August 2020 - Freeradius-Users - lists.freeradius.org

No Response from radius server
by Muhammed Buvaydani 13 Aug '20

13 Aug '20

I have freeradius 3.0 which is installed on ubuntu 18.10 , I am working on hotspot system using Mikrotik with freeradius , I was able to send login Request from Mikrotik to radius server without any problem , but then I enabled Ufw in ubuntu machine , then I disabled UFW , Now Mikrotik can send request to freeradius but freeradius can not send response to Mikrotik , I don't know what is the problem , I disabled UFW and even I removed it from the server ,but still Mikrotik Can not get response from Radius this is the debug of Freeradius (0) [expiration] = noop (0) [logintime] = noop (0) accessperiod: WARNING: Couldn't find check attribute, control:Access-Period, doing nothing... (0) [accessperiod] = noop (0) pap: WARNING: Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> test (0) sql: SQL-User-Name set to 'test' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', '0x8da5209f622859ac89fd640527cb56139a', 'Access-Accept', '2020-08-12 21:07:21') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', '0x8da5209f622859ac89fd640527cb56139a', 'Access-Accept', '2020-08-12 21:07:21') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sent Access-Accept Id 23 from 172.16.1.148:1812<http://172.16.1.148:1812/> to 172.16.1.252:40180<http://172.16.1.252:40180/> length 0 as u see from the last line , Freeradius sending Access-accept to Mikrotik , but this response not received by mikroitk and Mikrotik through Login Feild No Response From Radius I tested Mikrotik with another freeradius server and it is working without any problem So , I think there are somethings which prevent the response packet to Mikrotik . [1562314050593]

2 1

Re: FreeTDS affected_rows_count Problem, Virtual Servers - nas_table Server Column Problem
by Ali Arslan 12 Aug '20

12 Aug '20

Hello, Today i will post 2 problems together that i have already sent by 2 different emails but still i cannot resolve without taking side ways. I will give earlier email links but both of the problems will be stated completely here again not to make reader to consult other sources of the problem statement: Note: Though i overcome the problems here i thought you may need to know about them to make already the best radius server on the globe better. 1- FreeTDS affected_rows_count Problem earlier email: http://freeradius.1045715.n5.nabble.com/mssql-freetds-interim-update-proble… 2- Virtual Servers - nas_table Server Column Problem earlier email http://freeradius.1045715.n5.nabble.com/Virtual-Servers-amp-nas-table-Serve… Problem Statement 1- FreeTDS affected_rows_count Problem Since rlm_sql_freetds does not get the true affected rows count it continues to insert new records in radacct table for the same session in interim updates. I attached debug output (debug_freetds.txt). Some lines from debug that will summarize the problem are as follows: (3) WISPSQL: Executing query: UPDATE radacct SET AcctInterval = DATEDIFF(second, AcctUpdateTime, GETDATE()), AcctUpdateTime = GETDATE(), AcctStopTime = NULL, AcctSessionTime = 121, FramedIPAddress = '192.168.10.255', AcctInputOctets = convert(bigint, '0' * POWER(2.0, 32)) | '95438', AcctOutputOctets = convert(bigint, '0' * POWER(2.0, 32)) | '45977' WHERE AcctUniqueId = '69913b8866eac834270ab589229ef6ab' (3) WISPSQL: SQL query returned: success (3) WISPSQL: -1 record(s) updated (3) WISPSQL: Trying next query... (3) WISPSQL: EXPAND IF NOT EXISTS(SELECT 1 FROM radacct WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}') INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctUpdateTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfoStart, ConnectInfoStop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{%{Packet-Src-IP-Address}:-%{NAS-IP-Address}}', '%{%{NAS-Port-Id}:-%{NAS-Port}}', '%{NAS-Port-Type}', DATEADD(second, -1 * (%{%{Acct-Session-Time}:-0}), GETDATE()), GETDATE(), NULL, %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '%{Connect-Info}', NULL, convert(bigint, '%{%{Acct-Input-Gigawords}:-0}' * POWER(2.0, 32)) | '%{%{Acct-Input-Octets}:-0}', convert(bigint, '%{%{Acct-Output-Gigawords}:-0}' * POWER(2.0, 32)) | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', NULL, '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') (3) WISPSQL: --> IF NOT EXISTS(SELECT 1 FROM radacct WHERE AcctUniqueId = '69913b8866eac834270ab589229ef6ab') INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctUpdateTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfoStart, ConnectInfoStop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress) VALUES('81600002', '69913b8866eac834270ab589229ef6ab', 'test@orbit', '', '192.168.1.200', 'LAN', 'Ethernet', DATEADD(second, -1 * (121), GETDATE()), GETDATE(), NULL, 121, 'RADIUS', '', NULL, convert(bigint, '0' * POWER(2.0, 32)) | '95438', convert(bigint, '0' * POWER(2.0, 32)) | '45977', 'PPPoE', 'D8:C4:97:15:C1:F8', NULL, 'Framed-User', 'PPP', '192.168.10.255') (3) WISPSQL: Executing query: IF NOT EXISTS(SELECT 1 FROM radacct WHERE AcctUniqueId = '69913b8866eac834270ab589229ef6ab') INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctUpdateTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfoStart, ConnectInfoStop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress) VALUES('81600002', '69913b8866eac834270ab589229ef6ab', 'test@orbit', '', '192.168.1.200', 'LAN', 'Ethernet', DATEADD(second, -1 * (121), GETDATE()), GETDATE(), NULL, 121, 'RADIUS', '', NULL, convert(bigint, '0' * POWER(2.0, 32)) | '95438', convert(bigint, '0' * POWER(2.0, 32)) | '45977', 'PPPoE', 'D8:C4:97:15:C1:F8', NULL, 'Framed-User', 'PPP', '192.168.10.255') (3) WISPSQL: SQL query returned: success (3) WISPSQL: -1 record(s) updated (3) WISPSQL: No additional queries configured rlm_sql (WISPSQL): Released connection (8) (3) [WISPSQL] = noop (3) update control { (3) EXPAND %{User-Name} (3) --> test@orbit (3) SQL-User-Name set to 'test@orbit' rlm_sql (WISPSQL): Reserved connection (7) Here update runs and returns success (3) WISPSQL: SQL query returned: success (3) WISPSQL: -1 record(s) updated but since it does not return true updated rows count (-1 record(s) updated) so it tries to insert new record (3) WISPSQL: Executing query: IF NOT EXISTS(SELECT 1 FROM radacct WHERE AcctUniqueId = '69913b8866eac834270ab589229ef6ab') INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctUpdateTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfoStart, ConnectInfoStop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress) VALUES('81600002', '69913b8866eac834270ab589229ef6ab', 'test@orbit', '', '192.168.1.200', 'LAN', 'Ethernet', DATEADD(second, -1 * (121), GETDATE()), GETDATE(), NULL, 121, 'RADIUS', '', NULL, convert(bigint, '0' * POWER(2.0, 32)) | '95438', convert(bigint, '0' * POWER(2.0, 32)) | '45977', 'PPPoE', 'D8:C4:97:15:C1:F8', NULL, 'Framed-User', 'PPP', '192.168.10.255') (3) WISPSQL: SQL query returned: success (3) WISPSQL: -1 record(s) updated To disable insert i check if there is already a record for the same session IF NOT EXISTS(SELECT 1 FROM radacct WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}') To check true affected rows count i added an unlang statement in accounting section, it does not do anything but just to check if sql server returns true count: update control { Tmp-Integer-0 = "%{WISPSQL:SELECT @@ROWCOUNT}" } (3) EXPAND %{WISPSQL:SELECT @@ROWCOUNT} (3) --> 1 (3) Tmp-Integer-0 = 1 as seen it returns count as 1. I also checked affected rows count by freetds utility tsql and saw that it returns true values with select @@ROWCOUNT statement. I downloaded freeradius source code from gitHub to see if i can find anything about the way it gets affected rows count: the 2 methods in rlm_sql_freetds.c file related are: static int sql_num_rows(rlm_sql_handle_t *handle, UNUSED rlm_sql_config_t *config) { rlm_sql_freetds_conn_t *conn = handle->conn; CS_INT num; if (ct_res_info(conn->command, CS_ROW_COUNT, &num, CS_UNUSED, NULL) != CS_SUCCEED) { ERROR("rlm_sql_freetds: error retrieving row count"); return RLM_SQL_ERROR; } return num; } static int sql_affected_rows(rlm_sql_handle_t *handle, rlm_sql_config_t *config) { return sql_num_rows(handle, config); } the second being a recall of the first. Here ct_res_info method (cannot find its definition) returns affected_rows count, may be its a freetds library method or calling a method from library, and seems that that freetds library method does not do its job. Can't it be possible to use a direct call to sql server to get @@ROWSCOUNT by a select statment to get affected rows count? 2- Virtual Servers - nas_table Server Column Problem I want to use vertiaul servers and add specific clients to specific servers. And to do that i set Server columns of nas_table records with virtual server name for wich i want to attach. I encountered 2 problems with this method: 1 - Multiple clients cannot be added to the same virtual server, if tried get error like: rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql): Executing select query: SELECT Id, IPAddress, ShortName, 'other', Secret, ISNULL(Server, '') FROM nas WHERE IsActive = 1 rlm_sql (sql): Adding client 10.5.50.1 (home) to default clients list rlm_sql (10.5.50.1): Client "home" (sql) added rlm_sql (sql): Adding client 192.168.1.210 (citylight) to default clients list Failed to associate clients with virtual server default Failed to add client, possible duplicate? Although there is no other client with same Name (IPAddress) it cannot add second client. 2- If it gets an Access-Request it errors with "from unknown client" even if the client is added and same client works if it is made global, some lines from debug: rlm_sql (WISPSQL): Adding client 192.168.1.200 (orbitalanya) to WISPServer clients list rlm_sql (192.168.1.200): Client "orbitalanya" (WISPSQL) added Error with Access-Request: Ignoring request to auth address * port 2812 bound to server WISPServer from unknown client 192.168.1.200 port 49390 proto udp I attached debug output as file debug_VirtualServers.txt I got an answer from Mr. Alan DeKok on Wed, Jul 29 at 2:59 PM for my previous email for the same problem. >> I've pushed a fix. You can download the latest version of v3.0.x from gthub. Alan DeKok I have downloaded source https://github.com/FreeRADIUS/freeradius-server/archive/v3.0.x.zip and installed 3.0.22 but still get same error. Is it wrong version or do i do something wrong with configuration? Thanks.

2 2

RE: EAP-TLS Signature Check Failure
by Peter Bance 12 Aug '20

12 Aug '20

2 months later, a quick update on this topic (apologies, I may have broken the threading as I don't have a copy of the original e-mails any more!), just so there's an online reference here for anyone encountering the same error. Turns out I was wrong about it being Windows and OpenSSL getting muddled over TLS 1.2 vs. 1.3... To recap: Windows 10 clients, corporate WiFi network using EAP-TLS to RADIUS with machine certificate (SCEP) authentication only. Error in Freeradius logs: (6) eap_tls: ERROR: TLS Alert write:fatal:decrypt error tls: TLS_accept: Error in error (6) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read) (6) eap_tls: ERROR: error:0407E086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last octet invalid (6) eap_tls: ERROR: error:1417B07B:SSL routines:tls_process_cert_verify:bad signature (6) eap_tls: ERROR: System call (I/O) error (-1) (6) eap_tls: ERROR: TLS receive handshake failed during operation (6) eap_tls: ERROR: [eaptls process] = fail After encountering the error on a few machines again, even with "tls_max_version" set, I delved into the guts of Windows again, and found the error (which isn't helpful or descriptive) was actually caused because: * Some machine certificates had were stored/managed by the "Microsoft Platform Crypto Provider" (TPM-backed) * Built-in security measures control access to keys in that CSP, and it cannot be used non-interactively * Windows WiFi profile was set to auto-join (non-interactive) * Windows couldn't get the key, so $deity knows what signature it was sending * OpenSSL rightly got confused The solution: Ensure machine certificate keys are stored in the "Microsoft Software Key Storage Provider" (or another CSP/KSP that permits non-interactive use). All is well again, and I'm close to shutting down NPS :-) -- Peter Bance Information Security Adviser Alan DeKok wrote: > A final update on this, in case anyone here's interested (or to "wrap > up" for anyone stumbling across this thread online) - I fixed it, and > Windows clients are now happily joining WiFi. It's a beautiful thing to > behold :-) > > In the end, I had to force OpenSSL on FreeRADIUS to stop offering > TLS1.3 ciphers using the mods/eap config: > > tls_max_version = "1.2" Good to hear. > It seems there may be a bug in OpenSSL 1.1.1 such that even though the > negotiation resulted in a TLS 1.2 session, the weird back-port of TLS > 1.3 ciphers into TLS 1.2 confused things (a lot), and it tried checking > for TLS 1.3 style signatures inappropriately. Weird, but OK. It's OpenSSL :( Alan DeKok.

1 0

Windows 10 does not response EAP-Request/Identity from Switch after sucessfuly authentication of 802.1X
by luckydog xf 12 Aug '20

12 Aug '20

Hello, This may not be a question of Freeradius, but I post it here to see whether someone ran into the same issue before and found a way to fix it. We're running H3C switch, configure eap authentication, client is windows 10 and uses certificate authentication. Initially windows 10 can be online and soon after that it goes offline. By checking freeradius log, we can see that accounting Acct-Status-Type is Start and later becomes Stop. We use wireshark to capture packets of windows 10 and find that, after it's successfully online, Switch sends EAP-Request/Identity to it and expects a response. Yet windows 10 ignores it. Switch sends a 'Stop' to Freeradius when it's timeout. The whole process is listed http://www.h3c.com/en/Support/Resource_Center/Technical_Documents/Home/Swit… [ EAP relay ] section. 11. After the client comes online, the access device periodically sends handshake requests to check whether the client is still online. By default, if two consecutive handshake attempts fail, the device logs off the client. 12. Upon receiving a handshake request, the client returns a response. If the client fails to return a response after a number of consecutive handshake attempts (two by default), the access device logs off the client. This handshake mechanism enables timely release of the network resources used by 802.1X users that have abnormally gone offline. So it's quite weird, why does Windows 10 ignore it ? Appreciated for any help. Thanks.

1 1

MSCHAPV2 + OpenLDAP
by Клеусов Владимир Сергеевич 11 Aug '20

11 Aug '20

Hi Source data: OpenLDAP FreeRADIUS Version 3.0.21 I am trying to configure authentication via freeradius client VPN. Users in OpenLDAP . The problem is that the standard MacOS vpn client works via ms chap v2 (in the debut mode, I see the Client is using MS-CHAPv2). I would be grateful for help if someone had experience setting up in this configuration.

7 13

EXEC : possible to update pairs directly?
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 11 Aug '20

11 Aug '20

Hi all, Just researching possibilities to help me around the upgrades I need to do to move from old operating systems and FR3.1. I tried v4 for a while, and may go back to that, but am struggling with the exec module race condition - the dilemma is that I can't spend too long redoing what we used to do in exec. I've gone back to v3.0.22 to see what I can do there, but missed the SQL maps bit quite a bit so have do a few quick tests to see what I can achieve in the exec module, expanding my knowledge as it were. The following url contains an example that would be useful, but I can't get it working in 3.0.22 : https://stackoverflow.com/questions/26442693/freeradius-reading-attributes-… In the example Arran says : "Version 3 supports attribute assignment similar to what you've posted, but it'd be: update { control: += `/usr/bin/php -f /web/auth.php '%{NAS-Identifier} %{Calling-Station-Id}'` } Then modify your script output to be: Auth-Type = Accept reply:WISPr-Bandwidth-Max-Up = xxx .. " The key question is the inclusion of "reply:" attribute in an update { control : } section - it would be useful to be able to update any pairs via exec, not just the control (in this example), as you can do directly via Update [ Reply:reply-message := .. Control:auth-type := .. } When I try the example above, FR 3.0.22 can't parse the output: ERROR: Failed parsing output from: /usr/bin/php -f /etc/freeradius/sql_active_device_check_accounting.php -- '--hostname %{control:Hostname} --username %{request:User-Name} --nasipaddress %{request:NAS-IP-Address} --nasport %{request:NAS-Port} --macaddresslimit %{%{control:MacAddressLimit}:-0}': Expecting operator (0) ERROR: Program returned code (0) and output 'Auth-Type = Accept,reply:WISPr-Bandwidth-Max-Up = 123' It works if removing the reply: specifier from the "reply:WISPr-Bandwidth-Max-Up", i.e. Program returned code (0) and output 'Auth-Type = Accept,WISPr-Bandwidth-Max-Up = 123' (0) control::Auth-Type = Accept (0) control::WISPr-Bandwidth-Max-Up = 123 It's not the end of the world to have to copy the attributes from one "set" to another, but was hoping to be a bit cleaner if possible. IT's possible I just don't have the right syntax. Also happy taking advice on how best to replicate sql maps and attribute pair functionality best, possibly in python or perl I suppose, although those seem more "fixed" at a glance than exec. Thanks! Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 2

Is it possible to specify which authorization mode is being used?
by Kristian Faller 10 Aug '20

10 Aug '20

Hi everyone, I am brand new to FreeRadius so please excuse me for what could be a simple question with a simple answer. Is it possible to specify which authentication mode and tunnel type are being used? If yes, what files do I need to modify in order to do this? I have tried reading the documentation and looking through some of the config files, but as a complete beginner at this, I'm not sure if I'm even looking in the right places. Background: I work with software testing for reMarkable (we create an E ink tablet based on Linux), and we want to conduct more specified testing on WPA Enterprise (802.1X over Wi-Fi). At the moment we have done testing on our network gear which consists of Ubiquiti Unifi which only implements eap_peap with MSCHAPv2. While this is probably used for many companies all over the world, we would like to test other kinds of authentication and tunnel types, thus I started setting up FreeRadius on a Raspberry Pi 4, running Ubuntu 19.10 for IoT devices. Our tablet runs a flavor of Linux, using wpa_supplicant and should (in theory) be able to connect to most kinds of network. However, we know that certificate-based networks won't work at the moment due to not having a way to import licenses. However, I do believe there are other types of networks not needing certificates, and these are the ones we'd like to test. I got FreeRadius up and running, but for every connection attempt, I can see from the output with "freeradius -X" that eap_peap and MSCHAPv2 are used. I want to be able to set specific (valid) values so that our company can implement and properly test the different variations of auth modes and tunnels. I have also attached the (entire) output from 'freeradius -X'. If I miss any details or lack some information in my above text, please let me know, and I'll make sure to clarify/elaborate. Forhåndsvis vedlegget freeradius -x.txt freeradius -x.txt 85 KB <https://mail.google.com/mail/u/0?ui=2&ik=beb323e764&attid=0.1&permmsgid=msg…> -- *Kristian Faller* QA Engineer kristian.faller(a)remarkable.com +47 908 06 444 <+4790806444> Biermanns gate 6, 0473 Oslo, Norway <https://goo.gl/maps/YU24JR1ZYQM2> remarkable.com [image: cid:85D31282-3FFB-4F74-B5D9-6CB7ED4003E7] The privileged confidential information contained in this email is intended for use only by the addressees as indicated by the original sender of this email. If you are not the addressee indicated in this email or are not responsible for delivery of the email to such a person, please kindly reply to the sender indicating this fact and delete all copies of it from your computer and network server immediately. Your cooperation is highly appreciated. It is advised that any unauthorized use of confidential information of REMARKABLE AS is strictly prohibited.

2 2

rlm_ldap fails but ldapsearch works
by Victor 08 Aug '20

08 Aug '20

Hello, I'm trying to check whether a user belongs to a group or not: (0) if (LDAP-Group == "someusers") { (0) Searching for user in group "someusers" rlm_ldap (ldap): Reserved connection (6) (0) Using user DN from request "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" (0) Checking for user in group objects (0) EXPAND (&(cn=someusers)(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local)))) (0) --> (&(cn=someusers)(|(&(uid=common_user)(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local)))) (0) Performing search in "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" with filter "(&(cn=someusers)(|(&(uid=common_user)(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local))))", scope "sub" (0) Waiting for search result... (0) Search returned no results (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local", scope "base" (0) Waiting for search result... (0) No group membership attribute(s) found in user object rlm_ldap (ldap): Released connection (6) but ldapsearch -b "dc=domain,dc=local" "(&(cn=someusers)(member=uid\3dcommon_user\2ccn\3dusers\2ccn\3daccounts\2cdc\3ddomain\2cdc\3dlocal))" -D uid=common_user,cn=users,cn=accounts,dc=domain,dc=local -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: (&(cn=someusers)(member=uid\3dcommon_user\2ccn\3dusers\2ccn\3daccounts\2cdc\3ddomain\2cdc\3dlocal)) # requesting: ALL # # someusers, groups, accounts, domain.local dn: cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject description: Default group for all users cn: someusers ipaUniqueID: ebca3046-a5a0-11ea-8166-9a6e275fb41f member: uid=common_user,cn=users,cn=accounts,dc=domain,dc=local member: uid=very_special_user,cn=users,cn=accounts,dc=domain,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 and ldapsearch -b "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" -D uid=common_user,cn=users,cn=accounts,dc=domain,dc=local -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=common_user,cn=users,cn=accounts,dc=domain,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # common_user, users, accounts, domain.local dn: uid=common_user,cn=users,cn=accounts,dc=domain,dc=local displayName: utilisateur banal uid: common_user krbCanonicalName: common_user(a)DOMAIN.LOCAL objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson objectClass: inetuser objectClass: posixaccount objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipasshuser objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry objectClass: ipauserauthtypeclass loginShell: /bin/bash initials: ub gecos: utilisateur banal sn: banal homeDirectory: /home/common_user mail: common_user(a)domain.local krbPrincipalName: common_user(a)DOMAIN.LOCAL givenName: utilisateur cn: utilisateur banal ipaUniqueID: some_unique_ID uidNumber: theSameNumber gidNumber: theSameNumber krbPasswordExpiration: the_pass_exp krbLastPwdChange: the_pass_exp memberOf: cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local memberOf: cn=manyemoreusers,cn=groups,cn=accounts,dc=domain,dc=local ipaUserAuthType: o_type ipaSshPubKey: some_pubkey # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Some of the configuration: /etc/raddb/sites-enabled/default ... user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = 'uid=common_user,cn=users,cn=accounts,dc=domain,dc=local' scope = 'sub' membership_filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..ldapgroup})))" membership_attribute = 'memberOf' } /etc/raddb/mods-enabled/ldap ... post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } if (LDAP-Group == "someusers") { update { reply:Class := "OKOKOKOKOK" } } else { update { reply:Class := "NONONONONO" } } } Where to go from here? Kind regards

4 9

Accounting-Packets from Huawei NAS randomly not being written to the database
by Antônio Modesto 08 Aug '20

08 Aug '20

Hello everyone, I have some radius servers configured to use decoupled-accounting to avoid overwhelming the database with real-time writes. In all of them I am having the same problem. Some accounting packets sent from Huawei devices are not being written to the database. I have set up a second detail log file to check if the packets were being sent by the NAS. For example: Packet received from the NAS, stored in the second detail file: Fri Aug 7 08:54:43 2020 User-Name = "andersonoliveira" NAS-Port = 3162917 NAS-IP-Address = X.X.X.X Framed-IP-Address = 100.64.218.153 NAS-Identifier = "TI5-BRAS01" Acct-Status-Type = Stop Acct-Delay-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Session-Id = "TI5-BRA00304080500000a598ccAAADbA" Acct-Authentic = RADIUS Acct-Session-Time = 200 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Terminate-Cause = Lost-Carrier Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Event-Timestamp = "Aug 7 2020 08:54:43 -03" NAS-Port-Type = Ethernet Calling-Station-Id = "58:10:8c:07:48:8f" NAS-Port-Id = "slot=0;subslot=3;port=4;vlanid=805;" Service-Type = Framed-User Framed-Protocol = PPP Connect-Info = "1300000/1000000" Idle-Timeout = 0 Session-Timeout = 0 Huawei-IPHost-Addr = "100.64.218.153 58:10:8c:07:48:8f" Huawei-Input-Peak-Rate = 1000000 Huawei-Input-Peak-Rate = 1000000 Huawei-Input-Average-Rate = 1000000 Huawei-Output-Peak-Rate = 1300000 Huawei-Output-Average-Rate = 1300000 Huawei-Priority = 15 Huawei-Connect-ID = 13206 Huawei-Domain-Name = "provedor_pppoe" Huawei-Accounting-Level = 0 Huawei-Up-Priority = 15 Huawei-Down-Priority = 15 Huawei-Acct-IPv6-Input-Octets = 0 Huawei-Acct-IPv6-Output-Octets = 0 Huawei-Acct-IPv6-Input-Packets = 0 Huawei-Acct-IPv6-Output-Packets = 0 Huawei-Acct-IPv6-Input-Gigawords = 0 Huawei-Acct-IPv6-Output-Gigawords = 0 Huawei-User-Mac = "58:10:8c:07:48:8f" Huawei-Acct-Update-Address = 0 Huawei-Input-Burst-Size = 625000 Huawei-Output-Burst-Size = 812504 Huawei-Input-Peak-Burst-Size = 625000 Huawei-Output-Peak-Burst-Size = 812504 Timestamp = 1596801283 Record in the redacct table: -[ RECORD 5 ]-------+---------------------------------- username | andersonoliveira acctsessionid | TI5-BRA00304080500000a598ccAAADbA acctstarttime | 2020-08-07 08:51:23-03 acctlocalupdatetime | 2020-08-07 08:51:23-03 acctstoptime | As you can see, neither acctlocalupdatetime or acctstoptime were updated with the correct timestamps from the packet received by the NAS. I checked the logs and I couldn’t find any error message related to this. As the server is in production, enabling the debug creates a lot of output. The only thing I think could be causing this is this condition I have in my accounting section: if (noop) { ok } What do you guys suggest? Thanks in advance.

2 5

How to bind Freeradius outbound traffic to a network interface?
by kesavan km 07 Aug '20

07 Aug '20

Hi, With Freeradius Virtual-server construct, there is a possibility to select a Virtual-server instance based on a network interface (eth0 vs wlan0). But when Virtual-server-eth0 uses an LDAP, is it possible to bind the outgoing LDAP requests to eth0 and likewise, outbound LDAP requests initiated from Virtual-server-wlan0 to be bound to wlan0? For example, - Server hosting Freeradius has 3 interfaces Eth0, wlan-corp, wlan-misc - VS-wlan-corp - listening on interface "wlan-corp" --- loads module ldap-wlan-corp: LDAP_IP_X (Reachable only via wlan0) - VS-wlan100 - listening on interface wlan100 --- loads module ldap-wlan100: LDAP_IP_Y (Reachable only via wlan100) Above LDAP is just an example, same holds true for AD, proxy or any outbound communication initiated by Freeradius. Thanks, Kesavan

1 0