- Freeradius-Users - lists.freeradius.org

SQL xlat parsing problem
by Igor Smitran 24 May '17

24 May '17

Hi list, i have a simple query that doesn't execute properly. In config file: #sql named instance: SqlNamedInstance01 # MAC LIMIT update control { Tmp-Integer-1 = "%{SqlNamedInstance01: SELECT count(*) FROM mac_limit WHERE Username = '%{SQL-User-Name}' and callingstationid='%{Calling-Station-Id}'}" } if ("%{control:Tmp-Integer-1}" == 0) { update control { Tmp-String-1 = " MAC LIMIT: MAC address not authorized! " } reject } while in debug mode: (0) [SqlNamedInstance01] = ok (0) update control { (0) EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} (0) --> igor.smitran (0) SQL-User-Name set to 'igor.smitran' rlm_sql (SqlNamedInstance01): Reserved connection (2) (0) Executing select query: SELECT count(*) FROM mac_limit WHERE Username = '' and callingstationid='44-d4-e0-a2-f3-48' rlm_sql (SqlBlicnetSsid): Released connection (2) (0) EXPAND %{SqlNamedInstance01: SELECT count(*) FROM mac_limit WHERE Username = '%{SQL-User-Name}' and callingstationid='%{Calling-Station-Id}'} (0) --> 0 (0) Tmp-Integer-1 = 0 (0) } # update control = noop (0) if ("%{control:Tmp-Integer-1}" == 0) { (0) if ("%{control:Tmp-Integer-1}" == 0) -> TRUE (0) if ("%{control:Tmp-Integer-1}" == 0) { So, for some reason, SQL-User-Name is empty. Any help anyone? Thank you, Igor

3 3

Freeradius Proxy scenario help
by David Brierley 24 May '17

24 May '17

Hi Guys, Wondeirng if you can help, I have a scenario where I have two servers running Freeradius, one is setup using MYSQL and is working fine and the other is doing OTP and is a remote server. I would like to pass on the Auth part of this to the OTP server. E.g. if a request comes in to server 1 it will do radcheck against username only, it will then forward the request on to server two that will have the same username and then check its password and OTP, The OTP radius server will send an accept accept ONLY. The original server running MYSQL will then add the rad reply / radgroup reply items / AVP's to the reply. Main reason is I can keep the OTP server as just doing OTP and have multiple instances of Freeradius setup to essentially point the requests to the OTP server if they need / Want to. The original server can then have control of the rad replies to send to the client (Mainly VPN clients). It is possible on the OTP server alone however its very messy and to implement with MYSQL isn't exactly straight forward. Any pointers on this would be great e.g. how / what I need to look into. I have had a look at proxying rad requests but from what I can understand the original server cannot update the reply or if it can where I would do this. CHeers !!

2 1

(no subject)
by Lotkov Svyatoslav 24 May '17

24 May '17

unsubscribe

1 0

FR 3.0.13 - fail-over in proxy with radsec doesn't work
by Fikais Ladislav 23 May '17

23 May '17

Hello, I'm trying to setup a new FR 3.0.13 server as a proxy with radsec. I'm using two "main" radius servers (cuni-tls1, cuni-tls2 - FRv2 + RadSecProxy) to authenticate users and the new server should act only as a proxy (plus logging and VLAN rewrite) for a remote site. Currently I'm using for this FRv2 and RadSecProxy and it works fine (including fail-over) for a few years. Now if I try to use only FR 3.0.13 with radsec for this proxy, it only works if the first main server (cuni-tls1) is reachable. If not (a DROP rule in the main servers FW) the proxy will not even try the secondary server (verified by tcpdump) and I get timeout. Attached debug files: - 1-ok.txt - first main server is reachable - OK - 2-unr-r1.txt - first main server is NOT reachable - timeout even if I repeat the auth request I'm not sure if I'm making any kind of config mistake or it's a bug. Could you please help me? Thanks, Lada --- Ladislav Fikais Charles University Computer Centre Petrská 3, Praha 1 110 00, Czech Republic

2 1

Problems integrating RADIUS module with freeradius 3.0.12 on Ubuntu Linux
by kiran kumar 23 May '17

23 May '17

Hi, I am trying to integrate module (outside freeradius source tree) with freeradius 3.0.12. On compilation found few header files which are necessary for the module are missing and so updated freeradius source code to make them available for the module. Also updated libradius.h & radiusd.h file with the changes suggested here <https://github.com/FreeRADIUS/freeradius-server/pull/1418> to avoid below error *libradius.h:22:21: error: expected ‘)’ before string constant* *RCSIDH(libradius_h, "$Id: d356b97f983fba4421176d6b637bdd907ad36279 $") ^* Now I got stuck with the below error. */usr/include/freeradius/threads.h:30:4: error: #error WITH_THREADS defined, but pthreads not available* * # error WITH_THREADS defined, but pthreads not available* Can someone help me on this... Thanks..

2 1

Freeradius Multiple Disjoint Ad Domains
by Arnab Roy 23 May '17

23 May '17

Hi , Before I begin I would like to apologise that this is not really a FR issue but the Samba community has been less than helpful in responding hence hoping in the collective knowledge of this list I can get some pointers. We have a situation where we have 2 AD domains which are running across two complete separate AD domains i.e. no trust. Because of political reasons they cannot establish a trust. I have been able to get multiple instances of winbindd running with separate smb.conf's and joined to the respective AD domains. The problem seems to be ntlm_auth doesnt see that the winbindd privileged pipe and winbindd socket is running in a custom directory. I know what to do in the FR side .. Just wondering anyone has any experience with this kind of setup. Once I can get the ntlm_auth to work I can than finish off the rest of the FR config. My SMB config looks like follows: Winbindd_A server string = Samba Server Domain A hosts allow = 127. log file = /var/log/samba/log-DOMAINA.%m log level = 3 max log size = 50 security = ads encrypt passwords = yes passdb backend = tdbsam load printers = no cups options = raw printcap name = /dev/null allow trusted domains = yes interfaces=172.21.8.250 bind interfaces only = yes WORKGROUP=DOMAINA-NETWORKS REALM=DOMAINA-networks.com pid directory = /var/run/samba/DOMAINA-networks lock directory = /var/cache/samba/DOMAINA-networks private dir = /var/cache/samba/DOMAINA-networks winbindd socket directory = /var/cache/samba/DOMAINA-networks winbindd privileged socket directory = /var/cache/samba/DOMAINA-networks/winbindd_privileged smb passwd file = /var/cache/samba/DOMAINA-networks state directory = /var/cache/samba/DOMAINA-networks cache directory = /var/cache/samba/DOMAINA-networks usershare path = /var/cache/samba/DOMAINA-networks ntp signd socket directory = /var/cache/samba/DOMAINA-networks winbindd_B server string = Samba Server Domain B hosts allow = 127. log file = /var/log/samba/log-DOMAINB.%m log level = 3 max log size = 50 security = ads encrypt passwords = yes passdb backend = tdbsam load printers = no cups options = raw printcap name = /dev/null allow trusted domains = yes interfaces=172.21.8.250 bind interfaces only = yes WORKGROUP=DOMAINB-NETWORKS REALM=DOMAINB-networks.com pid directory = /var/run/samba/DOMAINB-networks lock directory = /var/cache/samba/DOMAINB-networks private dir = /var/cache/samba/DOMAINB-networks winbindd socket directory = /var/cache/samba/DOMAINB-networks winbindd privileged socket directory = /var/cache/samba/DOMAINB-networks/winbindd_privileged smb passwd file = /var/cache/samba/DOMAINB-networks state directory = /var/cache/samba/DOMAINB-networks cache directory = /var/cache/samba/DOMAINB-networks usershare path = /var/cache/samba/DOMAINB-networks ntp signd socket directory = /var/cache/samba/DOMAINB-networks Any pointers would be extremely appreciated..

4 6

Problem to assign freamed-pool in update reply
by Mohamad Yazdian 23 May '17

23 May '17

Hi everyone I have problem width the update reply. I check the total acctinputocted for the user and flag the Mikrotik-Xmit-Limit attribute. When I set the ip address for the module my pppoe user on mikrotik get this ip address successfuly but when I use the framed-pool and set the ip-pool name in mikrotik the clinet can not get the ip from the ip-pool. please help me to fix this problem user_limit1{ reject = 1 } if(reject){ update reply{ Mikrotik-Rate-Limit := "256K/256K" # <----This line is work fine Framed-IP-Address := "1.1.1.2" # <----This line is work fine Framed-Pool := "Expire" # <----This line isn't work } }

1 0

Re: Freeradius-Users Digest, Vol 145, Issue 48
by Mohamad Yazdian 23 May '17

23 May '17

Hi everyone I have problem width the update reply. I check the total acctinputocted for the user and flag the Mikrotik-Xmit-Limit attribute. When I set the ip address for the module my pppoe user on mikrotik get this ip address successfuly but when I use the framed-pool and set the ip-pool name in mikrotik the clinet can not get the ip from the ip-pool. please help me to fix this problem On Tue, May 23, 2017 at 1:41 AM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. is there a way to identify the very first ACCESS-REQUEST > (Michael Hocke) > 2. Re: is there a way to identify the very first ACCESS-REQUEST > (Matthew Newton) > 3. Re: Freeradius Multiple Disjoint Ad Domains (Arnab Roy) > 4. Re: is there a way to identify the very first ACCESS-REQUEST > (Michael Hocke) > 5. Re: is there a way to identify the very first ACCESS-REQUEST > (Matthew Newton) > 6. Re: is there a way to identify the very first ACCESS-REQUEST > (Michael Hocke) > 7. Re: Freeradius with multiotp - but otp-pin is in username > (blaster(a)vorsicht-bissig.de) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 22 May 2017 13:04:59 -0400 > From: Michael Hocke <mh103(a)nyu.edu> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: is there a way to identify the very first ACCESS-REQUEST > Message-ID: <D71F1F39-81F6-4417-8782-FCC16E6A82A8(a)nyu.edu> > Content-Type: text/plain; charset=us-ascii > > > Hi there, > > I want to improve our logging and want to keep track of authentication > attempts that do not complete. I was thinking of logging the very first > ACCESS-REQUEST and then later on the result. Is there a good way to > identify the very first ACCESS-REQUEST from the client with unlang? Maybe > by checking the contents of the session-state list or some such? Any ideas? > > Thanks! > > - Michael > > > > > ------------------------------ > > Message: 2 > Date: Mon, 22 May 2017 19:20:52 +0100 > From: Matthew Newton <matthew(a)newtoncomputing.co.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: is there a way to identify the very first ACCESS-REQUEST > Message-ID: <20170522182052.GA7565(a)elk.newtoncomputing.co.uk> > Content-Type: text/plain; charset=us-ascii > > On Mon, May 22, 2017 at 01:04:59PM -0400, Michael Hocke wrote: > > I want to improve our logging and want to keep track of > > authentication attempts that do not complete. I was thinking of > > logging the very first ACCESS-REQUEST and then later on the > > result. Is there a good way to identify the very first > > ACCESS-REQUEST from the client with unlang? Maybe by checking > > the contents of the session-state list or some such? Any ideas? > > I look to see if it's an EAP identity. Which works OK if you're > doing EAP. > > if (&EAP-Message =~ /^0x02......01/) { > detail > } > eap > > -- > Matthew > > > ------------------------------ > > Message: 3 > Date: Mon, 22 May 2017 21:09:58 +0200 > From: "Arnab Roy" <arnabroy(a)mail.com> > To: freeradius-users(a)lists.freeradius.org, "Matthew Newton" > <mcn4(a)leicester.ac.uk> > Subject: Re: Freeradius Multiple Disjoint Ad Domains > Message-ID: > <trinity-82f81d62-20d5-41b0-964a-3ed7ccdc55aa- > 1495480198798@3capp-mailcom-lxa14> > > Content-Type: text/plain; charset="UTF-8" > > Hi Matthew, > > Sorry I am back with this one. After digging through tons of samba > source I have finally managed to reach a stage where Winbind is now > running completely separately so just need to sort out ntlm_auth. > Looking through the source code I stumbled upon the following file in > nsswitch and saw your name as the author :) hope its the same Matthew > :) > > nsswitch/wb_common.c > > Now previously it seems like it was possible to set the Winbind Socket > directory via an environment variable ( > http://samba.2283325.n4.nabble.com/NTLM-Authentication-against-multiple > -domain-comtrollers-td3024825.html ) > > This seems to have gone now looking at the code > > static const char *winbindd_socket_dir(void) > { > if (nss_wrapper_enabled()) { > const char *env_dir; > env_dir = getenv("SELFTEST_WINBINDD_SOCKET_DIR"); > if (env_dir != NULL) { > return env_dir; > } > } > return WINBINDD_SOCKET_DIR; > } > > Can you see any issues if I changed this to return a custom environment > variable instead ? Also from a FR perspective I am considering > chrooting ntlm_auth ? > > Your help is much appreciated. > > Many Thanks > Arnab > > > > Sent: Monday, May 22, 2017 at 12:37 PM > From: "Matthew Newton" <mcn4(a)leicester.ac.uk> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius Multiple Disjoint Ad Domains > On Mon, May 22, 2017 at 01:27:53PM +0200, Arnab Roy wrote: > > The problem seems to be ntlm_auth doesnt see that the winbindd > > privileged pipe and winbindd socket is running in a custom directory. > IIRC ntlm_auth connects to winbindd using the /tmp/.winbindd/pipe > pipe, and then queries winbindd over that pipe what the location of > the priv pipe is. > So if you've got two winbindds both with /tmp/.winbindd/pipe, only > one of those is going to work. > Assuming the two copies of Samba were compiled with different > locations then it might work. I'd be inclined to strace all the > things and see what's really happening. > I'd expect that if you built Samba and installed in /opt/samba1/ > and /opt/samba2/ and then ran /opt/samba1/ntlm_auth and > /opt/samba2/ntlm_auth that the locations would probably be > separate and all would be OK. > But running two copies of Samba on the same box is hardly a > standard setup, so you're likely to be on your own. > Or you could just proxy the RADIUS request to a separate VM with > another instance of Samba on it and save the unusual setup. > Matthew > -- > Matthew Newton, Ph.D. <mcn4(a)leicester.ac.uk> > Systems Specialist, Infrastructure Services, > I.T. Services, University of Leicester, Leicester LE1 7RH, United > Kingdom > For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> > - > List info/subscribe/unsubscribe? See > [1]http://www.freeradius.org/list/users.html > > References > > 1. http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 4 > Date: Mon, 22 May 2017 15:32:00 -0400 > From: Michael Hocke <mh103(a)nyu.edu> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: is there a way to identify the very first ACCESS-REQUEST > Message-ID: <7D716BE5-D12E-4512-9BC0-480DFFE36E8C(a)nyu.edu> > Content-Type: text/plain; charset=utf-8 > > > > On May 22, 2017, at 2:20 PM, Matthew Newton < > matthew(a)newtoncomputing.co.uk> wrote: > > > > On Mon, May 22, 2017 at 01:04:59PM -0400, Michael Hocke wrote: > >> I want to improve our logging and want to keep track of > >> authentication attempts that do not complete. I was thinking of > >> logging the very first ACCESS-REQUEST and then later on the > >> result. Is there a good way to identify the very first > >> ACCESS-REQUEST from the client with unlang? Maybe by checking > >> the contents of the session-state list or some such? Any ideas? > > > > I look to see if it's an EAP identity. Which works OK if you're > > doing EAP. > > > > if (&EAP-Message =~ /^0x02......01/) { > > detail > > } > > eap > > That looks good. I’ll give it a try. Follow-up question: is there a way to > get a hold of the request number from within unlang? I don’t think I see it > anywhere in the source code but I want to ask anyway. If not, is this > something planned for a future release or is there a better way to > correlate different log lines to the same request? > > Thanks again! > > - Michael > > > > > ------------------------------ > > Message: 5 > Date: Mon, 22 May 2017 20:49:43 +0100 > From: Matthew Newton <matthew(a)newtoncomputing.co.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: is there a way to identify the very first ACCESS-REQUEST > Message-ID: > <9A9A26CD-35F6-4FA8-9A42-A8BA75D37D64(a)newtoncomputing.co.uk> > Content-Type: text/plain; charset=utf-8 > > On 22 May 2017 20:32:00 BST, Michael Hocke <mh103(a)nyu.edu> wrote: > >That looks good. I’ll give it a try. Follow-up question: is there a way > >to get a hold of the request number from within unlang? I don’t think I > >see it anywhere in the source code but I want to ask anyway. > > http://wiki.freeradius.org/config/run_time_variables > > %n, in v3 onwards. > > > > -- > Matthew > > > > ------------------------------ > > Message: 6 > Date: Mon, 22 May 2017 16:00:18 -0400 > From: Michael Hocke <mh103(a)nyu.edu> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: is there a way to identify the very first ACCESS-REQUEST > Message-ID: <1ECD6BA4-C805-450E-8241-49C446CCB483(a)nyu.edu> > Content-Type: text/plain; charset=utf-8 > > > > On May 22, 2017, at 3:49 PM, Matthew Newton < > matthew(a)newtoncomputing.co.uk> wrote: > > > > On 22 May 2017 20:32:00 BST, Michael Hocke <mh103(a)nyu.edu> wrote: > >> That looks good. I’ll give it a try. Follow-up question: is there a way > >> to get a hold of the request number from within unlang? I don’t think I > >> see it anywhere in the source code but I want to ask anyway. > > > > http://wiki.freeradius.org/config/run_time_variables > > > > %n, in v3 onwards. > > Awesome. Thank you very much. > > - Michael > > > > > ------------------------------ > > Message: 7 > Date: Tue, 23 May 2017 00:41:36 +0200 > From: blaster(a)vorsicht-bissig.de > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Freeradius with multiotp - but otp-pin is in username > Message-ID: <0fef0540-59bd-4b62-bd6f-adb1b1856e27(a)gmx.at> > Content-Type: text/plain; charset=utf-8; format=flowed > > Hello, > > I put the policy on the top of the authorize section and it works as > intendet. > Thank you very much, Alan DeKok for your advice! > > Best regards > Gerald > > > On 22.05.2017 14:30, Alan DeKok wrote: > > On May 21, 2017, at 6:53 PM, blaster(a)vorsicht-bissig.de wrote: > >> i'm trying to setup FreeRADIUS Version 3.0.13 with multiotp BUT I > want > >> to enter the information like this: > >> "{Username}:{OTP-PIN}" ==> f.e. "dani:955825" (username in users > >> file) > >> "{Password}" ==> f.e. "blabla" (password in > users > >> file) > > That's a little unusual, but it should work, mostly. > > > > But most people appoint the OTP to the password, not to the User-Name. > > > >> I think this could be a way, to get some devices to work with 2 > factor, > >> which are not build for it. > >> I successfully get an ok from multiotp, by regex'ing "{OTP-PIN}" > >> from "{Username}:{OTP-PIN}", > >> but PAP is failing, because I can't get PAP to look for "{Username}" > >> (f.e. "dani"). > >> It always tries to look for "{Username}:{OTP-PIN}" (f.e. > "dani:955825") > >> in the authentication-section. > > Because the default configuration looks up users by the contents of > the User-Name attribute. > > > > Sine you've modified the User-Name to contain the OTP key, that won't > work. > > > >> It would be nice if you could point me in the right direction. > >> My apologies, if this question was already asked, and I didn't find > it. > >> Best regards > >> Gerald > >> remark - begin > >> ------------ > >> I successfully did it with > >> "{Username} " ==> f.e. "dani" (username in users > file) > >> "{Password}{OTP-PIN}" ==> f.e. "blabla955825" (password in users > >> file) > > Which is what most people use. > > > >> But I think the > >> "{Username}" > >> "{Password}{OTP-PIN}" > >> way, fails when it comes to MSCHAP (with ActiveDirectory), because > >> Freeradius compares only password hashes and not plaintext, so it > can't > >> recongnise what's the OTP-PIN and what's the password. > > Yes. > > > >> -------------- > >> remark - end > >> /usr/local/etc/raddb/users > >> #### > >> "dani" Cleartext-Password := "blabla", MS-CHAP-Use-NTLM-Auth > := > >> 0 > >> #### > >> /usr/local/etc/dictionary > >> #### > >> ATTRIBUTE User-OTP 3000 string > > You don't need that. > > > >> ATTRIBUTE User-Password-TMP 3001 string > >> #### > >> /usr/local/etc/raddb# cat policy.d/pol_usernamemultiotp > >> ##### > >> pol_usernamemultiotp.authorize { > >> if ( &User-Name =~ /^(.*)(\:)([0-9]{6})$/) { > >> update request { > >> User-Password-TMP := "%{User-Password}" > >> User-OTP := "%{3}" > >> User-Password := "%{User-OTP}" > > This isn't necessary. > > > >> User-Name := "%{1}" > > You probably shouldn't re-write the User-Name. Leave it alone. > > > >> Stripped-User-Name := "%{1}" > > If Stripped-User-Name exists, the server uses it for lookups instead > of User-Name. So all you need to do is set Stripped-User-Name correctly. > > > >> ##### > >> radiusd -X output - begin > > Reading it carefully helps... the messages are useful. > > > >> ##### > >> Ready to process requests > >> (0) Received Access-Request Id 192 from 127.0.0.1:56491 to > >> 127.0.0.1:1842 length 81 > >> (0) User-Name = "dani:955825" > >> (0) User-Password = "blabla" > >> (0) NAS-IP-Address = 127.0.0.1 > >> (0) NAS-Port = 100 > >> (0) Message-Authenticator = 0x0cc5e28430dea113b6b4fde2d1537388 > > That's the Access-Request... > > > >> (0) custom_otp: Searching for user in group "vlan10" > >> rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle > for > >> 76 seconds > >> rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle > for > >> 76 seconds > >> rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle > for > >> 76 seconds > >> rlm_ldap (ldap): You probably need to lower "min" > >> rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle > for > >> 76 seconds > >> rlm_ldap (ldap): You probably need to lower "min" > >> rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle > for > >> 76 seconds > >> rlm_ldap (ldap): You probably need to lower "min" > > Pay attention to those messages. Either increase "idle_timeout", or > lower "min". > > > >> (0) custom_otp: EXPAND > >> (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) > >> (0) custom_otp: --> (samaccountname=dani:955825) > >> (0) custom_otp: Search returned no results > > Note that it's looking up the User-Name attribute. i.e. the name > *before* any edits. > > > >> rlm_ldap (ldap): Released connection (6) > >> (0) [ldap] = notfound > >> (0) [expiration] = noop > >> (0) [logintime] = noop > >> (0) policy pol_usernamemultiotp.authorize { > > And AFTER you look up User-Name (the one with the OTP), you run the > policy to fix the User-Name. > > > > i.e. you have this reversed. > > > > The solution is to put the re-write at the TOP of the "authorize" > section. That way, the Stripped-User-Name attribute is seen by all modules. > > > > And the policy you created is too complicated. Just do this: > > > > if ( &User-Name =~ /^(.*):([0-9]{6})$/) { > > update request { > > Stripped-User-Name := "%{1}" > > User-OTP := "%{2}" > > } > > } > > > > i..e. you don't need a "tmp" password. You don't need to re-write the > password. You don't need to match (:) in the regex. Just matching : is > good enough. > > > > Alan DeKok. > > > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 145, Issue 48 > ************************************************* >

1 1

Freeradius with multiotp - but otp-pin is in username
by blaster＠vorsicht-bissig.de 22 May '17

22 May '17

Hi guys, i'm trying to setup FreeRADIUS Version 3.0.13 with multiotp BUT I want to enter the information like this: "{Username}:{OTP-PIN}" ==> f.e. "dani:955825" (username in users file) "{Password}" ==> f.e. "blabla" (password in users file) I think this could be a way, to get some devices to work with 2 factor, which are not build for it. I successfully get an ok from multiotp, by regex'ing "{OTP-PIN}" from "{Username}:{OTP-PIN}", but PAP is failing, because I can't get PAP to look for "{Username}" (f.e. "dani"). It always tries to look for "{Username}:{OTP-PIN}" (f.e. "dani:955825") in the authentication-section. It would be nice if you could point me in the right direction. My apologies, if this question was already asked, and I didn't find it. Best regards Gerald remark - begin ------------ I successfully did it with "{Username} " ==> f.e. "dani" (username in users file) "{Password}{OTP-PIN}" ==> f.e. "blabla955825" (password in users file) . But I think the "{Username}" "{Password}{OTP-PIN}" way, fails when it comes to MSCHAP (with ActiveDirectory), because Freeradius compares only password hashes and not plaintext, so it can't recongnise what's the OTP-PIN and what's the password. -------------- remark - end /usr/local/etc/raddb/users #### "dani" Cleartext-Password := "blabla", MS-CHAP-Use-NTLM-Auth := 0 #### /usr/local/etc/dictionary #### ATTRIBUTE User-OTP 3000 string ATTRIBUTE User-Password-TMP 3001 string #### /usr/local/etc/raddb# cat policy.d/pol_usernamemultiotp ##### pol_usernamemultiotp.authorize { if ( &User-Name =~ /^(.*)(\:)([0-9]{6})$/) { update request { User-Password-TMP := "%{User-Password}" User-OTP := "%{3}" User-Password := "%{User-OTP}" User-Name := "%{1}" Stripped-User-Name := "%{1}" } multiotp if (ok) { update request { User-Name := "%{1}" User-Password := "%{User-Password-TMP}" } update control { Auth-Type := PAP } } else { reject } } } ##### radiusd -X output - begin ##### Ready to process requests (0) Received Access-Request Id 192 from 127.0.0.1:56491 to 127.0.0.1:1842 length 81 (0) User-Name = "dani:955825" (0) User-Password = "blabla" (0) NAS-IP-Address = 127.0.0.1 (0) NAS-Port = 100 (0) Message-Authenticator = 0x0cc5e28430dea113b6b4fde2d1537388 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/custom_otp (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) auth_log: --> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20170521 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "dani:955825", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) custom_otp: Searching for user in group "vlan10" rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 76 seconds rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 76 seconds rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 76 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 76 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 76 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (5), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://testdc.test.apa.lan:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (5) (0) custom_otp: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) (0) custom_otp: --> (samaccountname=dani:955825) (0) custom_otp: Search returned no results rlm_ldap (ldap): Released connection (5) Need 2 more connections to reach min connections (3) rlm_ldap (ldap): Opening additional connection (6), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://testdc.test.apa.lan:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) custom_otp: Searching for user in group "vlan99" rlm_ldap (ldap): Reserved connection (5) (0) custom_otp: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) (0) custom_otp: --> (samaccountname=dani:955825) (0) custom_otp: Waiting for search result... (0) custom_otp: Search returned no results rlm_ldap (ldap): Released connection (5) (0) [custom_otp] = noop rlm_ldap (ldap): Reserved connection (6) (0) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (samaccountname=dani:955825) (0) ldap: Waiting for search result... (0) ldap: Search returned no results rlm_ldap (ldap): Released connection (6) (0) [ldap] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) policy pol_usernamemultiotp.authorize { (0) if ( &User-Name =~ /^(.*)(\:)([0-9]{6})$/) { (0) if ( &User-Name =~ /^(.*)(\:)([0-9]{6})$/) -> TRUE (0) if ( &User-Name =~ /^(.*)(\:)([0-9]{6})$/) { (0) update request { (0) EXPAND %{User-Password} (0) --> blabla (0) User-Password-TMP := blabla (0) EXPAND %{3} (0) --> 955825 (0) User-OTP := 955825 (0) EXPAND %{User-OTP} (0) --> 955825 (0) User-Password := 955825 (0) EXPAND %{1} (0) --> dani (0) User-Name := dani (0) EXPAND %{1} (0) --> dani (0) Stripped-User-Name := dani (0) } # update request = noop (0) multiotp: EXPAND %{User-Name} (0) multiotp: --> dani (0) multiotp: EXPAND %{User-Password} (0) multiotp: --> 955825 (0) multiotp: EXPAND -src=%{Packet-Src-IP-Address} (0) multiotp: --> -src=127.0.0.1 (0) multiotp: EXPAND -chap-challenge=%{CHAP-Challenge} (0) multiotp: --> -chap-challenge= (0) multiotp: EXPAND -chap-password=%{CHAP-Password} (0) multiotp: --> -chap-password= (0) multiotp: EXPAND -ms-chap-challenge=%{MS-CHAP-Challenge} (0) multiotp: --> -ms-chap-challenge= (0) multiotp: EXPAND -ms-chap-response=%{MS-CHAP-Response} (0) multiotp: --> -ms-chap-response= (0) multiotp: EXPAND -ms-chap2-response=%{MS-CHAP2-Response} (0) multiotp: --> -ms-chap2-response= (0) multiotp: Program returned code (0) and output '' (0) multiotp: Program executed successfully (0) [multiotp] = ok (0) if (ok) { (0) if (ok) -> TRUE (0) if (ok) { (0) update request { (0) EXPAND %{1} (0) --> dani (0) User-Name := dani (0) EXPAND %{User-Password-TMP} (0) --> blabla (0) User-Password := blabla (0) } # update request = noop (0) update control { (0) Auth-Type := PAP (0) } # update control = noop (0) } # if (ok) = noop (0) ... skipping else: Preceding "if" was taken (0) } # if ( &User-Name =~ /^(.*)(\:)([0-9]{6})$/) = ok (0) } # policy pol_usernamemultiotp.authorize = ok (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/custom_otp (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: No password configured for the user. Cannot do authentication (0) [pap] = fail (0) } # Auth-Type PAP = fail (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/custom_otp (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> dani (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.1 seconds. Waking up in 0.8 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 192 from 127.0.0.1:1842 to 127.0.0.1:56491 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 192 with timestamp +76 Ready to process requests ##### radiusd -X output - end

2 2

Re: Freeradius3 + SQL -> radusergroup check is not matched
by Martin Bednar 22 May '17

22 May '17

Hello Alan, again thanks for your time. The goal is simple. When is user connecting to the wireless network he is asked for username/password if there is a match and at the same time he is allowed to use this SSID he is authenticated. username/password check should happen in radcheck table SSID check should happen in radusergroup table >> MariaDB [radius]> select * from radgroupreply where groupname = >> "SSID_EMPL-Test"; >> +----+----------------+-----------+----+--------+ >> | id | groupname | attribute | op | value | >> +----+----------------+-----------+----+--------+ >> | 6 | SSID_EMPL-Test | Auth-Type | := | Accept | >> +----+----------------+-----------+----+--------+ >> 1 row in set (0.00 sec) > i.e. anyone who logs into the EMPL-Test SSID gets accepted? You're right - that's not right. In this case even if the username/password would be wrong user would receive Access Accept. I believe that normally there is no need for radgroupreply item because Access Accept/Reject is already set from radcheck. Would it works like this ? Check user in radcheck -> is username/passsword are ok -> Accept otherwise Reject Check user in radgroupcheck -> for allowed SSID there would be group with no reply action -> if no match last group (highest priority) would be Reject which would be always matched. Yes solution proposed by you looks straightforward and would probably work but I have no idea where I should put that condition and I'm afraid that if I'd go this direction it would bring more questions than answers. Thanks for help -- "Martin Bednar"

2 2