- Freeradius-Users - lists.freeradius.org

ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
by Andrea Passuello 01 Sep '17

01 Sep '17

Hi everyone, I need a little help because I am trying to configure a FreeRadius 3.0.12 + LDAP. With the previous FR version (2.2.5) everything work fine and I was able to authenticate my LDAP'users. Now I am trying to replicate my configuration but I receive this error: ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject My config files seem to be the same among the different FR versions. This is my debug output: (0) Received Access-Request Id 85 from MYCLIENT:47127 to MYSERVER:1812 length 86 (0) User-Name = "MYUSER" (0) User-Password = "MYPASSWORD" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0xa7d43fb7b44c2c15e704324f69e3e0d9 (0) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "MYUSER", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=MYUSER) (0) ldap: Performing search in "dc=MYCOMPANY,dc=MYDOMAIN" with filter "(uid=MYUSER)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=MYUSER,ou=people,dc= MYCOMPANY,dc=MYDOMAIN" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> MYUSER (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 85 from MYSERVER:1812 to MYCLIENT:47127 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 85 with timestamp +2 Ready to process requests What do I wrong or miss? Many thanks in advance for your help. Andrea -- Avvertenze ai sensi del D.Lgs.196 del 30/06/2003 Le informazioni contenute in questo messaggio di posta elettronica e/o files allegati, sono da considerarsi strettamente riservati. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nello stesso. Costituisce violazione ai principi dettati dal D.Lgs. 196/2003: trattenere il messaggio stesso oltre il tempo necessario, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo od utilizzarlo per finalità diverse. In ogni momento potrà richiederci la sospensione dell'impiego dei suoi dati, ad esclusione delle comunicazioni effettuate in esecuzione di obblighi di legge. Qualora avesse ricevuto questo messaggio senza esserne il destinatario La preghiamo cortesemente di darcene notizia via e-mail e di procedere alla distruzione del messaggio stesso dal Suo sistema. Se desidera presentare un reclamo, può trovare informazioni e supporto sul nostro sito www.widegroup.eu/reclami o può scrivere a reclami(a)widegroup.eu. Grazie. -- This message is confidential. It may also be privileged or otherwise protected by work, product, immunity or other legal rules. If you have received it by mistake, please let us know by e-mail reply and delete it from your system; you may not copy this message or disclose its contents to anyone. The integrity and security of this message cannot be guaranteed on the Internet. If you want to submit a formal complaint, you can find information and support on our website www.widegroup.eu/reclami or writing to reclami(a)widegroup.eu. Thank you.

2 3

Crashes FreeRadius 3.0.11 using rlm_rest/libcurl + rlm_cache_rbtree
by RANJALAHY RASOLOFOMANANA, Bija 01 Sep '17

01 Sep '17

Hi all, We are frequently facing a crash of our freeradius server on live production environment (8 times in 2 months). The crash can't be reproduced on our test environment so we need help. Sometimes, we have a core dump (case 1- the server crashes), sometimes, we don't (case 2- the server freezes). Unfortunately, the core dumps don't provide useful informations: Here are examples of the core dumps : core 1: #0 0x00000034b680f5db in ?? () #1 0x00007fa718d066c6 in ?? () #2 0x0000000000000000 in ?? () core 2: #0 0x00000034b680f5db in ?? () #1 0x00007f169f94e6c6 in ?? () #2 0x0000000000000000 in ?? () Freeradius version : 3.0.11 Context : our server sends REST request to a http server to retrieve data which are then stored in a cache during 1 hour. The problem started when we added this feature. Leads : 1- The server logs all http requests that are sent. Somehow, the line log is truncated when the problem appears. Maybe, it is just a coincidence but we are suspecting this part. We use the rlm_rest module + libcurl to make our requests. Have you encountered a problem using those module/library ? We tried to upgrade libcurl from 7.50.3 to 7.54.0 but this doesn't fix the problem. 2- In the case 2 (the server freezes), we've got the following message in our log files: Mon Jun 26 22:00:31 2017 : Error: (10180900) Ignoring duplicate packet from client xxx port 21665 - ID: 164 due to unfinished request in component authorize module <our cache module> Our cache module is based on the rlm_cache_rbtree module: cache <cache name> { driver = "rlm_cache_rbtree" Have you encountered a problem using rlm_cache_rbtree module ? Thanks for your help. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

5 11

Freeradius Proxy - Framed IP Address Accounting attribute
by Byron Jeffery 01 Sep '17

01 Sep '17

Hi All We are trailing a wifi system that does not send through the Framed IP Address attribute to our accounting server after the clients have successfully authenticated (EAP-PEAP-MSCHAP authentication) against a FreeRadius server hosted at another site within our WAN. I am of the mindset of setting up a Freeradius proxy server locally onsite with the purpose of sending back an accounting start with the Framed IP Address attribute to the accounting server but am unsure if this is even possible as I am unsure if the freeradius server would be able to determine the clients IP address as only the clients MAC address is passed to the radius server during authentication. I was unable to find any documentation that would support this, and would hope that someone could point me in the right direction. - Regards - Byron

5 21

django-freeradius
by Fiorella De Luca 01 Sep '17

01 Sep '17

Hi everyone, I am Fiorella De Luca and I am a participant of the Google Summer Code. During this three months, I have worked on an OpenWISP project regarding the creation of a freeradius web interface.This app, django-freeradius, is a web interface built in django that can be used to manipulate the data of a freeradius 3 database. The project offers a REST API which can (and should) be used with freeradius 3 rest module. It's not yet ready for production but we are close to completing the first phase. In these links you can find the main information about the project: - GSOC project summary: https://delucafiorella2602.blog/2017/08/28/google-summer-of-code-2017-djang… - Repository of the project: https://github.com/openwisp/django-freeradius - Documentation of the project: http://django-freeradius.readthedocs.io/en/latest/ If you are interested in trying it I would be glad to know your precious opinions and suggestions. Thank you! Fiorella De Luca

2 1

new table and query
by Johansson, Daniel (GIS) 31 Aug '17

31 Aug '17

Hi I use FreeRADIUS Version 2.2.6 I want to make a custom table and query for freeradius. sql is enabled in sites-enabled/default for 'post-auth {sql}' and postauth_query is populating radpostauth However my 'macuseradd_query ' is not run can anyone tell me why? I have inserted a new table to my mysql for radius 'authorizedmacs'. mysql> show tables; +------------------+ | Tables_in_radius | +------------------+ | authorizedmacs | | radacct | | radcheck | | radgroupcheck | | radgroupreply | | radpostauth | | radreply | | radusergroup | +------------------+ mysql> describe authorizedmacs; +------------+----------------------+------+-----+-------------------+-----------------------------+ | Field | Type | Null | Key | Default | Extra | +------------+----------------------+------+-----+-------------------+-----------------------------+ | id | smallint(5) unsigned | NO | PRI | NULL | auto_increment | | macaddress | varchar(12) | NO | MUL | NULL | | | created | timestamp | NO | | CURRENT_TIMESTAMP | on update CURRENT_TIMESTAMP | +------------+----------------------+------+-----+-------------------+-----------------------------+ I also added a entry in sql.conf macauth_table = "authorizedmacs" Then I created query in dailup.conf 'macuseradd_query ' ####################################################################### # Authentication Logging Queries ####################################################################### # postauth_query - Insert some info after authentication ####################################################################### postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate) \ VALUES ( \ '%{User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', '%S')" macuseradd_query = "INSERT INTO ${macauth_table} \ (macaddress) \ VALUES ( \ '%{Calling-Station-Id}')" It would be much appreciated if anyone can tell me why macuseradd_query isn’t run as postauth_query is. BR /Daniel

5 11

Update on v4
by Alan DeKok 30 Aug '17

30 Aug '17

Version 4 has been under heavy development for the past year. The goal is to enable new features and new capabilities. Well, we're making progress. :) As background, in v4 proxying has been replaced by a "radius" module. The "radius" module sends RADIUS packets and waits (asynchronously) for a response. You can create one "radius" module for each home_server. e.g. radius home_server_1 { ... ip, port, secret, etc. } This also means that proxy.conf goes away (sorry), and that home_server_pools get replaced with "unlang": Home server pool *type = load-balance` gets replaced with 'unlang' load-balance { home_server_1 home_server_2 home_server_3 } Even better, you can now add proxying *anywhere*: if (User-Name == "bob") { home_server_1 } else if (User-Name == "doug") { home_server_2 } Or you can proxy multiple times: if (User-Name == "bob") { home_server_1 home_server_2 } Or catch proxy failures: home_server_1 if (fail) { linelog } Or (even more magically), proxy to multiple destinations at the same time: parallel { home_server_1 home_server_2 home_server_3 } i.e. it sends packets t home_server_1, then 2, then 3. It waits until it receives responses (or timeouts) from all of them. It then continues with processing the request. We're still not recommending average people install v4. There are some caveats which means it's best suited for people who know those caveats. But, the long wait has been worth it, I think. Things which used to be impossible in previous versions of the server are now *trivial* to do. The next step is to finalize the functionality which creates child requests. e.g. originate-coa, but more standardized. Once that's done, you should be able to do something like: if (... bandwidth exceeded...) { create child Disconnect-Request send to NAS } Which mimics the "originate-coa" functionality, but in 3 unlang statements. You can also take an Access-Request, and create one (or more) Accounting-Requests which are sent to home servers. The "radius" module also supports a "fire and forget" method, so that you can send packets to home servers, and continue without waiting for a response. We hope to release an alpha of version 4 this fall. Alan DeKok.

2 3

Freeradius and Winbindd Issue
by Kinglok Fong 30 Aug '17

30 Aug '17

Hi all, I am using freeradius 3.0.15. Samba version is 4.6.7. I compile both software on a Debian 9 machine. With nmbd and winbindd running flawlessly at the background, the domain user identification is working with using tools like wbinfo and id. However, when try to configure it with freeradius, it cannot authenticate. First of all, this configuration file: /usr/local/freeradius/etc/raddb/mods-enabled/mschap =============== winbind_username = “%{schap:User-Name}” winbind_domain = “SAMBADOM” #ntlm_auth = blahblahblah ============== Authentication was test using radtest =============== /usr/local/freeradius/bin/radtest -t mschap a_user thepassword 127.0.0.1 0 testing123 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 (0) No reply from server for ID 191 socket 3 =================== log.winbindd (in log level 10) =================== [2017/08/29 15:03:44.139816, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:761(process_request) process_request: request fn INTERFACE_VERSION [2017/08/29 15:03:44.141735, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:395(winbindd_interface_version) [25579]: request interface version (version = 28) [2017/08/29 15:03:44.143656, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:INTERFACE_VERSION]: delivered response to client [2017/08/29 15:03:44.145639, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:761(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2017/08/29 15:03:44.147727, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:428(winbindd_priv_pipe_dir) [25579]: request location of privileged pipe [2017/08/29 15:03:44.150965, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2017/08/29 15:03:44.153161, 6, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:919(new_connection) accepted socket 27 [2017/08/29 15:03:44.155338, 6, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:968(winbind_client_request_read) closing socket 25, client exited [2017/08/29 15:03:44.157538, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:734(process_request) process_request: Handling async request 25579:GETGROUPS [2017/08/29 15:03:44.159669, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getgroups.c:60(winbindd_getgroups_send) getgroups freerad [2017/08/29 15:03:44.162646, 1, pid=25544, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:468(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'SAMBADOM' name : * name : 'FREERAD' flags : 0x00000008 (8) [2017/08/29 15:03:44.171620, 1, pid=25544, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:468(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.180970, 5, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getgroups.c:235(winbindd_getgroups_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.183154, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:796(wb_request_done) wb_request_done[25579:GETGROUPS]: NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.192083, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:GETGROUPS]: delivered response to client ============== When I switch back using ntlm_auth instead, it is working flawlessly. Hope someone would help. Thanks for attending. Kinglok, Fong

4 10

django-freeradius
by Fiorella De Luca 29 Aug '17

29 Aug '17

Hi everyone, I am Fiorella De Luca and I am a participant of the Google Summer Code. During this three months, I have worked on an OpenWISP project regarding the creation of a freeradius web interface.This app, django-freeradius, is a web interface built in django that can be used to manipulate the data of a freeradius 3 database. The project offers a REST API which can (and should) be used with freeradius 3 rest module. It's not yet ready for production but we are close to completing the first phase. In these links you can find the main information about the project: GSOC project summary: https://delucafiorella2602.blog/2017/08/28/google-summer-of-code-2017-djang… .Repository of the project: https://github.com/openwisp/django-freeradius .Documentation of the project: http://django-freeradius.readthedocs.io/en/latest/ . If you are interested in trying it I would be glad to know your precious opinions and suggestions. Thank you! Fiorella De Luca

1 0

RE: How to log Access-Accept reply attributes/values in radpostauth sql
by James Wood 27 Aug '17

27 Aug '17

Thanks for the replies. I can use %{pairs:reply:} and it provides: "Acct-Interim-Interval =3D 120=2C Session-Timeout =3D 86400" But this doesn't look nice in the DB as it gets inserted exactly like that. Is there a way to unescape the quoted printable text to that =3D is actually = for example? I tried %{unescape:%{pairs:reply:}} but I didn't change it. Thanks James

3 2

How to log Access-Accept reply attributes/values in radpostauth sql
by James Wood 26 Aug '17

26 Aug '17

Hi All FR 3.0.13. Everything working perfectly, including SQL (mysql) for auth/acct logging. When a user authenticates, I would like to log any Access-Accept reply attributes we've set to sql (radpostauth). For example, my typical Access-Accept looks like this: Access-Accept (2), id: 0x2f, Authenticator: 123 Session-Timeout Attribute (27), length: 6, Value: 86400 Idle-Timeout Attribute (28), length: 6, Value: 600 Acct-Interim-Interval Attribute (85), length: 6, Value: 300 Therefore, I would like to log anything that was sent back to the NAS to the DB, in this instance: "Session-Timeout=86400,Idle-Timeout=600,Acct-Interim-Interval=300" or some other format as long as the data is readable... Is that possible? I tried using something like the below in the queries file: post-auth { query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, authdate, callingstationid, calledstationid, attributes) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%S', \ '%{Calling-Station-Id}', \ '%{Called-Station-Id}', \ '%{reply:[*]}')" But doesn't appar I can use %{reply[*]} in that way. Thanks James

4 4