- Freeradius-Users - lists.freeradius.org

Binding MAC address with username
by Alexandre Croteau 21 Dec '16

21 Dec '16

Hello, For my setup, I'd like to bind a MAC address to a specific user when it first login. For exemple, user 1 connects from computer 00:11:22:33:44:55. I'd like the system to remember this MAC address, so that the next time the user reuses this same computer, it does not asks to connect again. This way, the users would rather be the mac addresses. Another solution I think would be to store the MAC address as a new user in the same group as user 1. Which way would be the best? Thanks, Acrilex

3 5

FreeRADIUS 3.0.12: SQL xlat return back-quoted value in response
by Alexey Dotsenko 21 Dec '16

21 Dec '16

Hello! Test environment: Centos 7 (x86_64), FreeRADIUS 3.0.12 - rpm build from upstream source 3.0.12 (based on fedoraproject spec file (without code patches)). MariaDB [radius]> select * from radgroupreply; +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ | id | groupname | attribute | op | value | +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ | 3 | ras | cisco-avpair | += | ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224 | | 12 | ras | cisco-avpair | += | ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224 | | 14 | ras | Fall-Through | := | Yes | | 29 | ras | Cisco-AVPair | += | `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` | +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ 4 rows in set (0.00 sec) Back-quoted string (id 29 in radgroupreply) exlat-ed properly, but remains (in response) back-quoted (and as a result, rejected by nas): Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Group "ras": Merging reply items Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Fall-Through := Yes Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "`ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l`" Tue Dec 20 11:37:46 2016 : Debug: `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` Tue Dec 20 11:37:46 2016 : Debug: Parsed xlat tree: Tue Dec 20 11:37:46 2016 : Debug: literal --> `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP- Tue Dec 20 11:37:46 2016 : Debug: if { Tue Dec 20 11:37:46 2016 : Debug: attribute --> SQL-Group Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: else { Tue Dec 20 11:37:46 2016 : Debug: if { Tue Dec 20 11:37:46 2016 : Debug: attribute --> User-Name Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: else { Tue Dec 20 11:37:46 2016 : Debug: literal --> None Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: literal --> - Tue Dec 20 11:37:46 2016 : Debug: percent --> l Tue Dec 20 11:37:46 2016 : Debug: literal --> ` Tue Dec 20 11:37:46 2016 : Debug: (1) sql: EXPAND `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` Tue Dec 20 11:37:46 2016 : Debug: (1) sql: --> `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482223066` ... Tue Dec 20 11:37:47 2016 : Debug: (1) Sent Access-Accept Id 191 from 172.18.200.21:1812 to 172.18.200.2:48332 length 0 Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "`ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482223066`" Tue Dec 20 11:37:47 2016 : Debug: (1) Reply-Message = "privacyIDEA access granted" Tue Dec 20 11:37:47 2016 : Debug: (1) Finished request I looked at the source code of the module rlm_sql (sql.c, function sql_fr_pair_list_afrom_str) - back-quoted string marked for xlat and remains in quotes. I tried to change this behavior - take the value for xlat without quotes: diff -ru freeradius-server-3.0.12.orig/src/modules/rlm_sql/sql.c freeradius-server-3.0.12/src/modules/rlm_sql/sql.c --- freeradius-server-3.0.12.orig/src/modules/rlm_sql/sql.c 2016-09-29 18:19:48.000000000 +0300 +++ freeradius-server-3.0.12/src/modules/rlm_sql/sql.c 2016-12-20 11:44:37.001299860 +0300 @@ -168,16 +168,13 @@ break; /* - * Mark the pair to be allocated later. + * Take the unquoted string and mark the pair to be allocated later. */ case T_BACK_QUOTED_STRING: do_xlat = 1; - /* FALL-THROUGH */ - - /* - * Keep the original string. - */ + value = buf; + break; default: value = row[3]; break; in this case, xlat-ed string return unquoted: Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Group "ras": Merging reply items Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Fall-Through := Yes Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l" Tue Dec 20 11:59:27 2016 : Debug: ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l Tue Dec 20 11:59:27 2016 : Debug: Parsed xlat tree: Tue Dec 20 11:59:27 2016 : Debug: literal --> ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP- Tue Dec 20 11:59:27 2016 : Debug: if { Tue Dec 20 11:59:27 2016 : Debug: attribute --> SQL-Group Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: else { Tue Dec 20 11:59:27 2016 : Debug: if { Tue Dec 20 11:59:27 2016 : Debug: attribute --> User-Name Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: else { Tue Dec 20 11:59:27 2016 : Debug: literal --> None Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: literal --> - Tue Dec 20 11:59:27 2016 : Debug: percent --> l Tue Dec 20 11:59:27 2016 : Debug: (1) sql: EXPAND ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l Tue Dec 20 11:59:27 2016 : Debug: (1) sql: --> ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482224367 ... Tue Dec 20 11:59:28 2016 : Debug: (1) Sent Access-Accept Id 120 from 172.18.200.21:1812 to 172.18.200.2:57555 length 0 Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482224367" Tue Dec 20 11:59:28 2016 : Debug: (1) Reply-Message = "privacyIDEA access granted" Tue Dec 20 11:59:28 2016 : Debug: (1) Finished request Do I understand correctly that the removal of quotes should not do later - in the xlat code area? Best regards, Alex Dotsenko.

4 5

CoA -> REST
by adrian.p.smith＠bt.com 21 Dec '16

21 Dec '16

Please can someone say whether it's possible to receive a CoA and pass that into the REST module? I tried a simple configuration using 3.0.11 and got a startup error: /home/adrian/freeradius-server-3.0.11/etc/raddb/sites-enabled/coa[38]: "rest" modules aren't allowed in 'recv-coa' sections -- they have no such method. /home/adrian/freeradius-server-3.0.11/etc/raddb/sites-enabled/coa[23]: Errors parsing recv-coa section. We use the REST module quite extensively for auth and acct requests and would like to do similar for coa. Thanks, Adrian Smith

4 19

Re: Freeradius-Users Digest, Vol 140, Issue 39
by firing neurons 21 Dec '16

21 Dec '16

It was because Tmp-Integer-0 was used insted of Tmp-String-0. Using Tmp-String-0 now and there is no overflow. Still wondering about how to send gigawords reply attribute from sqlcounter. Message: 7 Date: Wed, 21 Dec 2016 01:32:51 +0100 From: "firing neurons" <firingneurons(a)mail.com> To: freeradius-users(a)lists.freeradius.org Subject: attribute overflow from sql query in unlang Message-ID: <trinity-89ec53bc-81a7-4948-9c3c-bd47e9d99221-1482280371811@3capp-mailc om-lxa09> Content-Type: text/plain; charset="UTF-8" Hi, The debug logs are(emphasis added): (6) Executing select query: SELECT (SUM(acctoutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='test' AND Year(acctstarttime) = (Year(NOW())) rlm_sql (sql): Released connection (6) (6) EXPAND %{sql: SELECT (SUM(acc toutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='%{User-Name}' AND Year(acctstarttime) = (Year(NOW())) } (6) --> 241450422693 (6) Tmp-Integer-0 := 932254117 (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (7) (6) Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released connection (7) (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (6) Executing select query: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='4Mbps_YR_225GB' rlm_sql (sql): Released connection (4) (6) EXPAND %{sql: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='%{sql: SELECT groupname FROM radusergroup WHERE username = '%{User-Name}' ORDER BY priority}'} (6) --> 241591910400 (6) Tmp-String-1 := 241591910400 (6) } # update control = noop Why is their an overflow in the first case? I am using radius3 The same query is used by the relevant sqlcounter module and it works as expected and doesn't overflow. I am trying to send CoA disconnect to the NAS after the user exhuasts their data with sql and unlang logic in accounting section. I also tried simply using the reply attribute Mikrotik-Total-Limit but the the NAS also expected Mikrotik-Total-Limit-Gigawords. The sqlcounter I made simply sent overflown value in Mikrotik-Total-Limit and hence lmit of more than 4Gb couldn't be enforced. Any way I can send the extra reply attribute from the sqlcounter? ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See [1]http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 140, Issue 39 ************************************************* References 1. http://www.freeradius.org/list/users.html

1 0

attribute overflow from sql query in unlang
by firing neurons 21 Dec '16

21 Dec '16

Hi, The debug logs are(emphasis added): (6) Executing select query: SELECT (SUM(acctoutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='test' AND Year(acctstarttime) = (Year(NOW())) rlm_sql (sql): Released connection (6) (6) EXPAND %{sql: SELECT (SUM(acc toutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='%{User-Name}' AND Year(acctstarttime) = (Year(NOW())) } (6) --> 241450422693 (6) Tmp-Integer-0 := 932254117 (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (7) (6) Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released connection (7) (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (6) Executing select query: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='4Mbps_YR_225GB' rlm_sql (sql): Released connection (4) (6) EXPAND %{sql: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='%{sql: SELECT groupname FROM radusergroup WHERE username = '%{User-Name}' ORDER BY priority}'} (6) --> 241591910400 (6) Tmp-String-1 := 241591910400 (6) } # update control = noop Why is their an overflow in the first case? I am using radius3 The same query is used by the relevant sqlcounter module and it works as expected and doesn't overflow. I am trying to send CoA disconnect to the NAS after the user exhuasts their data with sql and unlang logic in accounting section. I also tried simply using the reply attribute Mikrotik-Total-Limit but the the NAS also expected Mikrotik-Total-Limit-Gigawords. The sqlcounter I made simply sent overflown value in Mikrotik-Total-Limit and hence lmit of more than 4Gb couldn't be enforced. Any way I can send the extra reply attribute from the sqlcounter?

2 1

(no subject)
by Matteo Vocale 20 Dec '16

20 Dec '16

Inviato con AquaMail per Android http://www.aqua-mail.com

1 0

Anyone built FR 3.0.12 pon OS X 10.10 ?
by Alex Sharaz 20 Dec '16

20 Dec '16

What's the best way to install stuff such as the taloc library? A

3 4

Cross platform secure login on wpa2
by Henti Smith 20 Dec '16

20 Dec '16

Good day all. We currently have a wpapsk wifi managed by ubiquiti unif-fi. i'm in the process of trying to move this over to a WPA2-Enterprise setup using kerberos as authentication. I used Alans the guide on http://deployingradius.com/ to get PAP and EAP working with my current certs using a local user. Next I used the Edoroam freeradius for auth against kerberos guide on https://www.eduroam.us/node/90 to setup kerberos authentication. Now this is where things go south. With a test user in users, EAP is working fine. I can auth using ./rad_eap_test -H localhost -S testing123 -u kerberos-test -p secret -P 1812 -e PEAP -m WPA-EAP However if I remove the local user and add "DEFAULT Auth-Type = Kerberos" it stops working. When I then test without EAP, using radtest kerberos-test secret localhost 0 testing123 It's working. So I can get EAP working with local users, and kerberos without EAP. What am I missing or not getting about getting them to work together to allow users to log into the wireless with existing user/pass but encrypted ? Regards Henti -- --

7 18

Regarding RADIUS Authentication feature Implementation over TLS
by Javed 20 Dec '16

20 Dec '16

Hello All, I would like to let me know about my requirement first. We have a project running under RADIUS under UDP that means we have an existing architecture and APIs to support all the user authentication to RADIUS server via PAP and CHAP under UDP. We are running on top of FreeBSD OS. We have used PAM module to do and implement the same. Requirement: We need the same authentication to happen over a secure network where we need to implement RADIUS TCP/TLS .I need to change my client configuration and required code changes has to be done to adapt with RADIUS server which supports RADIUS over TLS. Queries: Is there anywhere I can find Client side program for FreeRadius which supports TLS? Is the existing PAM module any version supports RADIUS over TLS? If You have any suggestion for client configuration and file changes in order to adapt RADIUS over TLS,You may share. Your reply will be much appreciated. Thanks & Regards, Javed Akhtar Technical Lead <mailto:jaakhtar@cisco.com> jaakhtar(a)cisco.com Tel: Cisco Systems, Inc. India cisco.com Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please <http://www.cisco.com/web/about/doing_business/legal/cri/index.html> click here for Company Registration Information.

3 4

EAP-TLS with Client Cert, with Key Usage "EAP over Lan"
by Dominik.A.Schorpp＠ids.de 19 Dec '16

19 Dec '16

Hello, I have trouble to get 802.1x Authentication with EAP-TLS properly running. My Setup is the following: Server: FreeRADIUS Version 2.2.5, for host i586-pc-linux-gnu, built on Oct 24 2014 at 04:18:43 Switch: A NEXANS iSwitch G 1043E Client/Device: Yocto based Linux with wpa_supplicant v2.4 My Problem is the usage of the "X509v3 Extendend Key Usage" in the Certificate of the Client. If I use at the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, TLS Web Client Authentication" the 802.1x Authentication with EAP-TLS is running Fine. BUT I have the constrain that the Certificate on the Client is without "TLS Web Client Authentication" because there running absolute no Client Applications, the Device is running only some Server Applications. So I tried to Use on the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, EAP over Lan". But unfortunately the 802.1x Authentication with EAP-TLS did not work. The relevant debug Output (freeradius -X) I think is the following -------------------------CUT------------------------- Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 056b], Certificate --> verify error:num=26:unsupported certificate purpose [tls] >>> TLS 1.0 Alert [length 0002], fatal unsupported_certificate TLS Alert write:fatal:unsupported certificate TLS_accept: error in error rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Login incorrect (unsupported certificate purpose): [<----->] (from client 172.23.10.172 port 3 cli 00-12-AD-00-0E-F5) Using Post-Auth-Type REJECT -------------------------CUT------------------------- I also tried using Certificates with "X509v3 Extended Key Usage" : "TLS Web Server Authentication" and "X509v3 Extended Key Usage" : " EAP over Lan" only, but the Result are the Same. My Question is know which "X509v3 Extended Key Usage" are mandatory for the Certificate on the Device? And why is it not enough that the "X509v3 Extended Key Usage" has "EAP over LAN" in it? Thanks for Help Dominik ************************************* Dipl.-Ing. (FH) Dominik Andreas Schorpp Hard und Softwareentwickler Embedded Geräte IDS GmbH E-FW - Entwicklung Ferwirktechnik Nobelstr. 18 D-76275 Ettlingen T +49 (0) 72 43/2 18-618 F +49 (0) 72 43/2 18-100 <mailto:dominik.a.schorpp@ids.de> http://www.ids.de Geschäftsführer: Harald Herrmann, Jörn Fischer, Michael Schambach Sitz der Gesellschaft: Ettlingen Amtsgericht Mannheim HRB 362503 Ein Unternehmen der IDS-Gruppe *************************************

3 4