- Freeradius-Users - lists.freeradius.org

Mac authentication
by Luc Paulin 28 Feb '19

28 Feb '19

Hi eveyrone, I am looking at the mac authentication ( https://wiki.freeradius.org/guide/mac-auth) Base on that article look that the main behavior is to authorise or not system base on their mac address in addition the EAP. Currently my setup is working well an can dynamically assign user/system vlan base on their authentification. However there's some equipement that won't be able to use EAP/PEAP authenticate over 802.1x, (smart tv for example). Most likely there's somehing I miss, but would that be something possible to assign vlan 199 to mac address ABCDEF and vlan 201 to mac address UVWXYZ -Luc -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

4 6

Uses of Active directory User's attribute
by Luc Paulin 28 Feb '19

28 Feb '19

Hi List, I was wondering if it would be possible to use the Active Directory user's attributes. As we're standardizing our AD, all user should have the Department attribute field fill. So instead of using AD groups to dynamically assign vlan, I was thinking to use that field instead. Would that be something possible? Thanx! -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

1 1

Attribute showing in Hex or Some other format
by Nimesha Balasuriya 28 Feb '19

28 Feb '19

Dear Friends, I am having a problem in radius accounting message which showing some other format for particular attribute. Framed-Interface-Id = 0x520c0000520c00 How to convert this into following format. Framed-Interface-Id = ff0c:6192:9e9a:30fe My NAS is Juniper MX480 Please find the sample packet as bellow; Wed Nov 28 18:02:18 2018 NAS-Port-Type = Ethernet ERX-Pppoe-Description = "pppoe 90:61:0c:4b:4b:1c" Acct-Session-Id = "1328282907" ERX-Dhcp-Mac-Addr = "9061.0c4b.4b1c" Service-Type = Framed-User Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-IP-Address = 203.0.113.22 Framed-IP-Netmask = 255.255.255.255 NAS-Port-Id = "HK-AGJ_C300M_01 atm 1/1/8/7:8.35" Filter-Id = "IPV4-ingress:pbr-pp0.3221286001-in" ERX-Virtual-Router-Name = "default:sltbb.lk" Framed-Protocol = PPP User-Name = "HK2501112@SLTBB" ERX-Attr-177 = 0x506f72742073706565643a2031303030303030306b NAS-Identifier = "HK_MX480" Event-Timestamp = "Nov 28 2018 18:00:37 IST" ERX-Ingress-Policy-Name = "PBR" ADSL-Agent-Circuit-Id = "HK-AGJ_C300M_01 atm 1/1/8/7:8.35" Class = "ADSLWebFamilyPlus" Framed-IP-Address = 100.72.248.51 NAS-Port = 1342178323 Framed-Interface-Id = 0x6bd536006bd536 Acct-Delay-Time = 0 Acct-Unique-Session-Id = "d06986707183a0ac" Stripped-User-Name = "HK2501112" Realm = "sltbb" Timestamp = 1543408338 Thank you in advanced!!

2 1

Free Radius HA
by Aditya Vijjan 27 Feb '19

27 Feb '19

Hi Team, Can we configure HA Active - Active or Active-Passive for free-radius. -- Thanks & Regards Aditya Vijjan

3 2

Group ID of user
by Boudjoudad Abdelkader 27 Feb '19

27 Feb '19

Hello, Is there a way to return the group GID of user during the freeradius authentication process? Thanks,

2 1

Multiple ldap instances - User Group Membership search not done
by Florian Sus | indevis GmbH 27 Feb '19

27 Feb '19

Hi all, I have a question regarding multiple ldap instances in freeradius and searching users in LDAP-Groups. First of all, what do I try to achieve: Freeradius has to authenticate and authorize our admin users for our customers network devices. It has to perform user authentication with a simple ldap bind authentication and look up the group membership of the user. If the password of the user is correct and the user is member of a specific group, access shall be granted. I have already achieved a working configuration for the tasks above. I recently got a new task to allow also our customers access to their network devices with read-only access. The customer users are already configured in another ldap server. So I would like to configure two named ldap instances in rlm_ldap. If I do so, the authentication part for the admin user still works, but freeradius will not search the LDAP for user membership anymore and reject access. Please find below the config and debug output of the working configuration with only one ldap server And the modified config with two named ldap instances. Any help appreciated. If further debug output is needed, please let me know. Best regards, Florian #################### ## ## Sinlge LDAP Server configuration working ## LDAP search is performed and user is found in the configured group ## #################### Single LDAP Server configured: :/etc/freeradius/3.0# grep -v '#' mods-enabled/ldap | grep -v -e '^$' ldap { server = 'IP' identity = 'CN=freerad,OU=Service-Accounts,OU=User,OU=mycompany,DC=mycompany,DC=de' password = removed base_dn = 'OU=mycompany,DC=mycompany,DC=de' sasl { } update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' scope = 'sub' name_attribute = cn membership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))" membership_attribute = 'memberOf' } profile { } client { base_dn = "${..base_dn}" filter = '(objectClass=radiusClient)' template { } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } :/etc/freeradius/3.0# grep -v '#' sites-enabled/default | grep -v -e '^$' server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { preprocess eap { ok = return } ldap if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } } authenticate { digest Auth-Type LDAP { ldap if (LDAP-Group == "mycompany_Technik_Sec"){ if (Huntgroup-Name == "fortigate") { update reply { Fortinet-Group-Name = "mycompany_Operations" Fortinet-Access-Profile = "super_admin" } } } else { reject } } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } Debug output of auth request tested via radtest -t pap user.name pw-removed localhost 0 testing123 (0) Received Access-Request Id 178 from 127.0.0.1:52807 to 127.0.0.1:1812 length 81 (0) User-Name = "user.name" (0) User-Password = "pw-removed" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0x87ca46d1ef7da1eb772aef641e0d9e02 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (sAMAccountName=user.name) (0) ldap: Performing search in "OU=mycompany,DC=mycompany,DC=mycompany,DC=de" with filter "(sAMAccountName=user.name)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://IP:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) if ((ok || updated) && User-Password) { (0) if ((ok || updated) && User-Password) -> TRUE (0) if ((ok || updated) && User-Password) { (0) update { (0) control:Auth-Type := LDAP (0) } # update = noop (0) } # if ((ok || updated) && User-Password) = noop (0) } # authorize = ok (0) Found Auth-Type = LDAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type LDAP { rlm_ldap (ldap): Reserved connection (1) (0) ldap: Login attempt by "user.name" (0) ldap: Using user DN from request "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) ldap: Waiting for bind result... (0) ldap: Bind successful (0) ldap: Bind as user "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" was successful rlm_ldap (ldap): Released connection (1) (0) [ldap] = ok (0) if (LDAP-Group == "mycompany_Technik_Sec"){ (0) Searching for user in group "mycompany_Technik_Sec" rlm_ldap (ldap): Reserved connection (2) (0) Using user DN from request "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) Checking for user in group objects (0) EXPAND (&(cn=mycompany_Technik_Sec)(objectClass=posixGroup)(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))) (0) --> (&(cn=mycompany_Technik_Sec)(objectClass=posixGroup)(|(&(objectClass=group)(member=CN\3dUser Name\2cOU\3dWindows 10 User\2cOU\3dUser\2cOU\3dmycompany\2cDC\3dmycompany\2cDC\3dmycompany\2cDC\3dde)))) (0) Performing search in "OU=mycompany,DC=mycompany,DC=mycompany,DC=de" with filter "(&(cn=mycompany_Technik_Sec)(objectClass=posixGroup)(|(&(objectClass=group)(member=CN\3dUser Name\2cOU\3dWindows 10 User\2cOU\3dUser\2cOU\3dmycompany\2cDC\3dmycompany\2cDC\3dmycompany\2cDC\3dde))))", scope "sub" (0) Waiting for search result... (0) Search returned no results (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de", scope "base" (0) Waiting for search result... ber_get_next failed. ber_get_next failed. (0) Processing memberOf value "CN=mycompany_pdns_operator,OU=PDNS,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" as a DN (0) Resolving group DN "CN=mycompany_pdns_operator,OU=PDNS,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" to group name ... (0) Processing memberOf value "CN=mycompany_Technik_Sec,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" as a DN (0) Resolving group DN "CN=mycompany_Technik_Sec,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" to group name (0) Performing unfiltered search in "CN=mycompany_Technik_Sec,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de", scope "base" (0) Waiting for search result... (0) Group DN "CN=mycompany_Technik_Sec,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" resolves to name "mycompany_Technik_Sec" (0) User found in group "mycompany_Technik_Sec". Comparison between membership: name (resolved from DN "CN=mycompany_Technik_Sec,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de"), check: name rlm_ldap (ldap): Released connection (2) (0) if (LDAP-Group == "mycompany_Technik_Sec") -> TRUE (0) if (LDAP-Group == "mycompany_Technik_Sec") { (0) if (Huntgroup-Name == "fortigate") { (0) ERROR: Failed retrieving values required to evaluate condition (0) } # if (LDAP-Group == "mycompany_Technik_Sec") = ok (0) ... skipping else: Preceding "if" was taken (0) } # Auth-Type LDAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 178 from 127.0.0.1:1812 to 127.0.0.1:52807 length 0 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 178 with timestamp +15 Ready to process requests #################### ## ## Multiple LDAP Server configuration not working ## Looks like freeradius is not searching the ldap ## #################### :/etc/freeradius/3.0# grep -v '#' mods-enabled/ldap | grep -v -e '^$' ldap mycompany { server = 'IP' identity = 'CN=freerad,OU=Service-Accounts,OU=User,OU=mycompany,DC=mycompany,DC=de' password = removed base_dn = 'OU=mycompany,DC=mycompany,DC=de' sasl { } update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' scope = 'sub' name_attribute = cn membership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))" membership_attribute = 'memberOf' } profile { } client { base_dn = "${..base_dn}" filter = '(objectClass=radiusClient)' template { } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } ldap customers { server = 'IP' identity = 'CN=freerad,OU=Service-Accounts,OU=User,OU=mycompany,DC=mycompany,DC=de' password = removed base_dn = 'OU=mycompany,DC=mycompany,DC=mycompany,DC=de' sasl { } update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' scope = 'sub' name_attribute = cn membership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))" membership_attribute = 'memberOf' } profile { } client { base_dn = "${..base_dn}" filter = '(objectClass=radiusClient)' template { } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } :/etc/freeradius/3.0# grep -v '#' sites-enabled/default | grep -v -e '^$' server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { filter_username preprocess eap { ok = return } mycompany if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } customers if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } } authenticate { digest Auth-Type LDAP { mycompany if (mycompany-LDAP-Group == "mycompany_Technik_Sec"){ if (Huntgroup-Name == "fortigate") { update reply { Fortinet-Group-Name = "mycompany_Operations" Fortinet-Access-Profile = "super_admin" } } } else { reject } customers } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } Debug output of auth request tested via radtest -t pap user.name pw-removed localhost 0 testing123 (0) Received Access-Request Id 85 from 127.0.0.1:42556 to 127.0.0.1:1812 length 81 (0) User-Name = "user.name" (0) User-Password = "pw-removed" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0xd04d42343938af1eb2a54bbed931ccd6 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop rlm_ldap (mycompany): Reserved connection (0) (0) mycompany: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (0) mycompany: --> (sAMAccountName=user.name) (0) mycompany: Performing search in "OU=mycompany,DC=mycompany,DC=mycompany,DC=de" with filter "(sAMAccountName=user.name)", scope "sub" (0) mycompany: Waiting for search result... (0) mycompany: User object found at DN "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) mycompany: Processing user attributes (0) mycompany: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) mycompany: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (mycompany): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (mycompany): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (mycompany): Connecting to ldap://IP:389 rlm_ldap (mycompany): Waiting for bind result... rlm_ldap (mycompany): Bind successful (0) [mycompany] = ok (0) if ((ok || updated) && User-Password) { (0) if ((ok || updated) && User-Password) -> TRUE (0) if ((ok || updated) && User-Password) { (0) update { (0) control:Auth-Type := LDAP (0) } # update = noop (0) } # if ((ok || updated) && User-Password) = noop rlm_ldap (customers): Reserved connection (0) (0) customers: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (0) customers: --> (sAMAccountName=user.name) (0) customers: Performing search in "OU=mycompany,DC=mycompany,DC=mycompany,DC=de" with filter "(sAMAccountName=user.name)", scope "sub" (0) customers: Waiting for search result... (0) customers: User object found at DN "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) customers: Processing user attributes (0) customers: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) customers: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (customers): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (customers): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (customers): Connecting to ldap://IP:389 rlm_ldap (customers): Waiting for bind result... rlm_ldap (customers): Bind successful (0) [customers] = ok (0) if ((ok || updated) && User-Password) { (0) if ((ok || updated) && User-Password) -> TRUE (0) if ((ok || updated) && User-Password) { (0) update { (0) control:Auth-Type := LDAP (0) } # update = noop (0) } # if ((ok || updated) && User-Password) = noop (0) } # authorize = ok (0) Found Auth-Type = LDAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type LDAP { rlm_ldap (mycompany): Reserved connection (1) (0) mycompany: Login attempt by "user.name" (0) mycompany: Using user DN from request "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) mycompany: Waiting for bind result... (0) mycompany: Bind successful (0) mycompany: Bind as user "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" was successful rlm_ldap (mycompany): Released connection (1) (0) [mycompany] = ok (0) if (mycompany-LDAP-Group == "mycompany_Technik_Sec"){ (0) if (mycompany-LDAP-Group == "mycompany_Technik_Sec") -> FALSE (0) else { (0) [reject] = reject (0) } # else = reject (0) } # Auth-Type LDAP = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> user.name (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 85 from 127.0.0.1:1812 to 127.0.0.1:42556 length 20 Waking up in 3.9 seconds.

2 4

sqlippool on 3.0.18
by Nathan Ward 27 Feb '19

27 Feb '19

Hi, Wading in to this one now - not sure if this is a bug or if it’s known/fixed so posting here in the hope someone else has had this and looked in to it. If not, I’m learning a lot, so, that’s good. Will post more when I have it. I’m testing upgrading to 3.0.18, and when I get an Accounting-On with sqlippool (I am running a NAS simulator which sends Accounting-On first, not sure if other messages are impacted), I get: <snip> rlm_sql (sql-radiusippool): Reserved connection (0) (0) sqlippool-ipv4: EXPAND %{%{Chargeable-User-Identity}:-%{%{Stripped-User-Name}:-UNKNOWN}} (0) sqlippool-ipv4: --> UNKNOWN (0) sqlippool-ipv4: SQL-User-Name set to 'UNKNOWN' (0) sqlippool-ipv4: EXPAND START TRANSACTION (0) sqlippool-ipv4: --> START TRANSACTION (0) sqlippool-ipv4: Executing query: START TRANSACTION rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 0 src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: name[rlm_sql_t] expected[rlm_sql_handle_t] talloc abort: src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: name[rlm_sql_t] expected[rlm_sql_handle_t] </snip> src/modules/rlm_sqlippool/rlm_sqlippool.c:320 is: if (radius_axlat(&expanded, request, query, data->sql_inst->sql_escape_func, data->sql_inst) < 0) return -1; And I notice in Herwin Weststrate’s commit @ c8736367583 there is a lot of use of the handle as the last param for that function rather than the sql module instance: - if (radius_axlat(&expanded, request, inst->config->simul_verify_query, sql_escape_func, inst) < 0) { + if (radius_axlat(&expanded, request, inst->config->simul_verify_query, inst->sql_escape_func, handle) < 0) { Etc. so I’m thinking that commit didn’t take sqlippool in to account. I notice there’s a new function, sql_escape_for_xlat_func, which gets a connection from the pool then releases it, but I’m not sure that’s right for this situation in sqlippool - we’re doing these xlats in the middle of a transaction, so we should have a handle already? I've tried passing the handle to radius_axlat rather than the instance, i.e. (in rlm_sqlippool.c): - if (radius_axlat(&expanded, request, query, data->sql_inst->sql_escape_func, data->sql_inst) < 0) return -1; + if (radius_axlat(&expanded, request, query, data->sql_inst->sql_escape_func, handle) < 0) return -1; But now I get a talloc error - <snip> (0) sqlippool-ipv4: Executing query: START TRANSACTION rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 0 Bad talloc magic value - unknown value talloc abort: Bad talloc magic value - unknown value </snip> Here’s a backtrace for that - note the handle is passed through, so I’m not entirely clear why this is objecting. Is the handle freed somewhere? I’m wondering if this is simply because we’re running several queries in a transaction - the first query (i.e. START TRANSACTION) is always fine, even if I put an xlat in it. The second query always triggers this error. Should this handle even still be useable? The next line after the one I’ve changed above calls sql_query, which needs handle to have a ‘conn’ member, so, I expect so.. #3 0x00007fa228d5e77a in _talloc_get_type_abort () from /lib64/libtalloc.so.2 #4 0x00007fa2210f0f40 in sql_escape_func (request=request@entry=0x55a14277f330, out=out@entry=0x55a1427820d0 "", outlen=outlen@entry=30, in=0x55a1427819b0 "192.0.2.0", arg=arg@entry=0x7ffeb7db2ba0) at src/modules/rlm_sql/rlm_sql.c:381 #5 0x00007fa229aa6afe in xlat_aprint (ctx=ctx@entry=0x55a14277f330, request=0x55a14277f330, node=<optimized out>, escape=escape@entry=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=0x7ffeb7db2ba0, lvl=0) at src/main/xlat.c:2371 #6 0x00007fa229aa7aed in xlat_process (out=0x7ffeb7db1990, request=0x55a14277f330, head=0x55a142781f60, escape=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=0x7ffeb7db2ba0) at src/main/xlat.c:2410 #7 0x00007fa229aa6b51 in xlat_aprint (ctx=ctx@entry=0x55a142781a30, request=request@entry=0x55a14277f330, node=node@entry=0x55a142781df0, escape=escape@entry=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=escape_ctx@entry=0x7ffeb7db2ba0, lvl=0) at src/main/xlat.c:2344 #8 0x00007fa229aa79d1 in xlat_process (out=0x7ffeb7db1a90, request=0x55a14277f330, head=<optimized out>, escape=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=0x7ffeb7db2ba0) at src/main/xlat.c:2428 #9 0x00007fa229aa7b44 in xlat_expand_struct (out=out@entry=0x7ffeb7db1b48, outlen=outlen@entry=0, request=request@entry=0x55a14277f330, node=<optimized out>, escape=escape@entry=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=escape_ctx@entry=0x7ffeb7db2ba0) at src/main/xlat.c:2482 #10 0x00007fa229aa8094 in xlat_expand (out=out@entry=0x7ffeb7db1b48, outlen=outlen@entry=0, request=request@entry=0x55a14277f330, fmt=fmt@entry=0x7ffeb7db1b50 "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}'", escape=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=escape_ctx@entry=0x7ffeb7db2ba0) at src/main/xlat.c:2547 #11 0x00007fa229aa95fa in radius_axlat (out=out@entry=0x7ffeb7db1b48, request=request@entry=0x55a14277f330, fmt=fmt@entry=0x7ffeb7db1b50 "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}'", escape=<optimized out>, ctx=ctx@entry=0x7ffeb7db2ba0) at src/main/xlat.c:2617 #12 0x00007fa2212fae4f in sqlippool_command (fmt=<optimized out>, handle=handle@entry=0x7ffeb7db2ba0, data=data@entry=0x55a14264d250, request=request@entry=0x55a14277f330, param=param@entry=0x0, param_len=param_len@entry=0) at src/modules/rlm_sqlippool/rlm_sqlippool.c:320 #13 0x00007fa2212fb66e in mod_accounting_on (request=0x55a14277f330, inst=0x55a14264d250, handle=0x7ffeb7db2ba0) at src/modules/rlm_sqlippool/rlm_sqlippool.c:706 #14 mod_accounting (instance=0x55a14264d250, request=0x55a14277f330) at src/modules/rlm_sqlippool/rlm_sqlippool.c:779 -- Nathan Ward

2 1

Add support for systemd service and watchdogs Fixes #2499.
by Stefano Mason 27 Feb '19

27 Feb '19

Dear all, "systemctl start radiusd.service" it doesn't exit but remain in a stuck state, it's necessary to do a CTRL-C, after that I check the status e the process list: all it's okay. - systemctl start radiusd.service (stuck in) - systemctl status radiusd.service (okay) - systemctl stop radiusd.service (okay) Environment Centos 7 # cat /etc/redhat-release CentOS Linux release 7.6.1810 (Core) cd freeradius-server git pull git checkout v3.0.x git archive --format=tar --prefix=freeradius-server-3.0.19/ v3.0.x | bzip2 -c >../freeradius-server-3.0.19.tar.bz2 build from freeradius.spec results: x86_64]# ls -1 freeradius-3.0.19-2.el7.centos.x86_64.rpm freeradius-config-3.0.19-2.el7.centos.x86_64.rpm freeradius-debuginfo-3.0.19-2.el7.centos.x86_64.rpm freeradius-freetds-3.0.19-2.el7.centos.x86_64.rpm freeradius-krb5-3.0.19-2.el7.centos.x86_64.rpm freeradius-ldap-3.0.19-2.el7.centos.x86_64.rpm freeradius-mysql-3.0.19-2.el7.centos.x86_64.rpm freeradius-perl-3.0.19-2.el7.centos.x86_64.rpm freeradius-postgresql-3.0.19-2.el7.centos.x86_64.rpm freeradius-python-3.0.19-2.el7.centos.x86_64.rpm freeradius-redis-3.0.19-2.el7.centos.x86_64.rpm freeradius-rest-3.0.19-2.el7.centos.x86_64.rpm freeradius-sqlite-3.0.19-2.el7.centos.x86_64.rpm freeradius-unixODBC-3.0.19-2.el7.centos.x86_64.rpm freeradius-utils-3.0.19-2.el7.centos.x86_64.rpm Upgrade: # yum localinstall freeradius-3.0.18-2.el7.centos.x86_64.rpm freeradius-config-3.0.18-2.el7.centos.x86_64.rpm freeradius-ldap-3.0.18-2.el7.centos.x86_64.rpm freeradius-utils-3.0.18-2.el7.centos.x86_64.rpm # systemctl daemon-reload systemd read the new instructions from # cat /usr/lib/systemd/system/radiusd.service [Unit] Description=FreeRADIUS multi-protocol policy server After=network-online.target Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ [Service] Type=notify WatchdogSec=60 NotifyAccess=all PIDFile=/var/run/radiusd/radiusd.pid EnvironmentFile=-/etc/sysconfig/radiusd # FreeRADIUS can do static evaluation of policy language rules based # on environmental variables which is very useful for doing per-host # customization. # Unfortunately systemd does not allow variable substitutions such # as %H or $(hostname) in the EnvironmentFile. # We provide HOSTNAME here for convenience. Environment=HOSTNAME=%H # Limit memory to 2G this is fine for %99.99 of deployments. FreeRADIUS # is not memory hungry, if it's using more than this, then there's probably # a leak somewhere. MemoryLimit=2G RuntimeDirectory=radiusd RuntimeDirectoryMode=0775 ExecStartPre=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout ExecStartPre=/usr/bin/chown radiusd:radiusd /var/run/radiusd ExecStart=/usr/sbin/radiusd $FREERADIUS_OPTIONS Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target STATUS works: # systemctl status radiusd.service ● radiusd.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled; vendor preset: disabled) Active: activating (start) since Wed 2019-02-27 10:33:43 CET; 1min 13s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 31202 ExecStartPre=/usr/bin/chown radiusd:radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Process: 31199 ExecStartPre=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS) Main PID: 31208 (radiusd) Memory: 21.8M (limit: 2.0G) CGroup: /system.slice/radiusd.service └─31208 /usr/sbin/radiusd STOP works: # systemctl stop radiusd.service # START stuck in: # systemctl start radiusd.service ^C # LOG from journalctl: Feb 27 10:37:04 betty systemd[1]: Starting FreeRADIUS multi-protocol policy server... Feb 27 10:37:04 betty radiusd[31406]: FreeRADIUS Version 3.0.19 Feb 27 10:37:04 betty radiusd[31406]: Copyright (C) 1999-2019 The FreeRADIUS server project and contributors Feb 27 10:37:04 betty radiusd[31406]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Feb 27 10:37:04 betty radiusd[31406]: PARTICULAR PURPOSE Feb 27 10:37:04 betty radiusd[31406]: You may redistribute copies of FreeRADIUS under the terms of the Feb 27 10:37:04 betty radiusd[31406]: GNU General Public License Feb 27 10:37:04 betty radiusd[31406]: For more information about these matters, see the file named COPYRIGHT Feb 27 10:37:04 betty radiusd[31406]: Starting - reading configuration files ... Feb 27 10:37:04 betty radiusd[31406]: Debugger not attached Best regards. Stefano

2 1

Building the 3.0.18 version
by Elias Pereira 27 Feb '19

27 Feb '19

hello, I'm trying to build version 3.0.18 in a debian 9.8 by following the link https://wiki.freeradius.org/building/Debian%20and%20Ubuntu#building-packages, but when I run the "make deb" command the error "make: *** No rule to make target 'deb'" occurs. Getting the source ok Installing build dependencies ok Building Packages *error* Any idea? -- Elias Pereira

3 13

mschap: eapol_test peap/mschap fails
by Peter Kain 26 Feb '19

26 Feb '19

Hi, First time poster. I've been tasked with setting up a freeRADIUS (FR) server in order to join eduroam under the following conditions: authentication against Active Directory where we have two domains, the realm passed doesn't indicate the AD domain, and I can only join one domain "domainA", but there's trust between the domains. realm = user(a)uni.edu domainA.ad.uni.edu domainB.ad.uni.edu I've built a CentOS 7 server with FR 3.0.13 and winbind 4.8.3. Joined the server to the first domain and I'm able to authenticate users against both domains using the ntlm_auth command. As a first step, following the posted instructions "Configuring Authentication with Active Directory" I edited the mschap to use ntlm_auth setting "--domain=domainA". And I've set radiusd to run as root. Using the eapol_test program I'm able to authenticate as userA using both "-c ttls-mschap.conf" & "-c peap-mschap.conf" and I'm able to authenticate my iPad to our wireless . So far everything works as expected when setup for a single domain. file: mods-enabled/mschap mschap { ... ntlm_auth --domain=domainA ... In order to authenticate to both AD domains I followed a forum posting "PEAP and multiple domains" and created two additional domain instances for mschap in the radius.conf and updated both the default and inner-tunnels. raddb/radius.conf ... modules { $INCLUDE mods-enabled/ mschap mschap.domainA{ ntlm_auth = "/usr/bin/ntlm_auth --domain=domainA --allow-mschapv2 ... } mschap mschap.domainB{ ntlm_auth = "/usr/bin/ntlm_auth --domain=domainB --allow-mschapv2 ... } } sites-enabled/inner-tunnel (updated both default and inner-tunnel) In the "authorize section {" if mschap isn't commented out then it sets "Auth-Type = mschap". This seems contrary to the documentation within the file. Again running FR 3.0.13. Commented out mschap adding "mschap.domainA". This appears to set "Auth-Type = MS-CHAP". I'm not sure how the "Auth-Type" is determine, why one configuration results in "Auth-Type = mschap" and another "Auth-Type = MS-CHAP". aurhorized { ... # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. #mschap mschap.domainA ... authenticate { ... Auth-Type MS-CHAP { # mschap group { mschap.domainA { reject = 1 ok = return } mschap.domainB { ok = return } } } # # For old names, too. # mschap In order to make it clear in the logs, I edited mods-enabled/mschap setting "--domain=FOO" in the ntml_auth command. --> eapol_test -c ttls-mshchap.conf -s testing123 ... WORKS Looking at the logs I see "Auth-Type = MS-CHAP" being set and my defined mschap.domainA module being used. Works exactly as expected using the modules I defined. If a user isn't found in domainA it then searches domainB. I can authenticate to my wireless (ssid eduroam) using an Android phone where I can set the authentication to TTLS/mschapv2. (6) Virtual server inner-tunnel received request (6) User-Name = "userA" (6) MS-CHAP-Challenge = 0x74624904a951c158262f9cd8b0abc750 (6) MS-CHAP2-Response = 0x70008158d62efd7635c9fb5b701e2fb44ee300000000000000005390d893765b4f1900adee9e21dd10f5827472b58eeb8e48 (6) FreeRADIUS-Proxied-To = 127.0.0.1 (6) server inner-tunnel { (6) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [chap] = noop (6) mschap.domainA: Found MS-CHAP attributes. Setting 'Auth-Type = mschap.domainA' (6) [mschap.domainA] = ok (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "userA", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) update control { (6) &Proxy-To-Realm := LOCAL (6) } # update control = noop (6) eap: No EAP-Message, not doing EAP (6) [eap] = noop (6) [files] = noop (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = noop (6) } # authorize = ok (6) Found Auth-Type = MS-CHAP (6) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (6) Auth-Type MS-CHAP { (6) group { (6) mschap.domainA: Creating challenge hash with username: userA (6) mschap.domainA: Client is using MS-CHAPv2 (6) mschap.domainA: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} ... --> eapol_test -c peap-mschapv2.conf -s testing123 ... FAILS The above test is using mods-enabled/mschap where I've set "--domain=FOO". Tracing through the logs, it looks like the eap module is called (expected), within eap it executes the peap section (expected) which sets "default_eap_type = mschapv2". Not sure if I'm saying this correctly, but the mschapv2 section is executes using the default mschap module. (8) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [chap] = noop (8) [mschap.domainA] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "userA", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) update control { (8) &Proxy-To-Realm := LOCAL (8) } # update control = noop (8) eap: Peer sent EAP Response (code 2) ID 8 length 65 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0xa3eaf94ca3e2e3ae (8) eap: Finished EAP session with state 0xa3eaf94ca3e2e3ae (8) eap: Previous EAP request found for state 0xa3eaf94ca3e2e3ae, released from the list (8) eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) eap_mschapv2: authenticate { (8) mschap: Creating challenge hash with username: userA (8) mschap: Client is using MS-CHAPv2 (8) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-FOO} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: My apologies for not posting the "radius -X" for the failed eapol_test. There are restrictions at my site about posting server logs, I'm working on it. Questions: 1) Does it look like I've made any glaring mistakes or am I on the correct path? 2) What can I do to make peap/mschap work under this circumstances? Any help is appreciated. Pete K.

2 1