- Freeradius-Users - lists.freeradius.org

RE: redis_ippool module doesnot process lease_time in ack
by Chinnapaiyan, Nagamani 04 May '19

04 May '19

redis_ippool module: redis_ippool { # # Note all configuration items at this level (above the redis block) # are polymorphic, meaning xlats, attribute references, literal values # and execs may be specified. # # For example pool_name could be pool_name = 'my_test_pool' if only a # single pool were being used. # # Name of the pool to allocate leases from. # pool_name = &control:Pool-Name # # How long a lease is reserved for after making an offer to the DHCP client # if no value is provided, the value from lease_time is used for initial # allocations. No value should be provided for PPP/VPNs, this is mainly for # the DORA flow in DHCP. # offer_time = 120 # # How long a lease is allocated for # lease_time = &reply:DHCP-IP-Address-Lease-Time # # The device identifier, usually the Mac-Address but could be a combination # of attributes, a user-name or a certificate serial number (if the number # of sessions were limited to one per user/serial). # device = &DHCP-Client-Hardware-Address # # The IP address being renewed or released # requested_address = "%{%{DHCP-Requested-IP-Address}:-%{DHCP-Client-IP-Address}}" # # List and attribute where the allocated address is written to. # allocated_address_attr = &reply:DHCP-Your-IP-Address # # List and attribute where the Pool-Range ID (if set) is written to. # # The idea of the Pool-Range is that it provides a key into other datastores # or caches, which store the additional options associated with the range an # IP address belongs to. # # There may be multiple ranges of IP address contained within any given pool, # which is why this is provided in addition to the pool name. # range_attr = &reply:Pool-Range # # If set - the list and attribute to write the remaining lease time to. # This can be populated on alloc, or renew, if an IP address was available # for the alloc. # expiry_attr = &reply:DHCP-IP-Address-Lease-Time # # If true - Copy the value of ip_address to the attribute specified by # reply_attr when performing an update/renew. This is needed for DHCP where # we need to send back DHCP-Your-IP-Address in ACKs. # copy_on_update = yes # # Redis connection settings - Identical to all other Redis based modules. # redis { server = devstack08-db-eval1-0001-001.oovb0g.0001.usw2.cache.amazonaws.com pool { start = 0 min = ${thread[pool].num_workers} max = ${thread[pool].num_workers} spare = 1 uses = 0 lifetime = 0 retry_delay = 30 idle_timeout = 60 } } } dhcp server: recv DHCP-Request { ... update reply { &DHCP-IP-Address-Lease-Time = 3600 &DHCP-Domain-Name-Server = 72.173.31.41 ... } Regards, Nagamani Chinnapaiyan

3 2

Fwd: Re: SQL query as fallback to auth script?
by Wladyslaw Jankowski 04 May '19

04 May '19

On 03.05.19 18:35, Alan DeKok wrote: >> On May 3, 2019, at 10:40 AM, Wladyslaw Jankowski <wladekj(a)interia.pl> >> wrote: >> >> Learn how to format your messages. When you make it difficult for us >> to help you, we're inclined to avoid helping you. Please accept my apologies for my last message's formatting. What was written in plain ASCII became somehow re-formatted to HTML, and a lot of newlines were scrambled. Using different client now. >> This is the idea: script should always reject - doing its thing >> behind the scenes - and allow for SQL fallback. >> >> That makes no sense whatsoever. If the script always rejects, then >> you always need a work-around for that reject. >> >> Why not just have the script do it's thing, and have it return an >> "ok" code? The idea is for the script to ping the auth server (proprietary solution) for given user's NT hash, and store it in a local database for a short period of time. Script should always "Reject" and there is where I was hoping for an ability for an SQL fallback. This way the script would temporarily insert NT hash into the local database, and FreeRADIUS would query the database entry moments later. This would introduce a short delay but should work - would the fallback be possible. > I can't "Accept" RADIUS auth with this script as it can't calculate > MSCHAP challanges and no cleartext password will be provided to it > (can't use PAP). > Yes, FreeRADIUS does authentication. Your script doesn't. That's the > way it should work./ From my understanding of MSCHAP RFC documents - access to the NT hash is required to calculate/validate the challenge and/or Authenticator field. The idea was for the RADIUS server not to have full access to the whole database but to fire up a script that would grab one given hash, store it in a local database, and allow FreeRADIUS to use "sql" authorization method to validate the MSCHAP challenge based on the NT hash. > Perhaps you could set a password? > > Or, set "Auth-Type := Accept" if you want the user to always be accepted. I can't blindly accept any given password without validation. The least insecure way I've figured out was to be able to grab one given hash and work with that. That's why the script was supposed to always "Reject" (or is there like a half-way-Reject allowing for fallback?). > The problem here is that you're asking how to fix the "solution" you > came up with. That's bad practice. Instead, you should be describing > your requirements. We can then offer you advice as to how to meet > those requirements. My requirements were basically that I would like to be able to authorize users with EAP-MSCHAPv2 / EAP-TTLS without having direct access to the db with NT passwords. With PAP it is possible to pass %{User-Password} to the script but no such field is present in MSCHAPv2 packets. The fallback-idea was to blindly grab the (one given) hash from the proprietary solution and allow FreeRADIUS to validate credentials based on it. Short after it was supposed to be deleted from local store. > So what are you trying to do? What *problem* are you trying to solve? > And don't answer "run the script and SQL". That isn't relevant. What > are the users trying to do? What answers do you want the RADIUS server > to return? And why? Initial problem: with fancy-artsy authorization methods - the password is not being sent in clear text like it was with PAP - so there is no way to pass username and password to the script. Desired behavior: RADIUS server should Accept or Reject the request based on given credentials. I was hoping here to do this in such way that FreeRADIUS wouldn't have to have access to the full database but I guess that I'll have to go this path if it's the only viable option(?) Thanks WJ

1 0

Instance on Files Module
by Nicolas Breuer 04 May '19

04 May '19

Hello, I tried to configure two instances for the files modules but doesn’t seems to work.. files DSL { # Search for files in a subdirectory of mods-config which # matches this instance of the files module. moddir = ${modconfdir}/${.:instance} filename = ${moddir}/authorize instance=DSL usersfile = ${moddir}/authorize1 acctusersfile = ${moddir}/accounting preproxy_usersfile = ${moddir}/pre-proxy } files { # Search for files in a subdirectory of mods-config which # matches this instance of the files module. moddir = ${modconfdir}/${.:instance} filename = ${moddir}/authorize instance=dialup usersfile = ${moddir}/authorize2 acctusersfile = ${moddir}/accounting preproxy_usersfile = ${moddir}/pre-proxy } Looked on the website & docs but didn’t find any informations about that 😊

4 8

Evaluation of Service-Type.
by Nicolas Breuer 03 May '19

03 May '19

Hello, Any ideas what is wrong here ? (0) if (&reply:Service-Type == test) { (0) ERROR: Failed retrieving values required to evaluate condition Thanks in advance,

3 9

How to check logs
by Tornóci László 03 May '19

03 May '19

Hi, I use freeradius to provide eduroam service for our university. It works fine. My setup is pretty basic, with just a few changes from the default. I am using EAP-TTLS with PAP in the inner tunnel. Yesterday I got a complaint from a foreign user, he didn't get wifi service with his usual settings. I looked for the logs under radacct/ in the folder with the IP of the NAS. I have 'auth-detail', 'pre-proxy', 'post-proxy' and 'reply-detail'. I was able to find logs of his packages in auth-detail and pre-proxy, but was unable to find out if I got any reply. I can link logs of packets between 'auth-detail' and 'pre-proxy', and also between 'post-proxy' and 'reply-detail', but I couldn't find a way to see which reply-detail packets correspond to any one in auth-detail. Is that possible? If yes, how? If not, what should I do to be able to track reports like that without running the server in debug mode? Laszlo

2 1

Compilation Issue
by Nicolas Breuer 03 May '19

03 May '19

Any ideas about this compilation issue : CC src/lib/cbuff.c In file included from /usr/include/talloc.h:28, from src/freeradius-devel/libradius.h:60, from src/lib/cbuff.c:26: /usr/include/stdlib.h:96: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__BEGIN_NAMESPACE_STDâ /usr/include/stdlib.h:140: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before âexternâ /usr/include/stdlib.h:145: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before âexternâ /usr/include/stdlib.h: In function âatoiâ: /usr/include/stdlib.h:149: error: expected declaration specifiers before â__THROWâ /usr/include/stdlib.h:152: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:153: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:168: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:190: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:191: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:382: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:383: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:474: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:475: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:488: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:489: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:518: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:531: error: expected declaration specifiers before â__END_NAMESPACE_STDâ .....

3 14

Dictionnary Redback
by Nicolas Breuer 03 May '19

03 May '19

Hello, Is it expected that dictionary.redback is missing from release 3.0.19 ? Thanks

3 4

grace period support in redis and dhcp server
by Chinnapaiyan, Nagamani 03 May '19

03 May '19

Hi, Currently redis_ippool module has options for offer_time and lease_time. There is another time in dhcp server concept called grace-period: A particular ip is reserved for a particular mac address after lease expired until time mentioned in grace-period(before it is made available to other mac addresses). Is this grace period option is supported in FreeRadius dhcp server? If yes, how to enable it? Regards, Nagamani Chinnapaiyan

2 1

Failed finding socket
by Bassem Mettichi 03 May '19

03 May '19

Hello, please have you any idea about this error message, i got it when i make a bench test using radclient or radperf: Failed to send packet for ID 160: Failed finding socket, caller must allocate a new one Thanks Bassem

2 1

Multiple LDAP failover issue
by Satish Patel 01 May '19

01 May '19

I have freeradius configure with LDAP servers and so far everything is working great but today when i have added second ldap server i got following error I have created two ldap file as per document ldap1 & ldap2 and my authorization and authentication section look like following. authorization { ... Auth-Type LDAP { ldap1 { fail = 1 ok = return } ldap2 { fail = 1 ok = return } } authorize { .... redundant { ldap1 ldap2 } My users files look like following DEFAULT Ldap-Group == "cn=employee,cn=groups,cn=compat,dc=foo,dc=com", ASA-TunnelGroupName = "EMPLOYEE" DEFAULT Auth-Type := Reject Reply-Message = "Sorry, you're not part of an authorized group! when i start radiusd -X it failed here reading pairlist file /etc/raddb/mods-config/files/authorize /etc/raddb/mods-config/files/authorize[48]: Parse error (check) for entry DEFAULT: Unknown name "Ldap-Group" Failed reading /etc/raddb/mods-config/files/authorize /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" but when i changed Ldap-Group to ldap1-LDAP-Group it works do does that means i have to create two section in users file for two LDAP? ldap1-LDAP-Group ldap2-LDAP-Group

3 2