May 2022 - Freeradius-Users - lists.freeradius.org

log message when logintime returns userlock?
by Josef Vybíhal 17 May '22

17 May '22

HI list, I just set up the 'logintime' module. It works great - no problem there. I wanted to add one last thing - log when the user tries to login outside of allowed timeframe. It seemed easy to do: If the 'logintime' module returns 'userlock', I will just call the linelog module. post-auth { ... logintime if (userlock) { log_locked_by_logintime } ... } But this does not do what I expected. After logintime returns 'userlock', nothing else following in post-auth section is called. Snippet from debug: (9) } # policy assign_vlan = noop (9) logintime: Checking Login-Time (9) [logintime] = userlock (9) } # if (1) = userlock (9) } # post-auth = userlock (9) Using Post-Auth-Type Reject Technically it's inside of the if (1) {} condition, I have tried to move it outside of it, but the behavior was the same. Is this expected? Is there some trick how I can call the linelog in case of userlock? Due to the length of it, I have put full debug log here: https://up.jvi.cz/log_logintime.log Josef

2 2

Reporting on active users using radwho
by Djerk Geurts 16 May '22

16 May '22

Over the last week, I’ve spent some time getting radsniff telemetry into Grafana via Collectd and Telegraf. Sadly radsniff direct to Telegraf doesn’t work, but that’s another story. Wanting to graph online users I then scripted a rough little bit of bash to take the output of `radwho -r -n` and output the number of active users in influx format to Telegraf. However I’ve noticed that at midnight the reported online users drop to 0 to then slowly ramp up again. This may well be normal behaviour for what I should expect from rad who output, but it’s not what I’d like to see in my graph, it’s worrying to see the number of active xDSL subscribers drop to 0. I’d rather avoid having to state such a caveat. Is there a better way to track active users using the data available from FreeRADIUS server, its tools or directly from the (MySQL) database? — Thanks, Djerk Geurts

3 5

Case insensitive username
by Simon Dankau 13 May '22

13 May '22

Hello, we use FreeRadius at a school with about 3000 users and divide them into different groups. Since support requests often come from teachers who cannot enter their login data with correct capitalization, we want to use FreeRadius "case insensitive". At school we basically have 3 different groups. username student : 1234567 (a student's unique ID) username teacher: ABCD username employee: t.surname Some of our teachers try to login with "Abcd" or "abcd". That does not work, because FreeRadius is case sensitive. So far I've been browsing the forums and trying a few possible solutions. This includes the solutions from the following thread: https://lists.freeradius.org/pipermail/freeradius-users/2020-February/09751… 1. Changes in the server configuration authorize { update request { Stripped-User-Name := "%{tolower:%{User-Name}}" } ... everything else ... } 2. Changes in the "files" module key = "%{%{Stripped-User-Name}:-%{tolower:%{User-Name}}}" I can only test the login over the command line on our testserver, because i do not want to disrupt our currently working FreeRadius server including the wifi. All tests performed follow the scheme below. root@bkr-app:~# radtest TEST password 10.11.100.31:1812 10 test123 Sent Access-Request Id 245 from 0.0.0.0:33130 to 10.11.100.31:1812 length 74 User-Name = "TEST" User-Password = "start12K" NAS-IP-Address = 10.11.100.31 NAS-Port = 10 Message-Authenticator = 0x00 Cleartext-Password = "start12K" Received Access-Accept Id 245 from 10.11.100.31:1812 to 0.0.0.0:0 length 55 Reply-Message = "DEBUG: Lehrer VPN" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "37" root@bkr-app:~# radtest test start12K 10.11.100.31:1812 10 test123 Sent Access-Request Id 73 from 0.0.0.0:45170 to 10.11.100.31:1812 length 74 User-Name = "test" User-Password = "start12K" NAS-IP-Address = 10.11.100.31 NAS-Port = 10 Message-Authenticator = 0x00 Cleartext-Password = "start12K" Received Access-Reject Id 73 from 10.11.100.31:1812 to 0.0.0.0:0 length 46 Reply-Message = "DEBUG: Not found, reject" (0) -: Expected Access-Accept got Access-Reject root@bkr-app:~# Is there a way to use FreeRadius case insensitive so that we can reduce the support requests? Greetings from Germany, Simon

2 5

Unix domain socket support for authentication and accounting?
by William Tang 13 May '22

13 May '22

Hi, I'm wondering if freeradius has/will support for unix domain sockets for authentication and accounting? William

6 10

802.1x/iPSK DB access delegation.
by Alex Zetaeffesse 12 May '22

12 May '22

Dear folks, I hope you are enjoying the Christmas season and my best wishes for the 2022, Sorry if this question is not strictly related to FreeRadius but rather on the tools it interacts with for a better management of the WiFi accesses. I'm looking for suggestions/ideas that can point me in the right direction I have used Freeradius with its 2.0 version for my home project few years back, Now I'm in charge of providing wireless access in an environment with a few small companies. To better organize the air-media and avoid media competition or conflicts we would like to have just one/two SSIDs and then grant access to companies' employees or devices. So far so good, because for devices that can use 802.1x we can proxy Access-requests to the RADIUS server of each company. Problems come with non smart devices that still use PSK; I know iPSK helps a lot but I don't know how to delegate the management of MAC addresses. I'm not taking into account a text file to manage them; can we use a DB for iPSK too? And related to the DB is there a way to manage iPSK devices in this way? Just one table and a value specific to each company and small web interface that will handle only fields specific to each company? Would you have any other ideas to share with the community? Thanks, Alex

2 5

Typo in current "TLS - Config - common" doc ?
by Olivier 11 May '22

11 May '22

Hello, 1. In [1], the section that relates to private_key_password has a description that seems incorrect to me. It includes this text "If Private key & Certificate are located in the same file, then private_key_file & certificate_file must contain the same file name." 2. How should you set this private_key_password parameter ? Does it need to match a value set in one file from certs directory ? [1] https://networkradius.com/doc/current/raddb/tls/tls-config_tls-common.html Best regards

2 1

Re: FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 11 May '22

11 May '22

No offense meant. I am just being thorough. I have already experienced applications that allow authentication through AD that only perceive groups for the authentication. Once you are past that, there is no access to AD group information. On 5/10/22, 09:44, "Alan DeKok" <aland(a)deployingradius.com> wrote: On May 10, 2022, at 9:16 AM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > Thanks. > Does the AD-LDAP connection provide AD groups to allow user "filtering" ? That is what I said. I'm not sure why there's a need to double-check the answers I give. It's not productive. See also the documentation, or the mods-available/ldap file. There is *extensive* documentation on using AD groups. Alan DeKok.

2 1

Re: FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 10 May '22

10 May '22

Thanks. Does the AD-LDAP connection provide AD groups to allow user "filtering" ? On 5/10/22, 09:10, "Alan DeKok" <aland(a)deployingradius.com> wrote: On May 10, 2022, at 8:56 AM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > I am trying to replace a Cistron RADIUS service running on a dinosaur of a Sparc Solaris 9 server before it explodes. Wow. CIstron was effectively dead 20 years ago. > This RADIUS service is only used to access network devices (switches, routers, etc.) Likely only PAP then. But you'll have to double-check the packets. Every piece of vendor equipment does something magical and special. > We are moving to a centralized credentials setup with usernames/passwords in Active Directory. > > We followed this document to connect RHEL servers. > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… > > Now we need a new RADIUS service that uses the AD credentials. Odds are that you can just use PAP, and connect to AD via LDAP. And also check admin group privileges! if (LDAP-Group != "admin") { reject } ... else check passwords, etc. Alan DeKok.

3 2

Re: FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 10 May '22

10 May '22

I am trying to replace a Cistron RADIUS service running on a dinosaur of a Sparc Solaris 9 server before it explodes. This RADIUS service is only used to access network devices (switches, routers, etc.) We are moving to a centralized credentials setup with usernames/passwords in Active Directory. We followed this document to connect RHEL servers. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… Now we need a new RADIUS service that uses the AD credentials. On 5/10/22, 08:42, "Alan DeKok" <aland(a)deployingradius.com> wrote: > On May 10, 2022, at 8:21 AM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > Approaching the problem from a different direction: > Rather than "integrating" FR with Active Directory, could I set it up to use LDAP as the Auth-Type ? It depends. PAP? Yes. MS-CHAP? No. The documentation has endless examples of using Samba for AD integration, because in many cases it's required. e.g. for MS-CHAP. Perhaps instead of asking what's possible, describe what you want to do. We can then say how to do it. FreeRADIUS can do almost anything. The main limitations are external. i.e. certain EAP methods don't work with Active Directory, or with certain password storage methods. But if it's possible to do in RADIUS, FreeRADIUS can do it. Alan DeKok.

3 2

Re: FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 10 May '22

10 May '22

Approaching the problem from a different direction: Rather than "integrating" FR with Active Directory, could I set it up to use LDAP as the Auth-Type ? On 5/9/22, 16:09, "Freeradius-Users on behalf of Alan DeKok" <freeradius-users-bounces+daniel.e.white=nasa.gov(a)lists.freeradius.org on behalf of aland(a)deployingradius.com> wrote: On May 9, 2022, at 3:33 PM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > An observation: > The instructions seem to only cover winbind. > As an example, it says to use the "ntlm_auth" command. That command is not part of sssd. See the sssd documentation for other commands to test user name / password authentication with sssd. We didn't write sssd, and we don't know much about it. > Is there a newer version of that guide page that uses sssd instead of winbind ? There is no secret documentation. All of the documentation is public, and is publicly accessible. The Wiki can be edited. If you figure things out, please document them so that other people don't run into the same issues. Waiting for the FR developers to do everything may very well be a lost cause in some cases. Alan DeKok.

3 2