17:13:01 2017 : Debug: literal --> @EXAMPLE Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: 1/2 Found: foo (4) Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: EXPAND %{1}@EXAMPLE Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: --> foo@EXAMPLE

2 1