- Freeradius-Users - lists.freeradius.org

WEB Login fails occasionally even though radius authentication succeed
by Rajesh Subramanian 13 Apr '20

13 Apr '20

Hello all, I am using PAM radius module version 1.4.1 Testing sample: PAM radius does not support authorization. I DO NOT require accounting and authorization and have kept the return types as optional. Configure radius server and trying to login using radius users. Syslog is enabled Scenario 1: The following is the configuration inside /etc/pam.d/ # cat ssh auth sufficient /lib/security/pam_radius_auth.so debug account optional /lib/security/pam_radius_auth.so debug session optional /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_unix.so use_first_pass account optional /lib/security/pam_unix.so use_first_pass session optional /lib/security/pam_unix.so use_first_pass # cat php auth required /lib/security/pam_succeed_if.so user != root quiet auth sufficient /lib/security/pam_radius_auth.so debug account optional /lib/security/pam_radius_auth.so debug session optional /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_unix.so use_first_pass account optional /lib/security/pam_unix.so use_first_pass session optional /lib/security/pam_unix.so use_first_pass SSH - Always successful WEB - Sometimes, the login fails (NOT always) The following are noticed during the failure scenarios 1. Radius authentication always succeeds and final SYSLOG from radius module received is *USER.DEBUG. php: pam_radius_auth: authentication succeeded* 2. After this, the following SYSLOG is seen and login failed *AUTHPRIV.WARNING. php: pam_unix(php:auth): check pass; user unknownAUTHPRIV.NOTICE. php: pam_unix(php:auth): authentication failure, logname= uid=0 euid=0 tty= ruser= rhost=<IP address>* Scenario 2: I did the following changes with respect to the configuration to skip pam_unix and depend on pam_radius only. # cat ssh auth sufficient /lib/security/pam_radius_auth.so debug account optional /lib/security/pam_radius_auth.so debug session optional /lib/security/pam_radius_auth.so debug # cat php auth required /lib/security/pam_succeed_if.so user != root quiet auth sufficient /lib/security/pam_radius_auth.so debug account optional /lib/security/pam_radius_auth.so debug session optional /lib/security/pam_radius_auth.so debug SSH - Always successful WEB - Sometimes, the login fails (NOT always) The following are noticed during the failure scenarios 1. Radius authentication always succeeds and final SYSLOG from radius module received is *USER.DEBUG. php: pam_radius_auth: authentication succeeded* 2. After this, there are no SYSLOG messages In both cases, login fails sometimes and only through a WEB interface. Could you please provide any suggestions on the above? Why is the user unknown in scenario 1 Thanks, Rajesh

2 1

free radius 3.0. 21 on rhel site for download
by saurav jalan 13 Apr '20

13 Apr '20

Hi When we can expect official release of free radius 3.0.21 on rhel site for download . Thanks & Regards Saurav jalan

2 1

Remove mariadb - connector - free version
by saurav jalan 13 Apr '20

13 Apr '20

Hi Why mariadb-connector-c.x86_64 dependency is remove from free radius version 3.0.21 . Any bug was there in the previous version . Thanks & Regards Saurav jalan

1 0

freeradius-mysql dependent rpm
by saurav jalan 13 Apr '20

13 Apr '20

Hi Why mariadb-connector-c.x86_64 is the dependent rpm for freeradius-mysql-3.0.17-6 . Any reason for that , in earlier version of freeradius-mysql-2.X.X mariadb connector is not required . Thanks & Regards Saurav jalan

1 0

Same IP for different Users
by Aurélio de Souza Ribeiro Neto 12 Apr '20

12 Apr '20

Hi Everyone, Happy easter to all!! I´m using Freeradius 3.0.20 and MySQL. Sometimes, I think in NAS fault or packet loss, I have same IP for 2 different users. Any hint? Thanks Aurélio

2 1

free radius installation on rhel 8
by saurav jalan 12 Apr '20

12 Apr '20

Hi,I am trying to configure and run freeradius-3.0.17-6 with installed MySQL 8 in RHEL 8 and doesn’t want to install mariadb. Is there any way to configure and run it without mariadb?I have tried to configure and run but getting below ERROR please check and suggest the next stepsERROR --------------- Could not link driver rlm_sql_mysql: libmariadb.so.3: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld /etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql"Installed freeradius rpm (Installed with --nodeps) ========================================== freeradius-3.0.17-6.module+el8.1.0+3392+9bd8939b.x86_64.rpm freeradius-mysql-3.0.17-6.module+el8.1.0+3392+9bd8939b.x86_64.rpm freeradius-utils-3.0.17-6.module+el8.1.0+3392+9bd8939b.x86_64.rpmInstalled with –nodeps Shell# rpm –ivh freeradius-3.0.17-6.module+el8.1.0+3392+9bd8939b.x86_64.rpm freeradius-mysql-3.0.17-6.module+el8.1.0+3392+9bd8939b.x86_64.rpm freeradius-utils-3.0.17-6.module+el8.1.0+3392+9bd8939b.x86_64.rpm --nodepsInstalled MySQL rpm (Installed with --nodeps) ===================================== mysql-commercial-backup-8.0.17-1.1.el8.x86_64.rpm mysql-commercial-client-8.0.17-1.1.el8.x86_64.rpm mysql-commercial-common-8.0.17-1.1.el8.x86_64.rpm mysql-commercial-devel-8.0.17-1.1.el8.x86_64.rpm mysql-commercial-libs-8.0.17-1.1.el8.x86_64.rpm mysql-commercial-server-8.0.17-1.1.el8.x86_64.rpm mysql-commercial-test-8.0.17-1.1.el8.x86_64.rpm Thanks & Regards Saurav jalan

2 1

[RLM_REST] REST API creation using Freeradius REST Module
by Ashish Yadav 10 Apr '20

10 Apr '20

Dear Members, I am planning to create RADIUS authentication for our application using REST APIs but I was not able to move forward, I have tried couple of methods, https://github.com/fgsants/REST-API-FreeRADIUS In above method I was able to create users using DB Endpoint but RADIUS Endpoint was not working for me and I have posted there as well but no luck. For plain REST module I have referred below link as well, https://privacyidea.readthedocs.io/en/latest/application_plugins/rlm_rest.h… I am not getting clue on how to use the RLM_REST module to fulfil our requirements which is to authenticate users using REST APIs via RADIUS. Please let me know from where I can start to solve this issue. --Regards Ashishkumar S. Yadav

2 1

Freeradius Python version
by Dan M 09 Apr '20

09 Apr '20

We have been using python with freeradius for a little over a year with much success. Now we would like to upgrade Python from 2.7 to 3.x. Perhaps this only reflects my ignorance, but how can I configure freeradius to use python3? Currently, the python executable is a symlink /usr/bin/python -> python2 I don't expect this symlink to change based on the way our enterprise does things. Or does it actually even use that? Maybe it is only configured via python_path in mods-available/python. Please advise. Dan Mullen

2 1

Redundant-load-balance
by Daniel Oakes 08 Apr '20

08 Apr '20

So I’ve tried, but failed to get this working – I’m sure someone can point me in the right direction (or a sledgehammer…). So I changed mods-enabled/ldap to have two entries ldap server001 { .. } ldap server002 { .. } Modified sites-enabled/inner-tunnel to: Auth-Type LDAP { redundant-load-balance ldap { server001 server002 } } And tried variations based on finding things in the freeradius mailing lists but I can’t seem to get it working. Output from debug generally gives me: /etc/raddb/sites-enabled/inner-tunnel[157]: Failed to find "ldap" as a module or policy. /etc/raddb/sites-enabled/inner-tunnel[157]: Please verify that the configuration exists in /etc/raddb/mods-enabled/ldap. /etc/raddb/sites-enabled/inner-tunnel[48]: Errors parsing authorize section. What secret sauce ingredient am I missing? I’ve tried defining, including use instantiate etc, but just can’t get a working scenario. Regards, Daniel

5 11

FreeRADIUS 3.0.x and user authentification against Novell eDirectory without Universal Password
by Martin Kozelský 08 Apr '20

08 Apr '20

Hi, I am upgrading FreeRADIUS server from 2.2.5 (Debian 8) to 3.0.17 (Centos 8). I use LDAP user authentication against Novell eDirectory, where authentication works in two steps: 1. anonymous searching user in LDAP, 2. binding to LDAP as user with cleartext password, if it is successfull, the authentication&authorization is successfull. It is done by configuration option "edir_account_policy_check=yes" In new FreeRADIUS I have to use options "edir=yes" & "edir_autz=yes", but Universal Password is required before the step 2. and it fails: Mon Apr 6 15:03:15 2020 : Debug: (0) ldap: Performing search in "o=xxx" with filter "(uid=xxx)", scope "sub" Mon Apr 6 15:03:15 2020 : Debug: (0) ldap: Waiting for search result... Mon Apr 6 15:03:15 2020 : Debug: (0) ldap: User object found at DN "cn=xxx,ou=xxx,o=xxx" Mon Apr 6 15:03:15 2020 : ERROR: (0) ldap: Failed to retrieve eDirectory password: (-1631) BER manipulation failed I need to disable Universal Password. In my opinion something as "edir=no" & "edir_autz=yes" can solve it, but it doesn't work. You can see in source file rlm_ldap.c that "edir=no" option disables all eDirectory code block. Or any advice? Thank you very much Martin Kozelsky

2 2