November 2021 - Freeradius-Users - lists.freeradius.org

Problem with limiting users to group in Active Directory
by Erik Frangež 28 Nov '21

28 Nov '21

Hi guys, I am having problems with configuring Radius authentication limiting users to group in Active directory. Here is configuration of LDAP: ldap ldap1 { server = "Server" port = 389 identity = DOMAIN\user password = "password" basedn = "ou=OU,dc=domain,dc=dc,dc=dc" filter = "(sAMAccountName=%{User-Name})" groupmembership_filter = "(member=%{control:Ldap-UserDn})" groupmembership_attribute = "memberOf" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 user { filter = "(sAMAccountName=%{User-Name})" scope = "sub" base_dn = "ou=OU,dc=domain,dc=dc,dc=dc" access_positive = yes rebind = yes chase_referrals=yes } group { base_dn = "ou=OU,dc=domain,dc=dc,dc=dc" filter = "(sAMAccountName=%{User-Name})" scope = 'sub' membership_filter = "(member=%{control:Ldap-UserDn})" membership_attribute = 'memberOf' } tls { start_tls = no ca_file = "/etc/openldap/certs/ldap_certs.pem" require_cert = "demand" } dictionary_mapping = ${confdir}/ldap.attrmap keepalive { idle = 60 probes = 3 interval = 3 } } Policy: check_ldap_group_vpn { if (&ldap1-LDAP-Group[*] == "CN=group,OU=Groups,OU=OU,OU=OU,DC=DOMAIN,DC=DC,DC=DC") { ok } else { reject } } In sites-enabled for radius, I have specify this: authorize { suffix guard_vpn_file Autz-Type LDAPS-VPN { redundant { ldap1 ldap2 } check_ldap_group_vpn expiration } } Authentication is not working. Here are logs: rlm_ldap (ldap1): Reserved connection (0) (392) ldap1: EXPAND (sAMAccountName=%{User-Name}) (392) ldap1: --> (sAMAccountName=user) (392) ldap1: Performing search in "ou=ou,dc=domain,dc=dc,dc=dc" with filter "(sAMAccountName=user)", scope "sub" (392) ldap1: Waiting for search result... (392) ldap1: User object found at DN "..." rlm_ldap (ldap1): Released connection (0) (392) [ldap1] = ok (392) } # redundant = ok (392) policy check_ldap_group_vpn { (392) if (&ldap1-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") { (392) Searching for user in group "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" rlm_ldap (ldap1): Reserved connection (0) (392) Using user DN from request "CN=user" rlm_ldap (ldap1): Released connection (0) (392) User is not a member of "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" (392) if (&ldap1-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") -> FALSE (392) elsif (&ldap2-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") { (392) Searching for user in group "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" rlm_ldap (ldap2): Reserved connection (0) (392) Using user DN from request "CN=user" rlm_ldap (ldap2): Released connection (0) (392) User is not a member of "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" (392) elsif (&ldap2-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") -> FALSE (392) else { (392) [reject] = reject (392) } # else = reject (392) } # policy check_ldap_group_vpn = reject (392) } # Autz-Type LDAPS-VPN = reject User is member of group. Same configuration we are having for other domain and its working. Thank you for any advise! Best, Erik

2 1

Freeradius 3.0.22 - mssql - Schema
by Clive Allen 28 Nov '21

28 Nov '21

Hi, I noticed that the mssql schema does not include a "nas" section that the "mysql" contains as follows: CREATE TABLE IF NOT EXISTS nas ( id int(10) NOT NULL auto_increment, nasname varchar(128) NOT NULL, shortname varchar(32), type varchar(30) DEFAULT 'other', ports int(5), secret varchar(60) DEFAULT 'secret' NOT NULL, server varchar(64), community varchar(50), description varchar(200) DEFAULT 'RADIUS Client', PRIMARY KEY (id), KEY nasname (nasname) ); I have converted this to "mssql" staments and created the nas table. However, the radtest that has proved successful does not seem to take any of the nas table entries but does take the username. For example, if I use the following inputs into the "nas" table: Server = <freeradius box> Shortname = <ServerName> Secret = secret User details: clive test123 := Cleartext-Password And then I utilise radtest as follows: radtest clive test123 localhost 1812 secret ---- I can try any combination here of localhost, IP address or name and get the same result. It does not even pass to mssql (no response at all). However, if I use the following: radtest clive test123 localhost 1 testing123 I get an access-accept. So, my question is - Does mssql with freeradius accept a "nas" table please?

1 1

rlm_sql_unixodbc: Errors
by Clive Allen 27 Nov '21

27 Nov '21

Hi Alan, Many apologies for not responding to your response to my issue. It was excellent that you responded so quickly. I have resolved the issue and mailing here so it will be available if anyone else has the same problem. For some reason, and unsure why, after following Microsofts installation process for the unix and ms - odbc drivers and then following the freeradius instructions for odbc installation it looked like the drivers were not present when running radius -X (even though unixodbc and msodbc were there afetr confirming). The way the issue was resolved was by completing the following: yum list freeradius-* We get the following appearing in the list: freeradius-unixODBC.x86_64 yum install freeradius-unixODBC.x86_64 I restarted mssql-server as a precaution and then ran radiusd -X and everything worked. I completed a radtest and got successful accept packet returned. Thank you for you help Alan. Very much appreciated. I do have another question but will ask that in a separate mail. Thank you again.

1 0

Proxy
by Nicolas Breuer 25 Nov '21

25 Nov '21

Hello, According to the doc https://wiki.freeradius.org/config/Proxy ......... * he remote server replies with ACK or REJECT * On ACK: The initial Auth-Type is set to Accept * On REJECT: The initial Auth-Type is set to Reject * Then the users file is processed as usual. The username used at this point is the one after hints file processing (regardless of the "hints" option). It also includes the realm (regardless of the setting of the "nostrip" option) unless the realm is LOCAL. ........... Waking up in 0.3 seconds. (0) Marking home server 217. port 1649 alive (0) Clearing existing &reply: attributes (0) Received Access-Accept Id 112 from NAS (0) Service-Type = Framed-User (0) Cisco-AVPair = "ip:vrf-id=BEXX" (0) Cisco-AVPair = "ip:ip-unnumbered=Loopback22" (0) Framed-IP-Netmask = 255.255.255.255 (0) Proxy-State = 0x3936 (0) Framed-IP-Address = ZZZ (0) Session-Timeout = 172800 (0) server dsl { (0) # Executing section post-proxy from file /etc/raddb/config/... (0) post-proxy { (0) post_proxy_log: --> Thu Nov 25 14:48:24 2021 (0) [post_proxy_log] = ok (0) attr_filter.post-proxy: EXPAND %{Realm} (0) attr_filter.post-proxy: --> BE (0) attr_filter.post-proxy: Matched entry DEFAULT at line 106 (0) [attr_filter.post-proxy] = updated (0) } # post-proxy = updated (0) } (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/raddb/config/ (0) post-auth { (0) if (&reply:Subscription-Name=="PRO"){ (0) ERROR: Failed retrieving values required to evaluate condition (0) if (&reply:Subscription-Name=="NOSERVICE"){ (0) ERROR: Failed retrieving values required to evaluate condition (0) elsif (&reply:Subscription-Name != '') { (0) ERROR: Failed retrieving values required to evaluate condition (0) update reply { (0) Service-Type := Framed-User (0) Framed-IP-Netmask := 255.255.255.255 (0) } # update reply = noop (0) if (reply:Framed-IP-Address) { (0) if (reply:Framed-IP-Address) -> FALSE (0) else { (0) update reply { (0) Session-Timeout = 172800 (0) } # update reply = noop (0) } # else = noop (0) } # post-auth = noop (0) Login OK: [BCtest@BXXX] (from client test port 0) (0) Sent Access-Accept Id 96 from (0) Framed-IP-Netmask := 255.255.255.255 (0) Service-Type := Framed-User (0) Session-Timeout = 172800 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 96 with timestamp +8 Ready to process requests In users I have a match before the proxy (0) [suffix] = updated (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 54 (0) auth_dsl: users: Matched entry DEFAULT at line 79 (0) [auth_dsl] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop But this is not applied at all after the accept.... Any ideas ?

2 8

rlm_sql_unixodbc: Driver Link failure when running radiusd -X
by Clive Allen 25 Nov '21

25 Nov '21

Hello all, Firstly, my apologies if this is not freeradius related but am hoping someone may have seen this before or could point me in the right direction please: I am trying to connect to an mssql database with freeradius on redhat. When running radiusd -X I am getting the following readout (error): Nov 25 13:40:27 rhmssql1 radiusd[7698]: Creating attribute Unix-Group Nov 25 13:40:27 rhmssql1 radiusd[7698]: Could not link driver rlm_sql_unixodbc: /usr/lib64/freeradius/rlm_sql_unixodbc.so: cannot open shared object file: No such file or directory Nov 25 13:40:27 rhmssql1 radiusd[7698]: Make sure it (and all its dependent libraries!) are in the search path of your system's Nov 25 13:40:27 rhmssql1 radiusd[7698]: /etc/raddb/mods-enabled/sql[27]: Instantiation failed for module "sql" Nov 25 13:40:27 rhmssql1 systemd[1]: radiusd.service: control process exited, code=exited status=1 Nov 25 13:40:27 rhmssql1 systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. -- Subject: Unit radiusd.service has failed I have checked the directory /usr/lib64/freeradius/ and sure enough the file rlm_sql_unixodbc.so does not exist there. I have tested with isql -v rhmssql1 radius radPass_123 and that works fine. I can also access the DB with either radius or SA. I have configured /etc/odbc.ini with the following: [rhmssql1] Driver = ODBC Driver 17 for SQL Server Description=My DSN for the FreeRADIUS Database Database = radius Server = tcp:192.168.56.167,1433 The Driver section in here should then point to the relevant part in odbcinst.ini which is configured as follows: [ODBC Driver 13 for SQL Server] Description=Microsoft ODBC Driver 13 for SQL Server Driver=/opt/microsoft/msodbcsql/lib64/libmsodbcsql-13.1.so.9.2 UsageCount=1 [ODBC Driver 17 for SQL Server] Description=Microsoft ODBC Driver 17 for SQL Server Driver=/opt/microsoft/msodbcsql17/lib64/libmsodbcsql-17.8.so.1.2 UsageCount=1 I have checked the locations as follows: [root@rhmssql1 lib64]# ldd /opt/microsoft/msodbcsql17/lib64/libmsodbcsql-17.8.so.1.2 linux-vdso.so.1 => (0x00007ffd793f3000) libdl.so.2 => /lib64/libdl.so.2 (0x00007fc7c12fa000) librt.so.1 => /lib64/librt.so.1 (0x00007fc7c10f2000) libodbcinst.so.2 => /lib64/libodbcinst.so.2 (0x00007fc7c0ed8000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007fc7c0bef000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007fc7c09a2000) libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007fc7c069a000) libm.so.6 => /lib64/libm.so.6 (0x00007fc7c0398000) libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fc7c0182000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fc7bff66000) libc.so.6 => /lib64/libc.so.6 (0x00007fc7bfb98000) /lib64/ld-linux-x86-64.so.2 (0x00007fc7c190a000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007fc7bf965000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007fc7bf761000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007fc7bf551000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007fc7bf34d000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007fc7bf133000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fc7bef0c000) libpcre.so.1 => /lib64/libpcre.so.1 (0x00007fc7becaa000) I have ensured that the link is correct with: [root@rhmssql1 lib64]# odbcinst -q -d -n "ODBC Driver 17 for SQL Server" [ODBC Driver 17 for SQL Server] Description=Microsoft ODBC Driver 17 for SQL Server Driver=/opt/microsoft/msodbcsql17/lib64/libmsodbcsql-17.8.so.1.2 UsageCount=1 I have also followed the excellent process doument at https://wiki.freeradius.org/modules/Rlm_sql_unixodbc and everything works as should except the very last stage (start up of freeradius). Excuse my picking up on this as it is a typo I expect - but in there you have labelled port "1443" under the DSN (Section 4:Server = tcp:192.0.2.1, 1443 and suspect you meant 1433). In the /etc/raddb/mods-available - I completed the following changes: sql { dialect = "mssql" driver = "rlm_sql_unixodbc" # driver = "rlm_sql_${dialect}" # Connection info: # server = "rhmssql1" port = 1433 login = "radius" password = "radPass_123" Again, many apologies if the answer to this is obvious (which I know it is from the error) but this e-mail has been a last resort. There are articles on the wiki but they are from 2007 and 2008. I have completed a "find" for the named file and cannot find it "find / -name "*rlm_sql*" Thank you for any pointers.

2 1

detail file locking
by Thor Spruyt 25 Nov '21

25 Nov '21

Hi, Using freeradius 3.0.25 on centos 7 I have a configuration with a "detail" module writing to a file with locking = yes I have a type = detail listener on that same file. Under some load, apparantly, very sporadically a packet seems to gets lost. Am I correct to say that with locking = yes , there should never be any packet lost due to the reader renaming the file while the writer is writing to it ? How would be a good approach to further troubleshoot this ? -- Regards, Thor

2 12

(no subject)
by Giedrius Baronas 24 Nov '21

24 Nov '21

Hi, I read a manual about comparisons. If I write IP without network mask then it works but if IP with mask I get error Maybe who sees where I make a mistake? >From https://freeradius.org/radiusd/man/unlang.txt Comparisons (foo == bar) Compares 'foo' to 'bar', and evaluates to true if the comparison holds true. Valid comparison operators are "==", "!=", "<", "<=", ">", ">=", "=~", and "!~", all with their usual meanings. The operators ":=" and "=" are assignment oper- ators, and are not allowed for comparisons. The operators "<", "<=", ">", and ">=" are also allowed for checking that an IP address is contained within a network. For example: if (<ipaddr>192.0.2.1 < 192.0.2.0/24) { This com- parison succeeds, because the address 192.0.2.1 is contained within the network 192.0.2.0/24. My debug: Wed Nov 24 21:35:27 2021 : Debug: (1) if ( <ipaddr>NAS-IP-Address == 192.0.2.0/24 ){Wed Nov 24 21:35:27 2021 : ERROR: (1) Failed casting rhs operand: Invalid IPv4 mask length "/24". Only "/32" permitted for non-prefix typesWed Nov 24 21:35:27 2021 : ERROR: (1) Failed retrieving values required to evaluate condition -- Pagarbiai, Giedrius 861569551

2 2

FreeRADIUS modules python vs python3
by Jonathan Davis 24 Nov '21

24 Nov '21

I am looking to better understand the python modules under FreeRADIUS. My initial assumption was rlm_python was for 2.7.x and rlm_python3 was for 3.x. However I am confused about the information at https://freeradius.org/modules/ - rlm_python3 is listed as obsolete with the view documentation link taking you to https://networkradius.com/doc/current/raddb/mods-available/home.html where there is neither python or python3 - rlm_python is listed as not obsolete, with "Allows the server to call a persistent, embedded Python script." Installed FreeRADIUS 3.0.25 from the networkRADIUS packages at https://networkradius.com/packages/ In the FreeRADIUS dir, I see there is both python and python3 under mods-available, and under mods-config only a python dir Was rlm_python3 made obsolete as 2.7 was EOL back in Jan of 2020 and everything is now simply under rlm_python? Looking at the latest examples on https://github.com/FreeRADIUS/freeradius-server/blob/master/src/modules/rlm… I see both example.py and prepaid.py look to be executed as python3, both have #! /usr/bin/env python3 in their headers: Create the symlink in mods-enabled/python to mods-available/python and try with the example provided, which works, then I switch it over to my own script, start radiusd -Xx and get the following error: Tue Nov 23 16:02:41 2021 : Info: Python version: 2.7.18 (default, Oct 11 2021, 11:39:27) [GCC 8.5.0 20210514 (Red Hat 8.5.0-3)]a Tue Nov 23 16:02:41 2021 : Error: python_function_load - Module 'dr_yubikey' not found Tue Nov 23 16:02:41 2021 : Error: <type 'exceptions.ImportError'> (No module named requests) Tue Nov 23 16:02:41 2021 : Error: [0] /etc/raddb/mods-config/python/dr_yubikey.py:13 at <module>() Tue Nov 23 16:02:41 2021 : Error: python_function_load - Failed to import python function 'dr_yubikey.authorize' Tue Nov 23 16:02:41 2021 : Error: /etc/raddb/mods-enabled/python[9]: Instantiation failed for module "python" I'm aware the above is failing because requests can't be imported, but request is installed under python3, and that first info line is not python3, but Python 2.7.18 ? python2 pip install requests does get me to Tue Nov 23 16:19:55 2021 : Info: Ready to process requests when starting debug. Trying with python3 symlinked in mods-enabled, and creating mods-config/python3 and dropping my .py in there: Tue Nov 23 17:02:11 2021 : Error: /etc/raddb/mods-enabled/python3[9]: Failed to link to module 'rlm_python3': /usr/lib64/freeradius/rlm_python3.so: cannot open shared object file: No such file or directory Which is true, there is no rlm_python3.so that exists under /usr/lib64/freeradius/ Are my assumptions wildly incorrect or am I missing something super obvious? Thank you, Jonathan

3 3

sql ip pool module assign IP 0.0.0.0 to users
by Mirko Alberio 24 Nov '21

24 Nov '21

Hello! We have the following problem: When many of out NAS (which are Wireless PPPOE POPs) that are Mikrotik based are rebooted (for maintanance, updates or maybe outages) and then simultaneously connect to our Freeradius instance to authenticate again we are experiencing the following rows in the logs: Thu Nov 18 06:25:06 2021 : Error: Received conflicting packet from client OpenFiber port 50242 - ID: 114 due to unfinished request. Giving up on old request. Thu Nov 18 06:25:06 2021 : Error: Received conflicting packet from client port 33577 - ID: 70 due to unfinished request. Giving up on old request. Thu Nov 18 06:25:06 2021 : Error: Received conflicting packet from client port 37882 - ID: 21 due to unfinished request. Giving up on old request. Thu Nov 18 06:25:06 2021 : Error: Received conflicting packet from client port 50131 - ID: 95 due to unfinished request. Giving up on old request. Thu Nov 18 06:25:06 2021 : Error: Received conflicting packet from client port 40360 - ID: 211 due to unfinished request. Giving up on old request. Thu Nov 18 06:25:06 2021 : WARNING: (8349606) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349607) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349608) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349609) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349610) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349605) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349611) WARNING: Module rlm_sql became unblocked ... etc ... And the customers PPPOE sessions are getting an assigned IP = 0.0.0.0 instead of one of the IP pool. If we disconnect those sessions proprerly and let them authenticate again the problem is fixed. We have some doubts that this could happen because the POPs are not sending the correct AccTerminate packets when rebooting, so it is not freeing up the pools. And also those sessions are not recognized as active because we are using NAS PORT ID as pool key and it changes, maybe would be better tu user the Mac Address as key? A final note: our IP pool is nearly exhausted, we have about 30 free IPs. Could this also give problems? Thanks. -- Mirko Alberio - Assistenza tecnica e-mail: mirko.alberio(a)telemar.it Telemar SpA Internet Quality Provider Via Enrico Fermi, 235 - 36100 Vicenza - Italia Tel 0444 291302 - Fax 0444 566310 - www.telemar.it Assistenza tecnica 0444 1420000 Reg. Imp. Di Vicenza /C.F./P.I. 02508710247 Cap. Soc. € 120.000,00 I.V. R.E.A. VI-236292

2 5

Design strategies for preventing fraudulent logins across multiple sites
by Network RADIUS 24 Nov '21

24 Nov '21

** Preventing fraudulent logins across multiple sites --------------------------------------- When an ISP has RADIUS servers across multiple sites, new attacks are possible. Users can share account information with their friends, who can then log in separately to each site. If the RADIUS system design does not take this problem into account, users can defraud the ISP of significant revenue. One solution is to post-process the user sessions. The system can check hourly, or daily, if the same user is logged in at multiple sites. If the user is found to have multiple logins, they can be kicked offline, blocked, or even banned from the network. This solution works, but is not always the best one for every situation. Another solution is to not only track user sessions at each site, but to do cross-site checks for user logins. In this approach, each site will dynamically check every other site when a user logs in. As one might expect, there are costs and benefits to this approach. This article describes why this approach may be useful, how it is done, and what are the pros and cons. Read the full article… https://networkradius.com/articles/2021/02/10/preventing-fraudulent-logins-… <https://networkradius.com/articles/2021/02/10/preventing-fraudulent-logins-…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/request/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0