August 2021 - Freeradius-Users - lists.freeradius.org

trying to override the pam_auth attribute
by Jonathan Davis 27 Aug '21

27 Aug '21

I'm trying to override the pam_auth attribute which is set in: mods-enabled/pam In that file I read the following note: # Note that any Pam-Auth attribute set in the 'authorize' # section will over-ride this one. I've tried adding it to the authorize section of a virtual-server but get the following error when starting freeradius -X server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} /etc/freeradius/3.0/sites-enabled/default[329]: Entry is not a reference to a module /etc/freeradius/3.0/sites-enabled/default[283]: Errors parsing authorize section. The only other authorize I could think of which might be the authorize section referenced is: mods-config/files/authorize But not sure how to add it, as it's not a check item for a user, and I don't want to set it as a default? End goal is based on clients, change the pam_auth to load different /etc/pam.d/ files that specify different yubikey_mappings files. Thank you, JOnathan

3 11

radippool and expiry time
by Mirko Alberio 27 Aug '21

27 Aug '21

Hi! We have this "issue": - Our NAS are correctly configured with 10 minutes Interim-Update - Radius has 1h lease time for radippool module all is working fine but when simulating a NAS outage, for example it becomes disconnected from our network, IPs allocated from PPPOE users on that nas remain allocated even if expiry time is expired. Then when NAS comes back the expiry time is updated and all works fine, but our doubt is if this behaviour is intended or there is some other configuration our side: I expect that if an allocation expires because no interim update is received (and no accounting-stop is received because the NAS is not communicating) allocation should be freed, right? Thanks! -- Mirko Alberio - Assistenza tecnica e-mail: mirko.alberio(a)telemar.it Telemar SpA Internet Quality Provider Via Enrico Fermi, 235 - 36100 Vicenza - Italia Tel 0444 291302 - Fax 0444 566310 - www.telemar.it Assistenza tecnica 0444 1420000 Reg. Imp. Di Vicenza /C.F./P.I. 02508710247 Cap. Soc. € 120.000,00 I.V. R.E.A. VI-236292

2 3

Freeradius forum
by Jahans Solutions 27 Aug '21

27 Aug '21

Hi I am just wondering what happen to the forum? Its being down for a while. It was a great resources for the users. Any idea when it will be back! Thanks

3 4

Configurations for proxying radius requests to home-server using TCP
by Abhilash Y G 26 Aug '21

26 Aug '21

Proxying to homeserver using a TCP connection is causing issue. I am seeing the response from the homeserver, it seems like freeradius running on proxy server is not honoring the response. I have attached the debug logs collected on the proxying server (debug_proxy_server.txt), homeservers (debug_homeserver.txt). I had to trim the logs to focus on issue logs due to limitation in sending attachments more than 500KB. Please advise if any configuration changes are needed on the proxying server to handle the requests without timeouts. Please note, all the homeservers are running freeradius. Regards, Abhilash

2 1

Override/set Current-Time for rlm_logintime testing
by Jason Healy 26 Aug '21

26 Aug '21

I'm working on using rlm_logintime to enforce time of day logins for certain users. I'm also building some radclient packets that I can use to test different time boundaries to make sure my policies are correct. However, logintime looks like it's always using the packet arrival time to do its calculations (understandably; there's no other reliable source). Is there any way to override the packet arrival time, through an attribute or function? I tried setting Packet-Original-Timestamp with no luck. I also tried setting Current-Time, but that looks like a kind of virtual attribute that can be checked (against simple time strings), but not printed or assigned directly. Thanks for any clarification, Jason

2 1

attr_nas_filter_rule for VSA Alc-Nas-Filter-Rule-Shared
by Jan 'yanek' Bortl 25 Aug '21

25 Aug '21

Hello, we just discovered that latest version of Freeradius has support [1] for RFC4849 like mangling attribute NAS-Filter-Rule. We woud like enable this mangling also for VSA attribute Alc-Nas-Filter-Rule-Shared [2]. Is that somehow possible? [1] https://github.com/FreeRADIUS/freeradius-server/commit/36d045a464090893eea5… [2] https://github.com/FreeRADIUS/freeradius-server/pull/1160 -- Jan 'yanek' Bortl <yanek [at] yanek. cz> http://yanek.cz/ ----------------------------------------------------------------- "Maybe one day you will learn that your way is not the only way." Opher [StarGate: The Nox]

2 1

802.1X - ntlm, Secure LDAP and dynamic vlan
by Ray Burquest 25 Aug '21

25 Aug '21

Hi, I am setting up a pilot for 802.1X with dynamic VLAN assignment based on the domain of the user attempting to connect to the switch. Users will be authenticated through different means depending on their domain ie user(a)domainA.com<mailto:user@domainA.com> = ntlm user(a)domainB.com<mailto:user@domainB.com> = Secure LDAP unrecognised domain = default guest VLAN I have got ntlm authentication and Secure LDAP authentication working independently but I would like some guidance as to how and where I configure the selection process and then then how to return the VLAN information Thanks Ray Burquest Consultant Respiro Pty Ltd m: +61 466 557 149 e: rburquest(a)respiro.com.au<mailto:rburquest@respiro.com.au>

2 3

Config Issue
by Adam Taylor 23 Aug '21

23 Aug '21

Hey All, I have gone around and around with our FreeRadius server and I am at a lost for what is going on. The server at some point is replacing the username(a)ulm.edu<mailto:username@ulm.edu> (or username(a)warhawks.ulm.edu<mailto:username@warhawks.ulm.edu>) with anonymous(a)ulm.edu<mailto:anonymous@ulm.edu> and saying "Login Ok" Here is the thing....it's not doing this for every account...it seems to be random. Here is the logs I see when it does it: Aug 23 16:08:11 ulm-radius1 radiusd[17337]: (8062025) Login OK: [laurencenr(a)warhawks.ulm.edu] (from client wireless port 500 cli F0-1D-BC-AB-35-67 via TLS tunnel) Aug 23 16:08:11 ulm-radius1 radiusd[17337]: (8062025) Login OK: [anonymous(a)warhawks.ulm.edu] (from client wireless port 500 cli F0-1D-BC-AB-35-67) I can't seem to find where\when it is substituting anonymous in. Here is when someone else connects to the same SSID(uses same site config on radius): Aug 23 18:46:45 ulm-radius1 radiusd[17337]: (8897019) Login OK: [vuvd(a)warhawks.ulm.edu] (from client wireless port 256 cli 30-4B-07-5C-D9-7A via TLS tunnel) Aug 23 18:46:45 ulm-radius1 radiusd[17337]: (8897020) Login OK: [vuvd(a)warhawks.ulm.edu] (from client wireless port 256 cli 30-4B-07-5C-D9-7A) So what in the world is happening and where is anonymous slipping in from? Since the last login is "Anonymous"...that's what the WiFi controller shows as a user name. I can run debug and output that to you but that file gets HUGE very quickly as the server is production and quite busy. Was hoping someone would know at least where I could look. It's something with the inner/outer tunnels I think...I'm just not sure what/where or why. Thanks, Adam Taylor

2 3

VRF config from v2 to v3
by Richard Mealing 23 Aug '21

23 Aug '21

Hi there, A long time ago someone set up a freeradius server within our company and used the following patch places in policy.txt for vrf users - http://lists.freeradius.org/pipermail/freeradius-devel/2005-November/000699… After searching around I am not sure google has any answers for me for a v3 version. I wondered if anyone has the unlang config for this? Thanks, Rich

2 3

Send CoA/DM Requests over existing TLS connection
by Ünal Kayaduman 23 Aug '21

23 Aug '21

Hello, I want to send CoA over existing TLS connection that is established with client before. But, I am getting error as below. Is there anyone who can help me ? I also added my configurations below. *clients.conf* client 10.10.10.10 { ipaddr = 10.10.10.10 proto = tcp secret = testing123 } *tls.conf* listen { ipaddr = * port = 2083 type = auth+acct proto = tcp virtual_server = default limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } tls { private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh fragment_size = 8192 ca_path = ${cadir} ca_path_reload_interval = 3600 cipher_list = "DEFAULT" cipher_server_preference = no tls_min_version = "1.2" tls_max_version = "1.3" cache { enable = no lifetime = 24 # hours } require_client_cert = no verify { } } } *default.conf* server default { authorize { if (&User-Name == "bob") { update coa { &User-Name = "%{User-Name}" &Calling-Station-Id = "%{Calling-Station-Id}" &NAS-IP-Address = "10.10.10.10" } } filter_username preprocess chap mschap digest suffix eap { ok = return } files -sql -ldap expiration logintime pap Autz-Type New-TLS-Connection { ok } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap digest eap } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY } } update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } if (EAP-Key-Name && &reply:EAP-Session-Id) { update reply { &EAP-Key-Name := &reply:EAP-Session-Id } } } pre-proxy { } post-proxy { eap } } *ERROR* Listening on auth+acct proto tcp address * port 2083 (TLS) bound to server default Ready to process requests ... new connection request on TCP socket Listening on auth+acct from client (10.10.10.10, 42673) -> (*, 2083, virtual-server=default) Waking up in 0.3 seconds. (0) (TLS) recv TLS 1.3 Handshake, Finished (0) tls_recv: Access-Request packet from host 10.10.10.10 port 42673, id=0, length=69 Threads: total/active/spare threads = 5/0/5 Thread 5 got semaphore Thread 5 handling request 0, (1 handled so far) (0) Received Access-Request Id 0 from 10.10.10.10:42673 to 0.0.0.0:2083 length 69 (0) NAS-IP-Address = 1.1.1.1 (0) Calling-Station-Id = "00010305AABB" (0) Framed-IP-Address = 192.168.1.1 (0) User-Name = "bob" (0) User-Password = "hello" (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) if (&User-Name == "bob") { (0) if (&User-Name == "bob") -> TRUE (0) if (&User-Name == "bob") { (0) update coa { (0) EXPAND %{User-Name} (0) --> bob (0) &User-Name = bob (0) EXPAND %{Calling-Station-Id} (0) --> 00010305AABB (0) &Calling-Station-Id = 00010305AABB (0) &NAS-IP-Address = 10.10.10.10 (0) } # update coa = noop (0) } # if (&User-Name == "bob") = noop (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = noop (0) } # policy filter_username = noop (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "bob", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry bob at line 87 (0) files: EXPAND Hello, %{User-Name} (0) files: --> Hello, bob (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = noop (0) WARNING: Unknown destination 10.10.10.10:3799 for CoA request. (0) Sent Access-Accept Id 0 from 0.0.0.0:2083 to 10.10.10.10:42673 length 0 (0) Reply-Message = "Hello, bob" (0) (TLS) send TLS 1.3 Handshake, Finished (0) Finished request

2 2