- Freeradius-Users - lists.freeradius.org

WARNING: Outer and inner identities are the same. User privacy is compromised.
by Håvard Steen 04 Jun '17

04 Jun '17

I have a clean Freeradius install v. 3.0.14, and so far just made a few config modifications and generated new certificates. My test user is added to users (.../raddb/users). My task is to set up WPA enterprise. I'm testing with my iPhone, and it seems to work fine. But in the 'log' (radiusd -X output) the following message appears: (35) Virtual server inner-tunnel received request (35) EAP-Message = 0x027000061a03 (35) FreeRADIUS-Proxied-To = 127.0.0.1 (35) User-Name = "byod" (35) State = 0x9197e30a90e7f90d1e18c9ac6236626c (35) WARNING: Outer and inner identities are the same. User privacy is compromised. (35) server inner-tunnel { (35) session-state: No cached attributes (35) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (35) authorize { (35) policy filter_username { (35) This seems kind of bad, any ideas?

4 3

Compile error when configuring without "tcp" or "dhcp"
by Wussler, Doug 02 Jun '17

02 Jun '17

Just FYI, I am upgrading from 3.0.11 to 3.0.14 If I run “configure –without-tcp” and then “make”, I get: … CC src/main/tls_listen.c build/objs/src/main/process.o: In function `check_proxy': /downloads/freeradius-server-3.0.14/src/main/process.c:5324: undefined reference to `home_servers_udp' build/objs/src/main/realms.o: In function `home_server_afrom_cs': /downloads/freeradius-server-3.0.14/src/main/realms.c:770: undefined reference to `home_servers_udp' collect2: error: ld returned 1 exit status make: *** [build/bin/local/radiusd] Error 1 If I run “configure –without-dhcp” and then “make”, I get: … CC src/modules/proto_dhcp/dhcpclient.c /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/crt1.o: In function `_start': (.text+0x20): undefined reference to `main' collect2: error: ld returned 1 exit status make: *** [build/bin/local/dhcpclient] Error 1 v3.0.11 was also unable to be compiled without dhcp or tcp. I reported the issues at that time and I’m just trying to be a good soldier by reporting that they still exist. I just prefer not to compile in capabilities I don’t need but have been using 3.0.11 for well over a year and it has done very, very well for us. Doug Wussler 850.645.4201 Florida State University Information Technology Services

2 1

FreeRadius EAP-TTLS Troubleshooting
by Smith, James 01 Jun '17

01 Jun '17

FreeRADIUS Version 3.0.4 Hello, I'm new to the FreeRadius community and would like to start by saying hello. I'm working on a FreeRadius issue and am having some trouble figuring out what exactly is going on so I'm going to try to post here to see if there is a possible solution. We are utilizing FreeRadius for EAP-TTLS authentication with Siemens radios and I'm not able to get our radio to register with the base station. Certificates are installed on the radio, base station and radius server. I've included the Radius -X output to an text file and have it attached. I've looked through the debug file and I'm noticing that the radio is getting through part of the authentication then is failing when it tries to authorize the radio. The error seems like it would be easy to translate but nothing seems to be incorrect in my files regarding the client.conf so I'm having a hard time figuring out why the radio is unable to authorize. The actual error message states "No Auth type found:" rejects the user then says "Login Incorrect". Note: I changed the actual passwords using the Find/Replace function. The client that is failing is CPE4(a)siemens.com<mailto:CPE4@siemens.com> and it begins authentication as the Debug (7) in the debug log. The first reject happens in Debug (11) (I highlighted in red where the reject message begins.) Any help would be appreciated and if you have any questions at all, please let me know. Best Regards, James Smith This message is intended only for the addressee and may contain information that is company confidential or privileged. Any technical data in this message may be exported only in accordance with the U.S. International Traffic in Arms Regulations (22 CFR Parts 120-130) or the Export Administration Regulations (15 CFR Parts 730-774). Unauthorized use is strictly prohibited and may be unlawful. If you are not the intended recipient, or the person responsible for delivering to the intended recipient, you should not read, copy, disclose or otherwise use this message. If you have received this email in error, please delete it, and advise the sender immediately.

3 3

openLDAP, freeRadius and firewall integration
by M. selcuk karaca 01 Jun '17

01 Jun '17

Hi I have an architectural question and I hope I will not destroy list rules We have an openLDAP server. And we want to integrate LDAP users to our firewall. Our ultimate aim for integration is to apply FW policies according to users. curently we are applying policies according to IP addresses. Because openLDAP server does not provide us with accounting information sent to the FW, we have employed a freeRadius server. But we could not trigger freeRadius accounting packages by authenticating our users with openLDAP server. SO we have used libpam-radius-auth package and directly authenticated users from freeRadius. I want to ask whether this way is a logical one. does this have any negative effects, not recommended etc.. what should be the correct architecture for authenticating our users from openLDAP and provide Firewall integration for user based policies..? Thanks for your guidance..

4 5

Set parent queue for Mikrotik
by Krauss International 31 May '17

31 May '17

Hello I want to set parent queue for MikroTik PPPoE users, can anyone suggest me a way to do the same. I believe it is not possible via Mikrotik-Rate-Limit attribute. Can we customize an attribute (I understand that will require the manufacturer to do changes at their end also, but how can we do this) All replies on the matter will be highly appreciable Thanks & regards Mankomal Singh Krauss International P: +91-9910416231 E: ms(a)kc-india.com PS: Send all bulk emails to sanman.krauss(a)gmail.com ONLY W: http://www.kc-india.com

1 0

Second stage authrization with proxy
by Gianluca Baù 31 May '17

31 May '17

Hello, i would like to forward authorization requests to another Freeradius server if the user is not present in the local one. The proxy configuration is ok, now i need to know how to tell the local radius to forward the request **if user not found**. In an old similar post ( http://freeradius.1045715.n5.nabble.com/Re-Local-Auth-if-Proxy-Auth-fails-O…) Alan Dekok explains the way: authorize { ...... if (!notfound) { update control { Proxy-To-Realm := "newrealm" } } ...... } For me this condition is never matched. Without the if condition the request is correctly forwarded but even if the user exists in local Freeradius server. May you help me please? Do you need other technical details? Cheers, Gianluca

2 3

rpaths when building FreeRADIUS RPM
by Jonathan Gazeley 30 May '17

30 May '17

Hi folks, When building FreeRADIUS 3.0.14 from source on a CentOS 7 system, it throws the following error: [jg4461@build-el7 rpmbuild]$ rpmbuild -ba --sign SPECS/freeradius-3.0.14.spec ... ... + /usr/lib/rpm/check-rpaths /usr/lib/rpm/check-buildroot ******************************************************************************* * * WARNING: 'check-rpaths' detected a broken RPATH and will cause 'rpmbuild' * to fail. To ignore these errors, you can set the '$QA_RPATHS' * environment variable which is a bitmask allowing the values * below. The current value of QA_RPATHS is 0x0000. * * 0x0001 ... standard RPATHs (e.g. /usr/lib); such RPATHs are a minor * issue but are introducing redundant searchpaths without * providing a benefit. They can also cause errors in multilib * environments. * 0x0002 ... invalid RPATHs; these are RPATHs which are neither absolute * nor relative filenames and can therefore be a SECURITY risk * 0x0004 ... insecure RPATHs; these are relative RPATHs which are a * SECURITY risk * 0x0008 ... the special '$ORIGIN' RPATHs are appearing after other * RPATHs; this is just a minor issue but usually unwanted * 0x0010 ... the RPATH is empty; there is no reason for such RPATHs * and they cause unneeded work while loading libraries * 0x0020 ... an RPATH references '..' of an absolute path; this will break * the functionality when the path before '..' is a symlink * * * Examples: * - to ignore standard and empty RPATHs, execute 'rpmbuild' like * $ QA_RPATHS=$[ 0x0001|0x0010 ] rpmbuild my-package.src.rpm * - to check existing files, set $RPM_BUILD_ROOT and execute check-rpaths like * $ RPM_BUILD_ROOT=<top-dir> /usr/lib/rpm/check-rpaths * ******************************************************************************* ERROR 0001: file '/usr/lib64/freeradius/rlm_sql_postgresql.so' contains a standard rpath '/usr/lib64' in [/usr/lib64] ERROR 0001: file '/usr/lib64/freeradius/rlm_sql_unixodbc.so' contains a standard rpath '/usr/lib64' in [/usr/lib64] ERROR 0001: file '/usr/lib64/freeradius/rlm_rest.so' contains a standard rpath '/usr/lib64' in [/usr/lib64] error: Bad exit status from /var/tmp/rpm-tmp.fu96Fb (%install) Bad exit status from /var/tmp/rpm-tmp.fu96Fb (%install) Now, the workaround is obviously printed in the error message but this is just a workaround. It looks like there are hardcoded library paths in several .so objects that need updating. I should note that it has done this for previous versions too, but I never got round to posting about it. I'll use the workaround for now but it would be super if this could be fixed before the next release, so a more durable RPM can be built. Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

1 0

Disable rlm_sql Info level logging
by Joshua Rosenfeld 30 May '17

30 May '17

I am having difficulty figuring out how to disable rlm_sql Info level logs from my log file. Currently when I open freeradius.log, I see many, many lines all similar to the log below. How can I disable the logging seen below, or more ideally limit the logging to warnings and above? Tue May 30 04:59:21 2017 : Info: rlm_sql (sql): Closing connection (9): Hit idle_timeout, was idle for 67 seconds Tue May 30 04:59:21 2017 : Info: rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 67 seconds Tue May 30 04:59:21 2017 : Info: rlm_sql (sql): Closing connection (13): Hit idle_timeout, was idle for 67 seconds Tue May 30 04:59:21 2017 : Info: rlm_sql (sql): Need 5 more connections to reach 10 spares Tue May 30 04:59:21 2017 : Info: rlm_sql (sql): Opening additional connection (15), 1 of 59 pending slots used Tue May 30 04:59:39 2017 : Info: rlm_sql (sql): Need 4 more connections to reach 10 spares Tue May 30 04:59:39 2017 : Info: rlm_sql (sql): Opening additional connection (16), 1 of 58 pending slots used Tue May 30 05:00:04 2017 : Info: rlm_sql (sql): Need 3 more connections to reach 10 spares Tue May 30 05:00:04 2017 : Info: rlm_sql (sql): Opening additional connection (17), 1 of 57 pending slots used Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Closing connection (12): Hit idle_timeout, was idle for 86 seconds Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 86 seconds Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Closing connection (11): Hit idle_timeout, was idle for 61 seconds Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Closing connection (17): Hit idle_timeout, was idle for 61 seconds Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 61 seconds Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Closing connection (16): Hit idle_timeout, was idle for 61 seconds Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Closing connection (15): Hit idle_timeout, was idle for 61 seconds Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Closing connection (8): Hit idle_timeout, was idle for 61 seconds Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Opening additional connection (18), 1 of 64 pending slots used Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Need 2 more connections to reach 10 spares Tue May 30 05:01:05 2017 : Info: rlm_sql (sql): Opening additional connection (19), 1 of 63 pending slots used Tue May 30 05:02:18 2017 : Info: rlm_sql (sql): Closing connection (18): Hit idle_timeout, was idle for 73 seconds Tue May 30 05:02:18 2017 : Info: rlm_sql (sql): Closing connection (19): Hit idle_timeout, was idle for 73 seconds Tue May 30 05:02:18 2017 : Info: rlm_sql (sql): Opening additional connection (20), 1 of 64 pending slots used Tue May 30 05:02:18 2017 : Info: rlm_sql (sql): Need 2 more connections to reach 10 spares Tue May 30 05:02:18 2017 : Info: rlm_sql (sql): Opening additional connection (21), 1 of 63 pending slots used Tue May 30 05:02:41 2017 : Info: rlm_sql (sql): Need 1 more connections to reach 10 spares Tue May 30 05:02:41 2017 : Info: rlm_sql (sql): Opening additional connection (22), 1 of 62 pending slots used Thanks, Josh

2 1

Recursive string expansion
by Dan Breslau 29 May '17

29 May '17

I have an issue with recursive string expansion -- that is, it is recursing in a situation where I'd rather it didn't. Specifically, with freeradius 3.0.13, in policy.d/moonshot_targeted_ids, if I set targeted_id_salt = '${changeme' then I get the error: Fri May 26 20:23:37 2017 : Error: /etc/freeradius/policy.d/moonshot-targeted-ids[40]: Reference "${changeme%{tolower}" not found Fri May 26 20:23:37 2017 : Error: Failed expanding section name Fri May 26 20:23:37 2017 : Error: /etc/freeradius/policy.d/moonshot-targeted-ids[41]: Failed allocating memory for section Fri May 26 20:23:37 2017 : Error: Errors reading or parsing /etc/freeradius/radiusd.conf This seems to be a reference to these two lines (starting at line 40) : if (&outer.request:GSS-Acceptor-Host-Name) { if ("%{echo:/usr/bin/uuid -v 5 ${policy.moonshot_host_namespace} %{tolower:%{User-Name}}${policy.targeted_id_salt}%{tolower:%{outer.request:GSS-Acceptor-Host-Name}}}" =~ /^([^ ]+)([ ]*)$/) { So it definitely looks like ${policy.targeted_id_salt} is expanded once, and then something attempts to expand the expanded string, which fails because '${changeme' is invalid xlat syntax. I haven't found any user documentation indicating whether string expansion is recursive. I did find an older post by Arran where he says that "rlm_sql does recursive xlat" (see (http://lists.freeradius.org/pipermail/freeradius-users/2009-April/037249.ht…) This makes me wonder whether this behavior is decided upon by the module's implementer. If there is a way to prevent this behavior (i.e., force a string to be expanded non-recursively), I'd love to hear about it. I'd be happy to file a bug (or feature request) if that would be appropriate. Thanks, Dan Breslau

3 3

radius auth (RESt or script execution) & creating user on systems
by Janis Heller 29 May '17

29 May '17

I’ve got two question, question number 2 is not directly related to FreeRADIUS but I hope for some ideas. 1.) I’m using FreeRADIUS at the moment with the REST functionality, this means, when a new auth request is made a GET request is performed by the RADIUS server, sending username, password and station ID to a PHP script which is checking the user data and allowing or denying the access by returning the result of the check to radius. This PHP script is making some database checks (I know there’s a module for FreeRADIUS, but my database passwords are hashed in a special way and I need to make a few checks for each user). What way is recommended, using the rest functionality or let radius call the script directly and sending the username, password and station ID as parameters, when calling the script? -I’m using radius for example for DANTE, using DANTE (SOCKS5 server), every single request made by a user will result in an RADIUS request too. That’s why I ask. 2.) I’m using the same FreeRADIUS server to manage my SSH logins too. This works fine, but I need to create every user account on each machine, before the login using RADIUS for auth is working fine. It’s not the job of RADIUS to create user accounts, but what’s the best way to create these user accounts, without using a LDAP backend? My idea was to use a cronjob which will check for new user accounts in a database and update them in case of need. All the best from Germany;

2 1