April 2017 - Freeradius-Users - lists.freeradius.org

user authentication including ingress/egress policing
by Marijn van Gool 07 Apr '17

07 Apr '17

Hello all, As this is my first question to this mailing list, I hope I do it the right way :-) First, this is the version I’m using: marijn@server1:~$ freeradius -v freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03 Copyright (C) 1999-2011 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. I’m not sure about the ‘radiusd’ command. I don’t want to eat my keyboard so livingston is a no, but what about yardradius? marijn@server1:~$ radiusd -xx -l stdout -f The program 'radiusd' can be found in the following packages: * radiusd-livingston * yardradius Anyhow, on to my question. I’m a network engineer at an ISP which delivers Internet connections to business clients. Since IP Space is running out, we decided to use subscriber management on the MX router. Now, although we’ve got this part working (using Framed-IP-Address and Framed-Netmask attributes), even with QinQ, now comes the part where we want to limit bandwidth on QinQ connections. Juniper itself says that I should use RADIUS VSA’s 26-10 and 26-11 or Ingress/Egress-Policy-Name. Other documents say I should use the unisphere dictionary using Unisphere-Ingress/Egress-Policy-Name. However, this dictionary was not part of my configuration. I decided to ‘just add’ the dictionary to /usr/share/freeradius directory and add an $INCLUDE to the main dictionary file. Then I restarted the service. Unfortunately it’s still not working. What am I missing here? This is how I built up the radreply records, the username is the same as where the IP address and netmask are configured. If you need any other output, please ask. I don’t know where to look anymore. Marijn

4 8

FreeRADIUS, radsec and dnssec
by Michael Schwartzkopff 07 Apr '17

07 Apr '17

Hi, werecently had a discussion about FreeRADIUS and radsec. The DFN which ist the central hub for the German eduroam wants the universities to migrate to radsec. But the DFN thinks there are stil some issues with FreeRADIUS 3 so that is why they advertise to use radsecproxy. They did not tell me yet what the issues were, but as far as I understood they wanted to have a dynamic home server resolution based on realms in eduroam. Basically that seems to be a good idea but the problem is, how to estalish mutual trust with dynamic home servers. Here DNSSEC and especially the TLSA RR comes into play. Is it possible to add trust to FreeRADIUS 3 based on a TLSA RR verified by DNSSEC so my RADIUS server can trust the remote RADIUS server based on the comparison of its server certificate and the according TLSA RR in DNS of the home organisation? I know establishing this kind of mutiual trust work good for e-mail systems. The system is called DANE. See RFC 7671 for detailed information about DANE. Basically this the short version of this mail would be: Can the FreeRADIUS project add DANE authentication and verification of home servers to its features? Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG, 80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

6 11

FreeRadius 3.0.13 - Using SSID to check AD groups
by Pierre de Jong 07 Apr '17

07 Apr '17

Hi, I am currently trying to set up a single FreeRadius 3.0.13 server to handle diffenrents SSID on a network. Users should be allowed to use certain SSID IF they are in certain AD Group. We (my collegue and myself) have been to work things out, BUT we would like to optimise. Here is what has been done: In the DEFAULT site: Authenticate --> With the MSCHAP via NTLM_Auth Authorize ---> we have configured the LDAP module to be able to query the AD We could see that is was working, in the "radiusd -X" output. Then we implemented this, under.... But the first "if" does not work, although it should be ENOUGH and really enought dynamic.... if the SSID and AD Group are created the right way. We encountered the following problem: UNABLE to use "%{Called-Station-SSID}" (nor %Called-Station-SSID) But %{User-Name} works great. - rewrite_called_station_id --> has been called in "authorized" that should "instantiate" the Called-Station-SSID post-auth { if (LDAP-Group == "grp-ssid-%{Called-Station-SSID}") { update reply { Reply-Message = "Hello %{User-Name}: accès permis sur %{Called-Station-SSID} a" } ok return } if (LDAP-Group == "grp-ssid-GRP-Radius" && Called-Station-SSID == "GRP-Radius") { update reply { Reply-Message = "Hello %{User-Name}: accès permis sur %{Called-Station-SSID} b" } ok return } if (LDAP-Group == "grp-ssid-GRP-Radius2" && Called-Station-SSID == "GRP-Radius2") { update reply { Reply-Message = "Hello %{User-Name}: accès permis sur %{Called-Station-SSID} " } ok return } else { update reply { Reply-Message = "Hello %{User-Name}: Vous n'avez pas accès" } reject } #### - Is there any ways to use that "CALLED-STATION-SSID"? anywhere.... or, where is it "usable". - Is that kind of "mechanisme" the good way to go ? - Is there a way to initialise a "global" variable, so that we can use it "anywhere" ? (UNLANG) Thanks in advance Pierre de Jong -.-.-.-.-.-.-.-.-.-.-

3 8

How to change EAP type and inner authentication
by LUCA 07 Apr '17

07 Apr '17

Hello, I'm using both hostapd and freeradius. I was wondering if you could tell me how to change EAP type and inner authentication. Thank you. Regards, Luca

3 7

Custom handling of EAP module reject
by Alberto Martínez 07 Apr '17

07 Apr '17

Hi all, I got this: (4) eap_rogue: Peer sent packet with method EAP PEAP (25) (4) eap_rogue: Calling submodule eap_peap to process data (4) eap_peap: Continuing EAP-TLS (4) eap_peap: Peer indicated complete TLS record size will be 7 bytes (4) eap_peap: Got complete TLS record (7 bytes) (4) eap_peap: [eaptls verify] = length included (4) eap_peap: <<< recv TLS 1.0 Alert [length 0002], fatal unknown_ca (4) eap_peap: ERROR: TLS Alert read:fatal:unknown CA (4) eap_peap: ERROR: TLS_accept: Failed in unknown state (4) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) (4) eap_peap: ERROR: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (4) eap_peap: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure (4) eap_peap: ERROR: System call (I/O) error (-1) (4) eap_peap: ERROR: TLS receive handshake failed during operation (4) eap_peap: ERROR: [eaptls process] = fail (4) eap_rogue: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (4) eap_rogue: Sending EAP Failure (code 4) ID 6 length 4 (4) eap_rogue: Failed in EAP select (4) [eap_rogue] = invalid (4) } # authenticate = invalid (4) Failed to authenticate the user (4) Login incorrect (eap_peap: TLS Alert read:fatal:unknown CA): [<redacted>] (from client OAW_4650 port 0 cli A0-88-B4-2B-7F-E8) (4) Using Post-Auth-Type Reject (4) # Executing group from file /usr/local/freeradius-3.0.13/ etc/raddb/sites-enabled/default (4) Post-Auth-Type REJECT { (4) attr_filter.access_reject: EXPAND %{User-Name} (4) attr_filter.access_reject: --> <redacted> (4) attr_filter.access_reject: Matched entry DEFAULT at line 11 (4) [attr_filter.access_reject] = updated (4) [eap_legit] = noop (4) policy remove_reply_message_if_eap { (4) if (&reply:EAP-Message && &reply:Reply-Message) { (4) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (4) else { (4) [noop] = noop (4) } # else = noop (4) } # policy remove_reply_message_if_eap = noop (4) } # Post-Auth-Type REJECT = updated (4) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (4) Sending delayed response (4) Sent Access-Reject Id 176 from 172.16.250.29:1812 to 192.168.250.242:56028 length 44 (4) EAP-Message = 0x04060004 (4) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. I want to make a SQL call whenever the EAP module fails in authorize. I have tried with a redundant block but the SQL call is not a module and was ignored. How can I intercept the reject action? And, even better: How can I access from unlang to the "TLS Alert read:fatal:unknown CA" string? Thanks!

3 7

"[sql] stop packet with zero session length" problem
by Selahattin Cilek 06 Apr '17

06 Apr '17

I have been trying to get the Unifi AP line of products to work with FreeRADIUS (v 2.2.9) seamlessly for quite some time now; but with little success, I am afraid to say. It turned out that the portion of the firmware that deals with RADIUS accounting is a complete mess. I have sent them many e-mails with detailed information for the many bugs I have discovered. They say they will fix them all and I am still waiting. Since I cannot tell the site owners to dump all their Ubiquiti hardware and buy new equipment, my only option is to make the most of FreeRADIUS configuration and MySQL programming to compensate for the firmware bugs in the UAP. However, there is one bug for which I have not been able to find a workaround. Sometimes, and for some reason that is unknown to me, when a user connects to a UAP NAS, he is immediately kicked out. We can see that in the accounting details log of the NAS: Tue Apr 4 08:02:36 2017 Acct-Session-Id = "58D911BB-00001F5D" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "99481225842" NAS-Identifier = "44d9e77a2de5" NAS-Port = 0 Called-Station-Id = "46-D9-E7-7B-2D-E5:YEMEKHANE" Calling-Station-Id = "28-ED-6A-30-55-5A" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" Class = 0x3939343831323235383432 NAS-IP-Address = 192.168.0.31 FreeRADIUS-Acct-Session-Start-Time = "Apr 4 2017 08:02:36 MSK" Timestamp = 1491282156 Tue Apr 4 08:02:36 2017 Acct-Session-Id = "58D911BB-00001F5D" Acct-Status-Type = Stop Acct-Authentic = RADIUS User-Name = "99481225842" NAS-Identifier = "44d9e77a2de5" NAS-Port = 0 Called-Station-Id = "46-D9-E7-7B-2D-E5:YEMEKHANE" Calling-Station-Id = "28-ED-6A-30-55-5A" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" Class = 0x3939343831323235383432 Acct-Session-Time = 0 Acct-Input-Packets = 11 Acct-Output-Packets = 12 Acct-Input-Octets = 1289 Acct-Output-Octets = 3415 Event-Timestamp = "Apr 4 2017 08:02:35 MSK" Acct-Terminate-Cause = User-Request NAS-IP-Address = 192.168.0.31 FreeRADIUS-Acct-Session-Start-Time = "Apr 4 2017 08:02:36 MSK" Timestamp = 1491282156 I believe this is ridiculous. How on earth could someone be connected to a WLAN for 0 seconds, right? We can observe this bug in FreeRADIUS log messages too: Apr 4 08:02:36 radiusd 96187 [sql] stop packet with zero session length. [user '99481225842', nas '192.168.0.31'] So what is the problem? Well, the problem is that when FreeRADIUS receives the first packet, it runs a custom MySQL stored procedure I have written myself, which enters a record into the radacct table. But because it refuses to accept the second packet, I end up with a suspended session. And because users allowed to connect one device only to the network (Simultaneous-Use := 1), they will have to wait for 10 minutes for the suspended session to drop, thanks to a custom bash script. My question is: How can I make the sql module to accept accounting packets with zero session length? PS: Upgrading to FreeRADIUS 3.x is not an option. Thanks in advance. Selahattin CILEK [https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-anima…]<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…>

5 10

RE: Freeradius-Users Digest, Vol 144, Issue 10
by Peter Hutchison 05 Apr '17

05 Apr '17

I am a little bit new to freeradius. I have 2 freeradius 2.1.12 servers on Ubuntu 14.04.5 servers and two old freeradius 2.1.10 servers on Ubuntu 12.04.5 On the old server we have the default site and eduroam configured. On the new servers we have a switches which is similar to default but allows authentication to our Network switches. Extra configuration is set in the authorize section for switches but this does not work on the new servers. How does freeradius know which site file to use for authentication? Does it try each file in turn and in what order? I know that each line is read and executed in turn but is there some policy or conditions that need setting to tell freeradius Out to authorize users? Is there any document links I can read? Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Networks Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 1

Re: Re: User authentication for remote NAS'?
by wefwe fewfew 05 Apr '17

05 Apr '17

Brian, Apologies for mailing you directly, that wasn't my intention, Hi all, I played around with the mikrotik-total-limit right after installing. When sending that as a radreply attribute it works for that session alone but that makes sense. I tried modifying the counter to reflect mikrotik-total-time instead of session-time as explained on the wiki. https://wiki.freeradius.org/modules/Rlm_sqlcounter#scenarios_lifetime-limit… Unfortunately it doesn't seem to be as easy as simply changing the attribute and query ;) Would a similar counter for data usage have to go into the sqlcounter_expire_on_login file? Am I correct in thinking that in such a case the maximum data usage would become part of the radcheck just as for the session time? Is there any way to check what is sent as part of radcheck? Sending something as a attribute under radreply makes it show up under freeradius -X and on Mikrotik radius log but radcheck doesn't show anything. It must be sending something because trying the wiki example I got it working (though its half broken after I tried to change some things, even though I changed all my settings back. I'll have to look into that...) but I would like to be able to see what it's sending. Different question but is it possible to "stack" the time limit as per the wiki? E.g. Check total, monthly, weekly and daily max session time limits? I want to be able to give for example 1gb of usage per day, but a total of 5gb max per week. I guess that would involve doing unlang (something like check weeklycounter, if smaller then allowed, goto dailycounter else reject) in the sites-enabled/default file? Can you put unlang in there? ________________________________ From: wefwe fewfew <totallimpbizkit(a)hotmail.com> Sent: Tuesday, April 4, 2017 9:39:28 AM To: Brian Candler Subject: Re: Re: User authentication for remote NAS'? Hi Brian, I played around with the mikrotik-total-limit right after installing. When sending that as a radreply attribute it works for that session alone but that makes sense. I tried modifying the counter to reflect mikrotik-total-time instead of session-time as explained on the wiki. https://wiki.freeradius.org/modules/Rlm_sqlcounter#scenarios_lifetime-limit… Unfortunately it doesn't seem to be as easy as simply changing the attribute and query ;) Would a similar counter for data usage have to go into the sqlcounter_expire_on_login file? Am I correct in thinking that in such a case the maximum data usage would become part of the radcheck just as for the session time? Is there any way to check what is sent as part of radcheck? Sending something as a attribute under radreply makes it show up under freeradius -X and on Mikrotik radius log but radcheck doesn't show anything. It must be sending something because trying the wiki example I got it working (though its half broken after I tried to change some things, even though I changed all my settings back. I'll have to look into that...) but I would like to be able to see what it's sending. Different question but is it possible to "stack" the time limit as per the wiki? E.g. Check total, monthly, weekly and daily max session time limits? I want to be able to give for example 1gb of usage per day, but a total of 5gb max per week. I guess that would involve doing unlang (something like check weeklycounter, if smaller then allowed, goto dailycounter else reject) in the sites-enabled/default file? Can you put unlang in there? ________________________________ From: Brian Candler <b.candler(a)pobox.com> Sent: Monday, April 3, 2017 10:52:01 AM To: wefwe fewfew; FreeRadius users mailing list Subject: Re: Re: User authentication for remote NAS'? On 03/04/2017 09:52, wefwe fewfew wrote: > Long story short is that I want FR/mysql to check how long a user is still allowed online or how much bandwidth he has left and reject access/disconnect a user based on that. If you can *pre-calculate* this at the time the user connects, then you may be able to set an attribute at the start of the session and let the NAS kick them off when it's exceeded. Session-Timeout is a standard attribute and gives the time limit (in seconds). But that's not what you want. For limiting the bytes uploaded/downloaded, then it's entirely vendor specific. I notice in dictionary.mikrotik you'll find: ATTRIBUTE Mikrotik-Recv-Limit 1 integer ATTRIBUTE Mikrotik-Xmit-Limit 2 integer ATTRIBUTE Mikrotik-Recv-Limit-Gigawords 14 integer ATTRIBUTE Mikrotik-Xmit-Limit-Gigawords 15 integer ATTRIBUTE Mikrotik-Total-Limit 17 integer ATTRIBUTE Mikrotik-Total-Limit-Gigawords 18 integer (An integer is a 32-bit value, so if you want to give a value greater than 4GB you'll have to split it a 64-bit value into high and low 32-bit words, and use Gigawords for the high value. See RFC2869) So maybe that will do what you want. You could check at authentication time what their monthly limit is (say 40GB) and how much they've used so far this month (say 10GB), and then set the limit to 30GB. Otherwise, you'll have to run a process which periodically checks how much data a user has consumed, and tell the NAS interactively to kick them off. That again is very NAS-specific. Some NASes support a CoA packet for this; some NASes support an SNMP SET to do this; others you may need to script a login to the CLI and issue a command to kick them off. Sorry, I can't give you an off-the-shelf recipe to do this for Mikrotik, as I've never used their gear. FreeRADIUS can happily accumulate the accounting information into a database, to give you the source of info you need. (If you have a huge number of users then it might be an idea to use something like a Redis database instead of SQL) You will however want to ensure that you get accounting updates during a long-lived session, rather than waiting until the user disconnects which is the default. The way to do this is by including the Acct-Interim-Interval attribute in the authentication response: e.g. Acct-Interim-Interval = 600 This means "send me an update of usage for this session every 10 minutes". Most NASes won't let you set it lower than 5 or 10 minutes. For an ISP network I'd probably set it to 2 hours. HTH, Brian.

1 0

Unlang check if module exists before if else block
by Arnab Roy 04 Apr '17

04 Apr '17

Hello, Is it possible to check in unlang if module is enabled for e.g. something like this if(mschap) --> if mschap is enabled in mods-enabled/ { ..... } else{ ......... } Any pointers would be greatly appreciated. Many Thanks Arnab

2 2

Wrong datetime
by HugLeo 04 Apr '17

04 Apr '17

Something wrong with freeradius datetime. Linux local time is: Tue Apr 4 13:04:34 -03 2017 But freeradius set acctstarttime to: 2017-04-04 13:11:27 looks like freeradius is setting acctstarttime 7 minutes ahead than localtime. The diaclect is mysql in mods-enabled/sql. What can it be?

2 1