- Freeradius-Users - lists.freeradius.org

Failed retrieving values required to evaluate condition
by Christoph Litauer 30 Apr '19

30 Apr '19

Dear Freeradius-Users, I am not an experienced radius admin, so maybe you can give me a hint. I read the manuals, the logs and google, but without success. My wlan users authenticate themselves against eap/ldap. But for guests I generate a file with credentials. This worked for some years now. Because of changing root certificates I had to introduce two different eap-configurations (eap and eapoldca). These are used in the default site and inner-tunnel site via switch that decides on the outer User-Name which certificates are used. So I changed eap { ok = return } to if (&User-Name == "eduroam(a)uni-koblenz.de") { eap { ok = return } } else { eapoldca { ok = return } } This works for all wlan users except guests. If a guest tries to authenticate, at the end I get (8) if (&Called-Station-SSID == "ubnt") { (8) ERROR: Failed retrieving values required to evaluate condition This is because Called-Station-SSID is unset at this point. I don't think this is the root cause, instead the reason seems to be, that the "ok = return" statements exit the if ()-clause but not the authorize section. But as I said, I am not an expert ... You will find sites-enabled/{default,inner-tunnel}, mods-enabled/eap und a log file here: https://cloud.uni-koblenz-landau.de/s/cBrpcCgCAp9JjTr The radius log was generated while trying to connect to SSID ubnt using test/test as authentication. Any help is greatly appreciated. -- Kind regards Christoph _________________________________________ Uni Koblenz, Computing Centre, Office A 022 Postfach 201602, 56016 Koblenz Fon: +49 261 287-1311, Fax: -100 1311

2 1

Re: The Unix Radius attributes
by Full Name 30 Apr '19

30 Apr '19

On Apr 29, 2019, at 1:06 PM, Full Name <nuncestbibendum(a)excite.com> wrote: >> >> Freeradius ships with a dictionary file named dictionary.unix, that contains the following attributes: > > Yes, we know. There's no need to post configuration files to the list. Sorry - I just wanted to illustrate what I mean. >> Is the goal of this set of attributes to enable a Radius server to send back UID, GID, etc. information for a user that has been authenticated by the >> RADIUS server? If so, why use FTP in the name of the attributes? I mean, a Radius server will not be able to know whether the users being >> authenticated is accessing the target system via FTP, or some other service, right? > > IIRC, the dictionary was used by some FTP server ~20 years ago. I don't think it's been used for anything since. OK, thanks. What makes this interesting to me is that such attributes are meant to convey UID, GID, home directory and shell name information for the authenticated user to the system on whose behalf the authentication is carried out. > And no, the *name* of the attribute is irrelevant. It doesn't mean anything. I am aware of that. I was just thinking that, without the FTP, using them for purposes other than FTP would be more elegant. They can, of course, be used with the FTP string just the same. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.htm

2 1

Freeradius captive protal with Freeipa or ldap
by mustafa taha 29 Apr '19

29 Apr '19

Hi all , I am trying to limit user WiFi time , for example "1 hour a day for a client" . I read many documents about that , but they all use MySQL as database , so I want ask if I can make this in freeradius with Freeipa as database. i think if we can use *Password expiration or *Kerberos principal expiration attribute to make limit of the user time . can anybody help ? <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> Virus-free. www.avg.com <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> <#m_7906311293261143546_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

2 1

Simultaneous-Use
by Sudheer Satyanarayana 29 Apr '19

29 Apr '19

Hello, I am trying to use the Simultaneous-Use feature of FreeRADIUS. I have some questions regarding https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configurati… I am using SQL and I have set Simultaneous-Use to 1 with the := operator. I can see this in debug output. Is the implementation notes regarding radutmp valid for SQL too? I have verified that simul_count_query and simul_verify_query are syntactically correct. When I execute them manually, I see some SQL results in PostgreSQL console. I tried to run radcheck like this: checkrad -d other 192.168.3.5 0 testuser01 'ACA31EB30AD1-70BBE9363CBC-5CC2A65E-8DAD3' Returning 1 (double detected) I am using Aruba NAS. I do not know what NAS-Type to use. I tried 'other' and it doesn't seem to have any effect. Should I be looking at getting checkrad to work first before doing anything else? If so, any tips to get this to work with Aruba NAS would be appreciated. At the moment, FreeRADIUS allows login from two devices at the same time for the same user. I am not sure what approach to take here. Some guidance would be appreciated. - Sudheer S

3 5

The Unix Radius attributes
by Full Name 29 Apr '19

29 Apr '19

Freeradius ships with a dictionary file named dictionary.unix, that contains the following attributes: VENDOR Unix 4 BEGIN-VENDOR Unix ATTRIBUTE Unix-FTP-UID 10 integer ATTRIBUTE Unix-FTP-GID 11 integer ATTRIBUTE Unix-FTP-Home 12 string ATTRIBUTE Unix-FTP-Shell 13 string ATTRIBUTE Unix-FTP-Group-Names 14 string ATTRIBUTE Unix-FTP-Group-Ids 15 string END-VENDOR Unix Is the goal of this set of attributes to enable a Radius server to send back UID, GID, etc. information for a user that has been authenticated by the RADIUS server? If so, why use FTP in the name of the attributes? I mean, a Radius server will not be able to know whether the users being authenticated is accessing the target system via FTP, or some other service, right?

2 1

Accounting multicast + unacknowledge mode and conflicting packet
by François RAGUIN 27 Apr '19

27 Apr '19

I think that's what FreeRADIUS does. The log indicates ... Error: Received conflicting packet from client ... Giving up on old request. And in the source code of FreeRADIUS (process.c: 1765) we have request_done (request, FR_ACTION_CANCELLED); which cancels the old conflicting accounting and then retains only the new It would be interesting to have at least more information about the canceled accounting because in the log we just have the Radius client, its port and the Radius packet ID. See line 1776 in process.c ERROR ("Received conflicting packet from" "client% s port% d - ID:% u due to" "unfinished request in module% s. Giving up on old request.", client-> shortname, packet-> src_port, packet-> id, old_module); In addition I do not know if the canceled accounting is in the accounting logs. There is too little information to possibly make a corrective post-processing of this cancellation

3 7

Can FreeRADIUS send non-standard VSAs?
by Ian Pilcher 26 Apr '19

26 Apr '19

I'm beating my head against the RBAC VSAs used by a couple of Dell / Force 10 switches. Specifically, I am trying to figure out the binary format of the "Force10-avpair" VSA that is documented here: https://www.dell.com/support/manuals/us/en/04/force10-s3048-on/s3048-on-9.1… You'll note that the documentation makes no mention of a vendor-specific ID for the Force10-avpair attribute. Neither does anything else that Google can find, and Dell support is completely flummoxed. I'm starting to think that it's possible that there is no ID. Maybe Force 10 ignored the latter part of section 5.26 of RFC 2865 and just defined their VSA(s) as a simple string (without any vendor type or vendor length fields). Is it possible to get FreeRADIUS to send a VSA like this? -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================

2 5

How to properly deal with HTTP 200 response with body with rlm_rest?
by Martin Gignac 26 Apr '19

26 Apr '19

Hi, I have FreeRADIUS 3.0.17 set up to use rlm_rest to contact a custom REST server that does LDAP queries in the back and optionally does TOTP validation as well. The REST server then returns HTTP 204 when the request is accepted and HTTP 401 when it is rejected. So far this has been working great for pfSense OpenVPN authentication and WPA2-Enterprise, but now I want to use the same REST server to also handle FreeRADIUS requests for a Raritan Dominion KVM. The KVM says that I can optionally return a Filter-Id attribute containing a user group in the Access-Accept to authorize the authenticating user to access specific ports. Therefore, I've modified the REST server to return an HTTP 200 OK along with a JSON payload that contains the Filter-Id content I want to send back. When rlm_rest receives 204 it reurns the 'ok' code, but when receiving any other 2xx response it processes the body and returns the 'updated' code. Where I'm having an issue is, even after reading the Technical Guide, I'm having trouble wrapping my head around how I should properly deal with the 'updated' return code so that ultimately it is not the 'Post-Auth-Type REJECT' that gets called, but instead some other action where: 1) The request is seen as 'ok'/authorized, and 2) I can take the content of the Filter-Id and return it only with the Access-Accept message. Any guidance would be appreciated. Thanks, -Martin P.S. Find below the debug output of: a) a request with no returned body (and a resulting Access-Accept) b) a request with a returned Filter-Id body (and a resulting Access-Reject) -- Access-Accept (2) Received Access-Request Id 89 from 192.168.18.23:33311 to 192.168.40.34:1812 length 80 (2) NAS-Port-Type = Virtual (2) NAS-IP-Address = 192.168.18.23 (2) User-Name = "toto" (2) Acct-Session-Id = "koko1234" (2) User-Password = "fsdfsd" (2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "sdfsdf", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: No EAP-Message, not doing EAP (2) [eap] = noop (2) [files] = noop (2) [expiration] = noop (2) [logintime] = noop (2) if (User-Password) { (2) if (User-Password) -> TRUE (2) if (User-Password) { (2) update control { (2) Auth-Type := rest (2) } # update control = noop (2) } # if (User-Password) = noop (2) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (2) pap: WARNING: Authentication will fail unless a "known good" password is available (2) [pap] = noop (2) } # authorize = ok (2) Found Auth-Type = rest (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (2) authenticate { (2) rest: Expanding URI components (2) rest: EXPAND http://127.0.0.1:9080 (2) rest: --> http://127.0.0.1:9080 (2) rest: EXPAND /user/%{User-Name}/mac/%{Called-Station-ID}?action=authenticate (2) rest: --> /user/sdfsdf/mac/?action=authenticate (2) rest: Sending HTTP POST to "http://127.0.0.1:9080/user/sdfsdf/mac/?action=authenticate" (2) rest: Encoding attribute "NAS-Port-Type" (2) rest: Encoding attribute "NAS-IP-Address" (2) rest: Encoding attribute "User-Name" (2) rest: Encoding attribute "Acct-Session-Id" (2) rest: Encoding attribute "User-Password" (2) rest: Encoding attribute "Event-Timestamp" (2) rest: Processing response header (2) rest: Status : 204 (No Content) (2) [rest] = ok (2) } # authenticate = ok (2) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (2) post-auth { (2) update { (2) No attributes updated (2) } # update = noop (2) [exec] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) } # post-auth = noop (2) Sent Access-Accept Id 89 from 192.168.40.34:1812 to 192.168.18.23:33311 length 0 (2) Finished request -- Access-Reject (4) Received Access-Request Id 212 from 192.168.18.23:56985 to 192.168.40.34:1812 length 81 (4) NAS-Port-Type = Virtual (4) NAS-IP-Address = 192.168.18.23 (4) User-Name = "toto" (4) Acct-Session-Id = "01dc5cb9b7469d20072c" (4) User-Password = "koko1234" (4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "asdfasd", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: No EAP-Message, not doing EAP (4) [eap] = noop (4) [files] = noop (4) [expiration] = noop (4) [logintime] = noop (4) if (User-Password) { (4) if (User-Password) -> TRUE (4) if (User-Password) { (4) update control { (4) Auth-Type := rest (4) } # update control = noop (4) } # if (User-Password) = noop (4) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (4) pap: WARNING: Authentication will fail unless a "known good" password is available (4) [pap] = noop (4) } # authorize = ok (4) Found Auth-Type = rest (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) authenticate { (4) rest: Expanding URI components (4) rest: EXPAND http://127.0.0.1:9080 (4) rest: --> http://127.0.0.1:9080 (4) rest: EXPAND /user/%{User-Name}/mac/%{Called-Station-ID}?action=authenticate (4) rest: --> /user/asdfasd/mac/?action=authenticate (4) rest: Sending HTTP POST to "http://127.0.0.1:9080/user/asdfasd/mac/?action=authenticate" (4) rest: Encoding attribute "NAS-Port-Type" (4) rest: Encoding attribute "NAS-IP-Address" (4) rest: Encoding attribute "User-Name" (4) rest: Encoding attribute "Acct-Session-Id" (4) rest: Encoding attribute "User-Password" (4) rest: Encoding attribute "Event-Timestamp" (4) rest: Processing response header (4) rest: Status : 200 (OK) (4) rest: Type : json (application/json) (4) rest: Parsing attribute "Filter-Id" (4) rest: EXPAND Raritan:Gusergroup (4) rest: --> Raritan:Gusergroup (4) rest: Filter-Id := "Raritan:Gusergroup" (4) [rest] = updated (4) } # authenticate = updated (4) Failed to authenticate the user (4) Using Post-Auth-Type Reject (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) Post-Auth-Type REJECT { (4) attr_filter.access_reject: EXPAND %{User-Name} (4) attr_filter.access_reject: --> asdfasd (4) attr_filter.access_reject: Matched entry DEFAULT at line 11 (4) [attr_filter.access_reject] = updated (4) [eap] = noop (4) policy remove_reply_message_if_eap { (4) if (&reply:EAP-Message && &reply:Reply-Message) { (4) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (4) else { (4) [noop] = noop (4) } # else = noop (4) } # policy remove_reply_message_if_eap = noop (4) } # Post-Auth-Type REJECT = updated (4) Delaying response for 1.000000 seconds (4) (4) Discarding duplicate request from client wifi port 56985 - ID: 212 due to delayed response (4) Sending delayed response (4) Sent Access-Reject Id 212 from 192.168.40.34:1812 to 192.168.18.23:56985 length 20 (4) Cleaning up request packet ID 212 with timestamp +1997

3 6

Freeradius Load average
by Bassem Mettichi 25 Apr '19

25 Apr '19

Hello, we are using Freeradius 3:0.18 and we see that when we activate accounting logs the load average of the freeradius machine is very height ( 197%) however when we desactivate these logs the load average is less than 10%, our server has 8VCPU and we receive 3000 accounting start / second, is there any solution to reduce cpu consumption when activating detail module ? Thanks Bassem

4 4

Output of exec module
by Dom Latter 25 Apr '19

25 Apr '19

We are using the exec module [1]: https://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html In some circumstances we will reject a user even though they have authenticated. So we send a return code of 1. But this appears in radius./log as an error. Looking at src/main/exec.c I find these lines: if ((status != 0) || (ret < 0)) { RERROR("Program returned code (%d) and output '%s'", status, answer); so I am guessing this is essentially as designed. Is that right? [1] essentially, registering new devices on the network.

2 4