January 2018 - Freeradius-Users - lists.freeradius.org

Sending accounting and interim usage to couchbase.
by Mike Lopes 22 Jan '18

22 Jan '18

Hi guys, I've been progressing on the modernisation of our radius infrastructure but I'm stumped, once again. I am trying to migrate configurations from an older Freeradius 3.0.3 to 3.0.15. During this time I discovered that this: # Configuration items are in the format: # <element name> = '<radius attribute>' Was changed to this: # Configuration items are in the format: # <radius attribute> = '<element name>' In mods-available/couchbase.. Thanks to Alan DeKok for pointing that out to me :) But now I am left wondering if some other things changed. I reviewed the changelogs from 3.0.3 to 3.0.15 and couldn't spot anything in regards to my issue with couchbase as well as the change above. In our production setup we have the following in our /etc/raddb/mods-enabled/couchbase: map { sessionId = 'Acct-Session-Id' uniqueId = 'Acct-Unique-Session-Id' lastStatus = 'Acct-Status-Type' userName = 'User-Name' lowercaseUser = 'Stripped-User-Name' userDomain = 'Stripped-User-Domain' nasIpAddress = 'NAS-IP-Address' nasIdentifier = 'NAS-Identifier' nasPort = 'NAS-Port-Id' calledStationId = 'Called-Station-Id' callingStationId = 'Calling-Station-Id' framedIpAddress = 'Framed-IP-Address' framedRoute = 'Framed-Route' framedIpv6Address = 'Framed-IPv6-Prefix' framedIpv6Id = 'Framed-Interface-Id' framedV6Route = 'Delegated-IPv6-Prefix' multiSessionId = 'Acct-Multi-Session-Id' multiSessionCount = 'Acct-Link-Count' TerminateCause = 'Acct-Terminate-Cause' sessionTime = 'Acct-Session-Time' lastUpdated = 'Event-Timestamp' } usage { lastStatus = 'Acct-Status-Type' timeStamp = 'Event-Timestamp' download = 'Acct-Output-Octets64' upload = 'Acct-Input-Octets64' } On the new servers, I am using the following: update { Acct-Session-Id = 'sessionId' Acct-Unique-Session-Id = 'uniqueId' Acct-Status-Type = 'lastStatus' User-Name = 'userName' Stripped-User-Name = 'lowercaseUser' Stripped-User-Domain = 'userDomain' NAS-IP-Address = 'nasIpAddress' NAS-Identifier = 'nasIdentifier' NAS-Port-Id = 'nasPort' Called-Station-Id = 'calledStationId' Calling-Station-Id = 'callingStationId' Framed-IP-Address = 'framedIpAddress' Framed-Route = 'framedRoute' Framed-IPv6-Prefix = 'framedIpv6Address' Framed-Interface-Id = 'framedIpv6Id' Delegated-IPv6-Prefix = 'framedV6Route' Acct-Multi-Session-Id = 'multiSessionId' Acct-Link-Count = 'multiSessionCount' Acct-Terminate-Cause = 'TerminateCause' Acct-Session-Time = 'sessionTime' Event-Timestamp = 'lastUpdated' } usage { Acct-Status-Type = 'lastStatus' Event-Timestamp = 'timeStamp' Acct-Output-Octets64 = 'download' Acct-Input-Octets64 = 'upload' Now on my new server, it completely skips over the usage part and I'm no longer getting the interim updates into our couchbase server. I'm assuming that what used to work, no longer works. So it may have moved or remove. Or probably, it I missed something in another file, possibly in mods-config. Could someone point me in the right direction? Thanks! -Mike

2 9

Version 3.0.16 has been released
by Alan DeKok 22 Jan '18

22 Jan '18

Lots of fixes! FreeRADIUS 3.0.16 Thu 11 Jan 2018 12:00:00 EST urgency=low Feature improvements * rlm_python now supports multiple lists. From #2031. * Add trust router re-keying. From #2007. * Add support for Samba / AD LDAP schema. See doc/schemas/ldap/samba/README.txt and doc/schemas/ldap/samba/ * Add "tls_min_version" and "tls_max_version" to EAP module for Debian OpenSSL issues. * Better documentation for client certificates in PEAP and TTLS: it usually doesn't work. Fixes #2068. * Distinguish login failure from AD unavailable. Fixes #2069. * Update RH spec files. Fixes #2070. * Run Post-Proxy-Type if all home servers are dead. Fixes #2072. * Print offending IP addresses when EAP sessions come from two upstream home servers, and rate-limit the messages. * Minor packaging updates. * Better documentation for rlm_rest. * EAP-FAST now has it's own "cipher_list", so that it is easier to configure. * EAP-FAST now forcibly disables TLS1.2, until such time as we implement the new keying mechanism from TLS1.2. * Add documentation for allow_expired_crl. * Update Debian logrotation. #2093 and #2101. * DHCP relay can now drop responses. #2095. * rlm_sqlippool can now assign Delegated-IPv6-Prefix. It also now can assign any IPv4 or IPv6 address. Based on patches from maximumG. #2094. See raddb/mods-available/sqlippool for changes. * radeapclient can now use EAP-SIM-Ki to dynamically create the necessary triplets. * Explain why many LDAP connections are closed. Fixes #1969. * Debian build / package issues fixed by Matthew Newton. * dictionary.patton updates from Brice Schaffner. Fixes #2137. * Added scripts to build "inner-server.pem", and updated mods-config/inner-eap and certs/README to match. * Added provisions for using an external CA. See raddb/certs/ * Include dhcpclient binary in freeradius-dhcp debian packge. Bug fixes * Bind the lifetime of program name and python path to the module FR-AD-002 (redone) * Pass correct statement length into sqlite3_prepare[_v2] FR-AD-003 (redone) * Allow 100-Continue responses with additional headers in rlm_rest. * fix corner case where detail files were not being locked correctly. * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group. Fixes #1947 * Clean up exfile code. Which should help to avoid issues with reading / writing 100's of detail files. * Fix build for winbind. Patch from Alex Clouter. * Fix checkrad for Mikrotik. Patch from Muchael Ducharme. * Fix home server stats lookup. Patch from Phil Mayers. * Add libjson-c3 as an optional dependency. * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking against NSS, which breaks the server. Fixes #2040. * rlm_python fixes. Fixes #2041 * Typos in "man" pages. Fixes #2045 * Expand "next" in %{%{...}:-%{...}}. Fixes #2048 * Don't add TLS attributes twice. Fixes #2050. * Fix memory allocation in rlm_rest. Fixes #2051. * Update trustrouter for new API. Fixes #2059. * Fix SQLite issues on FreeBSD. Fixes #2060 * Don't do debug logging of bad passwords. Fixes #2064. * More graceful handling of "die" in rlm_perl. Fixes #2073. * Fix occasional crash when using cisco_accounting_username_bug = yes * EAP-FAST fixes from Isaac Boukris. #2078, #2076, and #2082, #2126. * DHCP fixes, relay, #2092, add run-time check, #2028 * Decode multiple RADIUS packets at a time in highly loaded RadSec connections. Patch from Jan Tomasek. #2106. * TunnelPassword is not "single value" in LDAP schema. Fixes #2061. * sql log now opens the expanded filename, not the input one. This was a regression introduced in 3.0.15. * Remove unnecessary UNIQUE constrain in Oracle schemas. * Fix SSL thread and locking issues when modules also use SSL. Fixes #2125 and #2129. * Re-add dhcpclient "raw packet" changes. Patches from Nicolas Chaigne and Matthew Newton. Fixes #2155.

8 16

Custom module to handle LDAP query returning multiple results?
by Nicolas Reich 20 Jan '18

20 Jan '18

Hello, The system looks like this: the users are each affiliated to one or more organisations. For each affiliation to an organisation, there's an entry in LDAP. So there can be several entries for the same user, each one with a different organisation. Now, granted the rest of the authentication process goes well, the user is accepted if he or she is affiliated to one of the whitelisted organisations, i.e. there is at least one entry with their name and a whitelisted organisation. This should be pretty straightforward to check: get all entries for the user, and check if at least one is for a whitelisted organisation. Except the ldap module throws an error if the search returns more than one result, and I can't use server-side sorting because it is an openldap server, which doesn't implement the ldap_create_sort_control function. (I think, I might have gotten that wrong though.) Is it possible to write a custom module to handle an LDAP query returning potentially multiple results? Or is there another solution you can think of? The obvious one is to serially query ldap for each organisation, but that's really ineffective. Final note to take into account: I cannot modify anything on the ldap side, it is used for other projects as well. Best regards, and thanks in advance Nicolas PS: Thanks Alan for your answer to my other question yesterday.

3 3

AW: AW: AW: After Upgrade from freeradius 2 to 3 (Debian 8 - 9): TLS Alert write:fatal:unsupported certificate
by Gladewitz, Robert 19 Jan '18

19 Jan '18

If I understand this logs rights, the error happening on ca certificate? ... Mon Dec 18 14:41:44 2017 : Debug: (2) eap_tls: TLS-Cert-Subject := "/C=DE/O=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH/OU=IT/CN=CAPF-1b0db5b4/ST=Sachsen/L=Leipzig" Mon Dec 18 14:41:44 2017 : Debug: (2) eap_tls: TLS-Cert-Issuer := "/C=DE/O=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH/OU=IT/CN=CAPF-1b0db5b4/ST=Sachsen/L=Leipzig" Mon Dec 18 14:41:44 2017 : Debug: (2) eap_tls: TLS-Cert-Common-Name := "CAPF-1b0db5b4" Mon Dec 18 14:41:44 2017 : ERROR: (2) eap_tls: SSL says error 26 : unsupported certificate purpose Mon Dec 18 14:41:44 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Mon Dec 18 14:41:44 2017 : Debug: (2) eap_tls: >>> send TLS 1.0 Alert [length 0002], fatal unsupported_certificate Mon Dec 18 14:41:44 2017 : ERROR: (2) eap_tls: TLS Alert write:fatal:unsupported certificate Mon Dec 18 14:41:44 2017 : Error: tls: TLS_accept: Error in error Mon Dec 18 14:41:44 2017 : ERROR: (2) eap_tls: Failed in __FUNCTION__ (SSL_read): ../ssl/statem/statem_srvr.c[2896]:error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed Mon Dec 18 14:41:44 2017 : ERROR: (2) eap_tls: System call (I/O) error (-1) ... Robert

4 19

Multiply CA and CA-Chain not working in Freeradius2
by Gladewitz, Robert 18 Jan '18

18 Jan '18

Hello List-Users, i try to use tls with two ca. One ca have a CA chain and i concat all in one pem file. Then the following error can be found on authentification: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x6e039e3b6c07932c did not finish! WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! If I use both certiface in a own file, it will work fine for the configuring certificate. Is thre same rules about ordering. Or are certificate with different SHA hashes not compatible? Regards Robert

2 1

freeradius high cpu load
by Bassem Mettichi 18 Jan '18

18 Jan '18

Hello, iam using freeradius version 3.0.15 with rlm_redis and rlm_perl. on this server i have 4 VCPU, when i start a becnh test with 6000 accounting start / sec i see that all my 4 VCPU are used 97% for every vcpu any advise please to minimize the use of vcpu on freeradius? Best Regards Mettichi Bassem

5 9

ldap filter from an external file
by Nicolas Reich 18 Jan '18

18 Jan '18

Hello, I want to accept or deny a request depending, among other things, on the value of one ldap attribute. There are several possible values that should be accepted, and the rest should be refused. This list is quite long, and might change; so I'd prefer not to have to change it manually in the freeradius configuration. Is this possible? Either configure freeradius to read the list and generate the filter, or just read the filter from a file? Thanks! nicolas

2 1

winbind / ntlm_auth funny
by Alex Sharaz 18 Jan '18

18 Jan '18

Hi, I've been using winbindd for a long time to authenticate york users .. and it "just works" We now have a requirement to authenticate another relam via trust relationship between our AD domain and theirs so in mods-enabled copy mschap machap { ... } into mschap mschap_hyms { } replace winbind_username = "%{Stripped-User-Name}" winbind_domain = "ITS.YORK.AC.UK" with winbind_username = "%{Stripped-User-Name}" winbind_domain = "HYMS.AC.UK" plus a few other bits to get inner-tunnel to call mschap_hyms as appropriate Then run eapol_test to perform an auth attempt and the HYMS AD controller bounces the aut with a no such user request Try ntlm_auth --username=eduroamtest2 --domain=HYMS.AC.UK and get the same no such user message However, try ntlm_auth --username=\eduroamtest2 --domain=HYMS.AC.UK and get a success after entering a password. Thought I'd go back to using ntlm_auth in my FR config for HYMS So how do I prefix Stripped-user-name wtih a "\" in inner-tunnel ? A

3 3

Freeradius Restrict User Auth Request Based on VLAN
by JAHANZAIB SYED 18 Jan '18

18 Jan '18

Scenario: We have Mikrotik as NAS and Freeradius as billing. VLAN are configured for each dealer's area. We have few reseller/franchise managers, like Dealer-A, Dealer-B. They can create there own users in freeradius using fronted designed in php. All dealers can view/edit there own users only. Sometimes it happens that Dealer-A creates ID and give it to a user/friend who is sitting in Dealer-B network, therefore from Billing perspective its a Loss of Dealer-B. Can we impose some restriction so that User-ID's created by each dealer should be able to connect only from his network (or from there own VLAN) only. Regards, JZ <http:///>

3 10

Unable to compile Freeradius 3.0.16
by Peter Balsianok 15 Jan '18

15 Jan '18

Hi, I am unable to compile Freeradius 3.0.16. OS version: Red Hat Enterprise Linux Server release 5.11 (Tikanga) Compiler version: Using built-in specs. Target: i386-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,obj-c++,java,fortran,ada --enable-java-awt=gtk --disable-dssi --disable-plugin --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --with-cpu=generic --host=i386-redhat-linux Thread model: posix gcc version 4.1.2 20080704 (Red Hat 4.1.2-55) Debug logs: CC jlibtool.c HEADER src/include/attributes.h HEADER src/include/features.h HEADER src/include/missing.h HEADER src/include/tls.h HEADER src/include/rfc2865.h HEADER src/include/rfc2866.h HEADER src/include/rfc2867.h HEADER src/include/rfc2868.h HEADER src/include/rfc2869.h HEADER src/include/rfc3162.h HEADER src/include/rfc3576.h HEADER src/include/rfc3580.h HEADER src/include/rfc4072.h HEADER src/include/rfc4372.h HEADER src/include/rfc4603.h HEADER src/include/rfc4675.h HEADER src/include/rfc4679.h HEADER src/include/rfc4818.h HEADER src/include/rfc4849.h HEADER src/include/rfc5090.h HEADER src/include/rfc5176.h HEADER src/include/rfc5447.h HEADER src/include/rfc5580.h HEADER src/include/rfc5607.h HEADER src/include/rfc5904.h HEADER src/include/rfc6519.h HEADER src/include/rfc6572.h HEADER src/include/rfc6677.h HEADER src/include/rfc6911.h HEADER src/include/rfc6929.h HEADER src/include/rfc6930.h HEADER src/include/rfc7055.h HEADER src/include/rfc7155.h HEADER src/include/rfc7268.h HEADER src/include/rfc7499.h HEADER src/include/rfc7930.h HEADER src/include/vqp.h HEADER src/include/freeradius.h CC src/lib/cbuff.c cc1: error: unrecognized command line option "-Wno-date-time" make: *** [build/objs/src/lib/cbuff.lo] Error 1 I have fixed this issue by removing "-Wno-date-time" from configure & configure.ac files. But question is: is it correct approach? Thank you very much.

6 10