August 2017 - Freeradius-Users - lists.freeradius.org

Re: How best to map users to domain name for login
by yani＠ecoco.co.uk 24 Aug '17

24 Aug '17

On 24/08/17 17:23, Alan DeKok wrote: > On Aug 24, 2017, at 10:24 AM, yani(a)ecoco.co.uk wrote: >> radiusd -v >> radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 17 2017 at 18:49:55 > I would suggest using 3.0.15. It has a lot of fixes over 3.0.4. > >> I want to be able to authenticate users to my email service and manage >> them according to the domain they belong to so fred(a)domaina.com is not >> the same as fred(a)domainb.com. But in both cases the first part is the >> login user name within the domain. > That's a pretty common requirement. Yep > >> I have looked at freeradius virtual servers - > Virtual servers are largely for separating functionality. i.e. WiFi rules in one virtual server, DSL rules in another, and VPN rules in a third virtual server. > >> and have considered >> using free radius realms dont see how either are actually the way forward - It seems >> that virtual servers will need a database system creating for every >> instance( am i actually correct here) > No. good suspected I was wrong, but needed confirmation. > >> and that realms are really for >> forwarding requests to other free radius servers - when all i need at >> the moment is a single server handling multiple domain based login >> groups. > Realms are often used for forwarding, but they don't need to be. > >> I understand from the documentation that I can create a local realm >> like this >> >> realm domaina.com { >> type= radius >> authhost= LOCAL >> accthost= LOCAL > Yes. > >> I suspect I'm on the right track here - but haven't figured out how to >> create users in the database/system that reflect this >> >> Please advise on the most appropriate way of configuring >> freeradius to achieve logins for multiple internet domains. > The bigger question is where are the users stored right now? What kind of database contains the name / password for each user? What is the schema used there? > > Once you know that, you just configure FreeRADIUS to query the database. It should be about 10 minutes work. > > I wouldn't suggest creating users via the default SQL schema. That's largely for ISP functionality, and will likely not work well for you. > > For enterprises we just recommend that FreeRADIUS look at the existing enterprise DB. > > i.e. you don't mangle your data to make FreeRADIUS happy. That's a lot of work. Instead, you configure 1-2 simple queries in FreeRADIUS, so that it pulls the correct information from your existing database. That's *much* easier. > > Alan DeKok. Thank you for the quick reply, I'm just a newbie with Freeradius, trying to understand its modus operandi :) I have come to the conclusion that I will need to modify the schema and change the way in which the db is queried after seeing the output below for a test user in the test domain domaina.com . I'm using a mysql back end at the moment. and this system is not live - still in development. ( I've wanted to get radius working for years and only just found the time.) I suppose it's really only adding a realm field to the radius.radcheckdb and using that in the subsequent queries. something like : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' and realm = {whatever_realm_is } ORDER BY id if this is what you mean by mangling the data then I'm still missing something - ie how to best relate users to realms/domains. Received Access-Request Id 25 from 10.64.4.111:36127 to 10.64.3.44:1812 length 86 User-Name = 'yani(a)domaina.com' User-Password = 'poppl' NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x552204bba16c70744eb4910adeb44f6f (11) Received Access-Request packet from host 10.64.4.111 port 36127, id=25, length=86 (11) User-Name = 'yani(a)domaina.com' (11) User-Password = 'poppl' (11) NAS-IP-Address = 127.0.1.1 (11) NAS-Port = 0 (11) Message-Authenticator = 0x552204bba16c70744eb4910adeb44f6f (11) # Executing section authorize from file /etc/raddb/sites-enabled/default (11) authorize { (11) filter_username filter_username { (11) if (!&User-Name) (11) if (!&User-Name) -> FALSE (11) if (&User-Name =~ / /) (11) if (&User-Name =~ / /) -> FALSE (11) if (&User-Name =~ /@.*@/ ) (11) if (&User-Name =~ /@.*@/ ) -> FALSE (11) if (&User-Name =~ /\\.\\./ ) (11) if (&User-Name =~ /\\.\\./ ) -> FALSE (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (11) if (&User-Name =~ /\\.$/) (11) if (&User-Name =~ /\\.$/) -> FALSE (11) if (&User-Name =~ /(a)\\./) (11) if (&User-Name =~ /(a)\\./) -> FALSE (11) } # filter_username filter_username = notfound (11) [preprocess] = ok (11) [chap] = noop (11) [mschap] = noop (11) [digest] = noop (11) suffix : Checking for suffix after "@" (11) suffix : Looking up realm "domaina.com" for User-Name = "yani(a)domaina.com" (11) suffix : Found realm "domaina.com" (11) suffix : Adding Stripped-User-Name = "yani" (11) suffix : Adding Realm = "domaina.com" (11) suffix : Authentication realm is LOCAL (11) [suffix] = ok (11) eap : No EAP-Message, not doing EAP (11) [eap] = noop (11) [files] = noop (11) sql : EXPAND %{User-Name} (11) sql : --> yani(a)domaina.com (11) sql : SQL-User-Name set to 'yani(a)domaina.com' rlm_sql (sql): Reserved connection (7) (11) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (11) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'yani(a)domaina.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'yani(a)domaina.com' ORDER BY id' (11) sql : User found in radcheck table (11) sql : Check items matched (11) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (11) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'yani(a)domaina.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'yani(a)domaina.com' ORDER BY id' (11) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (11) sql : --> SELECT groupname FROM radusergroup WHERE username = 'yani(a)domaina.com' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'yani(a)domaina.com' ORDER BY priority' (11) sql : User not found in any groups rlm_sql (sql): Released connection (7) rlm_sql (sql): 0 of 3 connections in use. Need more spares rlm_sql (sql): Opening additional connection (8) rlm_sql_mysql: Starting connect to MySQL server (11) [sql] = ok (11) [expiration] = noop (11) [logintime] = noop (11) [pap] = updated (11) } # authorize = updated (11) Found Auth-Type = PAP (11) # Executing group from file /etc/raddb/sites-enabled/default (11) Auth-Type PAP { (11) pap : Login attempt with password (11) pap : User authenticated successfully (11) [pap] = ok (11) } # Auth-Type PAP = ok (11) # Executing section post-auth from file /etc/raddb/sites-enabled/default (11) post-auth { (11) sql : EXPAND .query (11) sql : --> .query (11) sql : Using query template 'query' rlm_sql (sql): Reserved connection (8) (11) sql : EXPAND %{User-Name} (11) sql : --> yani(a)domaina.com (11) sql : SQL-User-Name set to 'yani(a)domaina.com' (11) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (11) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'yani(a)domaina.com', 'poppl', 'Access-Accept', '2017-08-24 17:23:57') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'yani(a)domaina.com', 'poppl', 'Access-Accept', '2017-08-24 17:23:57')' rlm_sql (sql): Released connection (8) (11) [sql] = ok (11) [exec] = noop (11) remove_reply_message_if_eap remove_reply_message_if_eap { (11) if (&reply:EAP-Message && &reply:Reply-Message) (11) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (11) else else { (11) [noop] = noop (11) } # else else = noop (11) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (11) } # post-auth = ok (11) Sending Access-Accept packet to host 10.64.4.111 port 36127, id=25, length=0 Sending Access-Accept Id 25 from 10.64.3.44:1812 to 10.64.4.111:36127 (11) Finished request > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2

How best to map users to domain name for login
by yani＠ecoco.co.uk 24 Aug '17

24 Aug '17

radiusd -v radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 17 2017 at 18:49:55 Hi. I've been reading the manuals to attempt to determine the best way to configure free radius for my requirements but can't decide which is the best route to follow. I want to be able to authenticate users to my email service and manage them according to the domain they belong to so fred(a)domaina.com is not the same as fred(a)domainb.com. But in both cases the first part is the login user name within the domain. I have configured all of the systems to work with the default radius configuration (Exim MTA Cyrus sasl and ssh logins working fine) and the mail server is correctly operating with virtual email domains (i.e fred(a)domaina.com is not the same as fred(a)domainb.com) I have looked at freeradius virtual servers - and have considered using free radius realms dont see how either are actually the way forward - It seems that virtual servers will need a database system creating for every instance( am i actually correct here) and that realms are really for forwarding requests to other free radius servers - when all i need at the moment is a single server handling multiple domain based login groups. I understand from the documentation that I can create a local realm like this realm domaina.com { type= radius authhost= LOCAL accthost= LOCAL I suspect I'm on the right track here - but haven't figured out how to create users in the database/system that reflect this Please advise on the most appropriate way of configuring freeradius to achieve logins for multiple internet domains. Yani

2 1

Re: Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 23 Aug '17

23 Aug '17

> Can you do a test for me? Go to src/modules/rlm_python/rlm_python.c, and find this code: if (tmpl_from_attr_str(&dst, s1, REQUEST_CURRENT, PAIR_LIST_REPLY, false, false) <= 0) { ERROR("%s - Failed to find attribute %s:%s", funcname, list_name, s1); continue; } >change the "false, false" to "true, false". Then re-build && re-install the server. I tested with the change. Still does not work. The change to true for allow_unknown did not make a difference because it is a known attribute. The issue seems to be that the type for 'Attr-26' is set to PW_TYPE_VSA (in tmpl_from_attr_substr) which later is rejected. -Najam ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

1 0

Re: Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 23 Aug '17

23 Aug '17

I am running 3.0.15 $ radiusd -v radiusd: FreeRADIUS Version 3.0.15, for host x86_64-alpine-linux-musl, built on Jul 18 2017 at 09:03:14 FreeRADIUS Version 3.0.15 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT -Najam -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+najam.siddiqui=gemalto.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, August 23, 2017 6:27 AM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: [+SPAM+]: Re: Returning Vendor Specific Attribute in radius reply On Aug 22, 2017, at 11:02 PM, Siddiqui Najam <Najam.Siddiqui(a)gemalto.com> wrote: > > Hi Alan, > > I did some debugging and code hits src/lib/value.c:585 and returns -1. This is confusing because we set the attribute name to Attr-26. Then you're running an older version of the server. Please use 3.0.15, which has this issue fixed. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 1

RE: Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 23 Aug '17

23 Aug '17

Hi Alan, I did some debugging and code hits src/lib/value.c:585 and returns -1. This is confusing because we set the attribute name to Attr-26. case PW_TYPE_VSA: fr_strerror_printf("Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...'"); return -1; -Najam On Aug 22, 2017, at 6:17 PM, Siddiqui Najam <Najam.Siddiqui(a)gemalto.com> wrote: > > Thanks for the response Alan. > > I have a backend server that can return any VSA, and the attribute is returned as a hex string. so I have to handle this dynamically. > > In version 2.X this was working fine. However, with 3.X (rlm_python) I am having this issue. > It should work. What's the full debug output for it? Wed Aug 23 00:44:09 2017 : Debug: (0) Received Access-Request Id 24 from 192.168.99.1:58796 to 172.17.0.5:1812 length 48 Wed Aug 23 00:44:09 2017 : Debug: (0) User-Name = "testuser" Wed Aug 23 00:44:09 2017 : Debug: (0) User-Password = "testpassword" Wed Aug 23 00:44:09 2017 : Debug: (0) session-state: No State attribute Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:09 2017 : Debug: (0) authorize { Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Aug 23 00:44:09 2017 : Debug: (0) [preprocess] = ok Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Initialised new thread state 0x563921b35680 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680 Wed Aug 23 00:44:09 2017 : Debug: authorize - 'config:Auth-Type' = 'agent' Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: APPENDING Auth-Type FROM 0 TO 0 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0 Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) [agent_mod] = ok Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling chap (rlm_chap) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from chap (rlm_chap) Wed Aug 23 00:44:09 2017 : Debug: (0) [chap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling mschap (rlm_mschap) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from mschap (rlm_mschap) Wed Aug 23 00:44:09 2017 : Debug: (0) [mschap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling digest (rlm_digest) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from digest (rlm_digest) Wed Aug 23 00:44:09 2017 : Debug: (0) [digest] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling suffix (rlm_realm) Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: Checking for suffix after "@" Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No '@' in User-Name = "testuser", looking up realm NULL Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No such realm "NULL" Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from suffix (rlm_realm) Wed Aug 23 00:44:09 2017 : Debug: (0) [suffix] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling files (rlm_files) Wed Aug 23 00:44:09 2017 : Debug: ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: Parsed xlat tree: Wed Aug 23 00:44:09 2017 : Debug: literal --> ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: (0) files: EXPAND ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: (0) files: --> ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: No matches Wed Aug 23 00:44:09 2017 : Debug: Adding 33 matches Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) Wed Aug 23 00:44:09 2017 : Debug: (0) [files] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) Wed Aug 23 00:44:09 2017 : Debug: (0) [expiration] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) Wed Aug 23 00:44:09 2017 : Debug: (0) [logintime] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: No "known good" password found for the user. Not setting Auth-Type Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: Authentication will fail unless a "known good" password is available Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) Wed Aug 23 00:44:09 2017 : Debug: (0) [pap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) } # authorize = ok Wed Aug 23 00:44:09 2017 : Debug: (0) Found Auth-Type = agent Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:09 2017 : Debug: (0) Auth-Type agent { Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authenticate]: calling agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680 Wed Aug 23 00:44:11 2017 : Debug: authenticate - Failed: 'reply:Attr-26' = '0x00000009010f54657374417474726962757465' Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Vendor-Specific Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: APPENDING Vendor-Specific FROM 0 TO 0 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0 Wed Aug 23 00:44:11 2017 : Debug: authenticate - 'config:Auth-Type' = 'agent' Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 1 MAX 2 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 1 out 1 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: to[0] = Auth-Type Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[authenticate]: returned from agent_mod (rlm_python) Wed Aug 23 00:44:11 2017 : Debug: (0) [agent_mod] = ok Wed Aug 23 00:44:11 2017 : Debug: (0) } # Auth-Type agent = ok Wed Aug 23 00:44:11 2017 : Debug: (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:11 2017 : Debug: (0) post-auth { Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec) Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec) Wed Aug 23 00:44:11 2017 : Debug: (0) [exec] = noop Wed Aug 23 00:44:11 2017 : Debug: (0) } # post-auth = noop Wed Aug 23 00:44:11 2017 : Auth: (0) Login OK: [testuser] (from client Radius Local port 0) Wed Aug 23 00:44:11 2017 : Debug: (0) Sent Access-Accept Id 24 from 172.17.0.5:1812 to 192.168.99.1:58796 length 0 SOFT ASSERT FAILED src/lib/value.c[1872]: 0 Wed Aug 23 00:44:11 2017 : Debug: (0) Vendor-Specific = Wed Aug 23 00:44:11 2017 : Debug: (0) Finished request Wed Aug 23 00:44:11 2017 : Debug: Waking up in 4.9 seconds. Wed Aug 23 00:44:16 2017 : Debug: (0) Cleaning up request packet ID 24 with timestamp +7 Wed Aug 23 00:44:16 2017 : Info: Ready to process requests >And is the hex string well-formed? i.e. is it correct for the Cisco VSA? Yes. The response from freeradius server version 2.2.0: Sending Access-Accept of id 25 to 192.168.56.1 port 55685 Attr-26 = 0x00000009010f54657374417474726962757465 In the test client (radtest) the response is: rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=204, length=53 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Cisco-AVPair = "TestAttribute" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 1

Re: Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 23 Aug '17

23 Aug '17

-----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+najam.siddiqui=gemalto.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, August 22, 2017 6:11 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: [+SPAM+]: Re: [+SPAM+]: Re: Returning Vendor Specific Attribute in radius reply On Aug 22, 2017, at 6:17 PM, Siddiqui Najam <Najam.Siddiqui(a)gemalto.com> wrote: > > Thanks for the response Alan. > > I have a backend server that can return any VSA, and the attribute is returned as a hex string. so I have to handle this dynamically. > > In version 2.X this was working fine. However, with 3.X (rlm_python) I am having this issue. > It should work. What's the full debug output for it? Wed Aug 23 00:44:09 2017 : Debug: (0) Received Access-Request Id 24 from 192.168.99.1:58796 to 172.17.0.5:1812 length 48 Wed Aug 23 00:44:09 2017 : Debug: (0) User-Name = "testuser" Wed Aug 23 00:44:09 2017 : Debug: (0) User-Password = "testpassword" Wed Aug 23 00:44:09 2017 : Debug: (0) session-state: No State attribute Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:09 2017 : Debug: (0) authorize { Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Aug 23 00:44:09 2017 : Debug: (0) [preprocess] = ok Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Initialised new thread state 0x563921b35680 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680 Wed Aug 23 00:44:09 2017 : Debug: authorize - 'config:Auth-Type' = 'agent' Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: APPENDING Auth-Type FROM 0 TO 0 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0 Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) [agent_mod] = ok Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling chap (rlm_chap) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from chap (rlm_chap) Wed Aug 23 00:44:09 2017 : Debug: (0) [chap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling mschap (rlm_mschap) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from mschap (rlm_mschap) Wed Aug 23 00:44:09 2017 : Debug: (0) [mschap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling digest (rlm_digest) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from digest (rlm_digest) Wed Aug 23 00:44:09 2017 : Debug: (0) [digest] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling suffix (rlm_realm) Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: Checking for suffix after "@" Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No '@' in User-Name = "testuser", looking up realm NULL Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No such realm "NULL" Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from suffix (rlm_realm) Wed Aug 23 00:44:09 2017 : Debug: (0) [suffix] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling files (rlm_files) Wed Aug 23 00:44:09 2017 : Debug: ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: Parsed xlat tree: Wed Aug 23 00:44:09 2017 : Debug: literal --> ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: (0) files: EXPAND ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: (0) files: --> ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: No matches Wed Aug 23 00:44:09 2017 : Debug: Adding 33 matches Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) Wed Aug 23 00:44:09 2017 : Debug: (0) [files] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) Wed Aug 23 00:44:09 2017 : Debug: (0) [expiration] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) Wed Aug 23 00:44:09 2017 : Debug: (0) [logintime] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: No "known good" password found for the user. Not setting Auth-Type Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: Authentication will fail unless a "known good" password is available Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) Wed Aug 23 00:44:09 2017 : Debug: (0) [pap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) } # authorize = ok Wed Aug 23 00:44:09 2017 : Debug: (0) Found Auth-Type = agent Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:09 2017 : Debug: (0) Auth-Type agent { Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authenticate]: calling agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680 Wed Aug 23 00:44:11 2017 : Debug: authenticate - Failed: 'reply:Attr-26' = '0x00000009010f54657374417474726962757465' Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Vendor-Specific Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: APPENDING Vendor-Specific FROM 0 TO 0 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0 Wed Aug 23 00:44:11 2017 : Debug: authenticate - 'config:Auth-Type' = 'agent' Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 1 MAX 2 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 1 out 1 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: to[0] = Auth-Type Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[authenticate]: returned from agent_mod (rlm_python) Wed Aug 23 00:44:11 2017 : Debug: (0) [agent_mod] = ok Wed Aug 23 00:44:11 2017 : Debug: (0) } # Auth-Type agent = ok Wed Aug 23 00:44:11 2017 : Debug: (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:11 2017 : Debug: (0) post-auth { Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec) Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec) Wed Aug 23 00:44:11 2017 : Debug: (0) [exec] = noop Wed Aug 23 00:44:11 2017 : Debug: (0) } # post-auth = noop Wed Aug 23 00:44:11 2017 : Auth: (0) Login OK: [testuser] (from client Radius Local port 0) Wed Aug 23 00:44:11 2017 : Debug: (0) Sent Access-Accept Id 24 from 172.17.0.5:1812 to 192.168.99.1:58796 length 0 SOFT ASSERT FAILED src/lib/value.c[1872]: 0 Wed Aug 23 00:44:11 2017 : Debug: (0) Vendor-Specific = Wed Aug 23 00:44:11 2017 : Debug: (0) Finished request Wed Aug 23 00:44:11 2017 : Debug: Waking up in 4.9 seconds. Wed Aug 23 00:44:16 2017 : Debug: (0) Cleaning up request packet ID 24 with timestamp +7 Wed Aug 23 00:44:16 2017 : Info: Ready to process requests >And is the hex string well-formed? i.e. is it correct for the Cisco VSA? Yes. The response from freeradius server version 2.2.0: Sending Access-Accept of id 25 to 192.168.56.1 port 55685 Attr-26 = 0x00000009010f54657374417474726962757465 In the test client (radtest) the response is: rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=204, length=53 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Cisco-AVPair = "TestAttribute" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

1 0

krb5 authentication not working
by Greg Wilson 23 Aug '17

23 Aug '17

FreeRADIUS Version 3.0.13 Getting (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject in debug output. The server does not appear to be trying krb5 authentication. In sites-enabled/default --------- authenticate { # # User Kerberos to authenticate # Auth-Type Kerberos { krb5 } In mods-enabled/krb5 -------------- krb5 { keytab = /etc/raddb-checkpoint/radius_auth.keytab service_principal = "radius_auth" In mods-config/files/authorize -------------- DEFAULT Auth-Type = Kerberos User-Service-Type = Login-User, Login-Service = Rlogin Debug output: ------------------ FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb-checkpoint/dictionary including configuration file /etc/raddb-checkpoint/radiusd.conf including configuration file /etc/raddb-checkpoint/proxy.conf including configuration file /etc/raddb-checkpoint/clients.conf including files in directory /etc/raddb-checkpoint/mods-enabled/ including configuration file /etc/raddb-checkpoint/mods-enabled/utf8 including configuration file /etc/raddb-checkpoint/mods-enabled/unpack including configuration file /etc/raddb-checkpoint/mods-enabled/unix including configuration file /etc/raddb-checkpoint/mods-enabled/sradutmp including configuration file /etc/raddb-checkpoint/mods-enabled/soh including configuration file /etc/raddb-checkpoint/mods-enabled/replicate including configuration file /etc/raddb-checkpoint/mods-enabled/realm including configuration file /etc/raddb-checkpoint/mods-enabled/radutmp including configuration file /etc/raddb-checkpoint/mods-enabled/preprocess including configuration file /etc/raddb-checkpoint/mods-enabled/passwd including configuration file /etc/raddb-checkpoint/mods-enabled/pap including configuration file /etc/raddb-checkpoint/mods-enabled/ntlm_auth including configuration file /etc/raddb-checkpoint/mods-enabled/mschap including configuration file /etc/raddb-checkpoint/mods-enabled/logintime including configuration file /etc/raddb-checkpoint/mods-enabled/linelog including configuration file /etc/raddb-checkpoint/mods-enabled/files including configuration file /etc/raddb-checkpoint/mods-enabled/expr including configuration file /etc/raddb-checkpoint/mods-enabled/expiration including configuration file /etc/raddb-checkpoint/mods-enabled/exec including configuration file /etc/raddb-checkpoint/mods-enabled/echo including configuration file /etc/raddb-checkpoint/mods-enabled/eap including configuration file /etc/raddb-checkpoint/mods-enabled/dynamic_clients including configuration file /etc/raddb-checkpoint/mods-enabled/digest including configuration file /etc/raddb-checkpoint/mods-enabled/dhcp including configuration file /etc/raddb-checkpoint/mods-enabled/detail.log including configuration file /etc/raddb-checkpoint/mods-enabled/detail including configuration file /etc/raddb-checkpoint/mods-enabled/date including configuration file /etc/raddb-checkpoint/mods-enabled/chap including configuration file /etc/raddb-checkpoint/mods-enabled/cache_eap including configuration file /etc/raddb-checkpoint/mods-enabled/attr_filter including configuration file /etc/raddb-checkpoint/mods-enabled/always including configuration file /etc/raddb-checkpoint/mods-enabled/krb5 including files in directory /etc/raddb-checkpoint/policy.d/ including configuration file /etc/raddb-checkpoint/policy.d/accounting including configuration file /etc/raddb-checkpoint/policy.d/canonicalization including configuration file /etc/raddb-checkpoint/policy.d/control including configuration file /etc/raddb-checkpoint/policy.d/cui including configuration file /etc/raddb-checkpoint/policy.d/debug including configuration file /etc/raddb-checkpoint/policy.d/dhcp including configuration file /etc/raddb-checkpoint/policy.d/eap including configuration file /etc/raddb-checkpoint/policy.d/filter including configuration file /etc/raddb-checkpoint/policy.d/operator-name including files in directory /etc/raddb-checkpoint/sites-enabled/ including configuration file /etc/raddb-checkpoint/sites-enabled/inner-tunnel including configuration file /etc/raddb-checkpoint/sites-enabled/default main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client netscalers { ipv4addr = 129.219.12.129/26 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client test { ipv4addr = 10.120.3.175 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = Kerberos # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb-checkpoint/mods-enabled/utf8 # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb-checkpoint/mods-enabled/unpack # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb-checkpoint/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/raddb-checkpoint/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb-checkpoint/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb-checkpoint/mods-enabled/replicate # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb-checkpoint/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb-checkpoint/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb-checkpoint/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb-checkpoint/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "radutmp" from file /etc/raddb-checkpoint/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb-checkpoint/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb-checkpoint/mods-config/preprocess/huntgroups" hints = "/etc/raddb-checkpoint/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb-checkpoint/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb-checkpoint/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/raddb-checkpoint/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb-checkpoint/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb-checkpoint/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb-checkpoint/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb-checkpoint/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb-checkpoint/mods-enabled/files files { filename = "/etc/raddb-checkpoint/mods-config/files/authorize" usersfile = "/etc/raddb-checkpoint/mods-config/files/authorize" acctusersfile = "/etc/raddb-checkpoint/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb-checkpoint/mods-config/files/pre-proxy" } # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb-checkpoint/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /Ã¤Ã©Ã¶Ã¼Ã Ã¢Ã¦Ã§Ã¨Ã©ÃªÃ«Ã®Ã¯Ã´ÅÃ¹Ã»Ã¼aÃ¿Ã ÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃÅÃÃÅ¸" } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb-checkpoint/mods-enabled/expiration # Loading module "exec" from file /etc/raddb-checkpoint/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loading module "echo" from file /etc/raddb-checkpoint/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb-checkpoint/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb-checkpoint/mods-enabled/dynamic_clients # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb-checkpoint/mods-enabled/digest # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb-checkpoint/mods-enabled/dhcp # Loaded module rlm_detail # Loading module "auth_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "detail" from file /etc/raddb-checkpoint/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_date # Loading module "date" from file /etc/raddb-checkpoint/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb-checkpoint/mods-enabled/chap # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb-checkpoint/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb-checkpoint/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb-checkpoint/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb-checkpoint/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb-checkpoint/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb-checkpoint/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb-checkpoint/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb-checkpoint/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb-checkpoint/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_always # Loading module "reject" from file /etc/raddb-checkpoint/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb-checkpoint/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb-checkpoint/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb-checkpoint/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb-checkpoint/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb-checkpoint/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb-checkpoint/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb-checkpoint/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb-checkpoint/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_krb5 # Loading module "krb5" from file /etc/raddb-checkpoint/mods-enabled/krb5 krb5 { keytab = "/etc/raddb-checkpoint/radius_auth.keytab" service_principal = "radius_auth" } instantiate { } # Instantiating module "IPASS" from file /etc/raddb-checkpoint/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb-checkpoint/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb-checkpoint/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb-checkpoint/mods-enabled/realm # Instantiating module "preprocess" from file /etc/raddb-checkpoint/mods-enabled/preprocess reading pairlist file /etc/raddb-checkpoint/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb-checkpoint/mods-config/preprocess/hints # Instantiating module "etc_passwd" from file /etc/raddb-checkpoint/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "pap" from file /etc/raddb-checkpoint/mods-enabled/pap # Instantiating module "mschap" from file /etc/raddb-checkpoint/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "logintime" from file /etc/raddb-checkpoint/mods-enabled/logintime # Instantiating module "linelog" from file /etc/raddb-checkpoint/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb-checkpoint/mods-enabled/linelog # Instantiating module "files" from file /etc/raddb-checkpoint/mods-enabled/files reading pairlist file /etc/raddb-checkpoint/mods-config/files/authorize reading pairlist file /etc/raddb-checkpoint/mods-config/files/authorize reading pairlist file /etc/raddb-checkpoint/mods-config/files/accounting reading pairlist file /etc/raddb-checkpoint/mods-config/files/pre-proxy # Instantiating module "expiration" from file /etc/raddb-checkpoint/mods-enabled/expiration # Instantiating module "eap" from file /etc/raddb-checkpoint/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb-checkpoint/certs" pem_file_type = yes private_key_file = "/etc/raddb-checkpoint/certs/server.pem" certificate_file = "/etc/raddb-checkpoint/certs/server.pem" ca_file = "/etc/raddb-checkpoint/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb-checkpoint/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "auth_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log # Instantiating module "detail" from file /etc/raddb-checkpoint/mods-enabled/detail # Instantiating module "cache_eap" from file /etc/raddb-checkpoint/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "attr_filter.post-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb-checkpoint/mods-enabled/attr_filter reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/access_reject [/etc/raddb-checkpoint/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb-checkpoint/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb-checkpoint/mods-enabled/attr_filter reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb-checkpoint/mods-enabled/attr_filter reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/accounting_response # Instantiating module "reject" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "fail" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "ok" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "handled" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "noop" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "updated" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "krb5" from file /etc/raddb-checkpoint/mods-enabled/krb5 Using MIT Kerberos library rlm_krb5 (krb5): Using service principal "radius_auth/radiusawsw@" rlm_krb5 (krb5): Using keytab "FILE:/etc/raddb-checkpoint/radius_auth.keytab" rlm_krb5 (krb5): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 0 retry_delay = 1 spread = no } rlm_krb5 (krb5): Opening additional connection (0), 1 of 32 pending slots used rlm_krb5 (krb5): Opening additional connection (1), 1 of 31 pending slots used rlm_krb5 (krb5): Opening additional connection (2), 1 of 30 pending slots used rlm_krb5 (krb5): Opening additional connection (3), 1 of 29 pending slots used rlm_krb5 (krb5): Opening additional connection (4), 1 of 28 pending slots used } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb-checkpoint/radiusd.conf } # server server inner-tunnel { # from file /etc/raddb-checkpoint/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb-checkpoint/sites-enabled/inner-tunnel:338 } # server inner-tunnel server default { # from file /etc/raddb-checkpoint/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### Listening on auth address 10.120.3.175 port 1645 Listening on acct address 10.120.3.175 port 1646 Listening on proxy address * port 59986 Ready to process requests (0) Received Access-Request Id 6 from 129.219.12.155:44940 to 10.120.3.175:1645 length 50 (0) User-Name = "User" (0) User-Password = "Pwd" (0) NAS-IP-Address = 129.219.12.155 (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 6 from 10.120.3.175:1645 to 129.219.12.155:44940 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 6 with timestamp +120 Ready to process requests

2 1

Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 22 Aug '17

22 Aug '17

Hi, I am trying to return a Cisco vendor specific attribute from a python module by adding it to the reply tuple as: (Attr-26, '0x00000009010f54657374417474726962757465') But I am getting the following error in the logs: Debug: authenticate - Failed: 'reply:Attr-26' '0x00000009010f54657374417474726962757465' Any ideas, how I can add VSA to the reply tuple from the python module? Thanks and Regards Najam ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 3

Logging eap timeouts in linelog
by Arnab Roy 22 Aug '17

22 Aug '17

Hi , Is it possible to log user auth where the request got rejected because of eap session timeout using linelog? TIA Arnab

2 3

Re: Remote users - proxying fails - NPS timeout
by Alan Buxey 22 Aug '17

22 Aug '17

Same offer here. Initial thought is handling of some attribute. Best thing to do is ensure you're calling attribute filter for all packets destined to NPS to strip them down to bare essentials (ie the minimum EAP contents for NPS to do its job with no other attrs present). I assume you're sending the EAP onward to NPS and not terminating EAP on FR and only sending inner Auth to NPS? alan On 18 Aug 2017 12:37 am, "John Horne" <john.horne(a)plymouth.ac.uk> wrote: Hello, We have 2 CentOS 7 servers which act solely as RADIUS proxy servers using PEAP. They proxy to backend Microsoft NPS servers. The servers proxy local (wireless) users (to NPS), visiting eduroam users (to NRPS) and our own (eduroam) users (to NPS) who are visting external sites. The eduroam users are proxied to/from the UK national proxy servers (NRPS). Both local radius servers ran the freeradius 3.0.4 CentOS package. This all worked well. However, I have updated freeradius to 3.0.15 (locally built RPM) on one of the servers. Whilst the local and visiting eduroam users are authenticating correctly, the majority of our own eduroam users authenticating to us via the NRPS servers now fail. The radius log shows (for example): ========== Thu Aug 17 23:16:20 2017 : ERROR: (7299) ERROR: Failing proxied request for user "abc(a)students.plymouth.ac.uk", due to lack of any response from home server 141.163.xxx.yyy port 1812 Thu Aug 17 23:16:20 2017 : Auth: (7299) Login incorrect (Home Server failed to respond): [abc(a)students.plymouth.ac.uk] (from client NRPS-0 port 13 cli FC-FC- 48-FF-AA-DD) SSID: eduroam Thu Aug 17 23:16:20 2017 : Auth: (7299) Login incorrect (Failing proxied request for user "abc(a)students.plymouth.ac.uk", due to lack of any response from home server 141.163.xxx.yyy port 1812): [abc(a)students.plymouth.ac.uk] (from client NRPS-0 port 13 cli FC-FC-48-DD-AA-DD) SSID: eduroam ========== For the NRPS clients this occurs nearly 100% of the time. For some reason an occassional user will authenticate successfully. I have captured the debug output for a user who authenticated successfully on the 3.0.4 server, but then failed to authenticate on the 3.0.15 server. Although the last packet sent seemed acceptable, with no reply from the MS NPS server it is difficult to know what happened next. A little googling seemed to indicate that MS NPS is known for just dropping packets rather than rejecting them or even logging them. I asked the sysadmin of the NPS servers if the logs showed anything, but he said not. The servers themselves were not under any particular load, so that was not a reason to drop the packets. Although the freeradius config files have had to be modified a little bit due to differences between 3.0.4 and 3.0.15, they are basically the same. I tried downgrading to an RHEL 7 beta RPM of freeradius 3.0.13, but we got the same timeout problem. I have now gone back to 3.0.4, and the problem has gone. I am a bit stumped with this. My first thought was that we had changed something to cause the MS NPS servers to drop the packets. Filtering seemed possible as I gather if NPS is sent a packet with unrecognised radius attributes then it is likely to drop it. However, the filtering is the same between 3.0.4 and 3.0.15. I have also gone through the changelog from 3.0.5 to 3.0.15, but could not find anything obvious (to me) that might explain this. My thoughts are that perhaps some core part of freeradius has been modified such that it is now causing NPS (for us) a problem. We could start to work through the versions from 3.0.5 upwards to see at what version we hit the problem, and then look further at the commits for that version. However, before that I thought I would ask here if anyone has any thoughts about this? Has anyone had a similar problem? Thanks, John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [http://www.plymouth.ac.uk/images/email_footer.gif]<http: //www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, Plymouth University accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. Plymouth University does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form. - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

4 4