March 2017 - Freeradius-Users - lists.freeradius.org

Freeradius with motp
by Isidro Hortelano 16 Mar '17

16 Mar '17

Hi all, I'm trying to configure freeradius version 3.0.3 with motp, to check to verify the otp i use a external script. This is my current configuration: /etc/raddb/radiusd.conf moudules { ..... exec MOTP { wait = yes program = "/etc/raddb/otpverify.sh %{User-Name} %{User-Password} %{reply:Secret %{reply:Pin} %{reply:Offset}" input_pairs = request output_pairs = reply } ....... } sites-enabled/default Auth-Type External { MOTP } /etc/raddb/users DEFAULT Auth-Type = External Exec-Program-Wait = "/usr/local/etc/raddb/otpverify.sh '%{User-Name}' '%{User-Password}' '%{reply:Secret}' '%{reply:Pin}' '%{reply:Offset}'", Fall-Through = Yes test2 Secret = a843ad39b0bSe12ede3092c0ac30676c23eb23ae, Pin = 1234, Offset = 0 When i start the radius server I'm getting this error, anybody know about it ? radiusd -X error: reading pairlist file /etc/raddb/mods-config/files/authorize /etc/raddb/mods-config/files/authorize[213]: Parse error (check) for entry test2: Unknown value 'External' for attribute 'Auth-Type' Failed reading /etc/raddb/mods-config/files/authorize /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" Regards,

2 1

Gotchas of LDAP Server Side Sort controls
by Arran Cudbard-Bell 15 Mar '17

15 Mar '17

Added SSS support to LDAP URLs for LDAP xlat and maps. Are there any particular gotchas with OpenLDAP or others that I should include in the documentation? -Arran

3 5

Cisco LNS realm redirection
by Richard Savage 15 Mar '17

15 Mar '17

Hi List Im just looking to see if someone can point me in the right direction. I have a slight issue in that im trying to repoint a PPP session that is terminating on a cisco LNS(5.5.5.5) from a DSL carrier (TT/BTW) to another LNS (6.6.6.6) (but the carrier (TT/BTW) dont get to see the customer LNS direct). We get the initial request from the carrier and send back an access accept to the carrier to land this on the LNS which is all fine, then we get the access request from our LNS which we then need to reply back with a different LNS IP (6.6.6.6) instead of itself (5.5.5.5) to tell the cisco LNS to forward the PPP session onto the other LNS. Would be good if we can do this based on realm. Is this possible and whats the best way of achieving this as there seems little info on how to achieve this. Im running freeradius 2.1.12 Many thanks in advance. Radius output below: Rich ============================================================================== Access-Request Id 159 1.1.1.1:1812 -> 2.2.2.2:1812 +4237.896 User-Name = "username@realm" CHAP-Password = 0x01d4aa02ffc6c1364cb2bf3ec9675019a2 CHAP-Challenge = 0xa771f601cd1ffd8b376661995e5a4e09 Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = "lts001.hex" NAS-Port = 2432808109 NAS-Port-Type = Virtual NAS-Port-Id = "L2TP LNS 111789" Medium-Type = DSL Connect-Info = "14144000/1057000" Platform-Type = SmartEdge-800 OS-Version = "12.1.1.9" Tunnel-Type:0 = L2TP Tunnel-Medium-Type:0 = IPv4 Tunnel-Server-Endpoint:0 = "10.177.255.128" Tunnel-Client-Endpoint:0 = "10.160.71.32" Tunnel-Server-Auth-Id:0 = "lts001.hex" Tunnel-Client-Auth-Id:0 = "nge001.sou-re0" Tunnel-Max-Sessions = 65535 Tunnel-Max-Tunnels = 32767 Redback-Attr-226 = 0x0000001e Tunnel-Function = LNS-Only Acct-Tunnel-Connection = "nge001.sou-re0/10.160.71.32:32009:29879" LAC-Port = 34699 Calling-Station-Id = " eth 0/3/1:101@FTTC" Access-Accept Id 159 2.2.2.2:1812 -> 1.1.1.1:1812 +4237.934 Tunnel-Server-Endpoint:0 = "5.5.5.5" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "XXXXXX-TT" Attr-69 = 0x00ba01f1c9da158a65f05e6965298b8b28548e Tunnel-Preference:0 = 1 Cisco-AVPair = "ip:ip-unnumbered=Loopback 1" ============================================================================== Access-Request Id 20 3.3.3.3:1645 -> 4.4.4.4:1812 +4238.251 Framed-Protocol = PPP User-Name = "username@realm" CHAP-Password = 0x02fb4271c598e5b5f54f53d246c7afe7b3 Calling-Station-Id = " eth 0/3/1:101@FTTC" Connect-Info = "14144000/1057000" NAS-Port-Type = ISDN NAS-Port = 20035 NAS-Port-Id = "Uniq-Sess-ID35" Service-Type = Framed-User NAS-IP-Address = 3.3.3.3 Access-Accept Id 20 4.4.4.4:1812 -> 3.3.3.3:1645 +4238.281 Tunnel-Server-Endpoint:0 = "5.5.5.5" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "XXXXXX-TT" Attr-69 = 0x00c5f560efa721d0f0cd39b73e64ca1145004a Tunnel-Preference:0 = 1 Cisco-AVPair = "ip:ip-unnumbered=Loopback 1" ----------------------------------- *NEEDS TO SAY:* Tunnel-Server-Endpoint:0 = "6.6.6.6" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "XXXXXXX-TT" Attr-69 = 0x00c5f560efa721d0f0cd39b73e64ca1145004a Tunnel-Preference:0 = 1 ==============================================================================

2 1

escaped quotes and backslashes in passwords
by John Smith 15 Mar '17

15 Mar '17

Hi, Thanks for reading this and if I am not clear in my thoughts please let me know. FreeRADIUS Version 2.2.5 (deb8 repos) I am using a perl module in authenticate{} to call an external api to validate the passwords received from Radius Proxy (Radius Proxy receives a password from openvpn radius plugin) The quotes and backslashes in the passwords I receive to the radius perl module, inside $RAD_REQUEST{'User-Password'} always end up escaped with backslashes. I was wondering what causes this behaviour and how can it be avoided without resorting to using perl regexps to remove the backslashes from the $RAD_REQUEST{'User-Password'} values? Thanks!

2 1

Send user notification on data usage
by Sachin Yadav 15 Mar '17

15 Mar '17

Dear All, We are using freeradius to control our WiFi hotspot. We have implemented FUP limits for users based on day/week/month. Now, we want to send a user notification if the user has used - let's say 80% of daily allowed limit, informing that data is about to finish, in the form of email/sms. I have 2 ways to implement it - 1. Some hook at freedaius side which can look at consumption in interim updates and based on logic call a webservice(or anything else) which will further take care of notification sending part. 2. Have a bot which will constantly read on radacct table and will send notification if required. I am more inclined towards approach 1 as it would be a neat and fast way of doing it. Reading a highly transaction table such as radacct is no good idea. Kindly suggest. Thanks,Sachin.

3 3

Problem with two ldap connections
by Jörn Volkhausen 15 Mar '17

15 Mar '17

Hello at all i have a small problem an dhope anyone can help me. First my configuration and the debug output: --- sites-available/radius-staging --- (is also linked in sites-enabled) authorize { if ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) { update request { Group-Name := "%{1}" Stripped-User-Name := "%{2}" } } else { reject } #"%{exec:/usr/bin/printenv}" ldap-kap-costumertype if ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}" == unmanaged) { update control { Proxy-to-Realm := unmanagedCostumers } # updated } else { ldap-kap-staging # updated } } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap-kap-staging } } --- modules/ldap-kap-staging --- ldap ldap-kap-staging { server := "test" identity := "cn=radiusbinduser,ou=admins,dc=domain,dc=de" password := "XXXXXXX" basedn := "ou=%{Group-Name},dc=domain,dc=de" filter := "(&(uid=%{Stripped-User-Name})(userEnabled=true))" dictionary_mapping = ${confdir}/ldap.attrmap set_auth_type = yes } --- modules/ldap-kap-costumertype --- ldap ldap-kap-costumertype { server := "test" identity := "cn=radiusbinduser,ou=admins,dc=domain,dc=de" password := "XXXXX" basedn := "dc=domain,dc=de" filter := "ou=%{Group-Name}" dictionary_mapping = ${confdir}/ldap.attrmap set_auth_type = no } --- debug output from freeradius --- Ready to process requests. rad_recv: Access-Request packet from host 10.10.20.100 port 55835, id=1, length=131 User-Name = "rplus.dt#test(a)domain.de" Acct-Session-Id = "1489473128K1snz" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "Localhost" NAS-Port = 0 Calling-Station-Id = "1115551212" User-Password = "testpass" Message-Authenticator = 0xb33a7beab35041d5b1c179deef4d6376 server radius-staging { # Executing section authorize from file /etc/freeradius/sites-enabled/radius-staging +group authorize { ++? if ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) expand: %{User-Name} -> rplus.dt#test(a)domain.de ? Evaluating ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) -> TRUE ++? if ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) -> TRUE ++if ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) { +++update request { expand: %{1} -> domain.dt expand: %{2} -> test +++} # update request = noop ++} # if ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) = noop ++ ... skipping else for request 0: Preceding "if" was taken [ldap-kap-costumertype] performing user authorization for test [ldap-kap-costumertype] expand: ou=%{Group-Name} -> ou=rplus.dt [ldap-kap-costumertype] expand: dc=domain,dc=de -> dc=domain,dc=de [ldap-kap-costumertype] ldap_get_conn: Checking Id: 0 [ldap-kap-costumertype] ldap_get_conn: Got Id: 0 [ldap-kap-costumertype] attempting LDAP reconnection [ldap-kap-costumertype] (re)connect to test:636, authentication 0 [ldap-kap-costumertype] setting TLS mode to 1 [ldap-kap-costumertype] bind as cn=radiusbinduser,ou=admins,dc=domain,dc=de/XXXXX to test:636 [ldap-kap-costumertype] waiting for bind result ... [ldap-kap-costumertype] Bind was successful [ldap-kap-costumertype] performing search in dc=domain,dc=de, with filter ou=rplus.dt [ldap-kap-costumertype] No default NMAS login sequence [ldap-kap-costumertype] looking for check items in directory... [ldap-kap-costumertype] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap-kap-costumertype] ldap_release_conn: Release Id: 0 ++[ldap-kap-costumertype] = ok ++? if ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}" == unmanaged) [ldap-kap-costumertype] - ldap_xlat expand: ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name} -> ldap:///dc=domain,dc=de?businessCategory?one?ou=rplus.dt [ldap-kap-costumertype] ldap_get_conn: Checking Id: 0 [ldap-kap-costumertype] ldap_get_conn: Got Id: 0 [ldap-kap-costumertype] performing search in dc=domain,dc=de, with filter ou=rplus.dt [ldap-kap-costumertype] Adding attribute businessCategory, value: managed [ldap-kap-costumertype] ldap_release_conn: Release Id: 0 [ldap-kap-costumertype] - ldap_xlat end expand: %{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}} -> managed ? Evaluating ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}" == unmanaged) -> FALSE ++? if ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}" == unmanaged) -> FALSE ++else else { [ldap-kap-staging] performing user authorization for test [ldap-kap-staging] expand: (&(uid=%{Stripped-User-Name})(userEnabled=true)) -> (&(uid=test)(userEnabled=true)) <--------------------------------------- [ldap-kap-staging] expand: ou=%{Group-Name},dc=domain,dc=de -> ou=rplus.dt,dc=domain,dc=de <--------------------------------------- [ldap-kap-staging] ldap_get_conn: Checking Id: 0 [ldap-kap-staging] ldap_get_conn: Got Id: 0 [ldap-kap-staging] attempting LDAP reconnection [ldap-kap-staging] (re)connect to test:636, authentication 0 [ldap-kap-staging] setting TLS mode to 1 [ldap-kap-staging] bind as cn=radiusbinduser,ou=admins,dc=domain,dc=de/XXXXX to test:636 [ldap-kap-staging] waiting for bind result ... [ldap-kap-staging] Bind was successful [ldap-kap-staging] performing search in ou=rplus.dt,dc=domain,dc=de, with filter (&(uid=test)(userEnabled=true)) [ldap-kap-staging] No default NMAS login sequence [ldap-kap-staging] looking for check items in directory... [ldap-kap-staging] userPassword -> Password-With-Header == "{SSHA}ac2cE0LcZb04Hr9mGf5RIvfeoDlDkT5BaEB4tw==" [ldap-kap-staging] looking for reply items in directory... [ldap-kap-staging] Setting Auth-Type = LDAP [ldap-kap-staging] ldap_release_conn: Release Id: 0 +++[ldap-kap-staging] = ok ++} # else else = ok +} # group authorize = ok Found Auth-Type = LDAP # Executing group from file /etc/freeradius/sites-enabled/radius-staging +group LDAP { [ldap-kap-staging] login attempt by "test" with password "testpass" [ldap-kap-staging] user DN: ou=rplus.dt,dc=domain,dc=de <--------------------------------------- [ldap-kap-staging] (re)connect to test:636, authentication 1 [ldap-kap-staging] setting TLS mode to 1 [ldap-kap-staging] bind as ou=rplus.dt,dc=telekom,dc=de/testpass to test:636 <--------------------------------------- [ldap-kap-staging] waiting for bind result ... [ldap-kap-staging] Bind failed with invalid credentials ++[ldap-kap-staging] = reject +} # group LDAP = reject Failed to authenticate the user. } # server radius-staging Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/radius-staging +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> rplus.dt#test(a)domain.de attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 0 for 1 seconds Can anyone explain me why freeradius use two different userdn's for the same ldap configuration [ldap-kap-staging]? That he is authorizing the user is good, but why is freeradius using the wrong dn at the authenticate stage for the same ldapconfig? Thank you very much Jörn Volkhausen

2 6

freeradius for vpn pptp
by Jan-Christoph Fuchs 14 Mar '17

14 Mar '17

Hello Mailinglist, I am using freeradius + mysql for dynamic vlan assignment. It works fine. Now I want to use the same radius for connecting via VPN pptp from a Unifi Security Gateway 4 pro. I had success connecting to vpn with local Users from the Unifi, but when I switch to use radius for authentication, the connection failed. I can see in radpostauth that the radius send access-accept and I dont now further. Is ther anything special I have to send with radreply? At the moment This is sending the Information for Dynamic vlan. Thank you Foxy

2 1

Initialize a variable at python script initialization time.
by Anuruddha Premalal 13 Mar '17

13 Mar '17

Hello Community, Is there a method in python extension to load an external data structure?. I just need to initialize a large MAC address array from a JSON. And use it in all the auth requests without re-reading it from the file every time. Is there a way to achieve this? Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>*

3 2

How to manipulate NAS-Port-ID from freeswitch using libfreeradius v1.1.7 ?
by Dmitriy Borisov 13 Mar '17

13 Mar '17

Hello, All! I`ve a problem :( I must interoperate with PortaBilling Radius server, which requires from me to send 5060 in NAS-Port-Id attribute. I can`t understood, how can I do this. It always equal to zero. I found that I must write something to /etc/freeradius/port-id-map, but I don`t know what port freeswitch using (eg /dev/tty0) Help me, please!

2 2

system startup/stop scripts when building from source
by Bill Schoolfield 13 Mar '17

13 Mar '17

When you build from source are there any scripts for starting and stopping the server? I'm running FreeRADIUS Version 3.0.13 on centos 6.x Bill

4 8