- Freeradius-Users - lists.freeradius.org

Re: User + Device Authentication to Specific Network
by Duncan X Simpson 12 Jun '19

12 Jun '19

On Jun 8, 2019, at 3:11 AM, Alan DeKok <aland(a)deployingradius.com> wrote: > That should be pretty simple. Put the MAC addresses into a database, and have FreeRADIUS check the database. > > if ("%{sql:SELECT MAC from known_macs WHERE MAC = %{Calling-Station-Id}") { > ... add to VLAN 2 ... > } > else { > ... add to VLAN 1 ... > } > > You'll have to create your own table, and do some more tests. But that's the basic idea. Thank you for the help! I seem to almost have it working, but I've run into one problem: Attributes don't seem to be expanding. I have the following in my post-auth section for testing: update reply { Unix-FTP-Shell := "%{Calling-Station-Id}" } Every time, Unix-FTP-Shell is set, but it's set to "": (22) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (22) post-auth { (22) update reply { (22) &Tunnel-Type := VLAN (22) &Tunnel-Medium-Type := IEEE-802 (22) } # update reply = noop (22) update reply { (22) EXPAND %{Calling-Station-Id} (22) --> (22) Unix-FTP-Shell := (22) } # update reply = noop I've swapped out Calling-Station-Id for a couple other things to test (Tunnel-Type (which I set about 3 lines up) and Service-Type (which came in with the request)), both with the same results. Why are these not getting expanded? Is post-auth the wrong place to do this?

2 5

Invalid vendor name in attribute name "0"
by Kyle Parrish 10 Jun '19

10 Jun '19

Hello, Seeking assistance troubleshooting the following error when running radiusd via Systemd. Error is: EXIT(1) CALLED src/main/mainconfig.c[955]. Last error was: Invalid vendor name in attribute name "0" Fresh install of FreeRADIUS 3.0.20. Compiled with "--localstatedir=/var --sysconfdir=/etc --with-rlm_sql_freetds --with-systemd" Operating System: Ubuntu 16.04.6 LTS Kernel: Linux 4.4.0-150-generic Architecture: x86-64 All configuration is default (aside from changing the user it is to run as to "Radiusd" in radiusd.conf). Running "radiusd -X" as root works as expected. Running "radiusd -X" as radiusd user manually works as expected. Only receive the error when running via Systemd. Systemd unit file is: [Unit] Description=FreeRADIUS multi-protocol policy server After=network-online.target Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ [Service] Type=notify WatchdogSec=60 NotifyAccess=all PIDFile=/var/run/radiusd/radiusd.pid EnvironmentFile=-/etc/default/radiusd # FreeRADIUS can do static evaluation of policy language rules based # on environmental variables which is very useful for doing per-host # customization. # Unfortunately systemd does not allow variable substitutions such # as %H or $(hostname) in the EnvironmentFile. # We provide HOSTNAME here for convenience. Environment=HOSTNAME=%H # Limit memory to 2G this is fine for %99.99 of deployments. FreeRADIUS # is not memory hungry, if it's using more than this, then there's probably # a leak somewhere. MemoryLimit=2G RuntimeDirectory=radiusd RuntimeDirectoryMode=0775 ExecStartPre=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout ExecStartPre=/bin/chown radiusd:radiusd /var/run/radiusd ExecStart=/usr/sbin/radiusd $FREERADIUS_OPTIONS Restart=on-failure RestartSec=5 # Don't elevate privileges after starting NoNewPrivileges=true # Allow binding to secure ports, broadcast addresses, and raw interfaces. CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW # Private /tmp that isn't shared by other processes PrivateTmp=true # cgroups are readable only by radiusd, and child processes ProtectControlGroups=true # don't load new kernel modules ProtectKernelModules=true # don't tune kernel parameters ProtectKernelTunables=true # Only allow native system calls SystemCallArchitectures=native # We shouldn't be writing to the configuration directory ReadOnlyDirectories=/etc/raddb/ # We can read and write to the log directory. ReadWriteDirectories=/var/log/radius/ [Install] WantedBy=multi-user.target Please let me know if there is any additional information that may help. Thank you. -- *Kyle Parrish* KyleParrish.com *living life to the fullest*

3 7

LDAP group checking stopping before the whole group list is checked
by Adam Bishop 10 Jun '19

10 Jun '19

I'm having an issue with ldap group checking where FreeRADIUS appears to bail out early if it encounters a group DN it can't resolve. The LDAP server (FreeIPA) has a very restrictive set of ACL's; the group which cannot be resolved (Replication Administrators) is not readable by standard accounts. I'd like to avoid messing with the ACL's, or granting FreeRADIUS more privileges if possible. If I run ldapsearch, the group I'm looking for is definitely in the memberOf list. Can I get it to continue reading the list of groups if it fails to resolve one, or is this intended (or something I've screwed up in the config)? Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk --- # raddebug (3) Debug: Received Access-Request Id 154 from [1:2:3:4:5::6]:55794 to [1:2:3:4:5::7]:1812 length 93 (3) Debug: User-Name = "adam" (3) Debug: User-Password = "asdf" (3) Debug: NAS-Identifier = "esw-001" (3) Debug: Calling-Station-Id = "8.8.8.8" (3) Debug: NAS-IPv6-Address = 1:2:3:4:5::6 (3) Debug: # Executing section authorize from file /etc/raddb/sites-enabled/infrastructure (3) Debug: authorize { (3) Debug: update request { (3) Debug: } # update request = noop (3) Debug: ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (3) Debug: ldap: --> (uid=adam) (3) Debug: ldap: Performing search in "cn=users,cn=accounts,dc=example,dc=org" with filter "(uid=adam)", scope "sub" (3) Debug: ldap: Waiting for search result... (3) Debug: ldap: User object found at DN "uid=adam,cn=users,cn=accounts,dc=example,dc=org" (3) Debug: ldap: Processing user attributes (3) Debug: [ldap] = ok (3) Debug: if ((ok || updated) && User-Password) { (3) Debug: if ((ok || updated) && User-Password) -> TRUE (3) Debug: if ((ok || updated) && User-Password) { (3) Debug: update { (3) Debug: } # update = noop (3) Debug: } # if ((ok || updated) && User-Password) = noop (3) Debug: if (&LDAP-Group[*] == "%{client:ldap_group}") { (3) Debug: EXPAND %{client:ldap_group} (3) Debug: --> switching-admins (3) Debug: Searching for user in group "switching-admins" (3) Debug: Using user DN from request "uid=adam,cn=users,cn=accounts,dc=example,dc=org" (3) Debug: Checking user object's memberOf attributes (3) Debug: Performing unfiltered search in "uid=adam,cn=users,cn=accounts,dc=example,dc=org", scope "base" (3) Debug: Waiting for search result... (3) Debug: Processing memberOf value "cn=servicea-admins,cn=groups,cn=accounts,dc=example,dc=org" as a DN (3) Debug: Resolving group DN "cn=servicea-admins,cn=groups,cn=accounts,dc=example,dc=org" to group name (3) Debug: Performing unfiltered search in "cn=servicea-admins,cn=groups,cn=accounts,dc=example,dc=org", scope "base" (3) Debug: Waiting for search result... (3) Debug: Group DN "cn=servicea-admins,cn=groups,cn=accounts,dc=example,dc=org" resolves to name "servicea-admins" (3) Debug: Processing memberOf value "cn=serviceb-admins,cn=groups,cn=accounts,dc=example,dc=org" as a DN (3) Debug: Resolving group DN "cn=serviceb-admins,cn=groups,cn=accounts,dc=example,dc=org" to group name (3) Debug: Performing unfiltered search in "cn=serviceb-admins,cn=groups,cn=accounts,dc=example,dc=org", scope "base" (3) Debug: Waiting for search result... (3) Debug: Group DN "cn=serviceb-admins,cn=groups,cn=accounts,dc=example,dc=org" resolves to name "serviceb-admins" <snip 10+ other groups> (3) Debug: Processing memberOf value "cn=Replication Administrators,cn=privileges,cn=pbac,dc=example,dc=org" as a DN (3) Debug: Resolving group DN "cn=Replication Administrators,cn=privileges,cn=pbac,dc=example,dc=org" to group name (3) Debug: Performing unfiltered search in "cn=Replication Administrators,cn=privileges,cn=pbac,dc=example,dc=org", scope "base" (3) Debug: Waiting for search result... (3) Debug: Search returned no results (3) ERROR: Group DN "cn=Replication Administrators,cn=privileges,cn=pbac,dc=example,dc=org" did not resolve to an object (3) Debug: User is not a member of "switching-admins" (3) Debug: if (&LDAP-Group[*] == "%{client:ldap_group}") -> FALSE (3) Debug: else { (3) Debug: update reply { (3) Debug: } # update reply = noop (3) Debug: [reject] = reject (3) Debug: } # else = reject (3) Debug: } # authorize = reject (3) Debug: Using Post-Auth-Type Reject (3) Debug: # Executing group from file /etc/raddb/sites-enabled/infrastructure (3) Debug: Post-Auth-Type REJECT { (3) Debug: attr_filter.access_reject: EXPAND %{User-Name} (3) Debug: attr_filter.access_reject: --> adam (3) Debug: attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) Debug: [attr_filter.access_reject] = updated (3) Debug: [eap] = noop (3) Debug: rp_log: EXPAND rp_log.%{%{reply:Packet-Type}:-format} (3) Debug: rp_log: --> rp_log.Access-Reject (3) Debug: rp_log: EXPAND radiusd-rp-log#DOMAIN=VIRT#LOCATION=ATL#SERVICE=%{%{Service-Class}:-NONE}#ORG=%{%{request:operator-name}:-%{request:Stripped-User-Domain}}#USER=%{User-Name}#CSI=%{Calling-Station-Id}#NAS=%{Called-Station-Id}#CUI=%{reply:Chargeable-User-Identity}#RESULT=FAIL#VLAN=%{%{reply:Tunnel-Private-Group-ID}:-NONE}#CLIENT=%{client:shortname}#REPLY_MESSAGE=%{%{reply:reply-message}:-NONE}#MODULE_MESSAGE=%{%{%{request:Module-Failure-Message}:-%{session-state:Module-Failure-Message}}:-NONE}# (3) Mon Jun 10 01:17:34 2019: Debug: rp_log: --> radiusd-rp-log#DOMAIN=VIRT#LOCATION=ATL#SERVICE=infrastructure#ORG=#USER=adam#CSI=8.8.8.8#NAS=#CUI=#RESULT=FAIL#VLAN=NONE#CLIENT=esw-001.inf#REPLY_MESSAGE=Not Authorised#MODULE_MESSAGE=Group DN "cn=Replication Administrators,cn=privileges,cn=pbac,dc=example,dc=org" did not resolve to an object# (3) Debug: [rp_log] = ok (3) Debug: policy remove_reply_message_if_eap { (3) Debug: if (&reply:EAP-Message && &reply:Reply-Message) { (3) Debug: if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) Debug: else { (3) Debug: [noop] = noop (3) Debug: } # else = noop (3) Debug: } # policy remove_reply_message_if_eap = noop (3) Debug: } # Post-Auth-Type REJECT = updated (3) Debug: Delaying response for 1.000000 seconds (3) Debug: Sending delayed response (3) Debug: Sent Access-Reject Id 154 from [1:2:3:4:5::7]:1812 to [1:2:3:4:5::6]:55794 length 36 (3) Debug: Reply-Message := "Not Authorised" (3) Debug: Cleaning up request packet ID 154 with timestamp +1036 Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

3 2

Re: Re: Data convertion and pre-defined variables for Dhcp site.
by CpServiceSPb 10 Jun '19

10 Jun '19

> Because DHCP-SIP-Servers-DHCP-Option is an "octets" data type, so you have to feed it octets. e.g. > &DHCP-SIP-Servers-DHCP-Option = 0x01c0a800fe > That will work. >* Dhcpdump shows: *> >* OPTION: 120 ( 12) SIP Servers DHCP Option *3131302e31302e302e323534* *> Because you gave the attribute a text string. Which isn't hex, and it isn't an IP address. But option 43 - DHCP-Vendor is octet also. However &DHCP-Vendor = "http://user:pass@%{listen:src_ipaddr}/pbx" works fine. > You just typed it there. You can add that as hex to the "update" statement. >* I specified this option at isc-dhcp-server simply *>* *option sip-pbx-servers 1 192.168.0.254;* *> That's nice for them. I added it &DHCP-SIP-Servers-DHCP-Option = "0x01c0a800fe" to update section. If you talked about it. But it would be easy that it is in human readable/clear format. > That's unfortunately more difficult to do in FreeRADIUS. Your best bet is to just use hex. Is there string to hex convertion ? Look like %{hex:%{listen:str_ipaddr}} ? But what about your previous words: > I looked into a lot of docs but didn' t find any success resolution. > So, how is the best way at unlang to: > - convert ipaddr type to octet; > - convert string to octet; > - convert string to ipaddr ? > You don't. The server should automatically do this. As I understood, in case of 120 option conversion in particular is made automatically, is it ?

2 3

Conditional variable references
by Adam Bishop 10 Jun '19

10 Jun '19

I store some settings like the redis password, and localhost shared secrets as variables, i.e.: ldap { ... identity = ${bind_dn} ... } as I'm running a single set of configuration shared across 3 different sets of servers, with a file called 'variables' generated by puppet that contains the instance specific settings. Is there any way to have a default value for these kinds of variables so I don't have to populate unused ones with dummy values? Or to have the server ignore missing variable references? I tried instantiating the variables as empty strings, then redefining them like: # cat /etc/raddb/radius.conf ... $INCLUDE defaults $INCLUDE variables ... # cat /etc/raddb/defaults ... bind_dn = "" # cat /etc/raddb/variables ... bind_dn = "dc=jisc,dc=ac,dc=uk" Which loaded without error, but returned an empty string. Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

2 2

Can I gracefully handle radius requests if all home servers are down?
by work vlpl 10 Jun '19

10 Jun '19

Hello, Is it possible to detect that home server is not available and gracefully process radius request locally? I tried to use `Post-Proxy-Type Fail-Authentication {}` section but it seems that FreeRadius server will not expect ``` update control { Auth-Type := Accept } ``` instruction in that section and reject request. This is a fragment from debug log ``` (30) Post-Proxy-Type Fail-Authentication { (30) update reply { (30) Tunnel-Type := VLAN (30) Tunnel-Medium-Type := IEEE-802 (30) Tunnel-Private-Group-id := 333 (30) Idle-Timeout := 1800 (30) } # update reply = noop (30) update control { (30) Auth-Type := Accept (30) } # update control = noop (30) } # Post-Proxy-Type Fail-Authentication = noop (30) There was no response configured: rejecting request (30) Using Post-Auth-Type Reject ``` -- Vladimir

3 6

Port/mac/IP authentication, authorization, auditing. Is it possible ?
by CpServiceSPb 09 Jun '19

09 Jun '19

Is it possible by default or by using additional modules to authentice, authorize devices plugged to managed switch not only by mac, btu also by mac/ip or port/mac/ip, especially for statically assigned devices ?

3 8

Data convertion and pre-defined variables for Dhcp site.
by CpServiceSPb 09 Jun '19

09 Jun '19

I try to set up Dhcp Option 120 - freeradius DHCP-SIP-Servers-DHCP-Option and Dhcp Option 43 - DHCP-Vendor using unlang, both are octet type. But is still faulted. I looked into a lot of docs but didn' t find any success resolution. So, how is the best way at unlang to: - convert ipaddr type to octet; - convert string to octet; - convert string to ipaddr ? I tried to use %{hex:192.168.0.254} and %{ipaddr: 192.168.0.254} but there is nothing. Also, I investigate that %{listen:src_ipaddr} is possible to use as some of pre-defined variable with Dcp IP. But its type is string. Also I tried %{hex: :%{listen:src_ipaddr}} and %{ipaddr:%{listen:src_ipaddr}} , there is no positive result. So, is there predefined variables, providing for example IP of Dhcp which I can use anywhere instead of specifying of 192.168.0.254 directly ? For example &DHCP-Domain-Name-Server += %{ipaddr:&some_variable}

2 3

Two radius servers and active sessions
by Marcin Romanowski 08 Jun '19

08 Jun '19

Hello, I'm going to set up two freeradius servers, one as primary second as slave. Both devices in different location. I'm going to genrate plain files for configuration for PPPoE servers. My problem is how to properlly sychronize actual active sessions for using simultanieusly = 1. What is proper way to acheve that solution? Best regards

2 1

Freeradius LDAP and Primary Group Issues
by Kevin Virk 08 Jun '19

08 Jun '19

I have utilized this mailing list to setup Freeradius and everyone has been a great help especially Alan. Thank you very much. Background: I am running Freeradius with EAP-TLS where the cert has a computername attribute that I pull and used that in a LDAP search for group membership of that computer to assign the computer into a VLAN. So this is working but only for users in the active directory group Domain Users. I test my ldap queries on ldp.exe on windows 10 and what I have discovered is the query I am using does not include any computers that are not in domain users as their primary group. This is the LDAP Query I am using: (&(objectClass=computer)(memberOf:1.2.840.113556.1.4.1941:=CN=RadiusGroup,OU=Groups,OU=Departments,DC=Company,DC=local)) Some background on this query is that the top level radius group contains other security groups which contain the actual computers which is why there is the need for .1941 memberOF attribute which will return double nested group memberships. My question for the mailing list is, has anyone dealt with this type of issue and if so how have you solved it? A quick summary if none of this makes sense is: Freeradius is working however LDAP doesn't return computers that are not in the domain users primary group which leads to computers that are not in domain users to not be authenticated even though they are in the security group. Thank you very much for your time.

2 1