October 2024 - Freeradius-Users - lists.freeradius.org

Issue Building FreeRADIUS 3.2.6 on RedHat 9.4.
by Mucci Andrea 11 Oct '24

11 Oct '24

Hi all, I'm trying to build the RPMs for FreeRadius v.3.2.6 on Red Hat Enterprise Linux release 9.4 (Plow). I need to do this because my database is Oracle. After fixing all dependencies. The "rpmbuild" command returns errors and does not create RPM packages. Three warning: warning: line 52: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-devel warning: line 53: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-libs warning: Macro expanded in comment on line 597: %{_mandir}/man5/rlm_idn.5.gz} One error while compile: CC src/modules/rlm_python/rlm_python.c In file included from src/freeradius-devel/radiusd.h:38, from src/modules/rlm_python/rlm_python.c:33: src/modules/rlm_python/rlm_python.c: In function 'python_error_log': src/modules/rlm_python/rlm_python.c:229:26: warning: implicit declaration of function 'PyString_AsString' [-Wimplicit-function-declaration] 229 | ERROR("%s (%s)", PyString_AsString(p_str_1), PyString_AsString(p_str_2)); | ^~~~~~~~~~~~~~~~~ src/freeradius-devel/log.h:139:55: note: in definition of macro 'ERROR' 139 | #define ERROR(fmt, ...) radlog(L_ERR, fmt, ## __VA_ARGS__) | ^~~~~~~~~~~ src/modules/rlm_python/rlm_python.c:229:15: warning: format '%s' expects argument of type 'char *', but argument 3 has type 'int' [-Wformat=] 229 | ERROR("%s (%s)", PyString_AsString(p_str_1), PyString_AsString(p_str_2)); This is the message at the end: Recommends: freeradius-debugsource(x86-64) = 3.2.6-1.el9 Checking for unpackaged file(s): /usr/lib/rpm/check-files /root/rpmbuild/BUILDROOT/freeradius-3.2.6-1.el9.x86_64 error: Installed (but unpackaged) file(s) found: /etc/raddb/mods-config/python/example.py /etc/raddb/mods-config/python/radiusd.py /usr/lib/debug/usr/lib64/freeradius/rlm_python.so-3.2.6-1.el9.x86_64.debug /usr/lib64/freeradius/rlm_python.so RPM build errors: line 52: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-devel line 53: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-libs Macro expanded in comment on line 597: %{_mandir}/man5/rlm_idn.5.gz} File listed twice: /etc/raddb/certs/bootstrap File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/queries.conf File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/cisco_h323_db_schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf Installed (but unpackaged) file(s) found: /etc/raddb/mods-config/python/example.py /etc/raddb/mods-config/python/radiusd.py /usr/lib/debug/usr/lib64/freeradius/rlm_python.so-3.2.6-1.el9.x86_64.debug /usr/lib64/freeradius/rlm_python.so I think the problem is that RedHat 9 does not support Python 2. Anyone have any idea how I can solve this?? Best Regards Andrea

2 1

Unable to Find Active Directory Group using LDAP Group Lookup module
by Ibrahim Almahfooz 08 Oct '24

08 Oct '24

Hello, We have successfully integrated our FreeRADIUS Version 3.2.6 with active directory using ntlm_auth module and also enabled sqlcounter to permit users with specific daily limit. All working well. However, part of the requirements is to give a specific time quota to users who are part of a specific AD group, which we guess is a common use case. To achieve this, we also integrated FR with ldap by using FreeRadius-ldap package and we populated the ldap configuration file with below: ldap section: server = '192.168.1.1' identity = 'cn=test,cn=Users,dc=domain,dc=com' password = 'xxxxxx' base_dn = 'CN=users,DC=domain,DC=com' ldap Group section: (As-is) In the Authorize or Post-Auth section we added below: if (LDAP-Group == "Office-VPN") { update reply { Reply-Message := "test reply" } } When we run radiusd -X, the ldap part is executed in the authorize section however it says "Search returned no results": (1) authorize { (1) if (LDAP-Group == "Office-VPN") { (1) Searching for user in group "Office-VPN" rlm_ldap (ldap): Reserved connection (1) (1) EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) --> (uid=test) (1) Performing search in "CN=users,DC=domain,DC=com" with filter "(uid=test)", scope "sub" (1) Waiting for search result... (1) Search returned no results rlm_ldap (ldap): Released connection (1) Need more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.1:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) if (LDAP-Group == "Office-VPN") -> FALSE In our active directory the user "test" is part of the "Office-VPN" group and both the user and group are inside "cn=Users,dc=domain,dc=com" Also when we run the ldapsearch command from within FR machine, we get positive results: ldapsearch -x -b "cn=Users,dc=domain,dc=com" -D "cn=test,cn=Users,dc=domain,dc=com" -h 192.168.1.1-w "xxxxxx" '(&(cn=Office-VPN))' # extended LDIF # # LDAPv3 # base <cn=Users,dc=domain,dc=com> with scope subtree # filter: (&(cn=Office-VPN)) # requesting: ALL # # Office-VPN, Users, domain.com dn: CN=Office-VPN,CN=Users,DC= domain,DC=com objectClass: top objectClass: group cn: Office-VPN member: CN=test,CN=Users,DC=domain,DC=com distinguishedName: CN=Office-VPN,CN=Users,DC=domain,DC=com instanceType: 4 whenCreated: 20241008110114.0Z whenChanged: 20241008131130.0Z uSNCreated: 134205037 uSNChanged: 134208547 name: Office-VPN objectGUID:: bJ2ut8zDLUu8jhVkbMh7mQ== objectSid:: AQUAAAAAAAUVAAAAEBY0cDMJoyrnPWkPzxYAAA== sAMAccountName: Office-VPN sAMAccountType: 268435456 groupType: -2147483646 objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=domain,DC=com dSCorePropagationData: 20241008120926.0Z dSCorePropagationData: 20241008114220.0Z dSCorePropagationData: 16010101000000.0Z # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 What do you think could be the issue? By the way, we also tried to change the parameter like filter = '(objectClass=posixGroup)' to use filter = '(objectClass=group)' and that didn't work either. Appreciate your help

2 2

Recommended value for ${db_dir} when using persist_dir
by George Benjin 08 Oct '24

08 Oct '24

I was about to enable persistent storage of sessions with FreeRADIUS 3.2.6 on RHEL 9.4 (installed from the NetworkRADIUS repo). The eap module states the following: The default directory is ${logdir}, for historical reasons. You should ${db_dir} instead. And check the value of db_dir in the main radiusd.conf file. It should not point to ${raddb}. I checked the value of db_dir in the radiusd.conf file as mentioned, and it is set to: ${raddbdir} which evaluates to /etc/raddb. The comment immediately above the line setting the value mentions that it should likely be set to ${localstatedir}/lib/radiusd. I haven't changed these settings from defaults. Should the radiusd.conf settings be updated in the default package, and/or should the guidance be made clearer? File excerpts below. Cheers -------------------------------------------------------------------------------- >From eap: # Simple directory-based storage of sessions. # Two files per session will be written, the SSL # state and the cached VPs. This will persist session # across server restarts. # # The default directory is ${logdir}, for historical # reasons. You should ${db_dir} instead. And check # the value of db_dir in the main radiusd.conf file. # It should not point to ${raddb} # # The server will need write perms, and the directory # should be secured from anyone else. You might want # a script to remove old files from here periodically: # # find ${logdir}/tlscache -mtime +2 -exec rm -f {} \; # # This feature REQUIRES "name" option be set above. # # persist_dir = "${logdir}/tlscache" ----------------------------------------------------------------------------- >From radiusd.conf: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # # name of the running server. See also the "-n" command-line option. name = radiusd # Location of config and logfiles. confdir = ${raddbdir} modconfdir = ${confdir}/mods-config certdir = ${confdir}/certs cadir = ${confdir}/certs run_dir = ${localstatedir}/run/${name} # Should likely be ${localstatedir}/lib/radiusd db_dir = ${raddbdir}

2 2

radmin stats home_server command always reporting zero requests
by paul.moser＠bt.com 03 Oct '24

03 Oct '24

I'm seeing the radmin stats home_server command with IP address and port arguments always report zero requests. The responses, last_packet and various elapsed metrics are incrementing as expected. Access and accounting requests both seem to be affected. I've rolled back to 3.2.4 and the requests metric increments as expected(*), but it does not with 3.2.5 or 3.2.6 The changelog for 3.2.5 does indicate that there was a bug fix around statistics: * Fix packet statistics. Stop double counting some packets, and track packet statistics even if a socket is closed. (*) My assumption is/was that the request metric should increment with every packet to be sent to a home server and that all things being good (no drops, in-flight packets etc) requests should equal responses (or rather responses should equal requests) but my understanding of what the requests metric is might not be correct. Paul

2 3