- Freeradius-Users - lists.freeradius.org

best practice for user permissions
by Samuel LEFOL 27 Jun '18

27 Jun '18

Hello, I'm using freeradius 3.0.12 with rlm_ldap authentication. I configured it as suggested in README: authorize { ... ldap if ((ok || updated) && User-Password) { update control { Auth-Type := ldap } } ... } authenticate { ... Auth-Type ldap { ldap } ... } I wonder what is the best practice for user permissions. 1. in users file : DEFAULT Auth-Type := ldap, LDAP-Group == "reseau" cisco-avpair :="shell:priv-lvl=15" DEFAULT Auth-Type := Reject OR 2. in post-auth section if (LDAP-Group == "reseau") { update reply { cisco-avpair :="shell:priv-lvl=15" } } else { reject } Could someone give me an explanation of the best way to go ? Best regards, Sam

3 4

Using rlm_rest for authorization and sqlcounters for session and bandwidth limits
by Rohith Asrk 27 Jun '18

27 Jun '18

Hi everyone, I'm working on a feature for being able to enforce session and bandwidth limits on users using a web interface of django-freeradius. I wish to authenticate the users using the rlm_rest module and use custom defined sqlcounters for putting limits on users. For ex., sqlcounter dailybandwidthcounter { counter_name = Max-Daily-Session-Traffic check_name = Max-Daily-Session-Traffic sql_module_instance = sql key = 'User-Name' reset = daily Reply-Message = "Your daily bandwidth limit has reached" query = "SELECT sum(AcctOutputOctets) + sum(AcctInputOctets) FROM radacct WHERE \ UserName = '%{${key}}' AND \ acctstarttime BETWEEN FROM_UNIXTIME('%%b') AND FROM_UNIXTIME('%%e')" } I'm not sure about configuring the FreeRADIUS configuration for accomplishing this. My authorize section looks like authorize { # ... dailybandwidthcounter rest # ... } I wish to use the concept of radius groups to implement this feature, i.e., add instances of radgroupcheck with attributes like Max-Daily-Session-Traffic so that the dailybandwidth counter checks it and puts the limits. I tried testing it with radclient and radtest but haven't been able to see any results. Am I going the right way? Can anyone help me with the concept of enforcing limits and also configuration? Regards, Rohith ASRK

2 4

Accounting Request
by Muhammed Buvaydani 27 Jun '18

27 Jun '18

I working on freeradius twith fortigate firewall . every things go fine and now I can make authentication and accounting. My problem is when making authentication for any user accounting-request from nas is send to Radius server and the user's info will insert again into radacct table, which will make big wrong in my program This is the Radius - x result when making authentication Sending Access-Accept of id 78 to 10.10.0.103 port 1030 Cisco-AVPair = "shell:priv-lvl=1" Idle-Timeout = 1000 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 10.10.0.103 port 1030, id=79, leng th=122 Acct-Status-Type = Start Acct-Session-Id = "1018bc85" User-Name = "10966417880" NAS-Identifier = "ftg" Framed-IP-Address = 192.168.33.4 Fortinet-Client-IP-Address = 192.168.33.4 Fortinet-Vdom-Name = "root" NAS-IP-Address = 10.10.0.20 Called-Station-Id = "10.10.0.20" Calling-Station-Id = "192.168.33.4" Event-Timestamp = "Jun 27 2018 16:44:33 +03" # Executing section preacct from file /etc/freeradius/sites-enabled/default.save +group preacct { ++[preprocess] = ok [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MA Y be inconsistent [acct_unique] Hashing ',NAS-Identifier = "ftg",NAS-IP-Address = 10.10.0.20,Acct- Session-Id = "1018bc85",User-Name = "10966417880"' [acct_unique] Acct-Unique-Session-ID = "a5d8f840a1843c92". ++[acct_unique] = ok [suffix] No '@' in User-Name = "10966417880", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop +} # group preacct = ok # Executing section accounting from file /etc/freeradius/sites-enabled/default.s ave +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> 10.10.0.103 [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:- %{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.10.0 .103/detail-20180627 [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IP v6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.10.0.103/de tail-20180627 [detail] expand: %t -> Wed Jun 27 16:44:33 2018 ++[detail] = ok [sradutmp] expand: /var/log/freeradius/sradutmp -> /var/log/freeradius/srad utmp [sradutmp] expand: %{User-Name} -> 10966417880 rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ++[sradutmp] = noop [sql] expand: %{User-Name} -> 10966417880 [sql] sql_set_user escaped user --> '10966417880' [sql] expand: %{Acct-Delay-Time} -> [sql] ... expanding second conditional [sql] expand: INSERT INTO radacct (acctsessionid, ac ctuniqueid, username, realm, nasipaddress, naspo rtid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinf o_stop, acctinputoctets, acctoutputoctets, calledstationid, calli ngstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessi onsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Ses sion-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-A ddress}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Ser vice-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 27 rlm_sql (sql): Released sql socket id: 27 ++[sql] = ok [attr_filter.accounting_response] expand: %{User-Name} -> 10966417880 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 79 to 10.10.0.103 port 1030 Finished request 1. Cleaning up request 1 ID 79 with timestamp +41 Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 78 with timestamp +41 Ready to process requests. This mean every user will has tow records in to radacct table how can I stop that .

1 0

(no subject)
by Hailun Tan 27 Jun '18

27 Jun '18

I am trying to perform the user authentication via freeradius server on the ssh conection. I have setup the free radius server according to the wiki pages: https://wiki.freeradius.org/guide/Getting-Started In addition, I managed to install the dolaradius to manage the free radius. I have run the radtest for the servers. The configurations for the radius server is: free radius server IP: 10.10.150.134 free radius server port: 1812 master secret: NOJA user name: micfox user password: micfox001 On the client machine (client IP: 10.10.150.136), I run the following command: *dev-ldap-server: radtest micfox micfox001 10.10.150.134:1812 <http://10.10.150.134:1812> 1812 NOJA* Sending Access-Request of id 5 to 10.10.150.134 port 1812 User-Name = "micfox" User-Password = "micfox001" NAS-IP-Address = 10.10.150.136 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 10.10.150.134 port 1812, id=5, length=38 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP So it should prove the free radius server is up and running. However, I have configured to use the pam-freeradius-auth.so to hookup with the PAM modules on the client machine to authenticate the ssh user. it does not work. I have updated the /etc/pam.d/sshd as follows: =========== *auth sufficient pam_radius_auth.so debug skip_passwd*# PAM configuration for the Secure Shell service # Standard Un*x authentication. @include common-auth # Disallow non-root logins when /etc/nologin exists. account required pam_nologin.so # Uncomment and edit /etc/security/access.conf if you need to set complex # access limits that are hard to express in sshd_config. # account required pam_access.so # Standard Un*x authorization. @include common-account # SELinux needs to be the first session rule. This ensures that any # lingering context has been cleared. Without this it is possible that a # module could execute code in the wrong domain. session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close # Set the loginuid process attribute. session required pam_loginuid.so # Create a new session keyring. session optional pam_keyinit.so force revoke # Standard Un*x session setup and teardown. @include common-session # Print the message of the day upon successful login. # This includes a dynamically generated part from /run/motd.dynamic # and a static (admin-editable) part from /etc/motd. session optional pam_motd.so motd=/run/motd.dynamic session optional pam_motd.so noupdate # Print the status of the user's mailbox upon successful login. session optional pam_mail.so standard noenv # [1] # Set up user limits from /etc/security/limits.conf. session required pam_limits.so # Read environment variables from /etc/environment and # /etc/security/pam_env.conf. session required pam_env.so # [1] # In Debian 4.0 (etch), locale-related environment variables were moved to # /etc/default/locale, so read that as well. session required pam_env.so user_readenv=1 envfile=/etc/default/locale # SELinux needs to intervene at login time to ensure that the process starts # in the proper default security context. Only sessions which are intended # to run in the user's context should be run after this. session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open # Standard Un*x password updating. @include common-password But now when I run the ssh micfox(a)10.10.150.136 (freeradius client's iP). the /var/log/auth.log has the following error messages: Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: Got user name micfox Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: ignore last_pass, force_prompt set Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: Sending RADIUS request code 1 Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG: get_ipaddr(10.10.150.134) is available. (1812) Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG: talk_radius(0x86960a0a) is available (1812,port). Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG: waiting for response from radius server 10.10.150.134 with port 1812 (master secret: NOJA). *Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: RADIUS server 10.10.150.134 failed to respond* Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: All RADIUS servers failed to respond. Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: authentication failed Jun 25 12:05:54 dev-ldap-server sshd[6438]: Postponed keyboard-interactive for invalid user micfox from 127.0.0.1 port 37362 ssh2 [preauth] The RADIUS server always failed to respond.. I have configured the /etc/pam_radius_auth.conf as follows: # pam_radius_auth configuration file. Copy to: /etc/raddb/server # # For proper security, this file SHOULD have permissions 0600, # that is readable by root, and NO ONE else. If anyone other than # root can read this file, then they can spoof responses from the server! # # There are 3 fields per line in this file. There may be multiple # lines. Blank lines or lines beginning with '#' are treated as # comments, and are ignored. The fields are: # # server[:port] secret [timeout] # # the port name or number is optional. The default port name is # "radius", and is looked up from /etc/services The timeout field is # optional. The default timeout is 3 seconds. # # If multiple RADIUS server lines exist, they are tried in order. The # first server to return success or failure causes the module to return # success or failure. Only if a server fails to response is it skipped, # and the next server in turn is used. # # The timeout field controls how many seconds the module waits before # deciding that the server has failed to respond. # # server[:port] shared_secret timeout (s) *10.10.150.134:1831 <http://10.10.150.134:1831> NOJA 3* #other-server other-secret 3 # # having localhost in your radius configuration is a Good Thing. # # See the INSTALL file for pam.conf hints. I believed I should have setup everything correctly?? why is the radius-pam-auth.so not working with the error message, * RADIUS server 10.10.150.134 failed to respond??* I have prolonged the timeout parameter from 3 seconds to 60 seconds but it did not work. If the radius server is not correctly set, it should not even pass the radtest before. But why there is no response from the radius server for freeradius-pam-auth.so if the server does work?? what could go wrong from the configurations on the pam-radius module? Please advise

5 11

accepting all the users
by John Martins 27 Jun '18

27 Jun '18

Hello, I'm new in freeradius, I installed freeeradius 3.016 and mysql, and would like to accept all the users directly. I work with Mikrotik routers. Could anybody give me a clue of how to do it? thanks!! Best Regards

3 5

Bypass Canceled Subscribers
by Guilherme Domingues 26 Jun '18

26 Jun '18

Hello, We've looking for a simple solution to bypass pppoe request from canceled subscribers. It's sounds odd, but some routers/onus from certain clients hits radius all day long, and we're think to access those devices again, by accepting their login(only CHAP) and configure this clients to DHCP networks. In alternative of it, we've seen as soluction blocking at L2, but we're working with different models of NAS and switches and other networks devices. For us is getting complicated for CHAP autentication. Someone have some idea or suggestion ? Best regards, --- "A mente que se abre a uma nova idéia jamais voltará ao seu tamanho original." Albert Einstein

2 1

Windows 10 breaks Samba/LDAP/freeradius machine credentials configuration
by Anthony Stuckey 26 Jun '18

26 Jun '18

I find it hard to believe that I'm the first person to come across this issue, but I have been unable to find anyone else with these exact questions or documentation that discusses this issue. It's easy to find a Microsoft document that discusses a problem that I don't have, it's very hard to find any document which discusses the problem I do have. https://support.microsoft.com/en-us/help/3121002/windows-10-devices-can-t-c… We use a Samba domain controller with an LDAP backend to provide account services for our organization. We have a Cisco wireless lan controller which uses freeradius to authenticate with Windows Machine Credentials. Windows 10 sends different User-Names before and after it is joined to the domain, and that causes wireless authentication to fail. Previous versions of Windows do not have this behavior, and wireless authentication works perfectly. Specifically, the User-Name attribute changes from User-Name = "host/i26171" to User-Name = "host/i26171.DOMAIN". The Samba server creates an ldap entry with the password attributes under the non-domain name, which is then not found when the credentials are presented with the domain attached. dn: uid=I26171$,ou=Machines,ou=SambaSAM,dc=domain,dc=edu uid: I26171$ uid: host/i26171 sambaSID: S-1-5-21-4128435402-3538960026-4000809499-15117 displayName: i26171$ objectClass: sambaSamAccount objectClass: account objectClass: radiusprofile sambaAcctFlags: [W ] cn: i26171 radiusFilterId: true radiusTunnelMediumType: IEEE-802 radiusTunnelType: vlan radiusTunnelPrivateGroupId: 630 sambaNTPassword: <<secret>> sambaPwdLastSet: 1526590492 Wed May 23 10:51:04 2018 : Info: [ldap] performing user authorization for host/i26171.DOMAIN Wed May 23 10:51:04 2018 : Info: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Wed May 23 10:51:04 2018 : Info: [ldap] ... expanding second conditional Wed May 23 10:51:04 2018 : Info: [ldap] expand: %{User-Name} -> host/i26171.DOMAIN Wed May 23 10:51:04 2018 : Info: [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=host/i26171.DOMAIN) Wed May 23 10:51:04 2018 : Info: [ldap] expand: ou=sambasam,dc=domain,dc=edu -> ou=sambasam,dc=domain,dc=edu Wed May 23 10:51:04 2018 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed May 23 10:51:04 2018 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed May 23 10:51:04 2018 : Debug: [ldap] performing search in ou=sambasam,dc=domain,dc=edu, with filter (uid=host/i26171.DOMAIN) Wed May 23 10:51:04 2018 : Debug: [ldap] object not found Wed May 23 10:51:04 2018 : Info: [ldap] search failed Wed May 23 10:51:04 2018 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed May 23 10:51:04 2018 : Info: ++[ldap] = notfound Has anyone else encountered this issue, and what did you do to fix it? The obvious solution is to rewrite the User-Name attribute in the freeradius configuration, but this is seriously frowned upon by the freeradius developers, for reasons which are not usually made explicit other than vague comments that it might allow a security hole. Attempts to actually do this all seem to end in various error messages and pain. Is there any known setting for Windows 10 that will cause it to act in the backwards-compatible way? Is there any documentation of why Microsoft made this change? Is this a known issue which is fixed in freeradius3/RHEL7 somehow? [root@radiusdebug /]# cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.9 (Santiago) [root@radiusdebug /]# rpm -qa | egrep -i freeradius freeradius-2.2.6-7.el6_9.x86_64 freeradius-utils-2.2.6-7.el6_9.x86_64 freeradius-ldap-2.2.6-7.el6_9.x86_64

2 1

right tutorial
by Javier Escalante 26 Jun '18

26 Jun '18

Hello, Could somebody tell us which tutorial /wiki can we follow in order to properly configure freeradius 3.0.16? Thanks in advance BR Javier Escalante Business Development Manager <mailto:Javier.escalante@bwireless.eu> Javier.escalante(a)bwireless.eu <tel:00%2034%20626%2078%2056%2075> 00 34 626 785 675 <tel:00%2034%2093%20172%2006%2074> 00 34 93 141 56 36 <tel:00%2041%2078%20689%2085%2069> 00 41 78 689 85 69 Skype: fruiz002 Do you know our IoT solutions? Have a look here: <http://www.bsmart.global/> www.bsmart.global <http://www.bwireless.eu/> http://www.bwireless.eu Le informamos que, de conformidad con la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, se informa que todos los datos personales que nos ha facilitado serán incorporados y tratados en los ficheros de BW & TAKACS TELECOM, S.L. para las finalidades de su e-mail. Puede ejercer sus derechos de acceso, rectificación, cancelación y oposición mediante una comunicación a BW & TAKACS TELECOM, S.L. con domicilio en <https://maps.google.com/?q=Camil+Oliveras,+26,+08032+Barcelona+(Espa%C3%B1a &entry=gmail&source=g> Camil Oliveras, 26, 08032 Barcelona (España), o bien mediante una comunicación a la dirección de correo electrónico <mailto:info@bwireless.eu> info(a)bwireless.eu. En ambos casos, deberá acompañar una copia de su documento nacional de identidad o documento válido que lo identifique.

11 40

tutorials
by Javier Escalante 26 Jun '18

26 Jun '18

Hello, I followed this wiki, https://wiki.freeradius.org/guide/SQL-HOWTO-for-freeradius-3.x-on-Debian-Ub… In theory, following completely, and having the files exactly as the wiki indicates, it should work, right? The error is still : (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query I don't get why it is not working, and why there is not more information in Internet (2 week with it already...). Since I have no clue where to look anymore? Can anybody give me a sensible and if possible understandable clue? Thanks BR Javier Escalante Business Development Manager Javier.escalante(a)bwireless.eu 00 34 626 785 675 00 34 93 141 56 36 00 41 78 689 85 69 Skype: fruiz002 Do you know our IoT solutions? Have a look here: www.bsmart.global http://www.bwireless.eu Le informamos que, de conformidad con la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, se informa que todos los datos personales que nos ha facilitado serán incorporados y tratados en los ficheros de B’W & TAKACS TELECOM, S.L. para las finalidades de su e-mail. Puede ejercer sus derechos de acceso, rectificación, cancelación y oposición mediante una comunicación a B’W & TAKACS TELECOM, S.L. con domicilio en Camil Oliveras, 26, 08032 Barcelona (España), o bien mediante una comunicación a la dirección de correo electrónico info(a)bwireless.eu. En ambos casos, deberá acompañar una copia de su documento nacional de identidad o documento válido que lo identifique.

2 1

Radperf
by Bassem Mettichi 26 Jun '18

26 Jun '18

hello, iam trying to make performnce tests for my freeradius server using Radperf tool but i don't know the command to send accounting and access request together at the same time, for example sending 1 accounting request than one access request, any help please? Thanks Bassem

1 0