- Freeradius-Users - lists.freeradius.org

Referencing LDAP/AD attributes in post-auth section
by Stefano Pardini 04 Aug '16

04 Aug '16

I'm sorry for asking such a simple thing but I can't find any reference for FreeRadius3. I have been successfully using this functionality in Freeardius2, in the same manner as reported here: http://freeradius-users.freeradius.narkive.com/k46qBmbs/referencing-ldap-at… I've created a new ldap module inside mods-available/ldap to extract a specific ldap attribute (macAddress) from a specific ldap location ad reported here in rlm_ldap module documentation. ldap ldap_mac_auth { server = 'samba4.server.mynet.lan' identity = 'cn=administrator,cn=Users,dc=ad,dc=mynet,dc=lan' password = p4ss base_dn = 'ou=WiFi,ou=Computers,ou=MyNet,dc=ad,dc=mynet,dc=lan' update { reply:macAddress := 'macAddress' } user { base_dn = "${..base_dn}" filter = "(&(objectClass=computer)(managedBy=%{control:Ldap-UserDn}))" } } Then i'm calling it inside the authorize section of the default server. authorize { .. ldap ldap_mac_auth .. } In the post-auth section of the default server i'm applying the following control. post-auth { .. if ( "%{reply:macAddress}" == "%{Calling-Station-Id}" ) { update reply { Tunnel-Private-Group-Id := 43 Tunnel-Medium-Type := "IEEE-802" Tunnel-Type := "VLAN" } } .. } Inside the dictionary file I've added the reference to that variable. ATTRIBUTE macAddress 3000 string During the authentication process I can see the ldap_auth_mac module running. (2) ldap_mac_auth: EXPAND (&(objectClass=computer)(managedBy=%{control:Ldap-UserDn})) (2) ldap_mac_auth: --> (&(objectClass=computer)(managedBy=CN\3dTest User\2cOU\3dStaff\2cOU\3dUsers\2cOU\3dMyNet\2cDC\3dad\2cDC\3dmynet\2cDC\3dlan)) (2) ldap_mac_auth: Performing search in "ou=WiFi,ou=Computers,ou=MyNet,dc=ad,dc=mynet,dc=lan" with filter "(&(objectClass=computer)(managedBy=CN\3dTest User\2cOU\3dStaff\2cOU\3dUsers\2cOU\3dMyNet\2cDC\3dad\2cDC\3dmynet\2cDC\3dlan))", scope "sub" (2) ldap_mac_auth: Waiting for search result... (2) ldap_mac_auth: User object found at DN "CN=MyNetbook,OU=WiFi,OU=Computers,OU=MyNet,DC=ad,DC=mynet,DC=lan" (2) ldap_mac_auth: Processing user attributes (2) ldap_mac_auth: reply:macAddress := '13-59-F3-A3-94-00' So, as you see, the macAddress ldap attribute is correctly mapped to the reply:macAddress variable. But at the end of the process, executing the post-auth section, this is the result: (10) post-auth { (10) if ( "%{reply:macAddress}" == "%{Calling-Station-Id}" ) { (10) EXPAND %{reply:macAddress} (10) --> (10) EXPAND %{Calling-Station-Id} (10) --> 13-59-F3-A3-94-00 (10) if ( "%{reply:macAddress}" == "%{Calling-Station-Id}" ) -> FALSE So the variable "reply:macAddress" couldn't correctly expanded. I'm using FreeRADIUS Version 3.0.12. Thanks in advance for your help.

4 4

Multiple Customer Databases
by Oliver Kutscher 03 Aug '16

03 Aug '16

Hi, I'm using freeradius 3.0.4 on a Red Hat Centos 7 and it seems I missed a fundamental point. I have several customers with their own database. I do logging accounting data to sql. My problem is that any accounting data of any customers is logged to any radacct tables. E.g. accounting data of customer1 is logged to (sql) customer1.radacct, but also to customer2.radacct and vise versa. /etc/raddb/mods-enabled/sql: sql customer1 { driver = "rlm_sql_mysql" dialect = "mysql" server = "localhost" port = 3306 login = "radius" password = "ffgfdfdgfdgdg" radius_db = "customer1" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" delete_stale_sessions = yes pool { start = 5 min = 4 max = ${thread[pool].max_servers} spare = 3 uses = 0 lifetime = 0 idle_timeout = 60 } read_clients = yes client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } sql customer2 { driver = "rlm_sql_mysql" dialect = "mysql" server = "localhost" port = 3306 login = "radius" password = "fgfdgdg" radius_db = "customer2" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" delete_stale_sessions = yes pool { start = 5 min = 4 max = ${thread[pool].max_servers} spare = 3 uses = 0 lifetime = 0 idle_timeout = 60 } read_clients = yes client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } ... /etc/raddb/sites-enabled/default: [..] accounting { .. customer1 customer2 .. } Any help would be appreciated. -- MrLINK

3 3

eap: ERROR: Failed continuing EAP PEAP (25) session.
by Stefano Pardini 02 Aug '16

02 Aug '16

Hi guys. I'm authenticating users against Samba4 using Winbindd (PEAP-MSCHAPv2). With radtest everything is working fine; the user information are correctly extracted and the authentication process is successful. I'm now trying to access through a WiFi client. The access point is configured properly and can communicate with the FreeRADIUS server. But I'm encountering the following error (radiusd -X): (8) eap_peap: Continuing EAP-TLS (8) eap_peap: [eaptls verify] = ok (8) eap_peap: Done initial handshake (8) eap_peap: [eaptls process] = ok (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state send tlv success (8) eap_peap: Received EAP-TLV response (8) eap_peap: Client rejected our response. The password is probably incorrect (8) eap_peap: ERROR: We sent a success, but the client did not agree (8) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (8) eap: Sending EAP Failure (code 4) ID 232 length 4 (8) eap: Failed in EAP select (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user I made some tests even with eapol_test, using the EAP-MSCHAPv2 config file reported in http://deployingradius.com: decapsulated EAP packet (code=4 id=8 len=4) from RADIUS server: EAP Failure I'm using the following FreeRADIUS version. radiusd: FreeRADIUS Version 3.0.12 (git #ae2f29c), for host x86_64-unknown-linux-gnu, built on Jul 29 2016 at 11:17:40 FreeRADIUS Version 3.0.12 And the following Samba version (Debian 8.5): 4.2.10. To understand the problem tell me if you need more accurate log. Thanks in advance.

3 6

freeradius-users list test
by miquels＠cistron.nl 01 Aug '16

01 Aug '16

ignore please (sorry).

1 0

Eduroam: Realm NULL in Accounting
by Marcio Luiz Ota 28 Jul '16

28 Jul '16

Hi, its possible some domains autheticated (proxies) hide Realm (Realm NULL) ? In 'Autorize' the User-Name contains @domain... but in 'Accounting' Realm = NULL...

2 4

Using variables
by Marcio Luiz Ota 28 Jul '16

28 Jul '16

I can't use a variable created in the 'Authorize' in 'Accounting'?

2 1

Accounting request duplication check
by rosect190＠yahoo.com 28 Jul '16

28 Jul '16

I recently noticed that the freeradius server checks duplicated requests by comparing length and authenticator. This is fine with authentication request because the Authenticator field in Access-Request is a random number. However, in Accounting-Request, the Authenticator is MD5-hashed with same info, unless length is different (assuming same other attributes info.). If length is the same, this way, there is basically no duplicate packet check. Is my understanding correctly? Thanks for your attention!

2 1

How to integrate leveldb database to FreeRadius-server-2.2.9
by Gengxiang Meng 28 Jul '16

28 Jul '16

Hi all, I porting freeradius-server-2.2.9 to my system, I have a leveldb(https://github.com/google/leveldb) database to manage local users. I check the module support list in source code src\modules, not sure which module I should use to integrate with my leveldb, is it rlm_dbm? (looks like rlm_dbm depend on gdbm, but I don't want to use gdbm to manage my database) Do you already have another module name like "rlm_leveldb"? Thanks your support. Thanks, Ross

2 1

Module Failure Message
by Laura Steynes 28 Jul '16

28 Jul '16

Hi All, I am seeing this in detail logs Module-Failure-Message = "Failed retrieving values required to evaluate condition" This is in response to authorize section entry: if (Calling-Station-Id =~ /^121.32/) { update reply { Reply-Message := "Geographical Access Failure" } reject } Hosts in that range do get the reject, but not the message, many google posts/blogs all seem to point that my entry is correct, it is probably something so obvious that I cant see the trees for the woods. Secondly, I don't want to start a new thread just for this unrelated question so, we have another regional ISP that can auth our customers on their network talking to our radius, do I treat their radius as just another local NAS? They nor us have ever does this before, and when our new poP in yet a third region is built we will proxy to them (through freeradius's proxy conf) longish, maybe I should have started new thread, Sorry :) Loz

5 8

help with rlm_rest module
by Mauricio 27 Jul '16

27 Jul '16

Hello, i have this error when i try to start the service on debian 32 bits. Error: /usr/local/etc/raddb/mods-enabled/rest[1]: Failed to link to module 'rlm_rest': /usr/local/lib/rlm_rest.so: wrong ELF class: ELFCLASS64 any idea how can i solve this ? thanks !

2 1