- Freeradius-Users - lists.freeradius.org

LDAP-UserDN is not unique per ldap module instance (auth problem when multiple ldap module instances used)
by Kostas Zorbadelos 17 Sep '18

17 Sep '18

Hello all, in my current authentication policy, I use 2 instances of the LDAP module. The first instance queries the directory in a specific branch and gets information used in later checks. The other instance is used to authorize the user (and also authenticate him in some rare situations) and queries another branch. The problem is that when the second LDAP module is used for the authentication, it tries to bind with an LDAP-UserDN attribute obtained from the first module. I need to rewrite control:LDAP-UserDN for this to work. Tracing a bit the source, I saw that LDAP-UserDN is set with the '=' operator: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm… Is this by design? I would expect each module instance to have its own LDAP-UserDN and use that when used in authentication. Am I missing something, or is this something worth of raising a github issue? Regards, Kostas -- Kostas Zorbadelos http://gr.linkedin.com/in/kzorba

2 8

Receive EAP and proxy out with PEAP
by Christian Salway 16 Sep '18

16 Sep '18

Hello, My client doesn't support PEAP but the NPS server is configured to only use PEAP, so I was wondering if freeRadius could be used as a proxy to receive EAP-MSCHAPv2 and proxy using PEAP-MSCHAPv2? Thanks,Christian

2 1

Authenticating against Active Directory using winbind
by Christoffer Jönsson 15 Sep '18

15 Sep '18

Hello! I used this guide a year ago to enable 802.1x on my switches and APs and it worked without any problems to authenticate to my Samba4 AD/DC: https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind. Today I am having trouble getting it to work because it wont accept the password when running this command or connecting from switches: "radtest -t mschap adtest Password1 127.0.0.1 0 testing123". And winbind returns this result: "NTLM CRAP authentication for user [auth.chrjsn.se]\[adtest] returned NT_STATUS_WRONG_PASSWORD". But running this command, it authenticates with this result: ntlm_auth --username=adtest --domain=auth.chrjsn.se Password: NT_STATUS_OK: Success (0x0): "Plain-text authentication for user AUTH.CHRJSN.SE\adtest returned NT_STATUS_OK (PAM: 0)" Radiusd reports that password has expired, when it has not. I have reset the password for adtest and administrator with same results. I don't know if there's any new settings or something and I'm really stuck here. It also doesn't matter which version of samba/freeradius I'm using. Thanks!

4 10

Debian Stretch: No radutmp file though seeing Accounting message at network level
by Olivier 14 Sep '18

14 Sep '18

Hello, I'm currently testing SimultaneousUse setting in WPA2 Enterprise WiFi environment. I'm quite new to Radius (both concepts and implementations). After reading this (very interesting) document [1], I assigned myself a first step: seeing useful data through radwho command, no matter if Freeradius relied on a completely different source on input to implement SimultaneousUse feature. In my testing, I'm having: # radwho Fri Sep 14 12:28:55 2018 : Error: Unable to check file "/var/log/freeradius/radutmp": No such file or directory radwho: Error reading /var/log/freeradius/radutmp: No such file or directory 1. I read in [2] then that /var/log/freeradius/radutmp is created by Freeradius whenever it receives accounting data. Is it correct on Debian Stretch when package's config is mostly left unchanged ? 2. At network level, I see that my WiFi AP are sending Account-Request and receiving back Account-Response. Does it prove Freeradius's Accounting is turned on and running or shall I for instance, read this Response content ? Is there a better way to look at Freeradius "running features" ? [1] https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configurati… [2] http://lists.freeradius.org/pipermail/freeradius-users/2014-April/071808.ht… Best regards

4 4

Recommanded way to display properties for a given user ?
by Olivier 14 Sep '18

14 Sep '18

Hello, I've just discovered radmin and its capabilty to display clients list and details. Is there a way a way to get the same kind of display but for configured Users (ie entries that can be configured in /etc/freeradius/3.0/users file) as those entries can inherit properties from several sources (Groups, default values, various backends, ...) ? If I'm not mistaken, /var/log/syslog nor /var/log/freeradius/radius.log do not print such detailed data when freeradius daemon is launched with -x option. Best regards

2 3

issue with realm
by Somanath Mishra 14 Sep '18

14 Sep '18

Hi, I am facing issue with configuring realms. My requirement was "need to forward accounting packet to Fortigate". In radacct i am not getting Realm . below you can see my radacct table data. --------------------------------------------------------------------- # radacctid, acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctinterval, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress '2', '3C07A8C0-0008A16D', '33dcf4d9b2a4e05be6c38b2b6509ea6c', 'bob', 'students', '', '192.168.0.4', '0', 'Wireless-802.11', '2018-09-13 14:59:36', '2018-09-13 14:59:36', '2018-09-13 15:06:07', NULL, '390', 'RADIUS', 'CONNECT Unknown Radio', 'CONNECT Unknown Radio', '625711', '8754721', '00:0c:29:67:6d:ec', '17:f0:r4:b0:fe:td', 'User-Request', '', '', '192.168.0.60' -------------------------------------------------------------------- so to show realm value in radacct and send accounting packets to fortigate i modified in radiusd.conf and proxy.conf. below you can see change that i made to conf files: radiusd.conf:= modules { realm FortiGate { format = suffix delimiter = "@" } } proxy.conf:= Proxy-To-Realm:="FortiGate" and realm FortiGate { authhost =192.168.0.1:1812 accthost =192.168.0.1:1813 secret =a1rl08 } ----------------------------------------------------------------- I am not getting anything. I know i am doing wrong. Can you suggest me please how to achieve this?

2 1

Using other ldap attribute as wifi password
by Wim Vinckier 14 Sep '18

14 Sep '18

Hi List, I've configured freeIPA and freeRadius so I could use my ldap password as login to the network. Unfortunatly my manager wants me to change the system so it would be possible to use another ldap attribute as wifi password. I already extended the ldap configuration with an wifiCode attribute and when I query the ldap database I get the correct result back. The ipa-tools also return the correct value. Now I want to use this field in freeradius but I get stuck. I replaced the line "control:NT-Password := 'ipaNTHash'" by "control:Cleartext-Password := 'wifiCode'" but without any result. Is there any other thing I have to change to make it working? Kind regards, Wim Vinckier. -- I would love to change the world, but they wont give me the source code.

4 3

Getting a string 'as is' with no escapes from LDAP
by Kostas Zorbadelos 13 Sep '18

13 Sep '18

Hello all, I think a new thread is better for this discussion. In a previous thread (http://lists.freeradius.org/pipermail/freeradius-users/2018-September/09260…) I raised the issue of failing to get a string as is from an LDAP backend. The string represents the clear text password and I would like to take it 'as is' with no escaping of any kind. I got the explanation about the shell rules that are now implemented in freeradius 3 for strings, so as to get a single uniform approach to freeradius 3 and fix the inconsistencies of string handling in freeradius 2. We got to the solution of mapping the LDAP attribute as a binary attribute, say Tmp-Octets-0 and then use the following policy: if (control:Tmp-Octets-0) { update control { Cleartext-Password := "%{string:control:Tmp-Octets-0}" } } The binary attribute would need to be converted to string for the comparison in pap to work. Now, we found a problem for strings beginning with '0x' :) Example 1 (passwd '0xtest123') -------------------------------- kzorba@devradius(0)[09:34 AM]~/radius->/opt/freeradius/bin/radclient -f test_kzorba1.txt -x 79.128.176.142:1812 auth testing123 Sending Access-Request of id 178 to 79.128.176.142 port 1812 User-Name = "kzorba1(a)otenet.gr" NAS-Port-Type = xDSL User-Password = "0xtest123" NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" NAS-Port = 12234455 rad_recv: Access-Reject packet from host 79.128.176.142 port 1812, id=178, length=20 (0) Received Access-Request Id 99 from 79.128.176.142:50436 to 79.128.176.142:1812 length 140 (0) User-Name = "kzorba1(a)otenet.gr" (0) NAS-Port-Type = xDSL (0) User-Password = "0xtest123" (0) NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" (0) Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" (0) NAS-Port = 12234455 (0) # Executing section authorize from file /opt/freeradius-3.0.17/etc/raddb/sites-enabled/cisco-bng (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop ... rlm_ldap (ldap_1): Reserved connection (0) ... (0) ldap_1: Performing search in "..." with filter "...", scope "sub" (0) ldap_1: Waiting for search result... (0) ldap_1: User object found at DN "..." (0) ldap_1: Processing user attributes ... (0) ldap_1: WARNING: Failed parsing value "0xtest123" for attribute Tmp-Octets-0: Length of Hex String is not even, got 7 bytes ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (0) ldap_1: No attributes updated (0) ldap_1: reply:Framed-IP-Address = 62.103.131.9 rlm_ldap (ldap_1): Released connection (0) (0) [ldap_1] = updated ... (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = updated (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /opt/freeradius-3.0.17/etc/raddb/sites-enabled/cisco-bng (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> kzorba1(a)otenet.gr (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [kzorba1(a)otenet.gr] (from client myself port 12234455 cli BNG INTERFACE # DSLAM PORT DESC RIPTION) (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Example 2 (passwd '0xtest1234') -------------------------------- kzorba@devradius(0)[09:39 AM]~/radius->/opt/freeradius/bin/radclient -f test_kzorba1.txt -x 79.128.176.142:1812 auth testing123 Sending Access-Request of id 85 to 79.128.176.142 port 1812 User-Name = "kzorba1(a)otenet.gr" NAS-Port-Type = xDSL User-Password = "0xtest1234" NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" NAS-Port = 12234455 rad_recv: Access-Reject packet from host 79.128.176.142 port 1812, id=85, length=20 (0) Received Access-Request Id 85 from 79.128.176.142:38359 to 79.128.176.142:1812 length 140 (0) User-Name = "kzorba1(a)otenet.gr" (0) NAS-Port-Type = xDSL (0) User-Password = "0xtest1234" (0) NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" (0) Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" (0) NAS-Port = 12234455 (0) # Executing section authorize from file /opt/freeradius-3.0.17/etc/raddb/sites-enabled/cisco-bng (0) authorize { ... (0) ldap_1: WARNING: Failed parsing value "0xtest1234" for attribute Tmp-Octets-0: Invalid hex data (0) ldap_1: No attributes updated ... Is there a way to overcome this? Generally speaking a solution is needed to get a string 'as is' out of an LDAP backend (most probably this will affect other backends too) without escaping/unescaping of any kind. Regards, Kostas -- Kostas Zorbadelos http://gr.linkedin.com/in/kzorba

2 4

Incorrect datetime issue
by Somanath Mishra 13 Sep '18

13 Sep '18

Hi, i am facing issue in radacct insert. So it is showing incorrect dattime. So in debug i found datetime cloumn is missing 'FROM_UNIXTIME' in debug o/p . Below you can see debug msg. --------------------------------------------------------------------- EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - %{%{Acct-Session-Time}:-0}), %{%{integer:Event-Timestamp}:-date('now')}, NULL, %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '%{Connect-Info}', '', %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0}, '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') (16) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('3C00A8C0-0002A0D8', '40c3d442406733f6f19fe4fb3da8211c', 'bob', '', '192.168.0.4', '0', 'Wireless-802.11', (1536835611 - 600), 1536835611, NULL, 600, 'RADIUS', 'CONNECT Unknown Radio', '', 0 << 32 | 155655, 0 << 32 | 434058, '00:0c:29:67:6d:ec', '18:f0:e4:b0:fe:fd', '', '', '', '192.168.0.60') ---------------------------------------------------------------------- but in insert stmt query looking ok. below is insert stmt query. query = "\ INSERT INTO ${....acct_table1} \ (${...column_list}) \ VALUES \ ('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', \ '%{NAS-IP-Address}', \ '%{%{NAS-Port-ID}:-%{NAS-Port}}', \ '%{NAS-Port-Type}', \ FROM_UNIXTIME(%{integer:Event-Timestamp}), \ FROM_UNIXTIME(%{integer:Event-Timestamp}), \ NULL, \ '0', \ '%{Acct-Authentic}', \ '%{Connect-Info}', \ '', \ '0', \ '0', \ '%{Called-Station-Id}', \ '%{Calling-Station-Id}', \ '', \ '%{Service-Type}', \ '%{Framed-Protocol}', \ '%{Framed-IP-Address}')" # So i am not able to understand where is the issue? Can you help me on that?

2 5

how to manage dynamic list of realms
by Gil Sudai 12 Sep '18

12 Sep '18

Hello I am new to freeRadius. Went over the docs but not fully understand what to do. I am planning following solution: A system where companies (aka realm in radius?) can be added or remove dynamically. And for each company there is a dynamic list of users. For example user@comp-1com, user(a)comp-2.com, etc. Users will authenticate with name and password. I would like tips and pointers for further reading regarding the following questions: - Is it possible to add & remove a company (realm?) dynamically without restarting the radius server? - How to setup the radius to support multiple (dynamic) realms? - I want to put the users in postgresql db. When a user is added to a company my code will add it to the db. To store all users from all realms will be in a single db table (realm would be a column) or in different db tables? - do I need to use virtual servers for that or only realms? - How to configure the virtual server or realms? Again – any tips or pointers for better understanding is welcome Gil

2 4