- Freeradius-Users - lists.freeradius.org

Timeout after invalid login
by Nazar Tareyev 05 Mar '22

05 Mar '22

Hello. We are experiencing some issues when users login with incorrect credentials to local wifi via FreeRadius. After incorrect login, authentication window doesn't show for several minutes, as if it is locked by some kind of timeout. Is there an option in FreeRadius config that controls authentication timeout after entering invalid credentials? Thank you! [https://www.1cb.kz/signature/img/fcb_logo_en.png] Nazar Tareyev Information Security Specialist First Credit Bureau Kazakhstan [https://www.1cb.kz/signature/img/phone-icon.png] +7 727 300 0171<callto:+7%20727%20300%200171> / [https://www.1cb.kz/signature/img/mobile.png] +7 707 105 4491<callto:+7%20707%20105%204491> [https://www.1cb.kz/signature/img/mail.jpg] NTareev(a)1cb.kz<mailto:NTareev@1cb.kz> / [https://www.1cb.kz/signature/img/Skype.png] nazzartareev<skype:nazzartareev?chat> [https://www.1cb.kz/signature/img/web.png] www.1cb.kz<http://www.1cb.kz> [https://www.1cb.kz/signature/img/facebook.png] @1cb.kz<https://www.facebook.com/1cb.kz> [https://www.1cb.kz/signature/img/vk_favicon.png] @1cb.kz<https://vk.com/firstcreditbureau> [https://www.1cb.kz/signature/img/android.png] Android<https://play.google.com/store/apps/details?id=kz.crystalspring.cs_1cb> [https://www.1cb.kz/signature/img/ios.png] iOS<https://itunes.apple.com/uz/app/1cb.kz-pervoe-kreditnoe-buro> [https://www.1cb.kz/signature/img/banner.png]<https://www.1cb.kz/>

2 1

User existence check
by Fred Neich 04 Mar '22

04 Mar '22

1 0

Check if a user exists
by Fred Neich 04 Mar '22

04 Mar '22

1 0

Accounting-On behavior
by Can Paçacı 04 Mar '22

04 Mar '22

Hi, How is the default system behavior when the NAS sends the message "Acct-Status-Type = Accounting-On"? Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

2 1

"redundant" block works in "default" virtual server, but does not work in "inner-tunnel".
by Rahman Duran 03 Mar '22

03 Mar '22

Hi, I am trying to implement a service based authorize section in FreeRadius (just like in Aruba ClearPass) so I can selectively decide what to do with the request based on source IP, SSID, username realm etc. Long story short, the following configuration works in default virtual server but it does not in inner tunnel. In inner-tunnel, if the first ldap section could not find user, then it does not go on and check second ldap; authorize { ..... ..... ..... ### AUTHORIZE: Hizmet verecek servis tanımları buradan itibaren tanımlanacak. ### Bu bölüm olduğu gibi "inner-tunnel" virtual server'ın aynı kısmına kopyalanmalı. ### 000: BIDB Test Ağı Servisi ### ### Test ağı if ( \ ((&Packet-Src-IP-Address < 10.10.243.0/24) || (&Packet-Src-IP-Address == 172.19.148.9/32)) \ && (&NAS-Port-Type == "Wireless-802.11") \ && (&Called-Station-SSID == "bidb-test") \ && (&User-Name =~ /^.+(a)erzurum\.edu\.tr$/) \ ) { update request { ETU-Radius-Service-Name := "BIDB_Test" } if (&Virtual-Server == "inner-tunnel") { update outer.request { ETU-Radius-Service-Name := "BIDB_Test" } } # EAP modülü OK döndürüyorsa işlemleri burada kes, gerisini authentication bölümündeki EAP modülü işleyecek. group etu_eap_process { eap if (ok) { return } } # İstek bir EAP isteği ise ve biz inner-tunnel değil isek burada başka bir kontrol yapma. Bunları inner-tunele bırak if ((&Virtual-Server == "inner-tunnel") || (!(&Virtual-Server == "inner-tunnel") && !&EAP-Message)) { # Authentication source group etu_auth_source { redundant { ldap_personel ldap_ogrenci } # Auth source'da kullanıcı bulunmuyorsa isteği reddet if (noop || notfound) { update request { Module-Failure-Message := "Auth Source Reject: [%{User-Name}] No matching user found in authentication source!" } if (&Virtual-Server == "inner-tunnel") { update outer.request { Module-Failure-Message := "Auth Source Reject: [%{User-Name}] No matching user found in authentication source!" } } reject } } # Authentication modules group etu_auth_modules { pap mschap } } # Servis eşleştiyse burada işleyişi kes, diğer servislere bakma return } ..... ..... ..... The above section is same in both default and inner tunnel, but when doing eap-peap or eap-ttls (so inner-tunnel used), user sarched in [ldap_personel] and not found, so it should search in [ldap_ogrenci] but it does not. Here is the debug section: .... .... .... (633) if ( ((&Packet-Src-IP-Address < 10.10.243.0/24) || (&Packet-Src-IP-Address == 172.19.148.9/32)) && (&NAS-Port-Type == "Wireless-802.11") && (&Called-Station-SSID == "bidb-test") && (&User-Name =~ /^.+(a)erzurum\.edu\.tr$/) ) { (633) EXPAND &Packet-Src-IP-Address (633) --> 10.10.243.23 (633) if ( ((&Packet-Src-IP-Address < 10.10.243.0/24) || (&Packet-Src-IP-Address == 172.19.148.9/32)) && (&NAS-Port-Type == "Wireless-802.11") && (&Called-Station-SSID == "bidb-test") && (&User-Name =~ /^.+(a)erzurum\.edu\.tr$/) ) -> TRUE (633) if ( ((&Packet-Src-IP-Address < 10.10.243.0/24) || (&Packet-Src-IP-Address == 172.19.148.9/32)) && (&NAS-Port-Type == "Wireless-802.11") && (&Called-Station-SSID == "bidb-test") && (&User-Name =~ /^.+(a)erzurum\.edu\.tr$/) ) { (633) update request { (633) ETU-Radius-Service-Name := "BIDB_Test" (633) } # update request = noop (633) if (&Virtual-Server == "inner-tunnel") { (633) EXPAND &Virtual-Server (633) --> inner-tunnel (633) if (&Virtual-Server == "inner-tunnel") -> TRUE (633) if (&Virtual-Server == "inner-tunnel") { (633) update outer.request { (633) ETU-Radius-Service-Name := "BIDB_Test" (633) } # update outer.request = noop (633) } # if (&Virtual-Server == "inner-tunnel") = noop (633) group { (633) eap: No EAP-Message, not doing EAP (633) [eap] = noop (633) if (ok) { (633) if (ok) -> FALSE (633) } # group = noop (633) if ((&Virtual-Server == "inner-tunnel") || (!(&Virtual-Server == "inner-tunnel") && !&EAP-Message)) { (633) EXPAND &Virtual-Server (633) --> inner-tunnel (633) if ((&Virtual-Server == "inner-tunnel") || (!(&Virtual-Server == "inner-tunnel") && !&EAP-Message)) -> TRUE (633) if ((&Virtual-Server == "inner-tunnel") || (!(&Virtual-Server == "inner-tunnel") && !&EAP-Message)) { (633) group { (633) redundant { rlm_ldap (ldap_personel): Closing connection (10): Hit idle_timeout, was idle for 53546 seconds rlm_ldap (ldap_personel): Closing connection (12): Hit idle_timeout, was idle for 53529 seconds rlm_ldap (ldap_personel): Closing connection (11): Hit idle_timeout, was idle for 53522 seconds rlm_ldap (ldap_personel): You probably need to lower "min" rlm_ldap (ldap_personel): Closing connection (13): Hit idle_timeout, was idle for 53521 seconds rlm_ldap (ldap_personel): You probably need to lower "min" rlm_ldap (ldap_personel): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap_personel): Opening additional connection (14), 1 of 32 pending slots used rlm_ldap (ldap_personel): Connecting to ldap://95.183.213.8:389 rlm_ldap (ldap_personel): Waiting for bind result... rlm_ldap (ldap_personel): Bind successful rlm_ldap (ldap_personel): Reserved connection (14) (633) ldap_personel: EXPAND (&(email=%{User-Name})(objectClass=kPerson)) (633) ldap_personel: --> (&(email=ogr1(a)erzurum.edu.tr )(objectClass=kPerson)) (633) ldap_personel: Performing search in "cn=personel,dc=etu" with filter "(&(email=ogr1(a)erzurum.edu.tr)(objectClass=kPerson))", scope "sub" (633) ldap_personel: Waiting for search result... (633) ldap_personel: Search returned no results rlm_ldap (ldap_personel): Released connection (14) Need 1 more connections to reach min connections (2) rlm_ldap (ldap_personel): Opening additional connection (15), 1 of 31 pending slots used rlm_ldap (ldap_personel): Connecting to ldap://95.183.213.8:389 rlm_ldap (ldap_personel): Waiting for bind result... rlm_ldap (ldap_personel): Bind successful (633) [ldap_personel] = notfound (633) } # redundant = notfound (633) if (noop || notfound) { (633) if (noop || notfound) -> TRUE (633) if (noop || notfound) { (633) update request { (633) EXPAND Auth Source Reject: [%{User-Name}] No matching user found in authentication source! (633) --> Auth Source Reject: [ogr1(a)erzurum.edu.tr] No matching user found in authentication source! (633) Module-Failure-Message := Auth Source Reject: [ ogr1(a)erzurum.edu.tr] No matching user found in authentication source! (633) } # update request = noop (633) if (&Virtual-Server == "inner-tunnel") { (633) EXPAND &Virtual-Server (633) --> inner-tunnel (633) if (&Virtual-Server == "inner-tunnel") -> TRUE (633) if (&Virtual-Server == "inner-tunnel") { (633) update outer.request { (633) EXPAND Auth Source Reject: [%{User-Name}] No matching user found in authentication source! (633) --> Auth Source Reject: [ogr1(a)erzurum.edu.tr] No matching user found in authentication source! (633) Module-Failure-Message := Auth Source Reject: [ ogr1(a)erzurum.edu.tr] No matching user found in authentication source! (633) } # update outer.request = noop (633) } # if (&Virtual-Server == "inner-tunnel") = noop (633) [reject] = reject (633) } # if (noop || notfound) = reject (633) } # group = reject (633) } # if ((&Virtual-Server == "inner-tunnel") || (!(&Virtual-Server == "inner-tunnel") && !&EAP-Message)) = reject (633) } # if ( ((&Packet-Src-IP-Address < 10.10.243.0/24) || (&Packet-Src-IP-Address == 172.19.148.9/32)) && (&NAS-Port-Type == "Wireless-802.11") && (&Called-Station-SSID == "bidb-test") && (&User-Name =~ /^.+(a)erzurum\.edu\.tr$/) ) = reject (633) } # authorize = reject (633) EXPAND Called-Station-ID: %{Called-Station-ID} Calling-Station-ID: %{Calling-Station-ID} Auth-Type: %{control:Auth-Type} (633) --> Called-Station-ID: a8bd27c04dac Calling-Station-ID: 3233fb9fb6d3 Auth-Type: (633) Invalid user (Auth Source Reject: [ogr1(a)erzurum.edu.tr] No matching user found in authentication source!): [ogr1(a)erzurum.edu.tr] (from client rektorluk port 0 cli 3233fb9fb6d3 via TLS tunnel) Called-Station-ID: a8bd27c04dac Calling-Station-ID: 3233fb9fb6d3 Auth-Type: (633) Using Post-Auth-Type Reject (633) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (633) Post-Auth-Type REJECT { (633) attr_filter.access_reject: EXPAND %{User-Name} (633) attr_filter.access_reject: --> ogr1(a)erzurum.edu.tr (633) attr_filter.access_reject: Matched entry DEFAULT at line 11 (633) [attr_filter.access_reject] = updated (633) update outer.session-state { (633) &Module-Failure-Message := &request:Module-Failure-Message -> 'Auth Source Reject: [ogr1(a)erzurum.edu.tr] No matching user found in authentication source!' (633) } # update outer.session-state = noop (633) } # Post-Auth-Type REJECT = updated (633) EXPAND Called-Station-ID: %{Called-Station-ID} Calling-Station-ID: %{Calling-Station-ID} Auth-Type: %{control:Auth-Type} (633) --> Called-Station-ID: a8bd27c04dac Calling-Station-ID: 3233fb9fb6d3 Auth-Type: (633) Login incorrect (Auth Source Reject: [ogr1(a)erzurum.edu.tr] No matching user found in authentication source!): [ogr1(a)erzurum.edu.tr] (from client rektorluk port 0 cli 3233fb9fb6d3 via TLS tunnel) Called-Station-ID: a8bd27c04dac Calling-Station-ID: 3233fb9fb6d3 Auth-Type: (633) } # server inner-tunnel (633) Virtual server sending reply (633) eap_ttls: Got tunneled Access-Reject (633) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed .... .... .... Any idea why "redundant" behaves different in the inner-tunnel or what am I missing? Regards, Rahman Duran

3 3

Does FreeRadius support TACACS+
by Rob Hughes 03 Mar '22

03 Mar '22

Hi, we have migrated a number of devices away from a RADIATOR server to FreeRadius. The RADIATOR also has a TACACS+ proxy which I'd like to replace with FreeRadius. My aim is to move over completely to use FreeRadius. Does FreeRadius currently support TACACS+? Regards Rob *Rob Hughes* | *Linux System Administrator* *|* *euNetworks* 5 Churchill Place *|* London *|* E14 5HU *+44 7740 098955* mobile For more information about euNetworks visit eunetworks.com <http://www.eunetworks.com/> or for details of our companies including euNetworks Fiber UK Ltd visit eunetworks.com/companies <http://www.eunetworks.com/companies>. Subscribe to receive updates from euNetworks eunetworks.com/subscribe/ <https://www.eunetworks.com/subscribe/> This email and any attachments may contain confidential and/or legally privileged information. If you are not the intended recipient, please delete the email without reading it and notify the sender.

2 1

Proxy - Home Server Management
by Mucci Andrea 02 Mar '22

02 Mar '22

Hi all, first of all I'm using version 3.0.25. I would like to have a clarification on the logic of Proxy. We have a configuration like this: Home Server: home_server "RAD-ROUTEDW3-1" { type = "auth+acct" ipaddr = "IpAddress1" port = 1812 secret = "********" response_window = 6 response_timeouts = 10 zombie_period = 30 status_check = "request" username = "radtest" password = "***" check_interval = 6 check_timeout = 6 num_answers_to_alive = 5 } home_server "RAD-ROUTEDW3-2" { type = "auth+acct" ipaddr = "IpAddress2" port = 1812 secret = "*********" response_window = 6 response_timeouts = 10 zombie_period = 30 status_check = "request" username = "radtest" password = "***" check_interval = 6 check_timeout = 6 num_answers_to_alive = 5 } Home Server Pool: home_server_pool "[AR] roamer.routedw3" { type = "fail-over" home_server = "RAD-ROUTEDW3-1" home_server = "RAD-ROUTEDW3-2" } Realm realm "~(?i)roamer.routedw3$" { pool = "[AR] roamer.routedw3" } We have seen that the change of state from live to dead is independent between the auth port and the acct port. If Home Server "RAD-ROUTEDW3-1" is unreachable, I will have to wait ten Access-Requests before sending an Access-Request to "RAD-ROUTEDW3-2". Now the Accounting-Request packet with Acct-Status-Type = 1 is not sent to the "RAD-ROUTEDW3-2"(The live Home Server), but again to the "RAD-ROUTEDW3-1" which however is unreachable. So I'll have to wait another ten Accounting-Request before sending the request to the live Home Server. Maybe it was better to handle the change of state live, zombie, dead by Home Server and not by port. Is there a way to force the sending of the Accounting-Request to the same Home Server to which the Access-Request was sent? Best Regards Andrea

2 1

Re: rlm_rest: Adding additional parameters
by Alan DeKok 02 Mar '22

02 Mar '22

On Mar 2, 2022, at 8:11 AM, Rens Houben <rhouben(a)systemec.nl> wrote: > > %{client:vendor} > > > There's no "vendor" field in the "client" definition? Meh. Just add one: > > >client foo { > > ipaddr = 1.2.3.4 > > secret = woo > > vendor = juniper > >} > > > You can put pretty much anything you want into the "client" definition, so long as it doesn't conflict with an existing config item. > > Unfortunately, this doesn't seem to have worked like I assumed it would. I'm attaching the full freeradius -X debug log below, but the short of it is that for some reason freeRADIUS didn't seem to expand the vendor variable into the request. > > Adding > > update request { > Vendor := 'ERX' > } That is absolutely not what I said to do. I didn't say to use an "update" section. I said to add a "Local-Vendor-Name" in raddb/dictionary. I didn't say to use "Vendor". Add the "vendor" line to the *client* definition, in the "clients.conf" file. Then, you can dynamically expand it via a %{client:vendor}. i.e. update request { Local-Vendor-Name := "%{client:vendor}" } > to the authorize stanza worked fine, but {%client:vendor} didn't get expanded. Since you didn't actually put the %{client:vendor} text anywhere, there's no surprise that it doesn't get expanded. Alan DeKok.

1 0

Getting remote proxy details in unlang
by Mark Donnelly 01 Mar '22

01 Mar '22

Hey all: I have a setup where I'm working with multiple partners for authentication. I have the proxying set up, and authentication is working great. The next step is that we want to do some reporting based on various factors, including which partner receives the proxied requests. The way I currently have it structured, this corresponds to a home_server_pool (but could be open to change if needed). I've spent a good part of yesterday looking for what I can write in Unlang to give me that information, but I can't figure out if it's exposed via any variable, list, or attribute. Does FreeRADIUS expose the home_server or home_server_pool of a proxy request anyplace where I could incorporate it into an expression to throw into a filename or log line? Thanks in advance!, --Mark Donnelly Painless Security

2 2

rlm_rest: Adding additional parameters
by Rens Houben 01 Mar '22

01 Mar '22

Hello all, I'm going to elaborate a bit on my current situation just in case I'm hitting an XY problem. I'll try to be succinct; please bear with me. I've got a FreeRADIUS setup that's working well - the RADIUS server calls a REST API to handle access requests, which connects to a database that's administered via a web frontend. Smooth sailing, and has been for several years. However, due to circumstances involving the company that supplied (and supplies the support for) our core routers going out of the router biz we've had to acquire new core routers from a different vendor... And, perhaps unsurprisingly, said vendor's hardware speaks a different dialect. The good news, such as it is, is that with some judicious parallel naming the actual /values/ can stay the same, but the /attribute names/ will change. Worse (from my perspective), my manager would very much like it if, while both sets of core routers are connected to our network, a connection attempt could be handled by either type of router while only being a single "Connection" entry in the frontend. Thankfully, I'm - if I say so myself - a fairly decent programmer and I've been able to rewrite the code logic so that the getAttributes() call (which creates the json dictionary that is then sent back by the REST API as the response) takes a 'vendor' parameter which pertinent parts use to determine how to respond -- IE, for a certain part, getAttributes('Ericsson') will yield '{'Qos-Metering-Profile-Name': 'test-down', 'Qos-Policing-Profile-Name': 'test-up'}' whereas getAttributes('ERX') yields '{'ERX-Ingress-Policy-Name': 'test-up', 'ERX-Egress-Policy-Name': 'test-down'}' This part works and has been tested, but what I now need is to find a good way to /supply/ that 'Vendor' parameter to the function. I've already restructured the FreeRADIUS config to use virtual servers so that I'll be able to use a different processing path depending on which client is asking, but I'm currently blanking on how best to add a 'Vendor=<...>' attribute to the REST request. I'd prefer to do that in the authorize{} function but I'm not 100% sure if I can just use update{} to add an arbitrary variable to the request. Worst case, which I'd prefer to avoid, I could just create two different copies of rlm_rest, one for the Ericssons and one for the ERXen and send them to different entry points in the REST API, but that'd require a whole lot more code duplication than I'm comfortable with. I'd welcome any suggestions or recommendations or "You're overthinking it, just use <Z>". --Rens Houben

3 2