August 2021 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 196, Issue 9
by Valery Kayukov 09 Aug '21

09 Aug '21

Hi Alan, I am trying to upgrade freeradius from 2.0 version to 3.0.17. Now I am with error: Mon Aug 9 17:00:32 2021 : Debug: # Loading authenticate {...} Mon Aug 9 17:00:32 2021 : Debug: eap Mon Aug 9 17:00:32 2021 : Error: /etc/raddb/sites-enabled/default[20]: Errors parsing preacct sub-section. Here is section: server { authorize { preprocess chap mschap # digest suffix eap { ok = return } files redundant-load-balance { ldap-server-a ldap-server-b } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } # digest # unix eap Auth-Type LDAP { redundant-load-balance { ldap-server-a ldap-server-b } } preacct { preprocess acct_unique suffix files } } accounting { detail # unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } #LDAP B Service if !(&Ldap-Group == "cn=scaler_vip,ou=resource groups,ou=Groups,dc= company ,dc=net") { update reply { Service-Type = "Administrative-User", Citrix-Group += "dwansible_netscaler_vip", Fall-Through = Yes } } #LDAP A Service elsif !(&Ldap-Group == "cn=scaler_service,ou=resource groups,ou=Groups,dc=company,dc=net") { update reply { Service-Type = "Administrative-User", Citrix-Group += "scaler_service" } } else { reject } } pre-proxy { } post-proxy { eap } } Could you please help to understand what is wrong, where to place LDAP group check and what is the syntax. Best regards, Valery On Mon, 9 Aug 2021 at 11:00, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius-Users Digest, Vol 196, Issue 8 (Valery Kayukov) > 2. Re: Freeradius-Users Digest, Vol 196, Issue 8 (Alan DeKok) > 3. How to Migrate (EAP) from: 2.1.xx to: 3.0.xx ? (Dennis Schneck) > 4. missing shared objects - proto_auth.so & proto_acct.so - on > openSuSE LEAP 15.3 (Dennis Schneck) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 8 Aug 2021 12:44:38 +0100 > From: Valery Kayukov <kayukovvalery(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Freeradius-Users Digest, Vol 196, Issue 8 > Message-ID: > < > CAAoKmEsmGHkTC-AV+8Dm1fG7xxVa_8qc_SkDOc4txuwJ-61DBw(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi Alan, > > Thank you for your help. By the way I use 3.0.17 version. I have fixed that > but still have this problem with LDAP groups: > Sun Aug 8 11:36:22 2021 : Debug: # Instantiating module "files" from > file /etc/raddb/mods-enabled/files > Sun Aug 8 11:36:22 2021 : Debug: reading pairlist file > /etc/raddb/mods-config/files/authorize > Sun Aug 8 11:36:22 2021 : Error: > /etc/raddb/mods-config/files/authorize[10]: Parse error (check) for entry > DEFAULT: Unknown name "LDAP-Group" > Sun Aug 8 11:36:22 2021 : Error: Failed reading > /etc/raddb/mods-config/files/authorize > Sun Aug 8 11:36:22 2021 : Error: /etc/raddb/mods-enabled/files[9]: > Instantiation failed for module "files" > > I have read the /etc/raddb/README.rst file about LDAP-Group but still not > getting how to apply it. > > In /etc/raddb/mods-config/files/authorize file I have following: > #LDAP NetEng team members > DEFAULT LDAP-Group == "cn=neteng,ou=system > groups,ou=Groups,dc=company,dc=net" > Service-Type = "Administrative-User", > cisco-avpair := "shell:roles=network-admin,vdc-admin", > cisco-avpair += "shell:priv-lvl=15", > Filter-Id = ":group_name=neteng;" > > In /etc/raddb/sites-available/default config: > authorize { > ... > ldap-server-a > if ((ok || updated) && User-Password) { > update control { > Auth-Type := ldap > } > } > ldap-server-b > if ((ok || updated) && User-Password) { > update control { > Auth-Type := ldap > } > } > ... > } > authenticate { > ... > redundant { > location1 > location2 > } > ... > } > > In /etc/raddb/mods-available/ldap config: > ldap ldap-server-a { > server = "ldap-a.company.net" > basedn = "dc=company,dc=net" > } > ... > } > > ldap ldap-server-b { > server = "ldap-b.company.net" > basedn = "dc=company,dc=net" > ... > } > > How convert config in file /etc/raddb/mods-config/files/authorize to v3? > > Best regards, > Valeriy > > On Sun, 8 Aug 2021 at 11:00, < > freeradius-users-request(a)lists.freeradius.org> > wrote: > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. Parse error (check) for entry DEFAULT: Unknown name > > "LDAP-Group" (Valery Kayukov) > > 2. Re: Parse error (check) for entry DEFAULT: Unknown name > > "LDAP-Group" (Alan DeKok) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Sat, 7 Aug 2021 13:00:11 +0100 > > From: Valery Kayukov <kayukovvalery(a)gmail.com> > > To: freeradius-users(a)lists.freeradius.org > > Subject: Parse error (check) for entry DEFAULT: Unknown name > > "LDAP-Group" > > Message-ID: > > < > > CAAoKmEsJSQ4ZMxM5UxEbwHks_4JyzfejTe6spjhJZeBEyS6ThQ(a)mail.gmail.com> > > Content-Type: text/plain; charset="UTF-8" > > > > Hi team, > > > > I am new to the freeRADIUS project. Can't start my server, it return > error > > message: > > Sat Aug 7 11:48:24 2021 : Debug: # Instantiating module "files" from > > file /etc/raddb/mods-enabled/files > > Sat Aug 7 11:48:24 2021 : Debug: reading pairlist file > > /etc/raddb/mods-config/files/authorize > > Sat Aug 7 11:48:24 2021 : Error: > > /etc/raddb/mods-config/files/authorize[10]: Parse error (check) for entry > > DEFAULT: Unknown name "LDAP-Group" > > Sat Aug 7 11:48:24 2021 : Error: Failed reading > > /etc/raddb/mods-config/files/authorize > > Sat Aug 7 11:48:24 2021 : Error: /etc/raddb/mods-enabled/files[9]: > > Instantiation failed for module "files" > > > > Here is configuration file /etc/raddb/mods-config/files/authorize: > > #LDAP Rancid service account > > rancid LDAP-UserDN := > > `uid=rancid,ou=services,ou=Accounts,dc=company,dc=net` > > Service-Type = "NAS-Prompt-User", > > cisco-avpair := "optional shell:roles=rancid,network-operator", > > cisco-avpair += "shell:priv-lvl=15", > > Juniper-Local-User-Name := "rancid", > > Citrix-Group = "rancid" > > > > #LDAP Apple team members > > DEFAULT LDAP-Group == "cn=apple,ou=system groups,ou=Groups,dc= > > company,dc=net" > > Service-Type = "Administrative-User", > > cisco-avpair := "shell:roles=network-admin,vdc-admin", > > cisco-avpair += "shell:priv-lvl=15", > > Juniper-Local-User-Name := "apple", > > Citrix-Group = "apple", > > Filter-Id = ":group_name=apple;" > > > > What is wrong here? > > > > -- > > Best Regards, > > Valeriy Kayukov > > System Engineer > > > > > > ------------------------------ > > > > Message: 2 > > Date: Sat, 7 Aug 2021 09:44:01 -0400 > > From: Alan DeKok <aland(a)deployingradius.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: Parse error (check) for entry DEFAULT: Unknown name > > "LDAP-Group" > > Message-ID: <8F938E67-BB0D-4459-8968-2EE5B10CFCEE(a)deployingradius.com> > > Content-Type: text/plain; charset=us-ascii > > > > On Aug 7, 2021, at 8:00 AM, Valery Kayukov <kayukovvalery(a)gmail.com> > > wrote: > > > > > > I am new to the freeRADIUS project. Can't start my server, it return > > error > > > message: > > > Sat Aug 7 11:48:24 2021 : Debug: # Instantiating module "files" from > > > file /etc/raddb/mods-enabled/files > > > Sat Aug 7 11:48:24 2021 : Debug: reading pairlist file > > > /etc/raddb/mods-config/files/authorize > > > Sat Aug 7 11:48:24 2021 : Error: > > > /etc/raddb/mods-config/files/authorize[10]: Parse error (check) for > entry > > > DEFAULT: Unknown name "LDAP-Group" > > > > You haven't enabled the LDAP module. > > > > Or, depending on the local file system, you may need to edit > > radiusd.conf to load the "ldap" module early: > > > > instantiate { > > ... > > ldap > > } > > > > This is documented in the comments before the "instantiate" section. > > > > Alan DeKok. > > > > > > > > > > ------------------------------ > > > > Subject: Digest Footer > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > > > End of Freeradius-Users Digest, Vol 196, Issue 8 > > ************************************************ > > > > > -- > Best Regards, > Valeriy Kayukov > System Engineer > > > ------------------------------ > > Message: 2 > Date: Sun, 8 Aug 2021 08:13:02 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius-Users Digest, Vol 196, Issue 8 > Message-ID: <1E9CA5AA-E8CD-42F3-8E16-F84327D985B4(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Aug 8, 2021, at 7:44 AM, Valery Kayukov <kayukovvalery(a)gmail.com> > wrote: > > > > Thank you for your help. By the way I use 3.0.17 version. > > You should really upgrade. We have packages for 3.0.23 on > http://packages.networkradius.com > > > I have fixed that > > but still have this problem with LDAP groups: > > Sun Aug 8 11:36:22 2021 : Debug: # Instantiating module "files" from > > file /etc/raddb/mods-enabled/files > > Sun Aug 8 11:36:22 2021 : Debug: reading pairlist file > > /etc/raddb/mods-config/files/authorize > > Sun Aug 8 11:36:22 2021 : Error: > > /etc/raddb/mods-config/files/authorize[10]: Parse error (check) for entry > > DEFAULT: Unknown name "LDAP-Group" > > Sun Aug 8 11:36:22 2021 : Error: Failed reading > > /etc/raddb/mods-config/files/authorize > > Sun Aug 8 11:36:22 2021 : Error: /etc/raddb/mods-enabled/files[9]: > > Instantiation failed for module "files" > > > > I have read the /etc/raddb/README.rst file about LDAP-Group but still not > > getting how to apply it. > > > > In /etc/raddb/mods-config/files/authorize file I have following: > > #LDAP NetEng team members > > DEFAULT LDAP-Group == "cn=neteng,ou=system > > groups,ou=Groups,dc=company,dc=net" > > Service-Type = "Administrative-User", > > cisco-avpair := "shell:roles=network-admin,vdc-admin", > > cisco-avpair += "shell:priv-lvl=15", > > Filter-Id = ":group_name=neteng;" > > > > In /etc/raddb/sites-available/default config: > > authorize { > > ... > > ldap-server-a > > It would help to describe what you're doing. > > If you've renamed the LDAP module, then the LDAP group information is in > the <LDAP-NAME>-LDAP-Group attribute. > > See the Wiki for documentation. Just type "LDAP-Group" into the search > bar. This is documented. > > Alan DeKok. > > > > > ------------------------------ > > Message: 3 > Date: Mon, 9 Aug 2021 07:33:19 +0200 > From: Dennis Schneck <dennis.schneck(a)schulergroup.com> > To: <Freeradius-Users(a)lists.freeradius.org> > Subject: How to Migrate (EAP) from: 2.1.xx to: 3.0.xx ? > Message-ID: <75580212-287b-3cb9-1679-7d3bf5779af0(a)schulergroup.com> > Content-Type: text/plain; charset="utf-8"; format=flowed > > > Hello, > > I am new in freeradius, should build a new system with the config of a > 2.1.12. > Did not find config parameters from /etc/raddb/eap.conf in the > /etc/raddb/policy.d/eap > > Where can I find how to migrate from Version 2.1.12 to 3.0.21 > > Thanks > > > /etc/raddb/eap.conf > > eap { > > default_eap_type = peap > > timer_expire = 60 > > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > > md5 { > } > > tls { > > private_key_password = password > > private_key_file = ${raddbdir}/certs/my/key.pem > certificate_file = ${raddbdir}/certs/my/server.pem > # Trusted Root CA list > CA_file = ${raddbdir}/certs/my/our.pem > > dh_file = ${raddbdir}/certs/my/DH > random_file = ${raddbdir}/certs/my/random > #random_file = /dev/urandom > fragment_size = 1024 > > include_length = yes > #check_crl = yes > > } > peap { > default_eap_type = mschapv2 > #VIRTUAL_SERVER = "inner-Tunnel" > #scopy_request_to_tunnel = yes > #use_tunneled_reply = yes > #proxy_tunneled_request_as_eap = yes > } > mschapv2 { > } > } > > > > > ------------------------------ > > Message: 4 > Date: Mon, 9 Aug 2021 11:18:57 +0200 > From: Dennis Schneck <dennis.schneck(a)schulergroup.com> > To: <Freeradius-Users(a)lists.freeradius.org> > Subject: missing shared objects - proto_auth.so & proto_acct.so - on > openSuSE LEAP 15.3 > Message-ID: <1aa004d4-3e29-eab2-486d-49537bd90f68(a)schulergroup.com> > Content-Type: text/plain; charset="utf-8"; format=flowed > > > Hello, > > installed freeradius 3.0.21 on OpenSuSE LEAP 15.3. > > created the certificates. (cd /etc/raddb/certs && ./bootstrap) > > Checked then the config with: radiusd -XXX > > > there are 2 shared objects missing... > > || > > |/usr/lib64/freeradius/proto_auth.so | > || > > || > > |/usr/lib64/freeradius/proto_acct.so| > | > > But can not find this shared objects to install.... > > How to fix this ? > > Thanks > > > | > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 196, Issue 9 > ************************************************ > -- Best Regards, Valeriy Kayukov System Engineer

2 3

Source-IP on server status packets
by Stefan Düring 09 Aug '21

09 Aug '21

We have 2 identical radius servers (FreeRADIUS 3.0.21) On the same servers radsecproxies are running. (radsecproxy 1.8.2) The servers have 2 IP adresses (1 as secondary which should be used for radius and radsecproxy). After freeradius restart everything works fine. Freeradius sends server status packets to the internal radsecproxy and to external radius servers (eduroam) with the correct source (secondary ip address). It works for a long time but suddenly one of these freeradius sends the server status packets with a wrong source ip (primary) to the internal radsecproxy. Radsecproxy ignores these packets of course. We followed the instructions in FAQ ("Is there a way to bind FreeRADIUS to a specific IP address?") Any ideas how to trace / correct this? thanks Stefan Here are the configuration details: ### Server Network Config $ ip address ... 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:50:56:82:9b:a3 brd ff:ff:ff:ff:ff:ff inet 10.173.120.23/23 brd 10.173.121.255 scope global eth0 valid_lft forever preferred_lft forever inet 10.173.120.11/23 brd 10.173.121.255 scope global secondary eth0 valid_lft forever preferred_lft forever ### site default server default { listen { type = auth ipaddr = 10.173.120.11 port = 1812 ... } ### proxy.conf home_server RadSecProxy { type = auth ipaddr = 10.173.120.11 port = 11812 status_check = status-server check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 ... } ### RadSecProxy Log ... # successful server status from/to corresponding radius Aug 9 08:28:19 2021: replyh: got status server response from tld2.eduroam.de Aug 9 08:28:22 2021: replyh: got status server response from tld1.eduroam.de Aug 9 08:28:22 2021: Access-Accept (response to Status-Server) from _self_ to tld1.eduroam.de (193.174.75.134) Aug 9 08:28:22 2021: Access-Accept (response to Status-Server) from _self_ to tld3.eduroam.de (194.95.245.98) Aug 9 08:28:30 2021: Access-Accept (response to Status-Server) from _self_ to tld2.eduroam.de (193.174.75.138) # successful server status from/to local radsecproxy Aug 9 08:28:37 2021: replyh: got status server response from radius-local # suddenly wrong source ip in server status packet freeradius-to-radsecproxy Aug 9 08:28:47 2021: radudpget: got packet from wrong or unknown UDP peer 10.173.120.23, ignoring

2 1

missing shared objects - proto_auth.so & proto_acct.so - on openSuSE LEAP 15.3
by Dennis Schneck 09 Aug '21

09 Aug '21

Hello, installed freeradius 3.0.21 on OpenSuSE LEAP 15.3. created the certificates. (cd /etc/raddb/certs && ./bootstrap) Checked then the config with: radiusd -XXX there are 2 shared objects missing... || |/usr/lib64/freeradius/proto_auth.so | || || |/usr/lib64/freeradius/proto_acct.so| | But can not find this shared objects to install.... How to fix this ? Thanks |

2 1

How to Migrate (EAP) from: 2.1.xx to: 3.0.xx ?
by Dennis Schneck 09 Aug '21

09 Aug '21

Hello, I am new in freeradius, should build a new system with the config of a 2.1.12. Did not find config parameters from /etc/raddb/eap.conf in the /etc/raddb/policy.d/eap Where can I find how to migrate from Version 2.1.12 to 3.0.21 Thanks /etc/raddb/eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } tls { private_key_password = password private_key_file = ${raddbdir}/certs/my/key.pem certificate_file = ${raddbdir}/certs/my/server.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/my/our.pem dh_file = ${raddbdir}/certs/my/DH random_file = ${raddbdir}/certs/my/random #random_file = /dev/urandom fragment_size = 1024 include_length = yes #check_crl = yes } peap { default_eap_type = mschapv2 #VIRTUAL_SERVER = "inner-Tunnel" #scopy_request_to_tunnel = yes #use_tunneled_reply = yes #proxy_tunneled_request_as_eap = yes } mschapv2 { } }

2 1

Re: Freeradius-Users Digest, Vol 196, Issue 8
by Valery Kayukov 08 Aug '21

08 Aug '21

Hi Alan, Thank you for your help. By the way I use 3.0.17 version. I have fixed that but still have this problem with LDAP groups: Sun Aug 8 11:36:22 2021 : Debug: # Instantiating module "files" from file /etc/raddb/mods-enabled/files Sun Aug 8 11:36:22 2021 : Debug: reading pairlist file /etc/raddb/mods-config/files/authorize Sun Aug 8 11:36:22 2021 : Error: /etc/raddb/mods-config/files/authorize[10]: Parse error (check) for entry DEFAULT: Unknown name "LDAP-Group" Sun Aug 8 11:36:22 2021 : Error: Failed reading /etc/raddb/mods-config/files/authorize Sun Aug 8 11:36:22 2021 : Error: /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" I have read the /etc/raddb/README.rst file about LDAP-Group but still not getting how to apply it. In /etc/raddb/mods-config/files/authorize file I have following: #LDAP NetEng team members DEFAULT LDAP-Group == "cn=neteng,ou=system groups,ou=Groups,dc=company,dc=net" Service-Type = "Administrative-User", cisco-avpair := "shell:roles=network-admin,vdc-admin", cisco-avpair += "shell:priv-lvl=15", Filter-Id = ":group_name=neteng;" In /etc/raddb/sites-available/default config: authorize { ... ldap-server-a if ((ok || updated) && User-Password) { update control { Auth-Type := ldap } } ldap-server-b if ((ok || updated) && User-Password) { update control { Auth-Type := ldap } } ... } authenticate { ... redundant { location1 location2 } ... } In /etc/raddb/mods-available/ldap config: ldap ldap-server-a { server = "ldap-a.company.net" basedn = "dc=company,dc=net" } ... } ldap ldap-server-b { server = "ldap-b.company.net" basedn = "dc=company,dc=net" ... } How convert config in file /etc/raddb/mods-config/files/authorize to v3? Best regards, Valeriy On Sun, 8 Aug 2021 at 11:00, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Parse error (check) for entry DEFAULT: Unknown name > "LDAP-Group" (Valery Kayukov) > 2. Re: Parse error (check) for entry DEFAULT: Unknown name > "LDAP-Group" (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 7 Aug 2021 13:00:11 +0100 > From: Valery Kayukov <kayukovvalery(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Parse error (check) for entry DEFAULT: Unknown name > "LDAP-Group" > Message-ID: > < > CAAoKmEsJSQ4ZMxM5UxEbwHks_4JyzfejTe6spjhJZeBEyS6ThQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi team, > > I am new to the freeRADIUS project. Can't start my server, it return error > message: > Sat Aug 7 11:48:24 2021 : Debug: # Instantiating module "files" from > file /etc/raddb/mods-enabled/files > Sat Aug 7 11:48:24 2021 : Debug: reading pairlist file > /etc/raddb/mods-config/files/authorize > Sat Aug 7 11:48:24 2021 : Error: > /etc/raddb/mods-config/files/authorize[10]: Parse error (check) for entry > DEFAULT: Unknown name "LDAP-Group" > Sat Aug 7 11:48:24 2021 : Error: Failed reading > /etc/raddb/mods-config/files/authorize > Sat Aug 7 11:48:24 2021 : Error: /etc/raddb/mods-enabled/files[9]: > Instantiation failed for module "files" > > Here is configuration file /etc/raddb/mods-config/files/authorize: > #LDAP Rancid service account > rancid LDAP-UserDN := > `uid=rancid,ou=services,ou=Accounts,dc=company,dc=net` > Service-Type = "NAS-Prompt-User", > cisco-avpair := "optional shell:roles=rancid,network-operator", > cisco-avpair += "shell:priv-lvl=15", > Juniper-Local-User-Name := "rancid", > Citrix-Group = "rancid" > > #LDAP Apple team members > DEFAULT LDAP-Group == "cn=apple,ou=system groups,ou=Groups,dc= > company,dc=net" > Service-Type = "Administrative-User", > cisco-avpair := "shell:roles=network-admin,vdc-admin", > cisco-avpair += "shell:priv-lvl=15", > Juniper-Local-User-Name := "apple", > Citrix-Group = "apple", > Filter-Id = ":group_name=apple;" > > What is wrong here? > > -- > Best Regards, > Valeriy Kayukov > System Engineer > > > ------------------------------ > > Message: 2 > Date: Sat, 7 Aug 2021 09:44:01 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Parse error (check) for entry DEFAULT: Unknown name > "LDAP-Group" > Message-ID: <8F938E67-BB0D-4459-8968-2EE5B10CFCEE(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Aug 7, 2021, at 8:00 AM, Valery Kayukov <kayukovvalery(a)gmail.com> > wrote: > > > > I am new to the freeRADIUS project. Can't start my server, it return > error > > message: > > Sat Aug 7 11:48:24 2021 : Debug: # Instantiating module "files" from > > file /etc/raddb/mods-enabled/files > > Sat Aug 7 11:48:24 2021 : Debug: reading pairlist file > > /etc/raddb/mods-config/files/authorize > > Sat Aug 7 11:48:24 2021 : Error: > > /etc/raddb/mods-config/files/authorize[10]: Parse error (check) for entry > > DEFAULT: Unknown name "LDAP-Group" > > You haven't enabled the LDAP module. > > Or, depending on the local file system, you may need to edit > radiusd.conf to load the "ldap" module early: > > instantiate { > ... > ldap > } > > This is documented in the comments before the "instantiate" section. > > Alan DeKok. > > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 196, Issue 8 > ************************************************ > -- Best Regards, Valeriy Kayukov System Engineer

2 1

Parse error (check) for entry DEFAULT: Unknown name "LDAP-Group"
by Valery Kayukov 07 Aug '21

07 Aug '21

Hi team, I am new to the freeRADIUS project. Can't start my server, it return error message: Sat Aug 7 11:48:24 2021 : Debug: # Instantiating module "files" from file /etc/raddb/mods-enabled/files Sat Aug 7 11:48:24 2021 : Debug: reading pairlist file /etc/raddb/mods-config/files/authorize Sat Aug 7 11:48:24 2021 : Error: /etc/raddb/mods-config/files/authorize[10]: Parse error (check) for entry DEFAULT: Unknown name "LDAP-Group" Sat Aug 7 11:48:24 2021 : Error: Failed reading /etc/raddb/mods-config/files/authorize Sat Aug 7 11:48:24 2021 : Error: /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" Here is configuration file /etc/raddb/mods-config/files/authorize: #LDAP Rancid service account rancid LDAP-UserDN := `uid=rancid,ou=services,ou=Accounts,dc=company,dc=net` Service-Type = "NAS-Prompt-User", cisco-avpair := "optional shell:roles=rancid,network-operator", cisco-avpair += "shell:priv-lvl=15", Juniper-Local-User-Name := "rancid", Citrix-Group = "rancid" #LDAP Apple team members DEFAULT LDAP-Group == "cn=apple,ou=system groups,ou=Groups,dc= company,dc=net" Service-Type = "Administrative-User", cisco-avpair := "shell:roles=network-admin,vdc-admin", cisco-avpair += "shell:priv-lvl=15", Juniper-Local-User-Name := "apple", Citrix-Group = "apple", Filter-Id = ":group_name=apple;" What is wrong here? -- Best Regards, Valeriy Kayukov System Engineer

2 1

Need help with FreeRADIUS stripping NT domain name from usernames
by Nazar Tareyev 05 Aug '21

05 Aug '21

Hello guys. Is there a FreeRADIUS professionals or experienced admins? I need help with stripping domain name from username. I've inherited this FreeRADIUS installation from previous admin and struggling to understand how it was configured in full. But as I see, stripping and policy config is pretty much default, nothing changed there. Users in our network use DOMAIN\Username format. When they log on with just username, authorization works as needed. When they use DOMAIN\Username, radius rejects login request. How do I configure FreeRADIUS to allow both username and DOMAIN\Username formats to be used? How do I strip DOMAIN\ from username? From debug output I can see that radius uses section 'authorize from file /etc/raddb/sites-enabled/default' and policy 'filter_username'. But also, I can see that radius uses stripping rule for username(a)domain.com format, which we don't use. Do I need to add something to this 'filter_username' config file to get it work as needed? Can someone please help me with this? I can post configs if needed. Thanks in advance! Here is debug info. Note that some fields was changed to hide names and addresses. (9) Received Access-Request Id 207 from xx.xx.xx.xx:41261 to yy.yy.yy.yy:1812 length 285 (9) User-Name = "DOMAIN\\Username" (9) Chargeable-User-Identity = 0x32 (9) Location-Capable = Civic-Location (9) Calling-Station-Id = "f8-28-19-5c-4e-cb" (9) Called-Station-Id = "00-27-e3-ff-c9-a0:WIFI" (9) NAS-Port = 1 (9) Cisco-AVPair = "audit-session-id=326e0a0a0001671fa3020061" (9) Acct-Session-Id = "610002a3/f8:28:19:5c:4e:cb/99737" (9) NAS-IP-Address = xx.xx.xx.xx (9) NAS-Identifier = "Cisco1832wlc" (9) Airespace-Wlan-Id = 8 (9) Service-Type = Framed-User (9) Framed-MTU = 1300 (9) NAS-Port-Type = Wireless-802.11 (9) EAP-Message = 0x0205001119800000000715030300020230 (9) State = 0x862de6f98528fff7b8c91607fcd06da7 (9) Message-Authenticator = 0xc8f22392cb9af7cdd37553e86e4f98ae (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/raddb/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "DOMAIN\Username", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 5 length 17 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x862de6f98528fff7 (9) eap: Finished EAP session with state 0x862de6f98528fff7 (9) eap: Previous EAP request found for state 0x862de6f98528fff7, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: Peer indicated complete TLS record size will be 7 bytes (9) eap_peap: Got complete TLS record (7 bytes) (9) eap_peap: [eaptls verify] = length included (9) eap_peap: <<< recv TLS 1.2 [length 0002] (9) eap_peap: ERROR: TLS Alert read:fatal:unknown CA (9) eap_peap: ERROR: TLS_accept: Failed in error (9) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) (9) eap_peap: ERROR: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (9) eap_peap: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure (9) eap_peap: ERROR: System call (I/O) error (-1) (9) eap_peap: ERROR: TLS receive handshake failed during operation (9) eap_peap: ERROR: [eaptls process] = fail (9) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (9) eap: Sending EAP Failure (code 4) ID 5 length 4 (9) eap: Failed in EAP select (9) [eap] = invalid (9) } # authenticate = invalid (9) Failed to authenticate the user (9) Login incorrect (eap_peap: TLS Alert read:fatal:unknown CA): [DOMAIN\Username] (from client Cisco1832wlc port 1 cli f8-28-19-5c-4e-cb) (9) Using Post-Auth-Type Reject (9) # Executing group from file /etc/raddb/sites-enabled/default (9) Post-Auth-Type REJECT { (9) sql: EXPAND .query (9) sql: --> .query (9) sql: Using query template 'query' rlm_sql (sql): Reserved connection (6) (9) sql: EXPAND %{User-Name} (9) sql: --> DOMAIN\\Username (9) sql: SQL-User-Name set to 'DOMAIN\\Username' (9) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (9) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'DOMAIN=5C=5CUsername', '', 'Access-Reject', '2021-07-27 18:57:11.875173') (9) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'DOMAIN=5C=5CUsername', '', 'Access-Reject', '2021-07-27 18:57:11.875173') (9) sql: SQL query returned: success (9) sql: 1 record(s) updated rlm_sql (sql): Released connection (6) Need 1 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (8), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.48-MariaDB, protocol version 10 (9) [sql] = ok (9) attr_filter.access_reject: EXPAND %{User-Name} (9) attr_filter.access_reject: --> DOMAIN\\Username (9) attr_filter.access_reject: Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # Post-Auth-Type REJECT = updated (9) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.4 seconds. (0) Cleaning up request packet ID 198 with timestamp +61 (1) Cleaning up request packet ID 199 with timestamp +61 (2) Cleaning up request packet ID 200 with timestamp +61 (3) Cleaning up request packet ID 201 with timestamp +61 (4) Cleaning up request packet ID 202 with timestamp +61 Waking up in 0.2 seconds. (9) Sending delayed response (9) Sent Access-Reject Id 207 from yy.yy.yy.yy:1812 to xx.xx.xx.xx:41261 length 44 (9) EAP-Message = 0x04050004 (9) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (5) Cleaning up request packet ID 203 with timestamp +65 (6) Cleaning up request packet ID 204 with timestamp +65 (7) Cleaning up request packet ID 205 with timestamp +65 (8) Cleaning up request packet ID 206 with timestamp +65 (9) Cleaning up request packet ID 207 with timestamp +65 Ready to process requests

3 3

Re: Need help with FreeRADIUS stripping NT domain name from usernames
by Alan DeKok 05 Aug '21

05 Aug '21

On Aug 5, 2021, at 7:43 AM, Nazar Tareyev <nazzartareev(a)gmail.com> wrote: > > Thank you. I have declared our domain in proxy.conf, then uncommented ntdomain in default site and now it seems that stripping domain from username works. > Regarding EAP error, I will dig into it deeper. But interestingly, when you manually enter just username, without domain, no such error appears and authentication is successful. EAP error only comes up when you enter DOMAIN\Username The error is coming from the EAP client. So there is nothing you can change in FreeRADIUS to fix this. Alan DeKok.

1 0

Bad talloc magic value
by Stefan Paetow 04 Aug '21

04 Aug '21

Hi, I’m seeing a lot of crashes after upgrading to the NR packaged versions of FreeRADIUS 3.0.23: Tue Jul 6 03:46:10 2021 : Auth: (145) Login OK: [anonymous@realm] (from client roaming1 port 0 cli 70-6F-6C-69-73-68) Bad talloc magic value - unknown value talloc abort: Bad talloc magic value - unknown value Tue Jul 6 03:46:24 2021 : Info: Debugger not attached Tue Jul 6 03:46:24 2021 : Info: systemd watchdog is disabled 3.0.22 ran nicely, but now I’m concerned about 50 crashes with the above message since 3am this morning... Any ideas, gents? *looks at Arran, Alan and Matthew expectantly* I’ve rolled back manually to 3.0.22 as a precaution. With Kind Regards Stefan Paetow Federated Roaming Technical Specialist t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet In line with government advice, at Jisc we’re now working from home and our offices are currently closed. Read our statement on coronavirus<https://www.jisc.ac.uk/about/corporate/coronavirus-statement>. jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

6 11

Re: How to configure rlm_rest module for authentication in freeradius
by CHANDAN BR 04 Aug '21

04 Aug '21

i want to use rest module with freeradius , please help me with how to configure .i'm new to this please tell me briefly. so that it will be helpful for me. i did configuration but it is authenticate with any user and password, how to solve this? thanks and regards, chandan

2 1