- Freeradius-Users - lists.freeradius.org

hello
by Roberto Rios 15 Aug '16

15 Aug '16

hi. I have a fresh install of freeradius on Centos7. I have been trying to connect via ldap to active directory for a few days now, but I still get this error: . . . . # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap Mon Aug 15 10:54:30 2016 : Debug: ldap { Mon Aug 15 10:54:30 2016 : Debug: server = "xx.xx.xx." Mon Aug 15 10:54:30 2016 : Debug: port = 389 Mon Aug 15 10:54:30 2016 : Debug: password = "xxxxxx2016" Mon Aug 15 10:54:30 2016 : Debug: identity = "cn=xxxxx,dc=xxxxx,dc=xxx" Mon Aug 15 10:54:30 2016 : Debug: user { Mon Aug 15 10:54:30 2016 : Debug: filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" Mon Aug 15 10:54:30 2016 : Debug: scope = "sub" Mon Aug 15 10:54:30 2016 : Debug: base_dn = "xxxxxx,dc=xxx" Mon Aug 15 10:54:30 2016 : Debug: access_positive = yes Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: group { Mon Aug 15 10:54:30 2016 : Debug: filter = "(objectClass=posixGroup)" Mon Aug 15 10:54:30 2016 : Debug: scope = "sub" Mon Aug 15 10:54:30 2016 : Debug: base_dn = "dc=xxxxx,dc=xxx" Mon Aug 15 10:54:30 2016 : Debug: name_attribute = "cn" Mon Aug 15 10:54:30 2016 : Debug: membership_attribute = "memberOf" Mon Aug 15 10:54:30 2016 : Debug: cacheable_name = no Mon Aug 15 10:54:30 2016 : Debug: cacheable_dn = no Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: client { Mon Aug 15 10:54:30 2016 : Debug: filter = "(objectClass=frClient)" Mon Aug 15 10:54:30 2016 : Debug: scope = "sub" Mon Aug 15 10:54:30 2016 : Debug: base_dn = "dc=xxxxxx,dc=xxx" Mon Aug 15 10:54:30 2016 : Debug: attribute { Mon Aug 15 10:54:30 2016 : Debug: identifier = "radiusClientIdentifier" Mon Aug 15 10:54:30 2016 : Debug: shortname = "cn" Mon Aug 15 10:54:30 2016 : Debug: secret = "radiusClientSecret" Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: profile { Mon Aug 15 10:54:30 2016 : Debug: filter = "(&)" Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: options { Mon Aug 15 10:54:30 2016 : Debug: ldap_debug = 40 Mon Aug 15 10:54:30 2016 : Debug: chase_referrals = yes Mon Aug 15 10:54:30 2016 : Debug: rebind = yes Mon Aug 15 10:54:30 2016 : Debug: net_timeout = 1 Mon Aug 15 10:54:30 2016 : Debug: res_timeout = 20 Mon Aug 15 10:54:30 2016 : Debug: srv_timelimit = 20 Mon Aug 15 10:54:30 2016 : Debug: idle = 60 Mon Aug 15 10:54:30 2016 : Debug: probes = 3 Mon Aug 15 10:54:30 2016 : Debug: interval = 3 Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: tls { Mon Aug 15 10:54:30 2016 : Debug: start_tls = no Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Warning: rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 Mon Aug 15 10:54:30 2016 : Info: rlm_ldap: libldap vendor: OpenLDAP version: 20439 Mon Aug 15 10:54:30 2016 : Debug: accounting { Mon Aug 15 10:54:30 2016 : Debug: reference = "%{tolower:type.%{Acct-Status-Type}}" Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: post-auth { Mon Aug 15 10:54:30 2016 : Debug: reference = "." Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): Using local pool section Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): No pool reference found in "ldap.pool" Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): Initialising connection pool Mon Aug 15 10:54:30 2016 : Debug: pool { Mon Aug 15 10:54:30 2016 : Debug: start = 5 Mon Aug 15 10:54:30 2016 : Debug: min = 4 Mon Aug 15 10:54:30 2016 : Debug: max = 32 Mon Aug 15 10:54:30 2016 : Debug: spare = 3 Mon Aug 15 10:54:30 2016 : Debug: uses = 0 Mon Aug 15 10:54:30 2016 : Debug: lifetime = 0 Mon Aug 15 10:54:30 2016 : Debug: cleanup_interval = 30 Mon Aug 15 10:54:30 2016 : Debug: idle_timeout = 60 Mon Aug 15 10:54:30 2016 : Debug: retry_delay = 1 Mon Aug 15 10:54:30 2016 : Debug: spread = no Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Info: rlm_ldap (ldap): Opening additional connection (0) Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): Connecting to xx.x.xx.x:389 Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap: New libldap handle 0x7f4a86f06d20 Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Mon Aug 15 10:54:30 2016 : Error: rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials Mon Aug 15 10:54:30 2016 : Error: rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1. Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap: Closing libldap handle 0x7f4a86f06d20 Mon Aug 15 10:54:30 2016 : Error: rlm_ldap (ldap): Opening connection failed (0) Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): Removing connection pool Mon Aug 15 10:54:30 2016 : Error: /etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap" What I found in google is that it might be a bad pass (52e), but password is correct and account is active.

3 3

FR3 RadSec for Eduroam (esp. Germany & DFN servers)
by Philipp Trenz 15 Aug '16

15 Aug '16

Hi there, my name is Philipp Trenz, I'm student at the University of Applied Science Harz and work there at the datacenter. I'm charged with updating the EDUROAM wifi auth infrastructure and searching for experiences with the RadSec implementation in FreeRadius3 in cooperation with the radius-servers of the German DFN or in general. I heared of different voices. At https://wiki.geant.org/display/H2eduroam/freeradius3-flr it says FR3 can replace third party software like RadSecProxy, but I also heared that the implementation does not work that fine. At the moment it's going to be FreeRADIUS 3.0.4 on a RHEL7.2, but also could go up to the latest stable release, if this would fix issues. I'd be very glad to hear some of your experiences! Best regards, Philipp Trenz

5 13

rlm_smsotp
by Arran Cudbard-Bell 15 Aug '16

15 Aug '16

Is this actually used by anyone, anymore? I hunted pretty hard, but couldn’t find a download link for smsotpd… Seems like it’d be better just to use a rest service for modern deployments. If no one speaks up, i’m going to remove rlm_smsotp from the v4.0.x branch. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2

Running out of file descriptors
by Jens Rantil 15 Aug '16

15 Aug '16

Hi, I've been running 2.1.10+dfsg-3ubuntu0.12.04.2 for ~165 days now on a low-volume machine (~20-30 authentication requests per day). FreeRadius delegates authentication requests to the PAM (which uses Yubico's PAM module). Yesterday, FreeRadius suddenly stopped working. Looking into the issue I noticed that FreeRadius failed to reload configuration with Error: Unable to open file "/etc/freeradius/proxy.conf": Too many open files Inspecting open files for the process showed me there were ~1012 open /dev/urandom: root@tink-auth-vpn-production:/var/log# lsof|grep freerad|grep /dev/urandom|wc -l 1012 Looks like a classic file resource leak. After restarting the process, no new /dev/urandom file resources are open. Making two authentication requests opens up two /dev/urandom. I'm fairly new to FreeRadius. Should I expect /dev/urandom file descriptors to be pooled between requests? Or should they be closed between requests? Anyone with input whether this is a bug in FreeRadius or simply a misconfiguration on my part? Also, let me know if you'd like me to debug this further. Thanks, Jens -- Jens Rantil Backend Developer @ Tink Tink AB, Wallingatan 5, 111 60 Stockholm, Sweden For urgent matters you can reach me at +46-708-84 18 32.

3 3

some helpful articles
by bunkertor 14 Aug '16

14 Aug '16

Dear friend! I've been looking for some information and came across these nice articles, they ma be helpful for you.You may read them here <http://frychyfrovu.americancranesystems.com/oidfvr> Rushing, bunkertor

2 2

disable LDAP referrals not working
by tirili＠web.de 12 Aug '16

12 Aug '16

I have /etc/openldap/ldap.conf TLS_CACERTDIR /etc/openldap/cacerts SASL_NOCANON on URI ldaps://dcdc0011.domain.local:636 ldaps://dcdc0021.domain.local:636 SCOPE one BASE dc=domain,dc=local REFERRALS off Freeradius ldap tells TLS: hostname (DomainDnsZones.domain.local) does not match common name in certificate (dcdc0020.domain.local). TLS: can't connect: TLS: hostname does not match CN in peer certificate. Unable to chase referral "ldaps://DomainDnsZones.domain.local/DC=DomainDnsZones,DC=domain,DC=loc al" (-1: Can't contact LDAP server) TLS: hostname (ForestDnsZones.domain.local) does not match common name in certificate (dcdc0020.domain.local). TLS: can't connect: TLS: hostname does not match CN in peer certificate. Unable to chase referral "ldaps://ForestDnsZones.domain.local/DC=ForestDnsZones,DC=domain,DC=loc al" (-1: Can't contact LDAP server) TLS: hostname (domain.local) does not match common name in certificate (dcdc0011.domain.local). TLS: can't connect: TLS: hostname does not match CN in peer certificate. Unable to chase referral "ldaps://domain.local/CN=Configuration,DC=domain,DC=local" (-1: Can't contact LDAP server) Why is REFERRALS off not taken into account - or how can these chase-referrals being disabled? Thanks for your help in advance T

2 1

EAP-AKA`
by Ravisankar 11 Aug '16

11 Aug '16

Hi, Could anyone please let me know if EAP-AKA and EAP-AKA`( prime) are supported in the latest freeradius version. Thanks, Ravisankar

5 6

Equivalent of Packet-Src-IP-Address for DHCP
by Бен Томпсон 11 Aug '16

11 Aug '16

Hi Everyone I have a DHCP server which listens on multiple interfaces and would like to run the requests thought different bits of unlang depending on the incoming interface. Could anyone advise whether there is a way to get this info from an attributes like we do in RADIUS (e.g Packet-Src-IP-Address). I guess one way to do this would be to configure separate virtual servers, but I just wondered if there was any way to do it using attributes. Thanks Ben

2 2

per instance Ldap-Group attribute does not work
by Oleg Palij 10 Aug '16

10 Aug '16

I'm switching from 2.2.5 to 3.0.12. Users are in Active Directory. I found that per instance Ldap-Group attribute does not work. I simplified working config to: authorize { ldap if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } } authenticate { Auth-Type LDAP { ldap } } post-auth { if !(LDAP-Group == 'vpdn') { update reply { Reply-Message += "no vpdn group" } reject } ... } With default ldap module name it searches in ldap and works as expected: (2) post-auth { (2) if !(LDAP-Group == 'vpdn') { (2) Searching for user in group "vpdn" … (2) User found in group object "...." (2) if !(LDAP-Group == 'vpdn') -> FALSE But as soon as I change default ldap module to named (per instance) one: mods-enabled/ldap: ldap { ... } -> ldap ldapdomain1 { ... } and replace in config 'ldap' with 'ldapdomain1' and 'LDAP-Group' with 'ldapdomain1-LDAP-Group' it stop searching in ldap, stripped debug log: # Loading module "ldapdomain1" from file /etc/freeradius/mods-enabled/ldap ldap ldapdomain1 { ... Creating attribute ldapdomain1-LDAP-Group ... (0) post-auth { (0) if !(ldapdomain1-LDAP-Group == 'vpdn') { (0) if !(ldapdomain1-LDAP-Group == 'vpdn') -> TRUE (0) if !(ldapdomain1-LDAP-Group == 'vpdn') { (0) update reply { (0) Reply-Message += "no vpdn group" (0) } # update reply = noop (0) [reject] = reject (0) } # if !(ldapdomain1-LDAP-Group == 'vpdn') = reject (0) } # post-auth = reject full debug log - https://gist.github.com/paleg/4041dfbfd2bfe997ce5b1e0345b2d232 <https://gist.github.com/paleg/4041dfbfd2bfe997ce5b1e0345b2d232> I was able to obtain the same effect when intend made mistake in named ldap group name. But I double check that registered paircompare name is correct. I tried different cases of lower/upper of ldap group name without success: - ldapdomain1-LDAP-Group (as in sources) - ldapdomain1-Ldap-Group (as in online docs) Could you please explain what I am doing wrong?

2 2

returning user and primary group (or any other ldap attribute) with radius response
by Thomas Schweikle 10 Aug '16

10 Aug '16

Hi! After searching for long with google, or in the manuals, i was not able to find any cookbook recipe to advice freeradius to respond with username and primary group for an authenticated user. The access-point needs this to sort out users into guest or internal networks. So how can I set up freeradius to return username and primary group (or any other ldap attribute) with the OK-response? -- Thomas

2 3