- Freeradius-Users - lists.freeradius.org

freeradius and winbind stop to work
by Victor Hugo dos Santos 21 Jul '16

21 Jul '16

Hello, I have a problem with a freeradius + samba and ntlm authetication. the configuration work very well and without problems for a random period of time, but after 2, 4, 7 days, the freeradius stop to work and only work again if I restart the service (/etc/init.d/freeradius restart). in the same machine, I have a samba file server (connected to a domain) and winbindd service... both still working without problems. I have this packages installed ====================== dpkg -l | egrep '(winb|samba|freeradius)' ii freeradius 2.1.12+dfsg-1.2ubuntu8.1 amd64 high-performance and highly configurable RADIUS server ii freeradius-common 2.1.12+dfsg-1.2ubuntu8.1 all FreeRADIUS common files ii freeradius-utils 2.1.12+dfsg-1.2ubuntu8.1 amd64 FreeRADIUS client utilities ii libfreeradius2 2.1.12+dfsg-1.2ubuntu8.1 amd64 FreeRADIUS shared library ii libnss-winbind:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba nameservice integration plugins ii libwbclient0:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba winbind client library ii python-samba 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Python bindings for Samba ii samba 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 SMB/CIFS file, print, and login server for Unix ii samba-common 2:4.3.9+dfsg-0ubuntu0.14.04.3 all common files used by both the Samba server and client ii samba-common-bin 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba common files used by both the server and the client ii samba-dsdb-modules 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba Directory Services Database ii samba-libs:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba core libraries ii samba-vfs-modules 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba Virtual FileSystem plugins ii winbind 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 service to resolve user and group information from Windows NT servers ====================== on ====================== # cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=14.04 DISTRIB_CODENAME=trusty DISTRIB_DESCRIPTION="Ubuntu 14.04.4 LTS" ====================== and in log file I found this (why the logs dont have the time for default ??) =================================== # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: operador [mschap] Told to do MS-CHAPv2 for operador with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Finished request 788. Going to the next request Thread 4 waiting to be assigned a request Waking up in 0.9 seconds. Thread 5 got semaphore Thread 5 handling request 789, (158 handled so far) [<thread>] # Executing section authorize from file /etc/freeradius/sites-enabled/default [<thread>] +- entering group authorize {...} [<thread>] ++- entering policy filter_hostname {...} [<thread>] +++? if (User-Name =~ /^host/) [<thread>] ? Evaluating (User-Name =~ /^host/) -> FALSE [<thread>] +++? if (User-Name =~ /^host/) -> FALSE [<thread>] ++- policy filter_hostname returns notfound ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "operador", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> operador attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 789 for 1 seconds Going to the next request Thread 5 waiting to be assigned a request Waking up in 0.9 seconds. Waiting to send Access-Reject to client red-gasco port 36995 - ID: 19 Sending delayed reject for request 789 Waking up in 3.9 seconds. =================================== any help or idea ? thanks and attentive -- -- Victor Hugo dos Santos http://www.vhsantos.net Linux Counter #224399

2 1

Accounting additional attributes
by Uwe Freier 21 Jul '16

21 Jul '16

Hello again, for any reason the attributes ADSL-Agent-Circuit-Id und ADSL-Agent-Remote-Id shall be accounted. My NAS sends them with each packet to the radius but there are no columns for them in the table radacct. So in my infinite naivity I simply would add this columns to table radacct and modify the SQL query "accounting_start_query" from /sql/mysql/dialup.conf so that these values are written each time an accounting starts (sure they must be only accounted once per session). Is this a legitime way or is it dangerous to modify the structure of the table radacct for any reason and there is a better way to account additional attributes? Many thanks in advance! Uwe Freier

2 1

Version 3.0.11 Compile Errors
by Wussler, Doug 21 Jul '16

21 Jul '16

I have downloaded the 3.0.11 tarball from freeradius.org and confirmed that I have all "BuildRequires" libraries. My platform is RHEL 7.2. "config.log" looks good but when I run "make" these options result in the following errors: "--with-dhcp=no" CC src/modules/proto_dhcp/dhcpclient.c /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/crt1.o: In function `_start': (.text+0x20): undefined reference to `main' collect2: error: ld returned 1 exit status make: *** [build/bin/local/dhcpclient] Error 1 "--with-tcp=no" CC src/main/client.c src/main/client.c: In function `client_afrom_cs': src/main/client.c:964:6: error: `hs_proto' undeclared (first use in this function) if (hs_proto) { ^ src/main/client.c:964:6: note: each undeclared identifier is reported only once for each function it appears in make: *** [build/objs/src/main/client.lo] Error 1 "--with-ascend-binary=no" CC src/lib/value.c src/lib/value.c: In function `value_data_from_str': src/lib/value.c:654:4: error: label `do_octets' used but not defined goto do_octets; ^ make: *** [build/objs/src/lib/value.lo] Error 1 I would prefer to eliminate unneeded options from the binary. The "--with-vmps=no" option works just fine. Have I done something wrong? Is there anything I can edit to resolve these problems? Doug Wussler Florida State University

4 4

Start up FreeRADIUS without all ldap servers present
by Jonathan Gazeley 21 Jul '16

21 Jul '16

I've configured my FreeRADIUS to use a virtual module 'uobldap' which is a redundant-load-balance set of 3 individual ldap servers. This works reasonably well, with one exception: if you try and start radiusd when one or more of the ldap servers is unavailable, the daemon hangs continuously retrying the connector. Is there a way to make FreeRADIUS start up with a degraded set of ldap connectors? Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

3 3

more limit for user
by تعلم البرمجة 20 Jul '16

20 Jul '16

hello and alsalamo alikom i have array in db array ( 0 { start-Timestamp = 05:30 end-Timestamp = 07:30 Mikrotik-Rate-Limit = 256k/512k } 1 { start-Timestamp = 07:30 end-Timestamp = 09:30 Mikrotik-Rate-Limit = 512k/1024k } ) I want Change Mikrotik-Rate-Limit When Equal any thing of this Values By COA If Freeradius Dosent support Array How I can Do This ? Best Regards

3 3

Multiple ippools and assigning them depending on realms
by Uwe Freier 20 Jul '16

20 Jul '16

Hello, basically I got my freeradius (v 2.1.10, Ubuntu 14.04) working through the documentation but I reached a point where I don't know how to continue and therefore dare to ask for help here. The radius does actually authentication of dial-in users and accounts their traffic. Some users have a static IP as a reply attribute, the others get dynamic IP addresses directly from the MX104 and this works without problems so far. Now the IP assignment should be switched to the radius and the IP addresses shall be assigned depending on the users' realms. The recent users with static IP addresses shall keep them, I hope to reach this with "override = no" in the ippool settings. Therefore I set up 3 ippools (for 3 realms) as described in "Custom configuration" of the docs (-> modules/Rlm_ippool) but I'm not sure about the settings in ./sites-available/default concerning multiple ippools: ### accounting { ... # Return an address to the IP Pool when we see a stop record. # main_ippool ### Should all 3 ippools be listed here? iIppool1 iIppool2 iIppool3 and in the same file: ### post-auth { # Get an address from the IP Pool. # main_pool ### This I don't really understand - is this an alternative to assigning ip addresses via ./users or is this a switch to enable the pool(s) generally? Should I list all ippools here? iIppool1 iIppool2 iIppool3 Because the 3 ippools shall be assigned to users depending on 3 realms, so my ./users at the end looks like: DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP, Framed-IP-Address = 255.255.255.254, Fall-Through = Yes [...] DEFAULT Realm == "realm1", Pool-Name:= ippool1 DEFAULT Realm == "realm2", Pool-Name:= ippool2 DEFAULT Realm == "realm3", Pool-Name:= ippool3 Is this a viable option? I'm a bit confused because In "guide/Ippool and radius clients" there is an example where an ippool is assigned but no Framed-IP-Address: DEFAULT Called-Station-Id == "testdhcpserver", Auth-Type := Accept, Pool-Name := "main_pool" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Isn't the setting "Framed-IP-Address = 255.255.255.254" necessary, can it be left out or assumes this example from the docs that it is already defined as a reply attribute at the users' definitions ? Many thanks in advance, each hint is appreciated! Uwe Freier

2 1

server error in 3.0.11/ unknown column
by Wegener, Norbert 20 Jul '16

20 Jul '16

I have my users in a local mysql database and want to send logs to a central mysql database via sql-relay. This works fine. Now as the central log db uses a radpostauth table with an extended structure compared to the default table available on every radius server installation, I want to provide additional information for the service desk people. Unfortunately, when I change the default post-auth in mods-config/sql/main/mysql/queries.conf from: post-auth { # Write SQL queries to a logfile. This is potentially useful for bulk inserts # when used with the rlm_sql_null driver. # logfile = ${logdir}/post-auth.sql query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, authdate) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%S')" To: post-auth { # Write SQL queries to a logfile. This is potentially useful for bulk inserts # when used with the rlm_sql_null driver. # logfile = ${logdir}/post-auth.sql query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, authdate, nasname, nasipaddress,radiusip,switchtype,machinetype,nasport,modulefailmes,csi,vlan) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%S','%{NAS-Identifier}','%{Client-IP-Address}','${RADIP}','%{request:Virtua l-Server}','%{request:usergroup}','%{NAS-Port-Id}','%{Module-Failure-Message }','%{Calling-Station-Id}','%{control:switchvlan}')" } I get a server error: ... (0) sqldef: --> INSERT INTO radpostauth (username, pass, reply, authdate, nasname, nasipaddress,radiusip,switchtype,machinetype,nasport,modulefailmes,csi,vlan) VALUES ( '000d60d11c1e', '000d60d11c1e', 'Access-Accept', '2016-07-20 07:34:36','','123.45.163.93','sapold','cisco','other','','MAC based auth','','') (0) sqldef: EXPAND /usr/local/freeradius-3.0.11/var/log/radius/post-auth.sql (0) sqldef: --> /usr/local/freeradius-3.0.11/var/log/radius/post-auth.sql (0) sqldef: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate, nasname, nasipaddress,radiusip,switchtype,machinetype,nasport,modulefailmes,csi,vlan) VALUES ( '000d60d11c1e', '000d60d11c1e', 'Access-Accept', '2016-07-20 07:34:36','','123.45.163.93','sapold','cisco','other','','MAC based auth','','') (0) sqldef: ERROR: rlm_sql_mysql: ERROR 1054 (Unknown column 'nasipaddress' in 'field list'): 42S22 (0) sqldef: SQL query returned: server error This could probably be solved by modifying the radpostauth table on every radius server, but this is something I really would like to avoid if possible on production systems. Any other idea? Norbert Wegener

2 1

NTLM hashed passwords.
by Dom Latter 19 Jul '16

19 Jul '16

Hi all, for a couple of years now we have been using freeradius to support a Wifi network. We are using WPA2-Enterprise. We need to support clients running any and every operating system. Currently we store passwords as plain text in a "radcheck" table in the database. I am experimenting with replacing "User-Password" (yes, I know it should be "Cleartext-Password") with an "NT-Password" generated by smbencrypt. So far it seems mostly okay with Windows, Android, iOS and MacOS. And Linux. Are there any pitfalls or gotchas to watch out for? Any systems that only do MSCHAPv1 (which I believe requires the plain text password). thanks dom

4 8

RE: Freeradius-Users Digest, Vol 135, Issue 39
by Peter Hutchison 18 Jul '16

18 Jul '16

>> e.g. >> Mon Jul 18 08:38:00 2016 : Auth : [U1234567(a)hud.ac.uk] (from client roaming0.ja.net port 0 via TLS tunnel). >> Instead of >> Mon Jul 18 08:38:00 2016 : Auth : [U1234567(a)hud.ac.uk] (from client qsa.n2k-mc01 port 0 via TLS tunnel). > umm, the only difference there is the NAS client name >and this doesnt look like linelog - this looks like the default FreeRADIUS log file (in terms of layout and format >- ie /var/log/radius/radius.log or whereever your debian/ubuntu variant logs to/from. >yuor question seems to have a level of confusion with it...the former entry could appear if a user logged in from a remote site (ie >requests came from one of the national proxies). the later would be a local login...in which case what do you currently see? >for custom logging, use line log module, ensure the strings contain the things you need and call it where needed in the config as >required. if you need several types of logging formats, use named modules eg >instead of >linelog { >stuff here >} >do >linelog internal-log { >stuff here >} >and call >internal-log in whichever virtual server you needed that to be called (perhaps eg inner-tunnel post-auth section). I already have a custom linelog module called eduroam-logging with these entries Linelog f_ticks { ... } Linelog eduroam_log { ... } Linelog inner_auth_log { .... } The eduroam_log modules is called from the eduroam site in three places: Accounting Post-auth Post-Auth-Type REJECT If it's using the default logging, how do I stop it from using that? Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Infrastructure Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 1

Machine auth LDAP group checking
by Dave Aldwinckle 18 Jul '16

18 Jul '16

Hi All, I've just successfully configured machine authentication with PEAP. As a final step, I am trying to assign a specific VLAN ID in sites-enabled/default post-auth. The problem I am having is that when I try to use the attribute "ldap.host-LDAP-Group", the LDAP search does not run. If I use "LDAP-Group" the search runs, but the group is not found due to a difference in the filter. I've configured a second instance of the ldap module like so: ldap ldap.host { ... } Then in sites-enabled/default: post-auth { ldap #uncommented if (ldap.host-LDAP-Group == "uw-WiFi-Managed") { update reply { Aruba-User-Vlan := 1025 } } I can see that ldap.host-LDAP-Group is created when the server starts, so I know I'm checking the right attribute. Examples: Using ldap.host-LDAP-Group (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [ldap.host] = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) if (&Realm == "uwaterloo.ca" ) { (9) if (&Realm == "uwaterloo.ca" ) -> FALSE (9) if (&Realm == "host") { (9) if (&Realm == "host") -> TRUE (9) if (&Realm == "host") { (9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") { (9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") -> FALSE (9) } # if (&Realm == "host") = noop (9) } # post-auth = noop (9) Login OK: [host/machine1 Using LDAP-Group (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [ldap.host] = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) if (&Realm == "uwaterloo.ca" ) { (9) if (&Realm == "uwaterloo.ca" ) -> FALSE (9) if (&Realm == "host") { (9) if (&Realm == "host") -> TRUE (9) if (&Realm == "host") { (9) if (LDAP-Group == "uw-WiFi-Managed") { (9) Searching for user in group "uw-WiFi-Managed" rlm_ldap (ldap): Reserved connection (0) (9) EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) (9) --> (samaccountname=machine1) (9) Performing search in "OU=People,dc=domain,dc=uwaterloo,dc=ca" with filter "(samaccountname=machine1)", scope "sub" (9) Waiting for search result... (9) Search returned no results rlm_ldap (ldap): Released connection (0) (9) if (LDAP-Group == "uw-WiFi-Managed") -> FALSE (9) } # if (&Realm == "host") = noop (9) } # post-auth = noop (9) Login OK: [host/machine1 -- Dave Aldwinckle Network Services Information Systems & Technology University of Waterloo (519)-888-4567, x41145

3 4