October 2018 - Freeradius-Users - lists.freeradius.org

Error Compiling 3.1.x
by Scott Pickles 19 Nov '18

19 Nov '18

I am compiling FreeRADIUS version 3.1.x from source and I get the following error: []# cd freeradius-server-3.1.x[]# ./configure --with-openssl-lib-dir=/usr/local/ssl/lib --with-openssl-include-dir=/usr/local/ssl/include[]# make [ .... SNIP ....] CC src/lib/version.c /usr/bin/ld: /usr/local/ssl/lib/libcrypto.a(md4_dgst.o): relocation R_X86_64_PC32 against undefined symbol `memset@@GLIBC_2.2.5' can not be used when making a shared object; recompile with -fPIC /usr/bin/ld: final link failed: Bad value collect2: error: ld returned 1 exit status make: *** [build/lib/local/libfreeradius-radius.la] Error 1 So I recompile openssl: []# cd openssl-1.0.2d []# ./config -fPIC[]# make[]# make install Trying make again, different module but same suggestion? []# cd freeradius-server-3.1.x[]# make [ .... SNIP ....] CC src/modules/rlm_wimax/rlm_wimax.c /usr/bin/ld: /usr/local/ssl/lib/libcrypto.a(rsaz_exp.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC /usr/local/ssl/lib/libcrypto.a: could not read symbols: Bad value collect2: error: ld returned 1 exit status make: *** [build/lib/local/rlm_wimax.la] Error 1

3 3

Dynamic session timeout
by Sam T 10 Nov '18

10 Nov '18

Hey there I was wondering if you could help me with some logic I'm working with some pretty limited attributes on some APs. They support radius, but only these attributes: Session-timeout Idle-timeout Bandwidth-up Bandwidth-down It sadly doesn't understand WISPr-Session-Terminate-Time Our application needs to timeout a user account and all devices with activate sessions on that account at a specific time. Our Service is offered monthly and are unlimited data. Is SQL counter or some other module able to send session timeout dynamically on the fly to accounts for a session that should only be 200min vs 1440 for an session that needs to expire at a specific moment on all devices? I was thinking to make a sql query script to do a Delta calculation between now and WISPr-Session-Terminate-Time and if that number is less than session-timeout, to use that value. I feel like there may be a module in freeradius that may do this but I could not figure if SQL counter does this. Any tips in what direction to go would be great!

3 20

Adding Filter-Id Attribute to Accounting Requests
by Alessandro Romano 05 Nov '18

05 Nov '18

Dear All, i need to add the attribute "Filter-ID" from database radusergroup to accounting-request packet. At the moment i retreive the attribute only in access-accept packet BR Alessandro Romano C.T.O. Cell: 3351402534 Positivo SRL Via San Leonardo 52 84131 Salerno ( Sa )

3 13

Apostrophe in username
by Dom Latter 02 Nov '18

02 Nov '18

We are using a mysql-backed v3 server and eap / peap / mschapv2. A new user has come along whose email address contains an apostrophe, ('single quote' if you prefer) which is unusual but legitimate. By default we allow users to use their email address as a username. I have found the safe_characters list here: /etc/freeradius/mods-config/sql/main/mysql/queries.conf Without the apostrophe in the safe_characters list, it gets encoded to =27 and so the db query [1] fails to find a user with that username. With the apostrophe in the list, the query fails with "an error in your SQL syntax"... Is there any way out of this conundrum except putting mime-encoded data in the database? [1] authorize_check_query from sql/mysql/dialup.conf

5 11

LDAP OU based authentication
by Tom Yard 02 Nov '18

02 Nov '18

Dear people, I have a Freeradius 2.2.5 authenticating against Active Directory (LDAP). Past week, the AD contained groups and users, and in freeradius I used this option OK and I could authenticate users belonging to WiFi group with the corresponding User-Name: If (LDAP-Group == "WiFi") ... But now, the AD has changed and it hasn't groups anymore. So I have to do an OU based authentication for the users: Basedn: OU=technology,OU=mexico,DC=company,DC=com I've read that DN's are also accepted as LDAP-Group values, so now I'm using this condition: If (LDAP-Group == "OU=technology,OU=mexico,DC=company,DC=com")... but it doesn't work. Please how can I authenticate users in accordance with their OU and not their groups? Thanking in advance, regards. Tommy

3 2

Wiki Documentation Error
by Dan M 31 Oct '18

31 Oct '18

There is a bad link on the wiki. The Getting Started page (http://wiki.freeradius.org/guide/Getting%20Started) Has text If you need to install it yourself, the Wiki >installation< page contains detailed instructions for a number of platforms. The page linked by "installation" doesn't seem to exist because it comes up as http://wiki.freeradius.org/create/Installation 403 - Forbidden (I'm sure it's forbidden because the public can't create pages) Perhaps it can be repaired Dan M

3 2

Evaluate condition against LDAP with ulang
by Tom Yard 31 Oct '18

31 Oct '18

Hi people, I have implemented a Freeradius sever running OK that authenticate against LDAP. Firstly, I have a LDAP tree with users under groups, such as: CN=Network,OU=Employess,DC=company,DC=com and my evaluating condition wit ulang was: if (LDAP-Group == Network) And the authentication was OK. But now, the LDAP administrators has modify the LDAP tree and now the users are under the OU as below: OU=Employess,DC=company,DC=com How can I evaluate the condition "if the user is under OU=Employees" ??? Because if I use if (LDAP-Group == Employees), it doesn't authneticate. Thanks a lot, regards !!!

3 3

pap + mac auth authentication problem
by Frédéric Goudal 31 Oct '18

31 Oct '18

Hello, I’m in the following situation : - I have switches that share either wifi and wired connexions. - on wifi connexion I have an eap/peap authentication - what I want is that on wired connexion, if the user/password authentication fail, authentication is done on mac-adress with automatic vlan configuration. I have a working wifi configuration on a first server I have a working wired configuration on a second server Is there any way to mix both on a single server ? Server version is 3.0.17 The wifi configuration is : authorize { preprocess mschap suffix eap files ldap } authenticate { Auth-Type MS-CHAP { mschap } eap } The wired configuration is : authorize { filter_username rewrite.called_station_id_ipb rewrite.calling_station_id_ipb preprocess suffix update control { Auth-Type := Accept Tunnel-Private-Group-Id :=" %{ldap:ldap://ldap.xxx/ou=hosts,dc=xxx,dc=xxx?radiusTunnelPrivateGroupId?sub?(&(objectClass=radiusProfile)(macAddress=%{Calling-Station-ID}))}" } if (!"%{control:Tunnel-Private-Group-ID}") { reject } expiration logintime } authenticate { } post-auth { update { &reply: += &session-state: } -sql update reply { &Tunnel-Private-Group-Id := "%{control:Tunnel-Private-Group-Id}" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Type := "VLAN" } remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject } Post-Auth-Type Challenge { } }

4 12

Re: Installing freeRADIUS 3.0.17 on centos
by Raghu nathan 30 Oct '18

30 Oct '18

Hello Alan, Since I'm not modifying any code , I will be interested to install directly (without code). Is it possible to install 3.0.17 directly in centos 7 without compiling the source code as we do it on Ubuntu? Is it possible to change the repository to point the installation to 3.0.17 instead of 3.0.13 for centos 7 Regards, Raghu Date: Tue, 30 Oct 2018 06:42:11 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Installing freeRADIUS 3.0.17 on centos Message-ID: <EEDBC965-429C-4A0C-8F0A-1FA108B4F91A(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Oct 30, 2018, at 6:19 AM, Raghu nathan <raghu.vdm(a)gmail.com> wrote: > > I tried installing freeradius using ubuntu 18.04 and we get 3.0.17 version, > when we tried using centos 7 we are ending up with 3.0.13. > > I tried using source code but end up with lot other issues. These issues can only be fixed if you DESCRIBE them. > Could you please suggest how should I install newer version using centos 7? The Wiki contain detailed instructions for building on RedHat. CentOS is largely the same, > Or what is the best OS (based on performance) to use freeRADIUS. It doesn't matter. Alan DeKok.

3 2

Fwd: Expiration Attribute
by Kliwer 30 Oct '18

30 Oct '18

Hi. I am trying to disable some user accounts at X date. I found that I could do that with Expiration module. I enabled this module, added "expiration" to instantiate, authorize and post-auth sections, yet I get [expiration] = noop in freeradius -X. (0) Received Access-Request Id 158 from 127.0.0.1:60707 to 127.0.0.1:1812 length 75 (0) User-Name = "mlody" (0) User-Password = "mlody" (0) NAS-IP-Address = 10.50.2.217 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x1dd6032013e085077807e62c694917f1 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) [chap] = noop (0) [mschap] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> mlody (0) sql: SQL-User-Name set to 'mlody' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, login AS UserName, 'Cleartext-Password' AS attribute, password AS value, ':=' AS op FROM nodes WHERE login = '%{User-Name}' ORDER BY id (0) sql: --> SELECT id, login AS UserName, 'Cleartext-Password' AS attribute, password AS value, ':=' AS op FROM nodes WHERE login = 'mlody' ORDER BY id (0) sql: Executing select query: SELECT id, login AS UserName, 'Cleartext-Password' AS attribute, password AS value, ':=' AS op FROM nodes WHERE login = 'mlody' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "mlody" (0) sql: EXPAND SELECT id, login AS UserName, 'Framed-IP-Address' AS attribute, inet_ntoa(ipaddr) AS value, ':=' AS op FROM nodes WHERE login = '%{User-Name}' UNION SELECT nodes.id, login AS UserName, 'Mikrotik-Rate-Limit' AS Attribute, '100k/100k 100k/100k 100k/100k 1/1 8 100k/100k' AS value, ':=' AS op FROM nodes WHERE login = '%{User-Name}' UNION SELECT nodes.id, login AS UserName, 'Expiration' AS Attribute, '29 Oct 2018 20:40:00 CET' AS value, ':=' AS op FROM nodes WHERE login = '%{User-Name}' ORDER BY id (0) sql: --> SELECT id, login AS UserName, 'Framed-IP-Address' AS attribute, inet_ntoa(ipaddr) AS value, ':=' AS op FROM nodes WHERE login = 'mlody' UNION SELECT nodes.id, login AS UserName, 'Mikrotik-Rate-Limit' AS Attribute, '100k/100k 100k/100k 100k/100k 1/1 8 100k/100k' AS value, ':=' AS op FROM nodes WHERE login = 'mlody' UNION SELECT nodes.id, login AS UserName, 'Expiration' AS Attribute, '29 Oct 2018 20:40:00 CET' AS value, ':=' AS op FROM nodes WHERE login = 'mlody' ORDER BY id (0) sql: Executing select query: SELECT id, login AS UserName, 'Framed-IP-Address' AS attribute, inet_ntoa(ipaddr) AS value, ':=' AS op FROM nodes WHERE login = 'mlody' UNION SELECT nodes.id, login AS UserName, 'Mikrotik-Rate-Limit' AS Attribute, '100k/100k 100k/100k 100k/100k 1/1 8 100k/100k' AS value, ':=' AS op FROM nodes WHERE login = 'mlody' UNION SELECT nodes.id, login AS UserName, 'Expiration' AS Attribute, '29 Oct 2018 20:40:00 CET' AS value, ':=' AS op FROM nodes WHERE login = 'mlody' ORDER BY id (0) sql: User found in radreply table, merging reply items (0) sql: Expiration := "Oct 29 2018 20:40:00 CET" (0) sql: Framed-IP-Address := 192.168.121.225 (0) sql: Mikrotik-Rate-Limit := "100k/100k 100k/100k 100k/100k 1/1 8 100k/100k" rlm_sql (sql): Released connection (1) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.3.10-MariaDB-1:10.3.10+maria~stretch-log, protocol version 10 (0) [sql] = ok (0) [pap] = updated (0) [expiration] = noop (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> mlody (0) sql: SQL-User-Name set to 'mlody' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'mlody', 'mlody', 'Access-Accept', '2018-10-29 21:06:14') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'mlody', 'mlody', 'Access-Accept', '2018-10-29 21:06:14') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) [expiration] = noop (0) } # post-auth = ok (0) Login OK: [mlody/mlody] (from client localhost port 1812) (0) Sent Access-Accept Id 158 from 127.0.0.1:1812 to 127.0.0.1:60707 length 0 (0) Framed-IP-Address = 192.168.121.225 (0) Mikrotik-Rate-Limit = "100k/100k 100k/100k 100k/100k 1/1 8 100k/100k" (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 158 with timestamp +2 Is there any working example of setting up Expiration module?

2 2