February 2018 - Freeradius-Users - lists.freeradius.org

Error after successful bind using Samba4, it might be the userPassword attribute
by Ing. Pedro Pablo Delgado Martell 13 Feb '18

13 Feb '18

I'm trying to set freeradius authentication against a *Samba Active Directory Domain Controller v4.3.0* (*sernet-samba-ad*) server. The parameters in my ldap module file look like this: server = "192.168.1.8" identity = "cn=root,cn=Users,dc=eleka,dc=co,dc=cu" password = password basedn = "dc=eleka,dc=co,dc=cu" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" When I run *radtest root password 127.0.0.1 0 testing123* in debug mode (freeradius -X) I get a successful bind (*[ldap] Bind was successful*) but after that, this error is shown: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? I found here http://lists.freeradius.org/pipermail/freeradius-users/2015-December/081338… that it might be a problem related to Samba4 which looks like doesn't has a userPassword attribute and the freeradius LDAP module can map *userPassword* attribute defined in *ldap.attrmap* I also executed this query using ldapsearch (*without any issue* so identity works): ldapsearch -LLL -b "dc=eleka,dc=co,dc=cu" -h 192.168.206.8 -D "cn=root,cn=Users,dc=eleka,dc=co,dc=cu" -w password userPassword=* # refldap://eleka.co.cu/CN=Configuration,DC=eleka,DC=co,DC=cu # refldap://eleka.co.cu/DC=DomainDnsZones,DC=eleka,DC=co,DC=cu # refldap://eleka.co.cu/DC=ForestDnsZones,DC=eleka,DC=co,DC=cu

2 1

IPv6 subnet as client ipaddr
by Klara Mall 12 Feb '18

12 Feb '18

Hi, we just wanted to configure an IPv6 subnet as client with the variable ipaddr. Found out that only a single IPv6 IP address is working with the variable ipaddr. With ipv6addr subnet is working, too. Does not work: client test { ipaddr = fd76:70:6e:1::/64 secret = XXXXXXXXXXXXXXXXXXXXXXXXX } Does work: client test { ipaddr = fd76:70:6e:1::1 secret = XXXXXXXXXXXXXXXXXXXXXXXXX } Does work: client test { ipv6addr = fd76:70:6e:1::/64 secret = XXXXXXXXXXXXXXXXXXXXXXXXX } Error log message: Failed to parse IPv4 address string "fd76:70:6e:1::/64" /etc/freeradius/3.0/clients.conf[270]: Error parsing client section Is it a bug? Tested in freeradius 3.0.12 and 3.0.16. Same behaviour. Thank you Klara

2 1

Simple freeradius install ins wrong by default
by Ing. Pedro Pablo Delgado Martell 12 Feb '18

12 Feb '18

My boss asked me to set up a wireless hotspot at the company I work. I decided to use freeradius (first time used) and captive portal (under pfSense). I saw a few tutorial videos on YouTube and for a basic installation were all almost the same. *OS: Ubuntu Server 16.04 LTS* *Guide: *https://wiki.freeradius.org/guide/Getting-Started *User:* root Next are the commands I used for the first basic use: 1. root@radius:~# apt-get update -y && apt-get upgrade -y 2. root@radius:~# apt-get install -f freeradius freeradius-ldap 3. root@radius:~# freeradius -X *Failed binding to authentication address * port 1812: Address already in use** **/etc/freeradius/radiusd.conf[273]: Error binding to port for 0.0.0.0 port 1812* Really don't get why is freeradius telling the port is already in use. I took some port info, BEFORE the installation, and this is how it look: tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 320 10.10.10.252:22 10.10.10.18:29324 ESTABLISHED No further connections, not even any of them listening on 1812. After installation the netstat -van output: tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 10.10.10.252:22 10.10.10.18:29340 ESTABLISHED udp 0 0 0.0.0.0:47291 0.0.0.0:* udp 0 0 127.0.0.1:18120 0.0.0.0:* udp 0 0 0.0.0.0:1812 0.0.0.0:* udp 0 0 0.0.0.0:1813 0.0.0.0:* udp 0 0 0.0.0.0:1814 0.0.0.0:* According to the tutorial (https://wiki.freeradius.org/guide/Getting-Started) the output should be: |Ready to process requests| |Thanks in advance! | **

3 2

Freeradius Solution (CHAP with LDAP encrypted password)
by Tsirkas Georgios 12 Feb '18

12 Feb '18

Hello, I am trying connect to a radius client, which can authenticate only with CHAP. Users credentials are stored encrypted in LDAP database. Unfortunately CHAP requires only cleartext password. I dont want to store users credentials plain-text. Is there a solution about it? Thank you, George

7 11

cisco phones
by Vacheslav 12 Feb '18

12 Feb '18

Peace, I still can't authenticate the ip phones using md5 on the voice vlan, they keep getting authenticated on the data vlan. I ducked ducked the internet and found that: "device-traffic-class=voice:= Cisco-AVPair" Must be added. So I added it username of the ip phone in daloradius but the behavior has not changed. Perhaps, that must be added manually to the users file for it work. I only found documentation on how to do that in cisco ACS.

7 25

Redis authorize module
by Bassem Mettichi 10 Feb '18

10 Feb '18

Hello, has any one developped an authorize module for redis database with freeradius. thanks an advance

2 1

Handling user based on an attribute in a dynamic manner
by Nathan Ward 10 Feb '18

10 Feb '18

Hi, I’m working on a solution where I need to auth differently, and return different attributes based on a user’s access type. I can see the interface that a user has arrived on, and from that look up the access type. We have maybe 100 different interfaces which can change a bit, divided in to 3 or 4 different access types. Once I know the access type, I can choose which of the other attributes I use to authenticate the user. We run 3.0.16 (or will by the time this is deployed). I’m trying to figure out a good way to map those 100 interfaces to access types, without a change meaning a restart. We run LDAP right now, we don’t have SQL servers running on our front end servers, and I’d rather avoid it. Right now, I’m considering SQLite, but I’m not certain how it would handle: 1) A 3rd party process opening the db file to write periodically - I see posts about only one writer, and that’s fine I only want one writer, but I want to write from a different application.. is that OK? 2) Changes to the file, would they require a restart - I presume the DB file is not cached in memory in FreeRADIUS somehow, but that’s just a guess. Our auth load is quite manageable, so, if a request blocked for a second or two while the write was happening that would be OK - but errors/false negatives would be bad. Can anyone help with these before I go spending a bunch of time testing? Any other solutions I should consider? A server restart is always an option, but, I’d rather avoid it if possible. -- Nathan Ward

3 2

Separate pam modules for multiple clients
by Jeff McCarty 09 Feb '18

09 Feb '18

I’m running FreeRadius 3.0.13 on RedHat EL 7 with IdM. IdM provides host-based access control by accepting or rejecting authentication via PAM. I’d like to set up two FreeRadius clients that authenticate users using two different PAM modules. It looks like the person in this thread was doing the same thing, but I can’t tell from the discussion how to set everything up: http://freeradius.1045715.n5.nabble.com/multiple-instances-of-pam-module-td… <http://freeradius.1045715.n5.nabble.com/multiple-instances-of-pam-module-td…> I have changed the user and group to root in radiusd.conf because I’ve read that PAM won’t work with the radiusd user. I’ve added the following line to mods-config/files/authorize: DEFAULT Auth-Type := pam I have multiple modules set up in my pam config file as below and have symlinked it to the mods-enabled folder: pam { pam_auth = radiusd } pam pam-one { pam_auth = radiusd-one } pam pam-two { pam_auth = radiusd-two } I have created a file in sites-available and symlinked it to sites-enabled with the following contents: server server-one { authenticate { pam-one } } server server-two { authenticate { pam-two } } And in my clients.conf file, I have: client client-one { ipaddr = 192.168.0.1 secret = secret-one virtual_server = server-one } client client-two { ipaddr = 192.168.0.2 secret = secret-two virtual_server = server-two } With this configuration, no matter which client I use, it authenticates against the default radiusd PAM module. What am I missing?

2 4

cafe wifi with freeradius
by Muhammed Buvaydani 09 Feb '18

09 Feb '18

Hello I working on freeradius management system and I wish to install it into cafe . my system contain self registiration so user can register for new account and password will send through sms . my question is how can I prevent another users from using my system ie . I want only cafe clients to use my system . so if user is inside my cafe and has table he can Access internet by register new account . how can I do this ? how can I prevent non client user from Access login page . I have idea like putting QR code onto every table inside my cafe and if user want to acccess internet he must read this code by his phone and he will redirect to register page to has new account , but I don't know how to implement this idea Are thgere any idea or way to make this

2 1

Failed to find "ldap" in the "modules" section.
by Muhammed Buvaydani 09 Feb '18

09 Feb '18

My freeradius server give me this error : /etc/freeradius/sites-enabled/default[234]: Failed to find "ldap" in the "modules" section. /etc/freeradius/sites-enabled/default[69]: Errors parsing authorize section. Even if I have ldap file in modules folder This is the content of ldap file ldap 127.0.0.1 { server =127.0.0.1 identity = 'cn=root,cn=dc=netcom,dc=com' password = roots # basedn = 'o=novell' filter = '(cn=%{Stripped-User-Name:-%{User-Name}})' port = 636 tls_mode = yes dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # for EAP/802.1x password_attribute = nspmPassword edir_account_policy_check=yes timeout = 8 timelimit = 3 net_timeout = 1 # so I don't have to enable the users to allow access access_attr_used_for_allow = no }

1 0