February 2018 - Freeradius-Users - lists.freeradius.org

Compilation Warning - FreeRadius 3.0.16
by Andrea Mucci 01 Jun '18

01 Jun '18

Hi All, we downloaded the source software freeradius 3.0.16 from: git clone https://github.com/FreeRADIUS/freeradius-server.git cd freeradius-server git checkout release_3_0_16 The OS is RHEL 7.4. We will use freeRadius with Oracle 12 DataBase. We compiled with this enviroment variable seting export LD_LIBRARY_PATH=/usr/lib/oracle/12.2/client64/lib:/usr/lib:/usr/lib64 export ORACLE_HOME=/usr/include/oracle/12.2/client64 We had this WARNING: configure: WARNING: securid headers not found. Use --with-rlm-securid-include-dir=<path>. checking for SD_Init in -laceclnt... no checking for SD_Init in -laceclnt in /usr/local/lib... no checking for SD_Init in -laceclnt in /opt/lib... no configure: WARNING: securid libraries not found. Use --with-rlm-securid-lib-dir=<path>. configure: WARNING: silently not building rlm_securid. configure: WARNING: FAILURE: rlm_securid requires: acexport.h libaceclnt. configure: WARNING: silently not building rlm_opendirectory. configure: WARNING: FAILURE: rlm_opendirectory requires: membership.h. configure: WARNING: Oracle version >= 12 needs -laio We would like to know if these warnings can generate incorrect behavior of the software. Thanks Andrea

4 4

Some attributes are showing hexa values
by Nimesha Balasuriya 01 May '18

01 May '18

Dear Team, I am using freeradius version 3 and there is some issue i am facing once write the some radius attributes to mariadb. I am getting hexa values to specific attribute call (Chargeable-User-Identity) 0x123456789. How can i convert this to correct this hex value to normal ascii words. Thank you ! Best Regards, Nimesha

3 4

Perl vs. python vs. Lua?
by Dom Latter 12 Apr '18

12 Apr '18

Hi, we have been using the exec module with version 2 to run an external PHP script that (for example) assigns a VLAN depending on the user's location [1] - this is done post-auth. We have migrated to freeradius version 3. I note from http://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html that "The exec module may look like it works for one or two tests, but in a live situation it can cause the server to become unresponsive under load. The perl module is recommended for general-purpose computing." Now if I had read that four years ago I'd not have gone down the exec route... anyway. So it seems to me we need to rewrite the exec module using one of the scripting modules. So I am wondering how the python module compares to the perl module. I found and read a great post from Herwin Weststrate <herwin(a)quarantainenet.nl> from November 2016 that explains some of the differences. I'd rather use python than perl, all else being equal. Lua is an outlier of an option. Any thoughts? Apologies if any of the above is unclear. [] which we get from the access-point identifier string.

3 17

Efficient AD group matching via the new wbclient interface
by Isaac Boukris 12 Apr '18

12 Apr '18

Hello all, I am working on improving AD group matching for mschap authentication, taking advantage of the new wbclient direct interface which returns the user's token (including group membership SIDs) as part of NTLM authentication. Work in progress: https://github.com/frenche/freeradius-server/commit/9af7dfd634a251f68b07064… I'm now thinking on how to implement the caching of group-name to SID mapping with configurable timeout, ideally using existing interface - ideas welcome. @mcnewton, I noticed at last there is a similar group-compare function in v4 branch, though I think the two actually can complete each other. Thoughts? Thank you, Isaac B.

3 9

Empty (not ended) session - freeradius 3.0.16
by dg 26 Mar '18

26 Mar '18

Hello, I have strange problem. >From time to time I have session not ended (and without any user assigned to that session). So i have time when session starts but stop time is NULL. example below: SELECT radacct.RadAcctId, hotspots.name as hotspot, radacct.UserName, radacct.FramedIPAddress, radacct.AcctStartTime, radacct.AcctStopTime, radacct.AcctSessionTime, radacct.AcctInputOctets, radacct.AcctOutputOctets, radacct.AcctTerminateCause, radacct.NASIPAddress FROM radacct LEFT JOIN hotspots ON radacct.calledstationid = hotspots.mac WHERE FramedIPAddress='' ORDER BY radacctid asc LIMIT 0, 1000; results ... | 1438 | NULL | user1 | | 2018-02-27 10:31:04 | 2018-02-27 10:35:33 | 269 | 1414483 | 40634419 | Admin-Reset | 192.168.1.110 | | 1439 | NULL | user2 | | 2018-02-27 10:31:11 | 2018-02-27 10:36:07 | 296 | 1714244 | 27071082 | Port-Error | 192.168.1.106 | | 1445 | NULL | | | 2018-02-27 09:49:24 | NULL | 6215 | 89145682 | 1799384 | | 192.168.1.110 | | 1446 | NULL | | | 2018-02-27 09:49:46 | NULL | 6242 | 89124192 | 1803157 | | 192.168.1.110 | | 1447 | NULL | | | 1993-03-01 01:01:22 | NULL | 788783565 | 92045995 | 1920254 | | 192.168.1.110 | | 1448 | NULL | | | 1993-03-01 01:01:24 | NULL | 788783603 | 93859941 | 1975125 | | 192.168.1.110 | so you can see that AcctStopTime is sometimes NULL. Can someone help me ? why its happening ? i am using cisco switches best regards

2 2

is there a way to identify the very first ACCESS-REQUEST
by Michael Hocke 16 Mar '18

16 Mar '18

Hi there, I want to improve our logging and want to keep track of authentication attempts that do not complete. I was thinking of logging the very first ACCESS-REQUEST and then later on the result. Is there a good way to identify the very first ACCESS-REQUEST from the client with unlang? Maybe by checking the contents of the session-state list or some such? Any ideas? Thanks! - Michael

4 6

Vists every day
by Oscar Jofre 01 Mar '18

01 Mar '18

Hi, I need Help to try to create a new table (MariaDB) with one row from each user identified by day on the radacct. Because radacct is growing fast I need to store a new table with the visits per day by username. Something like visits_table idVisits_table username date_visit with username and date_visit unique keys. Also a need to store this table in a different server from the server where is installed the radius_db. I've been reading and I can do a trigger on radius_db and every insert on radacct fire an insert-update on the new visits_table. Also a I can create this visits_table as a FederatedX table on the other MariaDB machine. I would like to know if someone have done this before and can give me a little bit of light on how to solve this. I think with the trigger and plus the FederatedX maybe a slow down to much the database, maybe some code (need help in this) on the radius part will do the job better. If anyone can give me a hand will be appreciate. Thanks. Oscar

2 2

Execute shell script in older version of FreeRADIUS
by MLists 01 Mar '18

01 Mar '18

I’m hoping someone can give me a helping hand. I’ve got an older version of FreeRADIUS (2.2.0) running on an internal legacy system. The server is scheduled to be replaced by the summer so at this point it would be a waste to try to upgrade it. I do however need to make a change to the configuration to hack for a requirement of the server that’s being replaced first… and I’ve been kind of going/googling around in circles. Have tried 4 or 5 different things that I’ve found but I think a few of them may be for newer versions of FreeRADIUS… and the ones I thought were old enough didn’t accomplish anything either 😊 Essentially what I need to do is run one script after a user is authenticated to which will extract the username and the IP address they’ve been assigned (and possibly the NAS IP/port) (in the current test script this info is just echoed to a file so that I can tell when it’s working). And then a different script (with the same parameters) when they log off. From reading I’m guessing accounting-start and accounting-stop is the point where I want to be doing this, but I’m open to input on that as well if there’s somewhere more appropriate. What is the best/right way to accomplish this in FreeRADIUS 2.2.0? Cheers, Mike

3 4

Intermittent failures of mod_krb5
by Brian Candler 01 Mar '18

01 Mar '18

Hello, I have been setting up freeradius-3.0.15 (from PPA) under Ubuntu 16.04, and using mod_krb5 to authenticate against Samba4. There are four freeradius servers, each with a Samba replica behind it. Once every few days, I get alerts from nagios saying one or more RADIUS servers has stopped working for a few minutes, and then they recover. There are two nagios servers making RADIUS checks across all four RADIUS servers, and both nagios servers see the problem simultaneously. I now have authentication logging turn on, and at the time of the last event I see: ... all OK Thu Feb 22 17:21:51 2018 : Auth: (273) Login OK: [nagiostest] (from client ix_nagios port 0) Thu Feb 22 17:22:38 2018 : Auth: (274) Login OK: [nagiostest] (from client wrn_mon2 port 0) Thu Feb 22 17:23:00 2018 : Error: Unresponsive child for request 275, in component authenticate module krb5 Thu Feb 22 17:23:10 2018 : WARNING: (275) WARNING: Module rlm_krb5 became unblocked Thu Feb 22 17:23:38 2018 : Auth: (276) Login OK: [nagiostest] (from client wrn_mon2 port 0) Thu Feb 22 17:24:00 2018 : Error: Unresponsive child for request 277, in component authenticate module krb5 Thu Feb 22 17:24:01 2018 : WARNING: (277) WARNING: Module rlm_krb5 became unblocked Thu Feb 22 17:24:46 2018 : Error: Unresponsive child for request 278, in component authenticate module krb5 Thu Feb 22 17:24:52 2018 : Info: Need 1 more connections to reach 5 spares Thu Feb 22 17:24:52 2018 : Info: rlm_krb5 (krb5): Opening additional connection (5), 1 of 5 pending slots used Thu Feb 22 17:24:52 2018 : WARNING: (278) WARNING: Module rlm_krb5 became unblocked Thu Feb 22 17:25:00 2018 : Error: Unresponsive child for request 279, in component authenticate module krb5 Thu Feb 22 17:25:01 2018 : WARNING: (279) WARNING: Module rlm_krb5 became unblocked Thu Feb 22 17:25:45 2018 : Info: rlm_krb5 (krb5): Closing connection (4), from 1 unused connections Thu Feb 22 17:25:45 2018 : Auth: (280) Login OK: [nagiostest] (from client wrn_mon2 port 0) Thu Feb 22 17:26:00 2018 : Error: Unresponsive child for request 281, in component authenticate module krb5 Thu Feb 22 17:26:10 2018 : WARNING: (281) WARNING: Module rlm_krb5 became unblocked Thu Feb 22 17:26:46 2018 : Error: Unresponsive child for request 282, in component authenticate module krb5 Thu Feb 22 17:26:56 2018 : Info: Need 1 more connections to reach 5 spares Thu Feb 22 17:26:56 2018 : Info: rlm_krb5 (krb5): Opening additional connection (6), 1 of 5 pending slots used Thu Feb 22 17:26:56 2018 : WARNING: (282) WARNING: Module rlm_krb5 became unblocked Thu Feb 22 17:27:00 2018 : Error: Unresponsive child for request 283, in component authenticate module krb5 Thu Feb 22 17:27:10 2018 : WARNING: (283) WARNING: Module rlm_krb5 became unblocked Thu Feb 22 17:27:43 2018 : Info: rlm_krb5 (krb5): Closing connection (1), from 1 unused connections Thu Feb 22 17:27:43 2018 : Auth: (284) Login OK: [nagiostest] (from client wrn_mon2 port 0) Thu Feb 22 17:28:00 2018 : Auth: (285) Login OK: [nagiostest] (from client ix_nagios port 0) ... all OK again I'm not sure about the meaning of the message "became unblocked". Looking at the source of call_modsingle() blocked = (request->master_state == REQUEST_STOP_PROCESSING); if (blocked) return RLM_MODULE_NOOP; ... blocked = (request->master_state == REQUEST_STOP_PROCESSING); if (blocked) { RWARN("Module %s became unblocked", sp->modinst->entry->name); } It seems to me that the module has unexpectedly become blocked (not unblocked!) But does this simply mean that the module is taking longer to respond than expected? Or if not, what else does it indicate? Apart from this: I wondered if you had any pointers to narrowing down the problem. There are four servers so I can probably leave one running under freeradius -X until it recurs. Now, of course the problem *could* be with Samba4. However I have a separate nagios script (below) which performs LDAP queries using krb5 authentication, and it never reports a problem - not even an occasional "soft" error; that suggests that KRB5 is reliable. It considered if it was a problem with the RADIUS checking plugin (check_radius_adv), but this seems very unlikely given that (a) both nagios servers see the same problem simultaneously, and (b) freeradius itself is logging problems around the time of the issue. I have: [radiusd.conf] max_request_time = 10 thread pool { start_servers = 3 ----------- #!/bin/sh host="$1" if [ "$host" = "" ]; then echo "Missing hostname" exit 2 fi export KRB5_CONFIG="/tmp/krb5.config.$$" export KRB5CCNAME="/tmp/krb5.cc_cache.$$" if expr "$host" : ".*:" >/dev/null; then khost="[$host]" else khost="$host" fi cat <<EOS >"$KRB5_CONFIG" [realms] AD.EXAMPLE.NET = { kdc = $khost } EOS # 1. Can we get a ticket from this host? kinit -k -t /etc/nagiostest.keytab nagiostest(a)AD.EXAMPLE.NET if [ "$?" != "0" ]; then echo "KINIT FAILED" rm "$KRB5_CONFIG" exit 2 fi # 2. Can we use this ticket to do an LDAP query to this host? res="$(ldapsearch -LLLQ -Y GSSAPI -h "$host" -b "cn=users,dc=ad,dc=example,dc=net" "(samaccountname=nagiostest)" samaccountname userprincipalname)" if [ "$?" != "0" ]; then echo "LDAPSEARCH FAILED" kdestroy rm "$KRB5_CONFIG" exit 2 fi if ! expr "$res" : ".*userPrincipalName: nagiostest(a)ad.example.net" >/dev/null; then echo "LDAPSEARCH BAD RESULT: $res" kdestroy rm "$KRB5_CONFIG" exit 2 fi # 3. Clean up kdestroy rm "$KRB5_CONFIG" echo "OK"

5 8

Authenticate via AD and via local "users" file
by DUPALUT, Benjamin 01 Mar '18

01 Mar '18

Hi everyone, I'm using a pfsense server as captive portal to authenticate users on my WiFi network. The captive portal is set to interrogate my freeradius server. My freeradius server can already authenticate users via my AD using winbind. I also need local account (via "users" file) to create some temporary "WiFi" account for guests. My problem is that it seems that when freeradius receive an mschap request, it only interrogate the AD and do not check the local "users" file : *Radtest output :* *root@radius:/etc/freeradius/3.0# radtest test hello localhost 0 testing123Sent Access-Request Id 221 from 0.0.0.0:55019 <http://0.0.0.0:55019> to 127.0.0.1:1812 <http://127.0.0.1:1812> length 74 User-Name = "test" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "hello"Received Access-Accept Id 221 from 127.0.0.1:1812 <http://127.0.0.1:1812> to 0.0.0.0:0 <http://0.0.0.0:0> length 20root@radius:/etc/freeradius/3.0# radtest -t mschap test hello localhost 0 testing123Sent Access-Request Id 57 from 0.0.0.0:45981 <http://0.0.0.0:45981> to 127.0.0.1:1812 <http://127.0.0.1:1812> length 130 User-Name = "test" MS-CHAP-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "hello" MS-CHAP-Challenge = 0x721c5f615cce85ee MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000fd35479230547ed1afaabb4620398d1ab297fc558976fbe5Received Access-Reject Id 57 from 127.0.0.1:1812 <http://127.0.0.1:1812> to 0.0.0.0:0 <http://0.0.0.0:0> length 61 MS-CHAP-Error = "\000E=648 R=0 C=36f192b64ad8bf50 V=2"(0) -: Expected Access-Accept got Access-Reject* *freeradius -X output :* *1) Received Access-Request Id 57 from 127.0.0.1:45981 <http://127.0.0.1:45981> to 127.0.0.1:1812 <http://127.0.0.1:1812> length 130(1) User-Name = "test"(1) NAS-IP-Address = 127.0.1.1(1) NAS-Port = 0(1) Message-Authenticator = 0x2ac9eeb221acb45d57e63c7670667269(1) MS-CHAP-Challenge = 0x721c5f615cce85ee(1) MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000fd35479230547ed1afaabb4620398d1ab297fc558976fbe5(1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default(1) authorize {(1) policy filter_username {(1) if (&User-Name) {(1) if (&User-Name) -> TRUE(1) if (&User-Name) {(1) if (&User-Name =~ / /) {(1) if (&User-Name =~ / /) -> FALSE(1) if (&User-Name =~ /@[^@]*@/ ) {(1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE(1) if (&User-Name =~ /\.\./ ) {(1) if (&User-Name =~ /\.\./ ) -> FALSE(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(1) if (&User-Name =~ /\.$/) {(1) if (&User-Name =~ /\.$/) -> FALSE(1) if (&User-Name =~ /(a)\./) {(1) if (&User-Name =~ /(a)\./) -> FALSE(1) } # if (&User-Name) = notfound(1) } # policy filter_username = notfound(1) [preprocess] = ok(1) [chap] = noop(1) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap'(1) [mschap] = ok(1) [digest] = noop(1) suffix: Checking for suffix after "@"(1) suffix: No '@' in User-Name = "test", looking up realm NULL(1) suffix: No such realm "NULL"(1) [suffix] = noop(1) eap: No EAP-Message, not doing EAP(1) [eap] = noop(1) files: users: Matched entry test at line 1(1) [files] = ok(1) [expiration] = noop(1) [logintime] = noop(1) pap: WARNING: Auth-Type already set. Not setting to PAP(1) [pap] = noop(1) } # authorize = ok(1) Found Auth-Type = mschap(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default(1) authenticate {(1) mschap: Found Cleartext-Password, hashing to create NT-Password(1) mschap: Found Cleartext-Password, hashing to create LM-Password(1) mschap: Client is using MS-CHAPv1 with NT-Password(1) mschap: EXPAND %{mschap:User-Name}(1) mschap: --> testrlm_mschap (mschap): Reserved connection (0)(1) mschap: sending authentication request user='test' domain='lan.domain.tld'rlm_mschap (mschap): Released connection (0)rlm_mschap (mschap): Need 5 more connections to reach 10 sparesrlm_mschap (mschap): Opening additional connection (5), 1 of 27 pending slots used(1) mschap: ERROR: No such user [0xC0000064](1) mschap: ERROR: Password has expired. User should retry authentication(1) [mschap] = reject(1) } # authenticate = reject(1) Failed to authenticate the user(1) Using Post-Auth-Type Reject(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default(1) Post-Auth-Type REJECT {(1) attr_filter.access_reject: EXPAND %{User-Name}(1) attr_filter.access_reject: --> test(1) attr_filter.access_reject: Matched entry DEFAULT at line 11(1) [attr_filter.access_reject] = updated(1) [eap] = noop(1) policy remove_reply_message_if_eap {(1) if (&reply:EAP-Message && &reply:Reply-Message) {(1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE(1) else {(1) [noop] = noop(1) } # else = noop(1) } # policy remove_reply_message_if_eap = noop(1) } # Post-Auth-Type REJECT = updated(1) Delaying response for 1.000000 secondsWaking up in 0.3 seconds.Waking up in 0.6 seconds.(1) Sending delayed response(1) Sent Access-Reject Id 57 from 127.0.0.1:1812 <http://127.0.0.1:1812> to 127.0.0.1:45981 <http://127.0.0.1:45981> length 61(1) MS-CHAP-Error = "\000E=648 R=0 C=36f192b64ad8bf50 V=2"Waking up in 3.9 seconds.(1) Cleaning up request packet ID 57 with timestamp +19* Does anyone has an idea how i can use both authentication methods (AD and "local") simultaneously ? Thanks in advance. Regards, *Benjamin Dupalut* Administrateur système et réseau Service des Moyens Informatiques Généraux (SMIG) ESIEE Paris 2 bd Blaise Pascal - 93162 Noisy-le-Grand Cedex T : +33 1 45 92 66 17 benjamin.dupalut(a)esiee.fr www.esiee.fr / www.cci-paris-idf.fr

2 2