- Freeradius-Users - lists.freeradius.org

radius authentication query not rejecting AUTH
by Amardeep Singh 08 Jun '16

08 Jun '16

Hi, Greetings. Hope you all are doing great! Following is the authentication query that I am using :- if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' \ and vlan_id regexp '[[:<:]]%{NAS-Port}[[:>:]]'}" } if (&Tmp-String-0) { update request { Tmp-String-1 := "%{sql:update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } } Also tried if (&Tmp-String-0 != "") { in the above query. The initial record that we have in the table is a follows :- mysql> select * from raduserzone; +----+---------+-------------------+---------+-------------------+ | id | site_id | mac_address | vlan_id | radius_group_name | +----+---------+-------------------+---------+-------------------+ | 1 | 100051 | 78-9E-D0-31-29-7E | 77,678 | 78-9E-D0-31-29-7E | +----+---------+-------------------+---------+-------------------+ Now when we try to switch the SSID to Guest space (VLAN_ID = 93) , the authentication query(above) did not seem to work as expected and it returns true every time we switch irrespective of the record in the raduserzone table. I have attached the debug logs file. On line 267 it says 'SQL query did not return any results' but still it updates the radusergroup table with a null value resulting in successfull AUTH on radius. It is not rejecting the AUTH somehow. Please suggest! I have already checked the mysql logs and the queries are working fine, if ran manually. Thanks

2 5

Config hints for providing list of groups in post-auth?
by Mike Ely 07 Jun '16

07 Jun '16

Hello list: I have a 3.0.4 machine successfully authenticating against Active Directory. For the use case I have in mind I'd like to have the Freeradius server add into post-auth something like: Group-Name:= "Domain Users", Group-Name+= "All Staff", etc. The idea here is that the NAS will be able to make its own decisions about what to grant based on group membership once radius has authenticated the user. I can parse the group list easily enough from the shell, but don't know how to get this into post-auth. Also, is Group-Name the best choice here or should I be using another attribute? Thanks greatly, Mike

2 9

Non-ascii username and linelog
by Jean-Marc TÊTU 07 Jun '16

07 Jun '16

Hello, First : sorry for my very bad English... We run a Freeradius 3.0.11 on an ubuntu 14.04. And il seems that one of our students find the way to put KO our server. He tries to authenticate with a user-name in non ASCII and freeradius crash on the write ( in linelog module ) of %{User-Name} linelog { .... messages { default = "Unknown packet type %{Packet-Type}" Access-Accept = "%D:%H:%G : Accept : %{User-Name} : %{Calling-Station-Id} : %{NAS-IP-Address} : %{Called-Station-Id}" Access-Reject = "%D:%H:%G : Reject : %{User-Name} : %{Calling-Station-Id} : %{NAS-IP-Address} : %{Called-Station-Id}" } ... } The user-name seem to be a UTF-8 Unicode text. I isolate the guilty string in a file (wke) : hexdump -C wke 00000000 ef bd 97 ef bd 8b ef bd 85 0a |..........| 0000000a cat wke ｗｋｅ I reproduce the problem with the initial example of configuration for freeradius modified for use of linelog (in post-auth section) , the (partial) result of radiusd -X : Ready to process requests (1) Received Access-Request Id 34 from 127.0.0.1:43956 to 127.0.0.1:1812 length 79 (1) User-Name = "ｗｋｅ" (1) User-Password = "hello" (1) NAS-IP-Address = 127.0.1.1 (1) NAS-Port = 0 (1) Message-Authenticator = 0x6bbba1a108aee843ee5c78a8efcf4788 (1) # Executing section authorize from file /usr/local/FR3011/etc/raddb//sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (!&User-Name) { (1) if (!&User-Name) -> FALSE (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@.*@/ ) { (1) if (&User-Name =~ /@.*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "ｗｋｅ", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/FR3011/etc/raddb//sites-enabled/default (1) Post-Auth-Type REJECT { (1) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (1) linelog: --> messages.Access-Reject (1) linelog: EXPAND /usr/local/FR3011/var/log/radius/linelog (1) linelog: --> /usr/local/FR3011/var/log/radius/linelog with this configuration : # Loading module "linelog" from file /usr/local/FR3011/etc/raddb//mods-enabled/linelog linelog { filename = "/usr/local/FR3011/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } If somebody have an idea.... And thanks to have read this very long text (in an incorrect english)..... -- -- Cordialement, Jean-Marc Têtu -------------------------------------------------------------- Jean-Marc Têtu, Direction Informatique et Système d'Information Tel : 02 29 00 10 87, Email: jm.tetu(a)telecom-bretagne.eu Institut Mines-Télécom - TELECOM Bretagne Pointe du Diable CS 83818 29238 BREST CEDEX 3 --------------------------------------------------------------

2 2

compile pam_radius_auth on AIX 6.1
by Rupesh Basnet 07 Jun '16

07 Jun '16

Hi All, I am trying to compile pam_radius_auth on AIX 6.1 but I am unknown where to start with. And I am not able to relevant document of AIX to configure PAM as well. Please help me to proceed further. Regards, Rupesh Basnet

2 1

RE: Freeradius-Users Digest, Vol 134, Issue 11
by Shawn Wilson 06 Jun '16

06 Jun '16

Hi Alan, thanks for replying. I will try to provide some clarification: >> Then I can pass the domain to the ntlm_auth command by using the "-domain=%{realm}" parameter. Everything works fine as long User->Name is in the format <username>@<my.domain.name>. >> >> HOWEVER, the big problem I'm encountering is that we need users to authenticate via alternate UPN suffixes. It turns out Ntlm_auth will not authenticate against these suffixes, only the actual domain names. >> > What does that mean? "actual domain name" ? The "actual domain name" is the active directory domain name that was used when the AD domain was originally created. Microsoft allows you to create "alternate UPN suffixes" which are like aliases for the domain (e.g. like this http://www.tutorialspoint.com/articles/adding-alternate-upn-suffix-to-activ…) The ntlm_auth command will not authenticate against alternate active directory UPN You must use the original active directory domain name. I realize this is not a freeradius problem but a Samba problem. Still, I was wondering if there was an elegant way to configure freeradius to work around this limitation. For the time being, I did a brutal hack to get it to work: >From /etc/freeradius/modules/mschap: ---- SNIP ---- # Choose the right AD domain to authenticate against. ntlm_auth = "/usr/local/bin/ntlm_auth_UPN %{%{Stripped-User-Name}:-%{%{User-Name}:-None}} %{realm} %{%{mschap:Challenge}:-00} %%{mschap:NT-Response}:-00}" ---- SNIP ---- Contents of /usr/local/bin/ntlm_auth_UPN: -------- #!/bin/sh # This script is a workaround to deal w/ the fact that the ntlm_auth # command does not authenticate properly using alternate UPN suffixes # in active directory domains. It is hardcoded to fix the domain. # USERNAME=$1 DOMAIN=$2 CHALLENGE=$3 NT_RESPONSE=$4 # Rewrite the suffix for office employees. if [ "${DOMAIN}" = "boguscorp.org" ] ; then # Set the AD domain we need to login to. DOMAIN="office.users.big-ugly-domain.local" Fi # Rewrite the suffix for students. if [ "${DOMAIN}" = "bcstudents.org" ] ; then # Set the AD domain we need to login to. DOMAIN="student.users.big-ugly-domain.local" Fi exec /usr/bin/ntlm_auth --request-nt-key --username=${USERNAME} --domain=${DOMAIN} --challenge=${CHALLENGE} --nt-response=${NT_RESPONSE} --------

3 2

upgrade from v1 to v3 L2TP issues
by Andy Smith 06 Jun '16

06 Jun '16

Hi list, I've just upgraded a freeradius v1.1.8 server with MySQL DB to 3.0.11. I didn't install or configure the original and haven't used freeradius previously so its been a steep learning curve. I've now got the server to a point where it seems to all work on the server side, we are testing via NTRadPing and we get a successful authentication logged on the server and in NTRadPing. However when we try and use Radius for real with a Cisco device doing authentication for L2TP something is failing. This is what my colleague who runs the network told me having looking at the debug info on the router side: "PPP comes up and then the router tries to get an IP address. This messages 0.0.0.0 there is no address and request the local router to provide it. So basically it's not getting an address from the radius server" When we test with NTRadPing we noticed that the output is slightly different if we authenticate against the v1 or v3 radius server: radius 1 - not working Framed-IP-Address=93.10.10.10 vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback 2003\0x0a Service-Type=Framed Tunnel-Medium-Type=IP Tunnel-Type=L2TP Tunnel-Password=\0x00\0x85K\0x97\0xd5jk\0x0b\0xefbN\0xac\0x12y\0x80.\0xda\0xb3\0xb1 Tunnel-Server-Endpoint=178.248.104.124 Tunnel-Client-Auth-ID=broadband-3 radius 2 - working (differences in red) Framed-IP-Address=93.10.10.10 vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback 2003\n Service-Type=Framed Tunnel-Medium-Type=IP Tunnel-Type=L2TP Tunnel-Password=\0x00\0xb0}=G\0xe7\0xe4\0x08\0xd1\\0xe4\0xax;\0x0d?\0x15\0xe4\0x8f\0xfe Tunnel-Server-Endpoint=178.248.104.124 Tunnel-Client-Auth-ID=broadband-3 could this be related to our issue? Noticing the line return is different on the avpair line and the password is different, its stored in clear text in the DB. Currently a bit stumped. Can pass on the output of radiusd -X if the above isn't the key to the problem, thanks, Andy.

3 6

Multiple Database
by Oscar Jofre 05 Jun '16

05 Jun '16

Hi, At the moment Im using freeradius 3.0.10 to identify hotspot users from over 400 mikrotiks. Its working fins but because all the routers are behind NAT IPS providers some of them uses the same local IP (nasipaddress). Im trying to change this creating VPN tunnels from mikrotik to radius server and assign unique IP to each hotspot mikrotik. I will identify this VPN clients throw radius as well. I dont want to use the same database from hotspot users and VPN-routers so I will create a new database and change configuration to setup freeradius to use 2 database. I will change on /mods-available/sql.conf to use sql hotspotdb {..} and sql vpndb {..} and pointing each one to a different database. For the moment I only want to use vpndb to authentificate not accounting So on sites-available/default I should change sql to hotspotdb and vpndb. Here are my questions. 1) Ive seen on sites-available/default authorize section sql, here is where I have to change to hotspotdb vpndb ? 2) On the other sections a have to change from sql à to hotspotdb .. anywhere else ? 3) This is most important how works authorization: When trying to authorize always check both databases ? Or if the first database return ok then doesnt query the second one. The best option will be with ULANG that Im not really familiarized with how I can know if a auth query comes to query a hotspot user or a VPN user .. maybe with nasipaddress or framedipaddress So what I should write on authorize section: If {% nasipaddress ?? } then - hotspotdb Else vpndb End if Thanks a lot !

2 1

make use of external DHCP server or ip address provisioning
by Rene Stoutjesdijk 05 Jun '16

05 Jun '16

Hello, i do have a question (my first on this list) or described situation below is possible, and if yes can somebody provide me tips how to do the freeradius part. I do have a freeradius daemon up and running with only authentication and accounting. I would like to change the setup that also ip address are provided (via the AVP Framed-IP-Address) towards the client. This seems to be possible, but i would like to get the ip address from an external DHCP server. So basically what i would like to achieve is: if authentication request comes in: - let the radius daemon do a request for an ip address from an external dhcp server with the following characteristics - the client mac address should contain the IMSI/MSISDN from the subscriber (request is coming from a GGSN (mobile network)) so doesn't contain a valid client mac address - the username AVP should be used as (i think option 61) within DHCP so it can also be used with the DHCP/DNS integration for name resolving (DDNS) - if the ip address is provided towards the free radius daemon, take this ip address and provide it back within the framed-ip-addres AVP towards the radius client (GGSN) I do have maybe an alternative and that's provide the ip address from the free radius daemon and execute a nsupdate update script to update the DNS, but i think the above described situation is better. thx in advance for your response.

2 2

ntlm_auth and UPN suffix for user-name
by Shawn Wilson 04 Jun '16

04 Jun '16

Hi, I'm trying to configure freeradius 2.x to authenticate users against 3 different domains in an active directory forest. Currently, I have the the proxy.conf file configure for each realm like so: realm domain.name { auth_pool = my_auth_failover } realm sub1.domain.name { auth_pool = my_auth_failover } realm sub2.domain.name { auth_pool = my_auth_failover } Then I can pass the domain to the ntlm_auth command by using the "-domain=%{realm}" parameter. Everything works fine as long User-Name is in the format <username>@<my.domain.name>. HOWEVER, the big problem I'm encountering is that we need users to authenticate via alternate UPN suffixes. It turns out Ntlm_auth will not authenticate against these suffixes, only the actual domain names. Soooo, my question is: How can I change the UPN suffixes to their corresponding domain names? I tried using preprocess and the hints file configured like this: DEFAULT User-Name =~ "^([^@]+)@upnsuffix1.name" User-Name := %{1}(a)domain.name<mailto:%25%7b1%7d@domain.name> But that seemed to break EAP because it detected that the user-name changed. Any help would be greatly appreciated, Shawn

2 1

Adding CUI support while NAS is not supporting it
by Anuruddha Premalal 04 Jun '16

04 Jun '16

Hi All, I have a setup as shown in the below figure (CUIissue.jpg) At step 3. the proxy AAA add the CUI to the radius access packet.and step 4 forward it unmodified to the NAS. NAS is supposed to send the CUI with the radius accounting requests, however the NAS is not supporting that and dropping the cui value. I read about the cui support in freeradius however it seems to be used in generating a new one and adding to the packet. In this case I need to add the CUI receiving from the proxy AAA to the accounting packets coming from the NAS. I could record the received CUI at step 3 and add that value to the accounting packet at pre-proxy stage 5>6, however the challenge is to find a correlation between the packets. Has anyone came across such a use-case and were there any solutions available? Appreciate your comments. Thanks and Regards, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>Sri Lanka.*

2 1