- Freeradius-Users - lists.freeradius.org

replay with different attributes depending on NAS
by Mathew Howard 17 Apr '18

17 Apr '18

I have a situation where I need to reply with different attributes depending on what NAS the request comes from. Currently, it we're doing this with a microsoft radius server, and it has the ability to do a check for the NAS-identifier, and match different policies, depending on what that is, but I haven't been able to figure out how to duplicate that in freeradius. Basically, what I'm trying to do is do a check to see if the user matches belongs to group 1, then check if NAS-identifier=A and reply with atttribute x, or if NAS-identifier=B, then reply with attribute y. Is there an easy way to do this, that I'm missing? Thanks!

2 1

How does Stripped-User-Name get evaluated?
by Nick Howitt 17 Apr '18

17 Apr '18

I am doing an ldap lookup with /etc/raddb/mods-available/ldap: user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" It comes back correctly with a simple username, but with a Domain username such as "test/MINI-1.CLEARSYSTEM" it always tries to look up user "test/MINI-1.CLEARSYSTEM". Changing filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" to filter = "(uid=%{Stripped-User-Name})" looks up a blank user and filter = "(uid=%{User-Name})" looks up user "test/MINI-1.CLEARSYSTEM" which fails. I think I am thinking is the function creating Stripped-User-Name is not being called. If so, how can I fix it? Thanks, Nick

3 2

No conf files installed on fresh freeradius install on Ubuntu 16.04
by John Burns 17 Apr '18

17 Apr '18

Matthew Newton wrote: > Installed... how? >From packages using apt-get >Assuming you installed from packages, > # apt-get install freeradius-config :/# apt-get install freeradius-config Reading package lists... Done Building dependency tree Reading state information... Done E: Unable to locate package freeradius-config :/# :/#apt list --installed | grep freeradius WARNING: apt does not have a stable CLI interface. Use with caution in scripts. freeradius/xenial-updates,xenial-security,now 2.2.8+dfsg-0.1ubuntu0.1 amd64 [installed] freeradius-common/xenial-updates,xenial-updates,xenial-security,xenial-security,now 2.2.8+dfsg-0.1ubuntu0.1 all [installed] freeradius-mysql/xenial-updates,xenial-security,now 2.2.8+dfsg-0.1ubuntu0.1 amd64 [installed] freeradius-utils/xenial-updates,xenial-security,now 2.2.8+dfsg-0.1ubuntu0.1 amd64 [installed,automatic] libfreeradius2/xenial-updates,xenial-security,now 2.2.8+dfsg-0.1ubuntu0.1 amd64 [installed,automatic] :/#

2 1

No conf files installed on fresh freeradius install on Ubuntu 16.04
by John Burns 17 Apr '18

17 Apr '18

I've just tried to install freeradius on Ubuntu 16.04.4 LTS and no conf files are installed. I performed an apt-get update and apt-get upgrade before the install. :/# find /etc/freeradius/ /etc/freeradius/ /etc/freeradius/certs /etc/freeradius/sites-enabled /etc/freeradius/sites-available /etc/freeradius/modules /etc/freeradius/sql /etc/freeradius/sql/mysql :/# I've tried two different Ubuntu 16.04.4 LTS servers and both have the same problem. I've tried removing, force reinstalling, and having no luck. Debug output: :/# freeradius -CXx Tue Apr 17 12:12:47 2018 : Info: freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Jul 26 2017 at 15:27:21 Tue Apr 17 12:12:47 2018 : Debug: Server was built with: Tue Apr 17 12:12:47 2018 : Debug: accounting Tue Apr 17 12:12:47 2018 : Debug: authentication Tue Apr 17 12:12:47 2018 : Debug: WITH_DHCP Tue Apr 17 12:12:47 2018 : Debug: WITH_VMPS Tue Apr 17 12:12:47 2018 : Debug: Server core libs: Tue Apr 17 12:12:47 2018 : Debug: ssl: OpenSSL 1.0.2g 1 Mar 2016 Tue Apr 17 12:12:47 2018 : Info: Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. Tue Apr 17 12:12:47 2018 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Apr 17 12:12:47 2018 : Info: PARTICULAR PURPOSE. Tue Apr 17 12:12:47 2018 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Apr 17 12:12:47 2018 : Info: GNU General Public License. Tue Apr 17 12:12:47 2018 : Info: For more information about these matters, see the file named COPYRIGHT. Tue Apr 17 12:12:47 2018 : Info: Starting - reading configuration files ... Tue Apr 17 12:12:47 2018 : Debug: including configuration file /etc/freeradius/radiusd.conf Tue Apr 17 12:12:47 2018 : Error: Unable to open file "/etc/freeradius/radiusd.conf": No such file or directory Tue Apr 17 12:12:47 2018 : Error: Errors reading or parsing /etc/freeradius/radiusd.conf :/# Any ideas? Thanks John

3 3

EAP-AKA set-up failure on 4.0 dev. stream
by yukou katori 16 Apr '18

16 Apr '18

I'm setting up EAP-AKA on 4.0 dev. stream, because I have to set up EAP-AKA. I got the following error. Radiusd -X /// snip /// Loaded module "rlm_eap_aka" aka { /usr/local/etc/raddb/mods-enabled/eap[1190]: Configuration item "network_id" must have a value /usr/local/etc/raddb/mods-enabled/eap[1190]: Failed evaluating configuration for module "rlm_eap_aka" /usr/local/etc/raddb/mods-enabled/eap[15]: Failed evaluating configuration for module "rlm_eap" /usr/local/etc/raddb/mods-enabled# vi eap 1187 ## EAP-AKA 1188 # 1189 # 1190 aka { 1191 1192 } 1193 } /usr/local/src/freeradius-server-4.0.x/src/modules/rlm_eap/types/rlm_eap_aka# find . -type f | xargs grep network_id ./eap_aka.h: char const *network_id; //!< Network ID as described by RFC 5448. ./rlm_eap_aka.c: { FR_CONF_OFFSET("network_id", FR_TYPE_STRING | FR_TYPE_REQUIRED, rlm_eap_aka_t, network_id ) }, ./rlm_eap_aka.c: eap_aka_session->keys.network = (uint8_t *) talloc_bstrndup(eap_aka_session, inst->network_id, ./rlm_eap_aka.c: talloc_array_length(inst->network_id) - 1); It seems ""network_id" must have a value", what should I do for this error? I know it's dev. stream, but any comment would be really appreciated to set it up. Regards,

2 2

multiple columns in rlm_sql
by petr.linke＠seznam.cz 16 Apr '18

16 Apr '18

Hi, I have question, is it possible in virtual server config do something like this? update control { &value1,&value2, ... ,&valueN="%{sql:SELECT value1,value2, ... ,valueN from some_table where ...}" } I know, that is no problem to do more sql queries like: update control { &value1="%{sql:SELECT value1,from some_table where ...}" &value2="%{sql:SELECT value2,from some_table where ...}" ... &valueN="%{sql:SELECT valueN,from some_table where ...}" } but it is too expensive for performance, much better is to do with one sql select. I looked into rlm_sql.c, and the line #462 - "for (i = 0; i < fields; i++) names[i] = field_info[i].name;" looks as multiple column separation. I tried find some info in the freerarius WiKi and in the documentation, but without success. Thank you for any idea, Petr Linke

4 6

Freeradius 3.0.12 not processing LDAP control/check items
by Jan Baumann 13 Apr '18

13 Apr '18

Good evening, I have a well running freeradius 3.0.12 (Debian 9 package) with mysql und openldap backends. Usernames are of course unique and exist either only in ldap or mysql. Everything works for ldap and mysql users, except one thing: If I add a check-item into mysql radcheck table it works as expected. If I add the same item into openldap, it is not taken care of and access is always permitted if the item matches the request or not. But... if I add a reply-item to openldap is is delivered as part of the radius access accept message. debug output: (0) ldap: User object found at DN „uid=jbaumann,ou=people,dc=cyberways,dc=net" (0) ldap: Processing user attributes (0) ldap: control:Cleartext-Password := '12345' (0) ldap: Attribute "radiusExpiration" not found in LDAP object (0) ldap: control:NAS-Identifier := 'myWifiSSID' (0) ldap: Attribute "radiusSimultaneousUse" not found in LDAP object (0) ldap: Attribute "radiusReplyMessage" not found in LDAP object (0) ldap: Attribute "radiusTunnelType" not found in LDAP object (0) ldap: Attribute "radiusTunnelMediumType" not found in LDAP object (0) ldap: reply:Tunnel-Private-Group-ID := '1336' (0) ldap: Attribute "radiusControlAttribute" not found in LDAP object (0) ldap: Attribute "radiusRequestAttribute" not found in LDAP object (0) ldap: Attribute "radiusReplyAttribute" not found in LDAP object rlm_ldap (ldap): Released connection (1) Radius pulls the NAS-Identifier control item from ldap correctly, but does not reject the request if it does not match. For the cleartext password it works. I don’t see any hints of processing NAS-Identifier in the debug output at all, regardless which operator (=, := or +=) I try. It also pulls the Tunnel-Private-Group-ID reply item from ldap and successfully puts it into the reply message. So my ldap users can successfully log in with PEAP, but into any wifi SSID. Mysql users are correctly rejected if the NAS-Identifier does not match. config of ldap module: compare_check_items = yes update { control:Cleartext-Password := 'userPassword' control:Expiration := 'radiusExpiration' control:NAS-Identifier := 'radiusNASIdentifier' control:Simultaneous-Use := 'radiusSimultaneousUse' reply:Reply-Message := 'radiusReplyMessage' reply:Tunnel-Type := 'radiusTunnelType' reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' # Where only a list is specified as the RADIUS attribute, # the value of the LDAP attribute is parsed as a valuepair # in the same format as the 'valuepair_attribute' (above). control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } I am trying to fix this for the entire past week, so may I please ask the experts here. How are ldap check items meant to be configured and work in freeradius 3? Special thanks! Jan

2 2

Radacct
by Yahn do Amaral Almeida Pinheiro 13 Apr '18

13 Apr '18

Good afternoon. Does exist some limitation in the freeradius with the NAS management? When we utilize 4 or minus NAS, the radacct register the information correctly (registers on average 4600 customers). But when I use more of 4 NAS, the RADIUS doesn't register the other users. It was to register on average, 15 thousand usuarios.

2 2

Mapping between sqlippool and radius attributes
by Thore Krüss 13 Apr '18

13 Apr '18

Good evening, after reading the configuration files, the wiki entry as well as trying to dig in the code I haven't been able to figure out how the columns from the sqlippool module are mapped back to radius attributes. The default table scheme creates a column "framedipaddress" which appears to become the "Framed-IP-Address" attribute through magic. Is there a way to extend this with a "Framed-IPv6-Prefix"? Is adding a column with that name sufficient? I've seen it being done using xlat extensions and sql in the post-auth section but this seems to be a horrible approach and I'd love to avoid that. Best regards Thore

2 3

Grouping of sub attributes in seperate VSAs
by Бенджамин Томпсон 13 Apr '18

13 Apr '18

Hi We have a device which sends individual traffic counters for several different services. The dicitionary is as follows: VENDOR VasExperts 43823 BEGIN-VENDOR VasExperts ... ATTRIBUTE VasExperts-Acct-Traffic-Class-Name 16 string ATTRIBUTE VasExperts-Acct-Traffic-Class-Input-Octets 17 integer64 ATTRIBUTE VasExperts-Acct-Traffic-Class-Output-Octets 18 integer64 ATTRIBUTE VasExperts-Acct-Traffic-Class-Input-Packets 19 integer64 ATTRIBUTE VasExperts-Acct-Traffic-Class-Output-Packets 20 integer64 ... In the accounting packet these attribtues are grouped into individual VSAs as follows: AVP: l=51 t=Vendor-Specific(26) v=VAS Experts(43823) AVP Type: 26 AVP Length: 51 VSA: l=5 t=VasExperts-Acct-Traffic-Class-Name(16): cs0 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Input-Octets(17): 0000000000000000 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Output-Octets(18): 00000000002128bc VSA: l=10 t=VasExperts-Acct-Traffic-Class-Input-Packets(19): 0000000000000000 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Output-Packets(20): 00000000000007a4 AVP: l=51 t=Vendor-Specific(26) v=VAS Experts(43823) AVP Type: 26 AVP Length: 51 VSA: l=5 t=VasExperts-Acct-Traffic-Class-Name(16): cs1 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Input-Octets(17): 0000000000000000 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Output-Octets(18): 0000000000000000 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Input-Packets(19): 0000000000000000 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Output-Packets(20): 0000000000000000 Here the fact that the five attributes are gouped together in a single VSA means that they all contain data which pertains to the same service. When FreeRADIUS processes the packet the attribtues are as I understand it added to one long list and I can access them individually by their index. However, as I understand it the ordering of RADIUS attributes is not something which is normally guaranteed and I would like to ask is whether there is any way in unlang or by other means to figure out which which sub attribtues came from the same parent attribute.

3 4