- Freeradius-Users - lists.freeradius.org

auth and detail logs into json format?
by J E H A N Z A I B 30 Apr '18

30 Apr '18

Hi folks, Is there anyway i can get auth-detail , linelog and detail logs into json instead of plain text ? so currently i have detail reply_log { #filename = ${radacctdir}/auth-detail-%Y%m%d filename = ${radacctdir}/auth-detail.log permissions = 0600 } if there is a way i can atleast convert these auth logs into json format? -- Regards, Jehanzaib

6 14

Authentication against Google Apps domain
by Matt Paska 27 Apr '18

27 Apr '18

Hello, I'm looking for steps to configure a wireless network for WPA2-Enterprise encryption with 802.1X authentication against Google Apps domain. With this, your users should be able to use their Google Apps credentials to access secure wireless network. EAP-TTLS/PAP devices. Similar to what is detailed here ( https://wiki.freeradius.org/guide/Enterprise-WiFi) using configuration files for iOS devices and Mac OS computers. Thanks!

1 0

What is the magic to see the Windows User as DOMAIN\user
by Nick Howitt 27 Apr '18

27 Apr '18

I'm sorry for posting this here as it is really a Windows question but it is driving me scatty trying to authenticate with a Windows client. I only seem to get the User-Name come through with machine credentials like host/machine_name.DOMAIN. For the life of me I can't see how to switch Win10 to pass a real user name through to Radius like DOMAIN\user. There must be a setting in Windows which I am overlooking. Can anyone please help? Thanks, Nick

2 1

Using unlang / SQL with single return value; couple of questions.
by Dom Latter 27 Apr '18

27 Apr '18

(This is partly a continuation of the thread "Perl vs. python vs. Lua?" started late February) [1]. First thanks to Alan for pointing me in the right direction. I thought I would describe the process for the benefit of others. Basically we need to assign wifi users a VLAN based on their location and username. If they are rejected we want to put a reason in the Reply-Message (and this *should* in due course end up in the line log and the postauth table). We have been using a PHP script. To replace it I have put the bulk of the logic in to the SELECT clause of the SQL query. If there's a "normal" VLAN available it's in the range 1 to 4096. Return codes 5000 to 5005 indicate "accepted" but with special conditions. Return codes 5010 to 5014 indicate "reject". Return codes above 10000 indicate a VLAN applied a different way, and so on. So in in our default server in the post-auth block we have (for example): update control { CustomVal := "%{sql:SELECT \ CASE \ WHEN (cs_suspended.value = '1') THEN 5010 \ WHEN (u.deleted != '0') THEN 5011 \ // etc Then the unlang code "decodes" the return value: if ( &control:XL-Vlan < 5000 ) { update reply { Filter-Id := &control:CustomVal Reply-Message += "Accept: MAC found." } } elsif (.... So I have managed quite okay without the map functionality of version 4; in fact, as the query should cache quite nicely it's possible that it's much better to put as much logic as possible into the query... I hope the above is reasonably clear - I have done my best with the time available! 1st question: I am currently using a REGEXP in the query to perform a partial match and would prefer to use a LIKE '%foo%' instead... but the % wildcard seems to conflict with freeradius's own substitution. Anybody know a workaround? 2nd question: we use a "magic" MAC address for non-wifi authentication; which contains for no good reason, an exclamation mark. The problem is that in the query the '%{request:Calling-Station-Id} gets expanded such that the '!' becomes '=21'. So my WHEN clause in the SELECT has to match on '=21'. Any workarounds so that the SQL query would see the "real" value? [1] I only do this gig part-time and only part of *that* is spent on freeradius development,

2 3

Are config and control list equal?
by work vlpl 26 Apr '18

26 Apr '18

Hello, The documentation/wiki for rlm_python module https://wiki.freeradius.org/modules/Rlm_python says, that module can return tuple of 3 elements (return code, reply attributes, config attributes) For debug purposes I added additional instructions in raddb/polici.d/debug debug_config { if("%{debug_attr:config:}" == '') { noop } } And noticed in debug output this (6) policy debug_config { (6) if ("%{debug_attr:config:}" == '') { (6) Attributes matching "config:" (6) &control:Auth-Type = MS-CHAP (6) &control:Cleartext-Password = testing (6) EXPAND %{debug_attr:config:} (6) --> (6) if ("%{debug_attr:config:}" == '') -> TRUE (6) if ("%{debug_attr:config:}" == '') { (6) [noop] = noop (6) } # if ("%{debug_attr:config:}" == '') = noop (6) } # policy debug_config = noop and debug_control policy return the same results (6) policy debug_control { (6) if ("%{debug_attr:control:}" == '') { (6) Attributes matching "control:" (6) &control:Auth-Type = MS-CHAP (6) &control:Cleartext-Password = testing (6) EXPAND %{debug_attr:control:} (6) --> (6) if ("%{debug_attr:control:}" == '') -> TRUE (6) if ("%{debug_attr:control:}" == '') { (6) [noop] = noop (6) } # if ("%{debug_attr:control:}" == '') = noop (6) } # policy debug_control = noop Is this means what control and config lists are equal?

2 1

Issue with EAP authentication on packet loss
by jm+freeradiususer＠roth.lu 26 Apr '18

26 Apr '18

Hello, We have a problem when packet loss occurs at step #4 of the EAP dialogue: 1) Access-Request 2) Access-Challenge 3) Access-Request 4) Accept or Reject (in this case: Access-Accept) 5) Access-Request (duplicate) 6) Reject In this case, #4 is sent by the server but gets lost on its way to the NAS. I've managed to reproduce using iptables dropping the packet. So after some time the NAS sends packet #3 again. At that point I am getting "No EAP session matching state" from the eap module in the "authenticate" section and the request is rejected. This is consistent with what we see in step #4 (upon sending the Access-Accept which gets lost), namely this: (1) eap : Expiring EAP session with state 0x2f8521a02f84259c (1) eap : Finished EAP session with state 0x2f8521a02f84259c (1) eap : Previous EAP request found for state 0x2f8521a02f84259c, released from the list Who's at fault? How do you solve this (except for not using UDP)? Do you set aggressive timeouts/retries on the NAS? Thanks, Marki

5 14

radreply is not queried
by Charly 26 Apr '18

26 Apr '18

Hello, I don't understand why radreply table is not queried whereas radgroupreply is queried : (0) authorize { (0) [preprocess] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> john (0) sql: SQL-User-Name set to 'john' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'john' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'john' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'john' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'john' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql-SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'common' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'common' ORDER BY id (0) sql: Group "common": Conditional check items matched (0) sql: Group "common": Merging assignment check items (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql-SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'common' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'common' ORDER BY id (0) sql: Group "common": Merging reply items Thank for your help Charly

2 2

EAP-TTLS certificates
by Tsirkas Georgios 26 Apr '18

26 Apr '18

Hello, Are certificates necessary using EAP-TTLS? Also clients certificates are installed only on Access-Points? Thank you!

2 1

ISSUE: Authentication will fail unless a "known good" password is available
by Somanath Mishra 26 Apr '18

26 Apr '18

Hi Team, I am facing issue with radtest. I am getting error like: Authentication will fail unless a "known good" password is available Below debug details: Received Access-Request Id 241 from 127.0.0.1:38747 to 127.0.0.1:1812 length 74 (3) User-Name = "test" (3) User-Password = "test123" (3) NAS-IP-Address = 127.0.1.1 (3) NAS-Port = 1812 (3) Message-Authenticator = 0x73b04566a900069b236e748aee43500c (3) # Executing section authorize from file /etc/freeradius/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "test", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: No EAP-Message, not doing EAP (3) [eap] = noop (3) [files] = noop (3) sql: EXPAND %{User-Name} (3) sql: --> test (3) sql: SQL-User-Name set to 'test' rlm_sql (sql): Closing connection (8): Hit idle_timeout, was idle for 141 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (9): Hit idle_timeout, was idle for 141 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (7): Hit idle_timeout, was idle for 141 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (10), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.22-0ubuntu0.16.04.1, protocol version 10 rlm_sql (sql): Reserved connection (10) (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (3) sql: User found in radcheck table (3) sql: Conditional check items matched, merging assignment check items (3) sql: User-Password := "test123" (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id (3) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (3) sql: --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (3) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (3) sql: User not found in any groups rlm_sql (sql): Released connection (10) Need 2 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (11), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.22-0ubuntu0.16.04.1, protocol version 10 (3) [sql] = ok (3) [expiration] = noop (3) [logintime] = noop (3) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (3) pap: WARNING: !!! Ignoring control:User-Password. Update your !!! (3) pap: WARNING: !!! configuration so that the "known good" clear text !!! (3) pap: WARNING: !!! password is in Cleartext-Password and NOT in !!! (3) pap: WARNING: !!! User-Password. !!! (3) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (3) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (3) pap: WARNING: Authentication will fail unless a "known good" password is available (3) [pap] = noop (3) } # authorize = ok (3) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (3) Failed to authenticate the user (3) Using Post-Auth-Type Reject (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) Post-Auth-Type REJECT { (3) sql: EXPAND .query (3) sql: --> .query (3) sql: Using query template 'query' rlm_sql (sql): Reserved connection (10) (3) sql: EXPAND %{User-Name} (3) sql: --> test (3) sql: SQL-User-Name set to 'test' (3) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (3) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test123', 'Access-Reject', '2018-04-26 20:51:05') (3) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test123', 'Access-Reject', '2018-04-26 20:51:05') (3) sql: SQL query returned: success (3) sql: 1 record(s) updated rlm_sql (sql): Released connection (10) (3) [sql] = ok (3) attr_filter.access_reject: EXPAND %{User-Name} (3) attr_filter.access_reject: --> test (3) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) [attr_filter.access_reject] = updated (3) [eap] = noop (3) policy remove_reply_message_if_eap { (3) if (&reply:EAP-Message && &reply:Reply-Message) { (3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) else { (3) [noop] = noop (3) } # else = noop (3) } # policy remove_reply_message_if_eap = noop (3) } # Post-Auth-Type REJECT = updated (3) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test/test123] (from client localhost port 1812) (3) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Sending delayed response (3) Sent Access-Reject Id 241 from 127.0.0.1:1812 to 127.0.0.1:38747 length 20 Waking up in 3.9 seconds. (3) Cleaning up request packet ID 241 with timestamp +264 Ready to process requests Please help me on that.

2 1

What is the recommended way of overriding a mod file like "realm"
by Nick Howitt 26 Apr '18

26 Apr '18

The reason I am asking is because domain logins are appearing as "user/machine.domain". I can make it work by adding a realm in proxy.conf (or a parallel file and adding an INCLUDE in radius.conf): realm "~(.*\.)*domain$" { } But I also either have to change the delimiter in the "realm suffix" section of /etc/raddb/mods-available/realm from "@" to "/" which means the file is non non-standard or I have a couple of choices of adding a block: realm realmclearos { format = suffix delimiter = "/" } at the bottom /etc/raddb/mods-available/realm or in its own file in mods-available and symlinking to it from mods-enabled, but then, either way, I also have to add a line "realmclearos" in /etc/raddb/sites-available/default around the line saying "suffix" which makes /etc/raddb/sites-available/default non-standard. There is a fair push on the mailing lists of keeping things standard and I am wondering what is the best direction - or is my solution completely wrong. Thanks, Nick

2 1