- Freeradius-Users - lists.freeradius.org

PPA update for 3.0.15 ?
by Brian Candler 28 Jul '17

28 Jul '17

Now that 3.0.15 has been released, would someone have time to rebuild the Ubuntu PPA package? https://launchpad.net/~freeradius/+archive/ubuntu/stable-3.0 It hasn't been updated since 3.0.12. Xenial is the one I'm specifically interested in. Thanks, Brian.

3 3

How to do FreeRADIUS understand the ssh encrypted password that is passed?
by Kalil de A. Carvalho 27 Jul '17

27 Jul '17

Hello all. It is me again. Sorry for that. I have my enviroment working fine for telnet access, my FreeRADIUS server is doing the user search on LDAP with no problem but, when I use any ssh session is passed a encryped password that RADIUS try to use with LDAP database, found the user but the password is considered wrong and regect my access. I searched for configuration and what I saw it is very similar whith I have here. The unic diference is that I am using a EdgeRouter Lite but I am folling the documentation and using the GUI tool. Can any one help me? Best regards. -- Atenciosamente, Kalil de A. Carvalho

2 3

About authorizing only users with specific attributes (post RADIUS proxy)
by Seiichirou Hiraoka 27 Jul '17

27 Jul '17

I am building RADIUS Proxy with FreeRADIUS 3.0.4. @mydomain.edu -> backendradius.mydomain.com All Other domains -> radius.otherdomain.com RADIUS server of mydomain.com which is its own domain is already built separately, and the server under construction wants to do RADIUS Proxy with the above two rules. For mydomain.com only, I would like to authorize users who have a specific character string in the RADIUS standard attribute Filter-Id. In this case, where should we determine the value of Filter-Id in the RADIUS response from backendradius.mydomain.com? Would you please let me know if you have any reference information, such as a conditional expression with unlang. Thank you.

2 2

Accounting replication issue
by Chris Adams 27 Jul '17

27 Jul '17

I have two servers running FreeRADIUS (CentOS 7 with freeradius-3.0.4). They are logging accounting records to local MySQL servers. For redundancy, I configured FreeRADIUS to replicate the accounting records to each other, based on the robust-proxy-accounting sample config. This works, except when one server is unavailable (call it server A), the other (server B) stops replicating the records until I restart FreeRADIUS on server B. Server B logs that server A went away, and logs that it came back (in this case, somebody did something dumb on server A and triggered the kernel oom_killer - didn't touch the FreeRADIUS or MySQL processes, just the dumb grep): Jul 24 09:25:38 srvB radiusd[20768]: Marking home server srvA port 1813 as zombie (it has not responded in 6.000000 seconds). Jul 24 09:25:38 srvB radiusd[20768]: (52212975) ERROR: Failing proxied request, due to lack of any response from home server srvA port 1813 Jul 24 09:25:42 srvB radiusd[20768]: No response to status check 52213042 for home server srvA port 1813 Jul 24 09:26:05 srvB radiusd[20768]: No outstanding request was found for reply from host srvA port 1813 - ID 197 Jul 24 09:26:06 srvB radiusd[20768]: No outstanding request was found for reply from host srvA port 1813 - ID 198 Jul 24 09:26:06 srvB radiusd[20768]: (52213350) Received response to status check 52213350 (1 in current sequence) Jul 24 09:26:06 srvB radiusd[20768]: (52213350) Marking home server srvA port 1813 alive The comments in the sample config just say "When the home servers come back up, the packets are forwarded, and the detail file processed as normal." - I don't see any configuration related to that, but it defintely did not happen for me; the records were just written to the detail file until I restarted the service (which then processed the backlog correctly). Any suggestions for what to look at? -- Chris Adams <linux(a)cmadams.net>

2 2

please remove my name from this group
by Nepolean AC 27 Jul '17

27 Jul '17

Hi Team, Can you please remove my name from this group asap. Regards, Nepolean

2 1

Re: How freeradius responds in json format to the request to authorize
by Fiorella De Luca 26 Jul '17

26 Jul '17

Hello! Regarding checks like bandwidth limits and session time limit, when authorizing through a REST API, I guess we can do these checks in the authorization phase via the REST API too and return an appropiate response accordingly, is this correct? Example: check the user exists, check password matches, check user has not exhausted their allocated daily bandwidth. If it's not correct, what's the current best practice in this case? Thank you for the help! Il Lunedì 24 Luglio 2017 15:48, Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> ha scritto: > I've tried your suggestion and it worked! Great! > I wanted to ask you: are there any publicly available examples of implementations using authorize, authenticate, accounting, postauth (and any other operation) with a REST API? No, unfortunately not. If you've got some specific scenarios I can add some examples to wiki.freeradius.org. > Another question: If we perform the username & password check in authorize, I suppose there's not much we will need to do in authenticate, correct? For PAP (Plaintext auth) that's correct. When you have more complex authentication mechanisms like EAP-PEAP, EAP-TTLS, MSCHAPv2, then the authentication flow is different. For those methods, you generally need to retrieve the "known good" password via the REST interface, then call the appropriate module in authenticate to actually do something with it. Could you do this with pap too if you're interested to see how it works. authorize { rest pap } authenticate { pap } Then your JSON would be: { control:Cleartext-Password := "<users password>" } You can also return hashed passwords. The attributes that hold them are in dictionary.freeradius.internal (https://github.com/FreeRADIUS/freeradius-server/blob/89380b053b3c85d7150cd1…) Search for -Password. Note: Only Cleartext-Password will work for all authentication mechanisms. > Thank you! No problem. -Arran

2 1

user group allowed just a specific device.
by Kalil de A. Carvalho 26 Jul '17

26 Jul '17

Hello all. I'm running a FreeRADIUS which search user groups on the LDAP and permid or denny the access. Every think works fine but now I'm needing a new kind of restriction. There is a user group that they just can access some specific defice. So what I want is put this configuration to work. What I think: Is this configuration is possible? Is this configuration is made on user file? Today my enviroment is working but the user group has access on all device. If I put the this new group, ou users, on the same where is working they will have access to all equipament and this is not what is needed. Bast regards. -- Atenciosamente, Kalil de A. Carvalho

4 9

Query Regarding IPV6 address support in RADIUS
by Javed 26 Jul '17

26 Jul '17

Hello Team, I am glad with few of this group support I was able to deploy FREERadius client to support over TLS.Now our aim is to support IPV6 Query I am trying to upgrade my FreeRADIUS client library to support IPv6 address(vs 1.7) and I almost did it and while testing I came across traces: Jul 26 10:59:14 rc_get_ipaddr: couldn't resolve hostname: 2009:4600:5840:2004:3530::8 Jul 26 10:59:14 rc_send_server: unable to find server: 2009:4600:5840:2004:3530::8 Jul 26 10:59:14 Unexpected return value Call flow across files : sendserver.c -> config.c -> ip_util.c Call flow across functions : rc_findserver() -> rc_get_ipaddr() -> rc_good_ipaddr() This seems to return negative value(rc_good_ipaddr() ) and followed by rc_gethostbyname(host) results the error saying rc_send_server: unable to find server: 2009:4600:5840:2004:3530::8 Am I missing something ? Is rc_good_ipaddr() not expect to validate ipv6 address also ? Kindly share your opinion . Thanks & Regards, Javed Akhtar Technical Lead <mailto:jaakhtar@cisco.com> jaakhtar(a)cisco.com Tel: Cisco Systems, Inc. India cisco.com Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please <http://www.cisco.com/web/about/doing_business/legal/cri/index.html> click here for Company Registration Information.

2 1

Authorization for Oracle DB
by Arvind Gupta 26 Jul '17

26 Jul '17

Hi All I have Oracle DB configured for RADIUS authentication and now having issue with Authorization part. My use case is as follows: 1. Oracle DB sends RADIUS AUthentication request to RADIUS server, which performs authentication against LDAP. 2. After succesfull authentication it retrieves group and role information for authenticated user and that group and role information it has to sent as part of authorization. 3. After receiving group and role info Oracle DB should provide him access of schemas associated with group and role. I am facing issue during Authorization. If anybody know Authorization steps then please let me know. Any help is highly appreciated. Thanks Arvind Kumar Gupta

2 1

LDAP group check not working with SQL expansion
by Klara Mall 25 Jul '17

25 Jul '17

Hi, I'm using FreeRADIUS Version 3.0.12. I'm doing EAP-TTLS/PAP and I have the following policy in the authorize section of the inner tunnel virtual server (same behaviour when it's in post-auth): w2vgroupcheck { if("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { if (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") { update reply { Tunnel-Private-Group-Id := "%{sql:SELECT vlan_id FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } } else { reject } } } } Which results in: (8) policy w2vgroupcheck { (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) EXPAND %{Stripped-User-Domain} (8) --> vlan-1.w2v.kit.edu (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) -> TRUE (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { rlm_sql (sql): Reserved connection (0) (8) Executing select query: SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (0) (8) EXPAND %{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> 1 (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) -> TRUE (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { (8) if (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") { rlm_sql (sql): Reserved connection (1) (8) Executing select query: SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (1) (8) EXPAND %{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> KIT-Group-1 (8) if (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") -> FALSE (8) else { (8) [reject] = reject (8) } # else = reject (8) } # if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) = reject (8) } # if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) = reject (8) } # policy w2vgroupcheck = reject I don't understand it because the SQL expansion works but then there is no try to do the LDAP group check. It just says FALSE and rejects. When I replace (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") with (LDAP-Group == "KIT-Group-1") it works: (8) policy w2vgroupcheck { [50/1950] (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) EXPAND %{Stripped-User-Domain} (8) --> vlan-1.w2v.kit.edu (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) -> TRUE (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { rlm_sql (sql): Reserved connection (0) (8) Executing select query: SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (0) (8) EXPAND %{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> 1 (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) -> TRUE (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { (8) if (LDAP-Group == "KIT-Group-1") { (8) Searching for user in group "KIT-Group-1" rlm_ldap (ldap): Reserved connection (1) (8) Using user DN from request "uid=abc123,ou=People,ou=unix,ou=IDM,dc=kit,dc=edu" (8) Checking for user in group objects (8) EXPAND (&(cn=KIT-Group-1)(objectClass=posixGroup)(memberUid=%{%{Stripped-User-Name}:-%{User-Name}})) (8) --> (&(cn=KIT-Group-1)(objectClass=posixGroup)(memberUid=abc123)) (8) Performing search in "ou=unix,ou=IDM,dc=kit,dc=edu" with filter "(&(cn=KIT-Group-1)(objectClass=posixGroup)(memberUid=abc123))", scope "sub" (8) Waiting for search result... (8) User found in group object "ou=unix,ou=IDM,dc=kit,dc=edu" rlm_ldap (ldap): Released connection (1) (8) if (LDAP-Group == "KIT-Group-1") -> TRUE (8) if (LDAP-Group == "KIT-Group-1") { (8) update reply { rlm_sql (sql): Reserved connection (1) (8) Executing select query: SELECT vlan_id FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (1) (8) EXPAND %{sql:SELECT vlan_id FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> 22 (8) Tunnel-Private-Group-Id := 22 (8) Tunnel-Type := VLAN (8) Tunnel-Medium-Type := IEEE-802 (8) } # update reply = noop (8) } # if (LDAP-Group == "KIT-Group-1") = noop (8) ... skipping else: Preceding "if" was taken (8) } # if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) = noop (8) } # if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) = noop (8) } # policy w2vgroupcheck = noop Thanks in advance Klara

3 7