- Freeradius-Users - lists.freeradius.org

SPAM User - Can someone help him, please?
by DM 20 Nov '18

20 Nov '18

Really, can someone ditch/unsubscribe this guy? Any Moderators? Cheers, DM

2 1

Fwd: EAP-sim using freeradius
by Siddharth Katragadda 19 Nov '18

19 Nov '18

Hi, Freeradius Version: 3.0 I had a question about EAP-SIM. We previously got EAP-SIM to work on the Free-radius version 2. But once we upgraded to 3.0, we saw the rlm_sim_files has been deprecated and now we need to use rlm_passwd. I made the following changes the config files: 1. eap - added to the eap{} sim { } 2. Changed passwd file under mods-enabled: passwd passwd { filename = /usr/local/etc/raddb/simtriplets.dat format = "*User-Name:User-Password" hash_size = 100 ignore_nislike = no allow_multiple_keys = no } /usr/local/etc/raddb/simtriplets.dat: 1001010123456789@wlan.mnc001.mcc001.3gppnetwork.org:2 ADE1426F93045258CCD7B9CF739CD51:CA1a6a73:44163dcd3063ee06 1001010123456789(a)wlan.mnc001.mcc001.3gppnetwork.org: A7DB577E986F41e999981FE01E8E9351:9E0ec181:2B3182377B3d2e05 1001010123456789@wlan.mnc001.mcc001.3gppnetwork.org:92 F13B6BB93641b0914DD3D6DAAFB78C:9Ca5541a:767e395d867fa4b0 1001010123456789@wlan.mnc001.mcc001.3gppnetwork.org:3 D6978EEB53E4c9f94F116A4AFC15EEC:09381b57:68fca592D475ada8 1001010123456789@wlan.mnc001.mcc001.3gppnetwork.org:56 F874F6F0C543c6B1D54CCE3B425E2B:3Ce1debe:4B16c28f5D165ab6 3. Added passwd in authorize section in default file under sites-available: passwd eap { ok = return } The radiusd starts up fine with this configuration. But when I run the SIM test, I see the following error: *eap_sim: ERROR: EAP-SIM-RAND1 not found* Is there any documentation on how to setup rlm_passwd for EAP-SIM? Any help in this regard would be appreciated. Thanks Siddharth (Wifi Test, Google inc)

6 242

Idiot on the mailing list: Song Zou
by Alan DeKok 19 Nov '18

19 Nov '18

I'm working to ban the most recent idiot who's spamming list list with unsubscribe comments. These emails serve as a public record that he's too stupid to hit the "unsubscribe" link at the bottom of every message to the list. What makes this more difficult is that he's using a remailer, so the public address we see isn't the one he's used for subscription. He also opened a GitHub issue, which again serves as a public record of idiocy. I think he's gone, but we'll see. Alan DeKok.

1 0

FreeRadius 3.0.11 [Best method to log access accept requests to DB]
by Ibrahim Nezar Al-Mahfooz 19 Nov '18

19 Nov '18

Hi, We are trying to log users access accept requests in a database for later statistics and analysis for the network. Firstly, we accomplished this requirement using the post-auth section by using sql module to inserting users request and it worked perfectly, however, and obviously, if the database is down for any reason, the radius won't process further requests which will prevent users from authentication. So we are wondering if there is any method to log radius accept request in a similar fashion like "Post-Auth-Type REJECT" where we noticed that FreeRadius can keep accepting radius requests and tolerate DB failures. Ibrahim --

5 13

Tough time getting FreeRADIUS 3.0.9 to work with mysql
by Kwesi Yankson 19 Nov '18

19 Nov '18

Hello,I am a freeRADIUS 2.x user and want to start using freeRADIUS 3.x.xI have installed freeRADIUS 3.0.9 and done a lot of reading since I want to avoid being told to "RTFM"I can't seem to get an Access-Accept when I do a radtest for MySQL users. I'm sure I'm missing something (still adjusting to the difference between the two version). Can someone help or point me in the right direction? Below is my debug:(1) Received Access-Request Id 121 from 127.0.0.1:35861 to 127.0.0.1:1812 length 72 (1) User-Name = "me" (1) User-Password = "pass" (1) NAS-IP-Address = 127.0.1.1 (1) NAS-Port = 0 (1) Message-Authenticator = 0xd9c706bfd54e51cd4eab51d9e19e4da2 (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (!&User-Name) { (1) if (!&User-Name) -> FALSE (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@.*@/ ) { (1) if (&User-Name =~ /@.*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "me", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) sql: EXPAND %{User-Name} (1) sql: --> me (1) sql: SQL-User-Name set to 'me' rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 252 seconds rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 252 seconds rlm_sql (sql): Closing connection (0): Hit idle_timeout, was idle for 252 seconds rlm_sql (sql): Closing connection (5): Hit idle_timeout, was idle for 252 seconds rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 244 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): Closing connection (6): Hit idle_timeout, was idle for 244 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 244 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (7), 1 of 32 pending slots used rlm_sql (sql): Reserved connection (7) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'me' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'me' ORDER BY id rlm_sql (sql): Released connection (7) rlm_sql (sql): 0 of 1 connections in use. Need more spares rlm_sql (sql): Opening additional connection (8), 1 of 31 pending slots used (1) [sql] = notfound (1) [expiration] = noop (1) [logintime] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) sql: EXPAND .query (1) sql: --> .query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (7) (1) sql: EXPAND %{User-Name} (1) sql: --> me (1) sql: SQL-User-Name set to 'me' (1) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (1) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'me', 'pass', 'Access-Reject', '2015-07-12 23:21:17') (1) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'me', 'pass', 'Access-Reject', '2015-07-12 23:21:17') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (7) (1) [sql] = ok (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> me (1) attr_filter.access_reject: Matched entry DEFAULT at line 18 (1) [attr_filter.access_reject] = updated (1) eap: Request didn't contain an EAP-Message, not inserting EAP-Failure (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) <delay>: Sending delayed response (1) <delay>: Sent Access-Reject Id 121 from 127.0.0.1:1812 to 127.0.0.1:35861 length 20 Waking up in 3.9 seconds. (1) <delay>: Cleaning up request packet ID 121 with timestamp +252 Thanks in advance

6 92

FreeRADIUS and Active Directory Integration
by Scott Pickles 19 Nov '18

19 Nov '18

I'm sure you're reading the subject going "ugh not another one". But there is so much documentation out there and all of it slightly different that I don't know which end is up at this point. I would like to use FreeRADIUS to authenticate VPN users and wireless, and I'm working on VPN right now. From what I understand so far, I want to use LDAP to check if the person is in the right group first, and if not reject them. If they are in the right group then authenticate using ntlm_auth. I am also understanding that the place to do this is no longer the users/authorize file and that it should be done in the 'default' file using 'unlang'. Is this correct so far? If so, can someone give me an example of the 'unlang' portion?

6 36

LDAP (rlm_ldap) Version 3.0.9
by Scott Pickles 19 Nov '18

19 Nov '18

I'm running a CentOS 7 environment and I just did a fresh install of v3.0.9 of FreeRADIUS. I also installed version 1.0.2d of openssl so I'm not subject to heartbleed. When I installed the ldap module, yum downloaded version 3.0.4 and also installed a heartbleed vulnerable version of openssl and broke my install. I know how to patch radiusd.conf for the heartbleed vulnerability but I'd rather not. So I removed the ldap module, re-installed openssl 1.0.2d and recompiled FreeRADIUS. Is there a repo that will provide me with a 3.0.9 version of the ldap module? If not, can I compile and point to my lib directory for openssl 1.0.2d instead? Yum downloads an RPM and I don't know of a way to simply extract that, so I am looking for a way to compile from source for either version 3.0.4 or 3.0.9 if it exists. Don't know where to look for the source(s).

4 7

FR 3.0: Fall back to proxy if SQL returns no result
by Rens Houben 19 Nov '18

19 Nov '18

Hello, I'm (still) working on migrating an existing Radiator setup to FreeRADIUS, and after some deliberation it was felt that the best way to handle the transition would be to have FreeRADIUS use the existing setup as proxies and configure it to fall back to said proxies when rlm_sql returns no hits. I've managed to set up the proxies thanks to the example in proxy.conf and the documentation in https://wiki.freeradius.org/config/Proxy, but all the instructions for /using/ the proxy pool involve setting specific realms rather than fallback, and I'm not sure if I'm even using the right search terms. Additionally, looking through the freeradius -X debug log I notice that while it does recognize the home_server stanzas I added to the virtual host, it does /not/ acknowledge the home_server_pool stanza in the same file. Have I missed something? --Rens.

3 8

Reply-Messages based on different conditions
by Kwesi Yankson 19 Nov '18

19 Nov '18

Hello,I'm using freeRADIUS 3.0.9I use the sql module to do AAAI currently want to use unlang to do the following.Assuming there a user called "bob" who has the password "pass"I want unlung to compare the username and password in such a way thatif username is "bob" and password is not "pass" a Reply-Message such as "Incorrect password for user "bob" " will be sent. This scenario is for only if the username bob exists.If username "bob" does not exist the a Reply-Message = "User "bob" not found" Can someone help me with the unlang which will do this?

2 1

LDAP Query: Not Found
by Scott Pickles 19 Nov '18

19 Nov '18

How can I further troubleshoot what might be the cause for my query against LDAP to return no results? I have verified the following from debugging and testing: [ ... SNIP ... ] # Loaded module rlm_ldap # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "dc01.myDomain.com" port = 3268 password = <<< secret >>> identity = "CN=Free RADIUS,CN=Users,DC=myDomain,DC=com" user { filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "DC=myDomain,DC=com" access_positive = yes } group { filter = "(objectClass=posixGroup)" scope = "sub" base_dn = "DC=myDomain,DC=com" name_attribute = "cn" membership_attribute = "memberOf" membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=frClient)" scope = "sub" base_dn = "DC=myDomain,DC=com" attribute { identifier = "radiusClientIdentifier" shortname = "cn" secret = "radiusClientSecret" } } profile { filter = "(&)" } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 rlm_ldap: libldap vendor: OpenLDAP version: 20439 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to dc01.myDomain.com:3268 rlm_ldap (ldap): Waiting for bind result... >>rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1) rlm_ldap (ldap): Connecting to dc01.myDomain.com:3268 rlm_ldap (ldap): Waiting for bind result... >>rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2) rlm_ldap (ldap): Connecting to dc01.myDomain.com:3268 rlm_ldap (ldap): Waiting for bind result... >>rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3) rlm_ldap (ldap): Connecting to dc01.myDomain.com:3268 rlm_ldap (ldap): Waiting for bind result... >>rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4) rlm_ldap (ldap): Connecting to dc01.myDomain.com:3268 rlm_ldap (ldap): Waiting for bind result... >>rlm_ldap (ldap): Bind successful } # modules [ ... SNIP ... ] So it appears to be binding to LDAP ok. I am binding on port 3268 to reference the global catalog and search sub-domains. [ ... SNIP ... ] Ready to process requests Received Access-Request Id 32 from 172.18.1.2:1025 to 172.18.2.100:1812 length 66 User-Name = 'spickles' User-Password = '****' NAS-IP-Address = 172.18.1.2 NAS-Port = 32 NAS-Port-Type = Virtual (1) Received Access-Request packet from host 172.18.1.2 port 1025, id=32, length=66 (1) User-Name = 'spickles' (1) User-Password = '****' (1) NAS-IP-Address = 172.18.1.2 (1) NAS-Port = 32 (1) NAS-Port-Type = Virtual (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) rewrite_calling_station_id rewrite_calling_station_id { (1) if (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i) (1) ERROR: Failed retrieving values required to evaluate condition (1) else else { (1) [noop] = noop (1) } # else else = noop (1) } # rewrite_calling_station_id rewrite_calling_station_id = noop (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop rlm_ldap (ldap): Reserved connection (4) (1) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap : --> (uid=spickles) (1) ldap : EXPAND DC=myDomain,DC=COM (1) ldap : --> DC=myDomain,DC=COM (1) ldap : Performing search in 'DC=myDomain,DC=COM' with filter '(uid=spickles)', scope 'sub' (1) ldap : Waiting for search result... >> (1) ldap : Search returned no results rlm_ldap (ldap): Released connection (4) rlm_ldap (ldap): 0 of 1 connections in use. Need more spares rlm_ldap (ldap): Opening additional connection (5) rlm_ldap (ldap): Connecting to rochdc01.myDomain.com:3268 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful >>(1) [ldap] = notfound (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Login incorrect (Failed retrieving values required to evaluate condition): [spickles/****] (from client <<client_short_name>> port 32) (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject : EXPAND %{User-Name} (1) attr_filter.access_reject : --> spickles (1) attr_filter.access_reject : Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (1) [eap] = noop (1) remove_reply_message_if_eap remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else else { (1) [noop] = noop (1) } # else else = noop (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (1) Sending delayed response (1) Sending Access-Reject packet to host 172.18.1.2 port 1025, id=32, length=0 Sending Access-Reject Id 32 from 172.18.2.100:1812 to 172.18.1.2:1025 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 32 with timestamp +189 Ready to process requests [ ... SNIP ... ] Not sure why it didn't find my user. My user is in the standard container (i.e. CN=Users) so I would think that sub would search there and find it? Perhaps that is my problem and either my base is incorrect or my scope is not correct? However, this seems to be correct according to the wiki (modules/Rlm_ldap). A final test with 'ldapsearch' yields similar results with no further information: [ ... SNIP ... ] []# ldapsearch -x -b "DC=myDomain,DC=com" -D "CN=Free RADIUS,CN=Users,DC=myDomain,DC=com" -h myDomain.com -w "<<password>>" "(&(CN=VPN-Internal,OU=VPN,OU=Groups,DC=myDomain,DC=com))" # extended LDIF # # LDAPv3 # base <DC=myDomain,DC=com> with scope subtree # filter: (&(CN=VPN-Internal,OU=VPN,OU=Groups,DC=myDomain,DC=com)) # requesting: ALL # # search reference ref: ldap://DomainDnsZones.myDomain.com/DC=DomainDnsZones,DC=myDomain, DC=com # search result search: 2 >>result: 0 Success # numResponses: 2 # numReferences: 1 [ ... SNIP ... ] The only other thing I can think of is that the user that I'm binding to AD with to read information doesn't have the right permissions? But I would also think that the bind wouldn't be successful in the first place for the module if that were the case? I don't know what direction to take this in next to get more information. I would check the logs but since I'm running the server in debug mode the logs would just be duplicates of what I already have, correct?

5 18