March 2019 - Freeradius-Users - lists.freeradius.org

Re: FR 3.0.13, reply of attributes missing
by Jürgen Northe 04 Mar '19

04 Mar '19

>> I managed it to define and assign the wanted LDAP attributes in the reply messages by defining them in the LDAP module. >> I am quite finished now but have one question left: >> All types of my VLAN settings are kept in profiles. >> In the settings of a device is a "radiusProfileDN" attribute pointing to the profile like >> cn=PRINTER,ou=VLAN,ou=profiles,ou=radius,dc=compend,dc=com where i.e. radiusTunnelPrivateGroupID and others are defined. >> Right now, the server is not going to resolve the radiusProfileDN. >Why? I have absolutely no idea and this is the reason of my posting. >> Do I have to define here also a matching pair of radius and LDAP attribute which is in module ldap group section treated with filter definitions?\ >I don't think so. The Wiki has full documentation on how the LDAP module works. That may help. I have read the the wiki and "user profile attribut" is what I want but I can't transfer it to my scenario because the choose of the DN of a profile entry containing radius attributes is not depending of a result of a service type. It is a simple extension of the entry without any dependencies. Thanks and best regards Juergen

2 1

Problem in import sqlite3 library in freeradius python module
by Mehrzad Moghaddas 04 Mar '19

04 Mar '19

Hi I have tried to use sqlite3 library in freeradius 3.0.16 python module on ubuntu 18.04 . I have installed freeradius via standard repositories . but I got this error message : reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "python" from file /etc/freeradius/3.0/mods-enabled/python Python version: 2.7.15rc1 (default, Nov 12 2018, 14:31:15) [GCC 7.3.0] python_function_load - Module 'example' not found <type 'exceptions.ImportError'> (No module named sqlite3) python_function_load - Failed to import python function 'example.instantiate' /etc/freeradius/3.0/mods-enabled/python[9]: Instantiation failed for module "python" any other library its ok -like os socket and etc - ! just have problem with sqlite3 ! there is my config files : mods-avalaible > python : python { # Path to the python modules # # Note that due to limitations on Python, this configuration # item is GLOBAL TO THE SERVER. That is, you cannot have two # instances of the python module, each with a different path. # python_path="/etc/freeradius/3.0/mods-config/python:/usr/lib/python2.7/s$ module = example mods-config > python > example.py import radiusd import sqlite3 DATABASE='path/to/database.db' def get_acls(): con=sqlite3.connect(DATABASE) cur=con.execute("SELECT * FROM acl") acls=cur.fetchall() con.close() acl_list=[] for acl in acls : .... I test python 2.7 and 3 but no differences , I tried installed freeradius from source -freeradius 3.0.19- what should I do ?

5 13

What kind of LDAP account should I to have in order to bind LDAP server if I need to use group policy?
by Rong Wang 04 Mar '19

04 Mar '19

I am trying to setup FreeRadius server to use group policy based on LDAP attributes. Is there any special requirement for the account used to bind LDAP server? Any kind of permission needed? Thank you! Rong -- Rong Wang Senior Network Engineer Address | 500 El Camino Real, Santa Clara, CA 95053 Phone | (408)551-7107 Email | rzwang(a)scu.edu Website | https://www.scu.edu/is/it

2 2

FreeRadius 3.0.11 [bypassing MySQL failures]
by Ibrahim Nezar Al-Mahfooz 04 Mar '19

04 Mar '19

Hi, We have two FR servers used to authorize LTE users based on their location and device type. We used unlang to meet the requirements and it worked pretty well. Inside the unlang blocks we have have different blocks to accept or reject users based on various conditions. For logging and reporting purposes, we have put the module sql inside this block as shown below. This setup works perfectly but until the mysql is down, users won't be able to authorize due to the module sql unable to proceed with the insert statement. ## The below is one example of post-auth section of sites-enabled/default *if (&3GPP-Charging-Characteristics == "0800") {update reply {Framed-Pool := "gnet-pool"Reply-Message := "Authorized"}* *-sqlaccept}* In the above case, users will be authorized based on the condition and then logged into sql and accepted. Would you be kind and suggest a working method or simple solution to bypass the sql module in case of mysql DB failures to avoid sacrificing our customers connectivity to the network in case of such incident? Appreciate your suggestions and support. Thanks. --

2 1

About RadiusDesk
by Ariel García Reyes 04 Mar '19

04 Mar '19

Hello I have been using RadiusDesk for about more than 1 year and everything is fine, except that today the parameters of the first users that create in the radcheck table were deleted, such as the password, the type of plan, etc. Some way so that does not happen again! The users are permanent.... -- ________________________________________________ Lic. Ariel García Reyes.

2 1

NAS-Port / radwho
by Hans-Christian Esperer 03 Mar '19

03 Mar '19

Hi, I'm using freeradius 3.17 with unifi APs[1] to provide authentication and accounting. I'm currently using 3 APs. I've run into a problem: radwho will only ever display one user per AP at max. I've run radiusd -X and also looked into the source code that handles radutmp. It seems that the NAS-Port value needs to be unique per user. The APs, however, always supply a NAS-Port of 0. I've looked a bit into the hostapd that unifi is using, and it seems it is a (heavily) patched version, so no chance to get a standard hostapd running. I've tested with standard hostapd: This does use a unique NAS-Port value when sending accounting packets to the radius server, so all concurrently logged in users per AP are shown correctly by radwho. My question is: Is there any way to get radwho/radutmp accounting to work correctly even with the NAS-Port always set to 0? Thanks, HC [1] https://www.ubnt.com/unifi/unifi-ap/

2 3

Re: FR 3.0.13, reply of attributes missing
by Jürgen Northe 03 Mar '19

03 Mar '19

I managed it to define and assign the wanted LDAP attributes in the reply messages by defining them in the LDAP module. I am quite finished now but have one question left: All types of my VLAN settings are kept in profiles. In the settings of a device is a "radiusProfileDN" attribute pointing to the profile like cn=PRINTER,ou=VLAN,ou=profiles,ou=radius,dc=compend,dc=com where i.e. radiusTunnelPrivateGroupID and others are defined. Right now, the server is not going to resolve the radiusProfileDN. Do I have to define here also a matching pair of radius and LDAP attribute which is in module ldap group section treated with filter definitions? I put the 4 lines of ldap module of group handling, because the server is not diving in. this section at all. filter = '(objectClass=radiusprofile)' name_attribute = cn membership_attribute = 'radiusProfileDN' membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" Thanks in advance. juergen

2 1

Problem with Version 3.0.18
by Grit Wehner 02 Mar '19

02 Mar '19

hi, i try to install version 3.0.18 on Debian 9. I have successfully used this tutorial: [1]https://wiki.freeradius.org/building/Debian-and-Ubuntu After that i can start freeradius by hand (freeradius -X). But not with systemd: $ systemctl start freeradius.service Job for freeradius.service failed because the control process exited with error code. See "systemctl status freeradius.service" and "journalctl -xe" for details. $ systemctl status freeradius.service freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; enabled; vendor preset: en Active: activating (auto-restart) (Result: exit-code) since Sat 2019-03-02 08:23:2 Docs: man:radiusd(8) man:radiusd.conf(5) [2]http://wiki.freeradius.org/ [3]http://networkradius.com/doc/ Process: 2973 ExecStart=/usr/sbin/freeradius $FREERADIUS_OPTIONS (code=exited, stat Process: 2971 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (c Main PID: 2973 (code=exited, status=1/FAILURE) Mär 02 08:23:24 test systemd[1]: Failed to start FreeRADIUS multi-protocol policy ser Mär 02 08:23:24 test systemd[1]: freeradius.service: Unit entered failed state. Mär 02 08:23:24 test systemd[1]: freeradius.service: Failed with result 'exit-code'. Thank you very much. Greta References 1. https://wiki.freeradius.org/building/Debian-and-Ubuntu 2. http://wiki.freeradius.org/ 3. http://networkradius.com/doc/

2 2

TLS section "tls" missing, trying to use legacy configuration
by Tal Nur 01 Mar '19

01 Mar '19

Dear all, I'm configuring Freeradius 3.0.15 for Eduroam.In the debug output of freeradius -X I got the error message: TLS section "tls" missing, trying to use legacy configurationI have tls section in my /mods-enabled/eap file but this tls configuration wasn't read during start of Freeradius. What I do wrong? Here is the part of the frreradius -X output: # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_tls tls { } TLS section "tls" missing, trying to use legacy configuration tls { verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } }

3 3

Deploying FreeRadius against Active Directory
by Daniel Wruck 01 Mar '19

01 Mar '19

I am plodding along as I set up FreeRadius against Active Directory on a newly installed Ubuntu 18.04 LTS box. My finding is that documentation is sparse or outdated. So I am stuck in winbind somewhere. Here in https://github.com/FreeRADIUS/freeradius-server/issues/1880, at the bottom, @alendekok tell the user to "Follow the guide at http://deployingradius.com/documents/configuration/active_directory.html". Is this guide still relevant in the Ubuntu 18.04 > FreeRadius v3.0.16 > Samba 4.7.6 days? This guide talks about parameters that do not exist in Samba's out-of-the-box smb.conf anymore? Is there a more relevant guide to FreeRadius 3.0.x integration with AD LDAP? Daniel W

4 3