- Freeradius-Users - lists.freeradius.org

(no subject)
by Mohiddin Shaik 19 Apr '18

19 Apr '18

Hey Hi, I have installed freeradius server and integrated freeipa server, when i run radtest its authenticate perfectly, i configured client.conf to auth my cisco firewall whenever i tried to login using freeipa user on my cisco firewall, radiusd -X debug mode say auth success but i am un able to login into terminal ((9) Sent Access-Accept Id 75 from x.x.x.x:1812 to x.x.x.x:22029 length 0 (9) Finished request). When i use freeipa admin user id i am able to login into cisco firewall to same freeradius server / same configuration. Debug Output: Ready to process requests (8) Received Access-Request Id 74 from 10.0.5.5:22029 to 10.0.0.94:1812 length 128 (8) User-Name = "mohiddin" (8) User-Password = "pass@123" (8) NAS-IP-Address = 10.0.5.5 (8) NAS-Port = 74 (8) NAS-Port-Type = Virtual (8) Cisco-AVPair = "ip:source-ip=10.0.2.49" (8) Calling-Station-Id = "10.0.2.49" (8) Cisco-AVPair = "coa-push=true" (8) # Executing section authorize from file /etc/raddb/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "mohiddin", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: No EAP-Message, not doing EAP (8) [eap] = noop (8) [files] = noop rlm_ldap (ldap): Closing connection (9): Hit idle_timeout, was idle for 133 seconds rlm_ldap (ldap): Closing connection (11): Hit idle_timeout, was idle for 133 seconds rlm_ldap (ldap): Closing connection (8): Hit idle_timeout, was idle for 120 seconds rlm_ldap (ldap): Closing connection (12): Hit idle_timeout, was idle for 120 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (10): Hit idle_timeout, was idle for 113 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (13): Hit idle_timeout, was idle for 113 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (14), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://ipa01.test.org:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (14) (8) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (8) ldap: --> (uid=mohiddin) (8) ldap: Performing search in "cn=users,cn=accounts,dc=test,dc=org" with filter "(uid=mohiddin)", scope "sub" (8) ldap: Waiting for search result... (8) ldap: User object found at DN "uid=mohiddin,cn=users,cn=accounts,dc=test,dc=org" (8) ldap: Processing user attributes (8) ldap: control:Password-With-Header += '{SSHA512}FBhJiiB8Uene3Nl6MkFBufEQNVBJsU9GrXy3wXtaaY0mUkjQ5CVAiWdWHHfEf5bZpYWYECf/mvwOojrM/L4dVJLuUJyt+N6Q' rlm_ldap (ldap): Released connection (14) Need 2 more connections to reach min connections (3) rlm_ldap (ldap): Opening additional connection (15), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://ipa01.test.org:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (8) [ldap] = updated (8) [expiration] = noop (8) [logintime] = noop (8) pap: Converted: &control:Password-With-Header -> &control:SSHA2-512-Password (8) pap: Removing &control:Password-With-Header (8) pap: Normalizing SSHA2-512-Password from base64 encoding, 96 bytes -> 72 bytes (8) [pap] = updated (8) } # authorize = updated (8) Found Auth-Type = PAP (8) # Executing group from file /etc/raddb/sites-enabled/default (8) Auth-Type PAP { (8) pap: Login attempt with password (8) pap: Comparing with "known-good" SSHA2-512-Password (8) pap: User authenticated successfully (8) [pap] = ok (8) } # Auth-Type PAP = ok (8) # Executing section post-auth from file /etc/raddb/sites-enabled/default (8) post-auth { (8) update { (8) No attributes updated (8) } # update = noop (8) [exec] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # post-auth = noop (8) Sent Access-Accept Id 74 from 10.0.0.94:1812 to 10.0.5.5:22029 length 0 (8) Finished request Waking up in 4.9 seconds. (8) Cleaning up request packet ID 74 with timestamp +504 Ready to process requests (9) Received Access-Request Id 75 from 10.0.5.5:22029 to 10.0.0.94:1812 length 84 (9) User-Name = "admin" (9) User-Password = "reflexis1" (9) NAS-IP-Address = 10.0.5.5 (9) NAS-Port = 75 (9) NAS-Port-Type = Virtual (9) Cisco-AVPair = "coa-push=true" (9) # Executing section authorize from file /etc/raddb/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "admin", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: No EAP-Message, not doing EAP (9) [eap] = noop (9) [files] = noop rlm_ldap (ldap): Closing connection (14): Hit idle_timeout, was idle for 160 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (15): Hit idle_timeout, was idle for 160 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (16), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://ipa01.test.org:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (16) (9) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (9) ldap: --> (uid=admin) (9) ldap: Performing search in "cn=users,cn=accounts,dc=test,dc=org" with filter "(uid=admin)", scope "sub" (9) ldap: Waiting for search result... (9) ldap: User object found at DN "uid=admin,cn=users,cn=accounts,dc=test,dc=org" (9) ldap: Processing user attributes (9) ldap: control:Password-With-Header += '{SSHA512}rtaic2+6VABUusn0KrluEZLtSkvcTxH7SVTmJYwYtlgWqp2f2oMYIQ0AuUTrfNEutEVbn794QFmkwinsfMFihn68yrWO+Po3' rlm_ldap (ldap): Released connection (16) Need 2 more connections to reach min connections (3) rlm_ldap (ldap): Opening additional connection (17), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://ipa01.test.org:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (9) [ldap] = updated (9) [expiration] = noop (9) [logintime] = noop (9) pap: Converted: &control:Password-With-Header -> &control:SSHA2-512-Password (9) pap: Removing &control:Password-With-Header (9) pap: Normalizing SSHA2-512-Password from base64 encoding, 96 bytes -> 72 bytes (9) [pap] = updated (9) } # authorize = updated (9) Found Auth-Type = PAP (9) # Executing group from file /etc/raddb/sites-enabled/default (9) Auth-Type PAP { (9) pap: Login attempt with password (9) pap: Comparing with "known-good" SSHA2-512-Password (9) pap: User authenticated successfully (9) [pap] = ok (9) } # Auth-Type PAP = ok (9) # Executing section post-auth from file /etc/raddb/sites-enabled/default (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # post-auth = noop (9) Sent Access-Accept Id 75 from 10.0.0.94:1812 to 10.0.5.5:22029 length 0 (9) Finished request Waking up in 4.9 seconds. (9) Cleaning up request packet ID 75 with timestamp +664 Ready to process requests Thanks, Mohiddin.

3 3

Version 3.0.17 has been released
by Alan DeKok 18 Apr '18

18 Apr '18

Full release notes on the web site: https://freeradius.org/release_notes/?br=3.0.x&re=3.0.17 Fixes for a few things broken in 3.0.15 and 3.0.16, sorry. :( We now have Docker files! https://hub.docker.com/r/freeradius/freeradius-server/ Packages (Ubuntu, Debian, CentOS) are on: http://packages.networkradius.com Packages and Docker files for 3.0.17 should be available on the web sites shortly. They are building now. Alan DeKok.

2 1

Change Options based on Client
by Paul 17 Apr '18

17 Apr '18

Hi, I have 2 Clients configured named "Cisco" and "Unifi" and want to assign different VLANs based on the requesting client for each User individually. client.conf: client cisco{ ipaddr= 1xx.xx.x.109 secret = F*** } client unifi{ ipaddr= 1xx.yyy.zz.100 secret = H*** } Here is a "pseudo"-Config for the user: #TestforDynamicVLAN-Assignment test Cleartext-Password := "test" if (client == cisco){ # PSEUDO-Config Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 500 } if (client == unifi){ # PSEUDO-Config Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 1000 } I couldn't find any documentation on changing attributes based on the requesting client. Is there such an option? If no: Do you have any idea for an easy and scalable fix? I could run two separate Radius-Sever but this would reduce maintainability. Thanks! Paul

4 3

replay with different attributes depending on NAS
by Mathew Howard 17 Apr '18

17 Apr '18

I have a situation where I need to reply with different attributes depending on what NAS the request comes from. Currently, it we're doing this with a microsoft radius server, and it has the ability to do a check for the NAS-identifier, and match different policies, depending on what that is, but I haven't been able to figure out how to duplicate that in freeradius. Basically, what I'm trying to do is do a check to see if the user matches belongs to group 1, then check if NAS-identifier=A and reply with atttribute x, or if NAS-identifier=B, then reply with attribute y. Is there an easy way to do this, that I'm missing? Thanks!

2 1

How does Stripped-User-Name get evaluated?
by Nick Howitt 17 Apr '18

17 Apr '18

I am doing an ldap lookup with /etc/raddb/mods-available/ldap: user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" It comes back correctly with a simple username, but with a Domain username such as "test/MINI-1.CLEARSYSTEM" it always tries to look up user "test/MINI-1.CLEARSYSTEM". Changing filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" to filter = "(uid=%{Stripped-User-Name})" looks up a blank user and filter = "(uid=%{User-Name})" looks up user "test/MINI-1.CLEARSYSTEM" which fails. I think I am thinking is the function creating Stripped-User-Name is not being called. If so, how can I fix it? Thanks, Nick

3 2

No conf files installed on fresh freeradius install on Ubuntu 16.04
by John Burns 17 Apr '18

17 Apr '18

Matthew Newton wrote: > Installed... how? >From packages using apt-get >Assuming you installed from packages, > # apt-get install freeradius-config :/# apt-get install freeradius-config Reading package lists... Done Building dependency tree Reading state information... Done E: Unable to locate package freeradius-config :/# :/#apt list --installed | grep freeradius WARNING: apt does not have a stable CLI interface. Use with caution in scripts. freeradius/xenial-updates,xenial-security,now 2.2.8+dfsg-0.1ubuntu0.1 amd64 [installed] freeradius-common/xenial-updates,xenial-updates,xenial-security,xenial-security,now 2.2.8+dfsg-0.1ubuntu0.1 all [installed] freeradius-mysql/xenial-updates,xenial-security,now 2.2.8+dfsg-0.1ubuntu0.1 amd64 [installed] freeradius-utils/xenial-updates,xenial-security,now 2.2.8+dfsg-0.1ubuntu0.1 amd64 [installed,automatic] libfreeradius2/xenial-updates,xenial-security,now 2.2.8+dfsg-0.1ubuntu0.1 amd64 [installed,automatic] :/#

2 1

No conf files installed on fresh freeradius install on Ubuntu 16.04
by John Burns 17 Apr '18

17 Apr '18

I've just tried to install freeradius on Ubuntu 16.04.4 LTS and no conf files are installed. I performed an apt-get update and apt-get upgrade before the install. :/# find /etc/freeradius/ /etc/freeradius/ /etc/freeradius/certs /etc/freeradius/sites-enabled /etc/freeradius/sites-available /etc/freeradius/modules /etc/freeradius/sql /etc/freeradius/sql/mysql :/# I've tried two different Ubuntu 16.04.4 LTS servers and both have the same problem. I've tried removing, force reinstalling, and having no luck. Debug output: :/# freeradius -CXx Tue Apr 17 12:12:47 2018 : Info: freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Jul 26 2017 at 15:27:21 Tue Apr 17 12:12:47 2018 : Debug: Server was built with: Tue Apr 17 12:12:47 2018 : Debug: accounting Tue Apr 17 12:12:47 2018 : Debug: authentication Tue Apr 17 12:12:47 2018 : Debug: WITH_DHCP Tue Apr 17 12:12:47 2018 : Debug: WITH_VMPS Tue Apr 17 12:12:47 2018 : Debug: Server core libs: Tue Apr 17 12:12:47 2018 : Debug: ssl: OpenSSL 1.0.2g 1 Mar 2016 Tue Apr 17 12:12:47 2018 : Info: Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. Tue Apr 17 12:12:47 2018 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Apr 17 12:12:47 2018 : Info: PARTICULAR PURPOSE. Tue Apr 17 12:12:47 2018 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Apr 17 12:12:47 2018 : Info: GNU General Public License. Tue Apr 17 12:12:47 2018 : Info: For more information about these matters, see the file named COPYRIGHT. Tue Apr 17 12:12:47 2018 : Info: Starting - reading configuration files ... Tue Apr 17 12:12:47 2018 : Debug: including configuration file /etc/freeradius/radiusd.conf Tue Apr 17 12:12:47 2018 : Error: Unable to open file "/etc/freeradius/radiusd.conf": No such file or directory Tue Apr 17 12:12:47 2018 : Error: Errors reading or parsing /etc/freeradius/radiusd.conf :/# Any ideas? Thanks John

3 3

EAP-AKA set-up failure on 4.0 dev. stream
by yukou katori 16 Apr '18

16 Apr '18

I'm setting up EAP-AKA on 4.0 dev. stream, because I have to set up EAP-AKA. I got the following error. Radiusd -X /// snip /// Loaded module "rlm_eap_aka" aka { /usr/local/etc/raddb/mods-enabled/eap[1190]: Configuration item "network_id" must have a value /usr/local/etc/raddb/mods-enabled/eap[1190]: Failed evaluating configuration for module "rlm_eap_aka" /usr/local/etc/raddb/mods-enabled/eap[15]: Failed evaluating configuration for module "rlm_eap" /usr/local/etc/raddb/mods-enabled# vi eap 1187 ## EAP-AKA 1188 # 1189 # 1190 aka { 1191 1192 } 1193 } /usr/local/src/freeradius-server-4.0.x/src/modules/rlm_eap/types/rlm_eap_aka# find . -type f | xargs grep network_id ./eap_aka.h: char const *network_id; //!< Network ID as described by RFC 5448. ./rlm_eap_aka.c: { FR_CONF_OFFSET("network_id", FR_TYPE_STRING | FR_TYPE_REQUIRED, rlm_eap_aka_t, network_id ) }, ./rlm_eap_aka.c: eap_aka_session->keys.network = (uint8_t *) talloc_bstrndup(eap_aka_session, inst->network_id, ./rlm_eap_aka.c: talloc_array_length(inst->network_id) - 1); It seems ""network_id" must have a value", what should I do for this error? I know it's dev. stream, but any comment would be really appreciated to set it up. Regards,

2 2

multiple columns in rlm_sql
by petr.linke＠seznam.cz 16 Apr '18

16 Apr '18

Hi, I have question, is it possible in virtual server config do something like this? update control { &value1,&value2, ... ,&valueN="%{sql:SELECT value1,value2, ... ,valueN from some_table where ...}" } I know, that is no problem to do more sql queries like: update control { &value1="%{sql:SELECT value1,from some_table where ...}" &value2="%{sql:SELECT value2,from some_table where ...}" ... &valueN="%{sql:SELECT valueN,from some_table where ...}" } but it is too expensive for performance, much better is to do with one sql select. I looked into rlm_sql.c, and the line #462 - "for (i = 0; i < fields; i++) names[i] = field_info[i].name;" looks as multiple column separation. I tried find some info in the freerarius WiKi and in the documentation, but without success. Thank you for any idea, Petr Linke

4 6

Freeradius 3.0.12 not processing LDAP control/check items
by Jan Baumann 13 Apr '18

13 Apr '18

Good evening, I have a well running freeradius 3.0.12 (Debian 9 package) with mysql und openldap backends. Usernames are of course unique and exist either only in ldap or mysql. Everything works for ldap and mysql users, except one thing: If I add a check-item into mysql radcheck table it works as expected. If I add the same item into openldap, it is not taken care of and access is always permitted if the item matches the request or not. But... if I add a reply-item to openldap is is delivered as part of the radius access accept message. debug output: (0) ldap: User object found at DN „uid=jbaumann,ou=people,dc=cyberways,dc=net" (0) ldap: Processing user attributes (0) ldap: control:Cleartext-Password := '12345' (0) ldap: Attribute "radiusExpiration" not found in LDAP object (0) ldap: control:NAS-Identifier := 'myWifiSSID' (0) ldap: Attribute "radiusSimultaneousUse" not found in LDAP object (0) ldap: Attribute "radiusReplyMessage" not found in LDAP object (0) ldap: Attribute "radiusTunnelType" not found in LDAP object (0) ldap: Attribute "radiusTunnelMediumType" not found in LDAP object (0) ldap: reply:Tunnel-Private-Group-ID := '1336' (0) ldap: Attribute "radiusControlAttribute" not found in LDAP object (0) ldap: Attribute "radiusRequestAttribute" not found in LDAP object (0) ldap: Attribute "radiusReplyAttribute" not found in LDAP object rlm_ldap (ldap): Released connection (1) Radius pulls the NAS-Identifier control item from ldap correctly, but does not reject the request if it does not match. For the cleartext password it works. I don’t see any hints of processing NAS-Identifier in the debug output at all, regardless which operator (=, := or +=) I try. It also pulls the Tunnel-Private-Group-ID reply item from ldap and successfully puts it into the reply message. So my ldap users can successfully log in with PEAP, but into any wifi SSID. Mysql users are correctly rejected if the NAS-Identifier does not match. config of ldap module: compare_check_items = yes update { control:Cleartext-Password := 'userPassword' control:Expiration := 'radiusExpiration' control:NAS-Identifier := 'radiusNASIdentifier' control:Simultaneous-Use := 'radiusSimultaneousUse' reply:Reply-Message := 'radiusReplyMessage' reply:Tunnel-Type := 'radiusTunnelType' reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' # Where only a list is specified as the RADIUS attribute, # the value of the LDAP attribute is parsed as a valuepair # in the same format as the 'valuepair_attribute' (above). control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } I am trying to fix this for the entire past week, so may I please ask the experts here. How are ldap check items meant to be configured and work in freeradius 3? Special thanks! Jan

2 2