July 2017 - Freeradius-Users - lists.freeradius.org

using Freeradius in a cloud application
by The Doctor 30 Jul '17

30 Jul '17

I wish to the following: ---------- ---------------------------- ---------------------- | client| --> | cloud from anywhere | -->| Freeradius auth. | ---------- ---------------------------- ---------------------- What is needed? -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising! https://www.empire.kred/ROOTNK?t=94a1f39b Look at Psalms 14 and 53 on Atheism Talk Sense to a fool and he calls you foolish - Euripides

2 1

Ways to simplify configs?
by Dan Mahoney, System Admin 29 Jul '17

29 Jul '17

All, Is there some way to condense the config into a few files? I understand that we want huntgroups and users to be their own things, but my /usr/local/etc/raddb is currently 45 dirs and 215 files. Try putting that in puppet, to push out to several servers. I'm willing to keep the full tree on my puppet server for editing, but setting that up for deployment is insane. Bind, for example, has a tool that will read in a config and output the relevant, well-formatted, includes-processed, bit. Any ideas? -Dan -- "Don't try to out-wierd me. I get stranger things than you free with my breakfast cereal." -Button seen at I-CON XVII (and subsequently purchased) --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org ---------------------------

9 12

PBKDF2 Support
by Arran Cudbard-Bell 28 Jul '17

28 Jul '17

A few people have asked for this. There’s now support for PBKDF2 in v4.0.x for the following hashes: { "HMACSHA1", FR_SSHA_PASSWORD }, { "HMACSHA2+224", FR_SSHA2_224_PASSWORD }, { "HMACSHA2+256", FR_SSHA2_256_PASSWORD }, { "HMACSHA2+384", FR_SSHA2_384_PASSWORD }, { "HMACSHA2+512", FR_SSHA2_512_PASSWORD }, Format of hash string currently supported is the ‘ldap’ format from the CPAN library Crypt::PBKDF2: {hash_algorithm}:base64(iterations):base64(salt):base64(hash) ...but there doesn’t seem to be a standard for the hash string format. Ideally we’d like to add support for common generators of PBKDF2 strings out of the box, in addition to allowing people to support their own via unlang policies. …so can anyone suggest what the common formats for PBKDF2 might be? -Arran

2 5

PPA update for 3.0.15 ?
by Brian Candler 28 Jul '17

28 Jul '17

Now that 3.0.15 has been released, would someone have time to rebuild the Ubuntu PPA package? https://launchpad.net/~freeradius/+archive/ubuntu/stable-3.0 It hasn't been updated since 3.0.12. Xenial is the one I'm specifically interested in. Thanks, Brian.

3 3

How to do FreeRADIUS understand the ssh encrypted password that is passed?
by Kalil de A. Carvalho 27 Jul '17

27 Jul '17

Hello all. It is me again. Sorry for that. I have my enviroment working fine for telnet access, my FreeRADIUS server is doing the user search on LDAP with no problem but, when I use any ssh session is passed a encryped password that RADIUS try to use with LDAP database, found the user but the password is considered wrong and regect my access. I searched for configuration and what I saw it is very similar whith I have here. The unic diference is that I am using a EdgeRouter Lite but I am folling the documentation and using the GUI tool. Can any one help me? Best regards. -- Atenciosamente, Kalil de A. Carvalho

2 3

About authorizing only users with specific attributes (post RADIUS proxy)
by Seiichirou Hiraoka 27 Jul '17

27 Jul '17

I am building RADIUS Proxy with FreeRADIUS 3.0.4. @mydomain.edu -> backendradius.mydomain.com All Other domains -> radius.otherdomain.com RADIUS server of mydomain.com which is its own domain is already built separately, and the server under construction wants to do RADIUS Proxy with the above two rules. For mydomain.com only, I would like to authorize users who have a specific character string in the RADIUS standard attribute Filter-Id. In this case, where should we determine the value of Filter-Id in the RADIUS response from backendradius.mydomain.com? Would you please let me know if you have any reference information, such as a conditional expression with unlang. Thank you.

2 2

Accounting replication issue
by Chris Adams 27 Jul '17

27 Jul '17

I have two servers running FreeRADIUS (CentOS 7 with freeradius-3.0.4). They are logging accounting records to local MySQL servers. For redundancy, I configured FreeRADIUS to replicate the accounting records to each other, based on the robust-proxy-accounting sample config. This works, except when one server is unavailable (call it server A), the other (server B) stops replicating the records until I restart FreeRADIUS on server B. Server B logs that server A went away, and logs that it came back (in this case, somebody did something dumb on server A and triggered the kernel oom_killer - didn't touch the FreeRADIUS or MySQL processes, just the dumb grep): Jul 24 09:25:38 srvB radiusd[20768]: Marking home server srvA port 1813 as zombie (it has not responded in 6.000000 seconds). Jul 24 09:25:38 srvB radiusd[20768]: (52212975) ERROR: Failing proxied request, due to lack of any response from home server srvA port 1813 Jul 24 09:25:42 srvB radiusd[20768]: No response to status check 52213042 for home server srvA port 1813 Jul 24 09:26:05 srvB radiusd[20768]: No outstanding request was found for reply from host srvA port 1813 - ID 197 Jul 24 09:26:06 srvB radiusd[20768]: No outstanding request was found for reply from host srvA port 1813 - ID 198 Jul 24 09:26:06 srvB radiusd[20768]: (52213350) Received response to status check 52213350 (1 in current sequence) Jul 24 09:26:06 srvB radiusd[20768]: (52213350) Marking home server srvA port 1813 alive The comments in the sample config just say "When the home servers come back up, the packets are forwarded, and the detail file processed as normal." - I don't see any configuration related to that, but it defintely did not happen for me; the records were just written to the detail file until I restarted the service (which then processed the backlog correctly). Any suggestions for what to look at? -- Chris Adams <linux(a)cmadams.net>

2 2

please remove my name from this group
by Nepolean AC 27 Jul '17

27 Jul '17

Hi Team, Can you please remove my name from this group asap. Regards, Nepolean

2 1

Re: How freeradius responds in json format to the request to authorize
by Fiorella De Luca 26 Jul '17

26 Jul '17

Hello! Regarding checks like bandwidth limits and session time limit, when authorizing through a REST API, I guess we can do these checks in the authorization phase via the REST API too and return an appropiate response accordingly, is this correct? Example: check the user exists, check password matches, check user has not exhausted their allocated daily bandwidth. If it's not correct, what's the current best practice in this case? Thank you for the help! Il Lunedì 24 Luglio 2017 15:48, Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> ha scritto: > I've tried your suggestion and it worked! Great! > I wanted to ask you: are there any publicly available examples of implementations using authorize, authenticate, accounting, postauth (and any other operation) with a REST API? No, unfortunately not. If you've got some specific scenarios I can add some examples to wiki.freeradius.org. > Another question: If we perform the username & password check in authorize, I suppose there's not much we will need to do in authenticate, correct? For PAP (Plaintext auth) that's correct. When you have more complex authentication mechanisms like EAP-PEAP, EAP-TTLS, MSCHAPv2, then the authentication flow is different. For those methods, you generally need to retrieve the "known good" password via the REST interface, then call the appropriate module in authenticate to actually do something with it. Could you do this with pap too if you're interested to see how it works. authorize { rest pap } authenticate { pap } Then your JSON would be: { control:Cleartext-Password := "<users password>" } You can also return hashed passwords. The attributes that hold them are in dictionary.freeradius.internal (https://github.com/FreeRADIUS/freeradius-server/blob/89380b053b3c85d7150cd1…) Search for -Password. Note: Only Cleartext-Password will work for all authentication mechanisms. > Thank you! No problem. -Arran

2 1

user group allowed just a specific device.
by Kalil de A. Carvalho 26 Jul '17

26 Jul '17

Hello all. I'm running a FreeRADIUS which search user groups on the LDAP and permid or denny the access. Every think works fine but now I'm needing a new kind of restriction. There is a user group that they just can access some specific defice. So what I want is put this configuration to work. What I think: Is this configuration is possible? Is this configuration is made on user file? Today my enviroment is working but the user group has access on all device. If I put the this new group, ou users, on the same where is working they will have access to all equipament and this is not what is needed. Bast regards. -- Atenciosamente, Kalil de A. Carvalho

4 9