- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 139, Issue 55
by firing neurons 19 Nov '16

19 Nov '16

I read in mods-available/cache that "The module can cache a fixed set of attributes per key. It can be listed in "authorize", "post-auth", "pre-proxy" and "post-proxy". " This means that I can't update cache inside accounting section and read it back later? Message: 8 Date: Fri, 18 Nov 2016 17:01:42 -0500 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Store a attribute in session-state list till the next interim update? Message-ID: <5F646959-9FB0-4F1B-96CF-E9FDB746CD6A(a)freeradius.org> Content-Type: text/plain; charset="utf-8" > On Nov 18, 2016, at 4:35 PM, firing neurons <firingneurons(a)mail.com> wrote: > > Hi, > > I want to store a Tmp-String-0 attribute in session-state list and > retrive it and use it in a conditional in the next interim update. Can > this be done? Yes, with the cache module. -Arran

1 0

LDAP Group Default
by Albert K 19 Nov '16

19 Nov '16

Hi, I have want to the login user to be authorized according to their user grouping in Microsoft AD and also a catch all default. At the moment I am testing with two DEFAULT. Is it possible to do a Catch all DEFAULT. My example below only catch non hod group. Any help would be much appreciated. Thank you. /users DEFAULT Ldap-Group == "cn=hod,cn=users,dc=smartoptz,dc=com" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "30" DEFAULT Ldap-Group != "cn=hod,cn=users,dc=smartoptz,dc=com" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "40"

5 7

How is User-Name getting into reply?
by Brian Candler 19 Nov '16

19 Nov '16

I don't understand how a User-Name attribute is being added into the *reply* when using EAP. To replicate this, I have the default 3.0.12 config with the "steve" user uncommented, and with radtest it behaves as expected: no User-Name in the reply. But if I exercise this account using eapol_test, I see the outer User-Name attribute is in the Access-Accept: (29) Sent Access-Accept Id 10 from 127.0.0.1:1812 to 127.0.0.1:38985 length 0 (29) MS-MPPE-Recv-Key = 0xb581e1ac47471ad3952989c90595a23d8b851827abebc4089ef09574e9d69246 (29) MS-MPPE-Send-Key = 0x244f2954e441937015fa8aa44a36fc94d3c473fbb86ae9498b93f3524b126d37 (29) EAP-Message = 0x030a0004 (29) Message-Authenticator = 0x00000000000000000000000000000000 (29) User-Name = "anonymous" << HERE And if I uncomment these sections from inner-tunnel: update { &outer.session-state: += &reply: } update outer.session-state { MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY } then the reply has *two* User-Name attributes: (10) Sent Access-Accept Id 10 from 127.0.0.1:1812 to 127.0.0.1:53750 length 0 (10) MS-MPPE-Recv-Key = 0x0bd13ceb1f41f1cd7acbc81339d64f6a5411d5c507153eacefe6f7b51201956c (10) MS-MPPE-Send-Key = 0x619ca77357791b4b88a270e610dd8716cce3faebd7973dc07b18aa2cb625611a (10) EAP-Message = 0x030a0004 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) User-Name = "anonymous" << HERE (10) Service-Type += Framed-User (10) Framed-Protocol += PPP (10) Framed-IP-Address += 172.16.3.33 (10) Framed-IP-Netmask += 255.255.255.0 (10) Framed-Routing += Broadcast-Listen (10) Framed-Filter-Id += "std.ppp" (10) Framed-MTU += 1500 (10) Framed-Compression += Van-Jacobson-TCP-IP (10) User-Name += "steve" << HERE Any clues as to what's going on here? RFC2865 (section 5.44) says that an Access-Accept may only contain 0 or 1 User-Name attributes. I could filter them both out, but I'd like to understand how they are getting there in the first place. Thanks, Brian.

2 1

Store a attribute in session-state list till the next interim update?
by firing neurons 18 Nov '16

18 Nov '16

Hi, I want to store a Tmp-String-0 attribute in session-state list and retrive it and use it in a conditional in the next interim update. Can this be done? FN

2 1

Version 3.0.12 reply:Packet-Type not set to Access-Reject in Post-Auth-Type REJECT section
by Thor Spruyt 18 Nov '16

18 Nov '16

Hi, I stumbled upon a possible issue with v3.0.12 when rejecting a previously accepted user in de post-auth section. Here's my linelog module instance and post-auth section configuration: linelog linelog_auth { filename = ${logdir}/radius.log reference = "%{reply:Packet-Type}" format = "" Access-Accept = "%t : Access-Accept: User-Name=%{User-Name}" Access-Reject = "%t : Access-Reject: User-Name=%{User-Name}" } post-auth { # ACCEPT { reject linelog_auth # } Post-Auth-Type REJECT { linelog_auth } } And here's the debugging output: (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known-good" SSHA-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/raddb/server.conf (0) post-auth { (0) [reject] = reject (0) } # post-auth = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/server.conf (0) Post-Auth-Type REJECT { (0) linelog_auth: EXPAND %{reply:Packet-Type} (0) linelog_auth: --> Access-Accept (0) linelog_auth: EXPAND %t : Access-Accept: User-Name=%{User-Name} (0) linelog_auth: --> Fri Nov 18 15:12:54 2016 : Access-Accept: User-Name=x (0) linelog_auth: EXPAND /var/log/radius/radius.log (0) linelog_auth: --> /var/log/radius/radius.log (0) [linelog_auth] = ok (0) } # Post-Auth-Type REJECT = ok (0) Sent Access-Reject Id 48 from x.x.x.x:1812 to x.x.x.x:1814 length 0 (0) Finished request So using the always reject module in post-auth works to get an Access-Reject at the end. But for some reason, it looks like the reply:Packet-Type is not changed to Access-Reject when entering the Post-Auth-Type REJECT section. Am I forgetting to set something in addition to just "reject" or should the reply:Packet-Type value have been updated when the linelog module is called ? My workaround would be to set reply:Packet-Type in the Post-Auth-Type REJECT section before calling the linelog module. Like so and then it works ok: post-auth { # ACCEPT { reject linelog_auth # } Post-Auth-Type REJECT { update reply { Packet-Type := Access-Reject } linelog_auth } } Would that be a good workaround or are there better workarounds ? -- Regards, Thor

2 2

FreeRadius 3.0.11 and Winbind
by Albert K 18 Nov '16

18 Nov '16

Hi, I am doing a setup has the following criteria. I have setup as per instruction from freeradius wiki but stuck with the Dynamic VLAN part. May I know where can I get further information on Authorization for VLAN setup? Thank you for helping. https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind Existing Setup 1) Windows 2012R2 Acitive Directory Server Proposed Setup 1) Unifi AP-Lite with Unifi Controller 5.2.9, FreeRadius 3.0.11, Samba 4.3 2) WAP-Enterprise with PEAP-MSCHAPv2 3) Dynamic VLAN Assignment by user group

4 8

No TLS 1.2
by David Ward 18 Nov '16

18 Nov '16

We are looking into how to change TLS behavior on radiusd. This is for testing purpose, so I want to intentionally only allow TLS 1.0. Currently running: FreeRADIUS Version 3.0.12. Is there a way to make this version only accept TLS 1.0, right now we are using older 2.x version to test this. -David

3 3

TLS Cache
by Adam Bishop 17 Nov '16

17 Nov '16

Using 3.0.x is it possible to simply test for a resumed/cached session in post-auth? I think I can do it by setting an attribute in the outer virtual server, then checking to see if the inner virtual server modified it or not, but that seems hacky. The end goal is that I'd like to include a value in the linelog config so that I can monitor the effectiveness of the cache, so it gets noticed if a change breaks it. Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

1 0

using groupname in accounting/authorize in deafult
by firing neurons 17 Nov '16

17 Nov '16

Hi, TL;DR: read last 5 lines. I want to use the groupname of the user for which the NAS has sent Access/Accouting-Request or Interim update in a sql query (via xlat) in default. I have tired groupname='%{Group}' groupname='%{Sql-Group}' (this should be the one i think) groupname='%{Group-name}' but it always resolves to '' (empty) like the attributes doesn't exist. doing Tmp-String-0 := "%{sql: SELECT groupname FROM radusergroup WHERE username = '%{User-Name}' ORDER BY priority}" will set Tmp-String-0 to the groupname but when i try to use it in another query like groupname='%{Tmp-String-0}', it resovles to '' (empty). Basically I want this to happen: for two groups named abc and abc_ex with the same attribute name having diffrent vaules of said attribute: groupname = '%{Sql-Group}_Ex' resolves to groupname = abc_ex and groupname = '%{Sql-Group}' resolves to groupname = abc Regards, FN

1 0

Skip policy check if there is no outer request
by Adam Bishop 16 Nov '16

16 Nov '16

I'm using the 'filter_inner_identity' policy to check if a user is trying to do nasty things with their outer/inner id's. However, it has the side effect of preventing me from doing such things. I can whitelist the NAI easily enough, but for this situation I can rely on there not being an outer request (I'm poking the inner-tunnel port directly with radclient). Can I test for the existence of an outer request using unlang? Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

2 2