- Freeradius-Users - lists.freeradius.org

Radius error
by TOURE Amidou Florian 06 May '16

06 May '16

Hi all after installing freeradius on centOS 6.7 I got this errorerror reading /etc/raddb [FAILED : file or directoryHow can I solve this.Thanks

2 1

Virtual server with dedicated database
by Lorenzo Milesi 06 May '16

06 May '16

Hi. I have created a second virtual server on my FreeRADIUS 2.2.9 with a dedicated database, but I'm having troubles with checks. My goal is to have a second port which is identical to the first, same db structure, but separate user base. In sql.conf I modified the standard 'sql' instance and renamed it to 'sql_principale', then created a 'sql_biblioteche' for the second virtual server. In the virtual server I modified all the 'sql' occurrences with the new instance, and the 'default' server with 'sql_principale'. Everything seems to be ok, but I just noticed that restrictions check were not applied anymore. For example Max-Daily-Session was not enforced. So I noticed I didn't replace the sqlmod-inst option in counter.conf. After doing that I realized that this means the same Max-Daily-Session on both virtual server would be checked against the first database only! So, since the sql instance is bonded to the database check, this means I would have to redefine and duplicate all checks for the second database? I'd like to understand if this is the correct way to go, because I'd rather not duplicate and differentiate the attributes between the two servers. Did I miss something in the configuration, or is this the only way to go? thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

2 3

regex in hints file
by Ana Gallardo Gómez 06 May '16

06 May '16

Hello :) Can I use regex in Hints file?? DEFAULT User-Name =~ /^[0-9]/ Thank you very much -- :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::

2 5

Selective disabling of radacct and radpostauth entries for specific users in 3.0.12
by Alex Sharaz 06 May '16

06 May '16

Hi, With FR 2.x I configured stuff so that for locally generated "Health-Check" users I didn't write entries into the back end database. some of these users authenticate every 30 seconds. This worked fine. I've now set up two 3.0.12 servers that write radacctg and radpostauth info into a postgresql back end db. Again everything works fine and I can see appropriate entries in the db tables. What I can't find is where to put my "If auths from this client don't write to the db" clause in my sites-enable directory files. I thought something like if ("%{client:shortname}" != "systems0") { -sql } would work but FR is hanging in there and still writing the users into the db. I should point out that I'm using the "null" sql driver and writing accoiunting and postauth stuff into a text file with radsqlrelay actually doing the job of getting the data into the db. rgds Alex

2 2

FreeRadius - Wifi - Active directory (Eap-Peap-MSCHAP)
by Milka Net 06 May '16

06 May '16

Hello, I am trying to set a freeradius authentification against a MS Active directory for Wifi. all went right: - debian in AD - net ads testjoin- wbinfo -a test- /usr/bin/ntlm_auth --request-nt-key --domain=DOM --username=u1 --password=thepassord So basically: authenticating with a AD user is really fine.... even from a "windows 7" laptop is fine, AS LONG as i get prompt for the user/pass, and that I enter it in the form or USER/PASS When i try to use the "automatic", so that it's the "laptop" that sends the credential, it does not work: it does send it as: DOMAIN\\USER. domain: galaxy.privuser: test here is the freeradius -X output. rad_recv: Access-Request packet from host 10.2.103.17 port 59985, id=177, length=173 User-Name = "galaxy\\test" NAS-Identifier = "44d9e7fc21c1" NAS-Port = 0 Called-Station-Id = "46-D9-E7-FD-21-C1:FreeRadius" Calling-Station-Id = "00-1E-65-22-14-C2" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x027300100167616c6178795c74657374 Message-Authenticator = 0x3d46f71089cc7034c3a6636b891a17af# Executing section authorize from file /etc/freeradius/sites-enabled/default+group authorize {++[preprocess] = ok[ntdomain] Looking up realm "galaxy" for User-Name = "galaxy\test"[ntdomain] Found realm "GALAXY"[ntdomain] Adding Stripped-User-Name = "test"[ntdomain] Adding Realm = "GALAXY"[ntdomain] Authentication realm is LOCAL.++[ntdomain] = ok[suffix] Request already proxied. Ignoring.++[suffix] = ok++[chap] = noop++[mschap] = noop++[digest] = noop[suffix] Request already proxied. Ignoring.++[suffix] = ok[eap] EAP packet type response id 115 length 16[eap] No EAP Start, assuming it's an on-going EAP conversation++[eap] = updated++[files] = noop++[expiration] = noop++[logintime] = noop[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.++[pap] = noop+} # group authorize = updatedFound Auth-Type = EAP# Executing group from file /etc/freeradius/sites-enabled/default+group authenticate {[eap] EAP Identity[eap] processing type tls[tls] Initiate[tls] Start returned 1++[eap] = handled+} # group authenticate = handledSending Access-Challenge of id 177 to 10.2.103.17 port 59985 EAP-Message = 0x017400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1d729faf1a330fa1233dbe164274a4fFinished request 1.Going to the next requestWaking up in 4.9 seconds. Would you guys have any things i could test? Any advice would be welcome ! Thanks in advance Milkanet

4 5

LDAP CONFIGURATION IN FreeRadius
by WINANT, KEVIN 05 May '16

05 May '16

Hi Folks, On the FreeRadius servers we have inherited, I am trying to locate where LDAP is configured. Our Servers communicate with an External Authentication server (companies phone directory for user id/pswd verification) so I know someplace in there the LDAP server is specified and should indicate which port (389 or 636) it is using. FreeRadius doc indicates this is defined in radiusd.conf In checking radiusd.conf I do not see anything specifying LDAP. Was thinking would see something similar to this in radiusd.conf: server = "ldap" port = 636 #port = 389 SO my question is, is there someplace else where the LDAP server may be configured? Or radius.conf is the place.?? I have poked around in etc/raddb but unable to locate these settings. Appreciate any information anyone may be able to provide. Thanks in Advance

6 16

LDAP + SASL Freeradius 3.0.11
by Matthew Beckler 05 May '16

05 May '16

Hello, I'm currently learning Freeradius so most of this is new to me. My ultimate goal is to authenticate users via winbind and check group membership via LDAP to Active Directory in post_auth. I was feeling good until I got to ldap section. I have the following working: Winbind authentication LDAPSearch is working for testing with : ldapsearch -LLL -Y "DIGEST-MD5" -h dc.dc.local -U ldaplookup -W -b "ou=Users,ou=OU,dc=dc,dc=local" sAMAccountName=usertoget However when running freeradius -X I receive the following: rlm_ldap (ldap): Connecting to ldap://dc.dc.local:389 rlm_ldap (ldap): Starting SASL mech(s): DIGEST-MD5 SASL/DIGEST-MD5 authentication started rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 52e, v1db1. rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/freeradius/mods-enabled/ldap[8]: Instantiation failed for module "ldap" Obviously I have checked username and password at least 10 times and pasted them in. It appears 52e is correct username but bad password. I'm probably setting up my ldap config wrong so here are the sections I have changed I did not change anything else below this line. Maybe I'm doing this totally incorrectly. ldap { server = 'dc.dc.local' # Port to connect on, defaults to 389, will be ignored for LDAP URIs. # port = 389 # Administrator account for searching and possibly modifying. If using SASL + KRB5 these should be commented out. identity = 'ldaplookup' password = **************** # Unless overridden in another section, the dn from which all searches will start from. base_dn = 'ou=Users,ou=Company,dc=dc,dc=local' # # SASL parameters to use for admin binds # # When we're prompted by the SASL library, these control the responses given, as well as the identity and password directives above. # # If any directive is commented out, a NULL response will be provided to cyrus-sasl. # # Unfortunately the only way to control Keberos here is through environmental variables, as cyrus-sasl provides no API to set the krb5 config directly. # # Full documentation for MIT krb5 can be found here: # # http://web.mit.edu/kerberos/krb5-devel/doc/admin/env_variables.html # # At a minimum you probably want to set KRB5_CLIENT_KTNAME. # sasl { # SASL mechanism mech = 'DIGEST-MD5' # SASL authorisation identity to proxy. # proxy = 'autz_id' # SASL realm. Used for kerberos. # realm = 'example.org' } Thanks for any assistance Matt

2 1

Problem with Local variable especially when its negative
by Mrinal K 05 May '16

05 May '16

Hello members of the freeradius email list, I have added some unlang code in the authorize section of my configuration, however I am having some trouble with the values in my variables. My server is running Version 2.1.12. The snippet is as follows and is intended to check how much of data user has downloaded till now, My-Local-Int-2 has the maximum data allowed to the user and My-Local-Int-1 is the start timestamp. The idea is to get the difference of maximum allowed octets and octets used till now and if comes out to be less than zero we reject the user else user is allowed. #### Section 1 Start update control { My-Local-Int-3 = "%{sql: select ('%{control:My-Local-Int-2}' - ifnull(sum(acctinputoctets) + sum(acctoutputoctets),0)) from radacct where calledstationid='%{Called-Station-Id}' and callingstationid='%{Calling-Station-Id}' and sessionstarttimestamp > '%{control:My-Local-Int-1}'}" } #### Section 1 End #### Section 2 Start if("%{control:My-Local-Int-3}" > 0){ update reply { ChilliSpot-Max-Total-Octets := "%{control:My-Local-Int-3}" Idle-Timeout = 600 Acct-Interim-Interval = 180 } } else{ update control { Auth-Type := reject } } #### Section 2 End Its pretty straight forward and work well till My-Local-Int-3 has value which is greater than 0. However when value of My-Local_Int-3 is in negative "if("%{control:My-Local-Int-3}" > 0) " still returns true and ChilliSpot-Max-Total-Octets is assigned an unknown positive value. Concerned debug output is as follows, expand: %{sql: select ('%{control:My-Local-Int-2}' - ifnull(sum(acctinputoctets) + sum(acctoutputoctets),0)) from radacct where calledstationid='%{Called-Station-Id}' and callingstationid='%{Calling-Station-Id}' and sessionstarttime > '%{control:My-Local-Int-1}'} -> -500017 expand: %{sql: select ('%{control:My-Local-Int-2}' - ifnull(sum(acctinputoctets) + sum(acctoutputoctets),0)) from radacct where calledstationid='%{Called-Station-Id}' and callingstationid='%{Calling-Station-Id}' and sessionstarttime > '%{control:My-Local-Int-1}'} -> -500017 +++[control] returns noop +++? if ("%{control:My-Local-Int-3}" > 0) expand: %{control:My-Local-Int-3} -> 4294467279 ? Evaluating ("%{control:My-Local-Int-3}" > 0) -> TRUE +++? if ("%{control:My-Local-Int-3}" > 0) -> TRUE +++- entering if ("%{control:My-Local-Int-3}" > 0) {...} At first when sql query is expanded the value is -500017 but later same My-Local-Int-3 expands to 4294467279. Regards, Kumar Mrinal Splash Networks http://splashwifi.net

4 4

unlang to customize error message
by Stefano Zanmarchi 05 May '16

05 May '16

According to MS-CHAP-V2 standard in case of authentication failure the Failure Packet should contain the following text in the Message field: "E=691 R=... ..." . Freeradius does send "E=691" if send_error is set to yes in mods-enabled/eap, but this may cause (as stated in the comments) some clients not to work. This is sadly the case with iOS 9.3.1 supplicants. Luckily we have a table relating MACs and OSs of the devices of our users. Is it possible via unlang to have Freeradius conditionally send "E=691" (in case authentication failure) based on a sql query? I believe this is quite tricky, but it'd really help us a lot. Thank you, Stefano

3 4

rlm_python in v3.0.x
by Arran Cudbard-Bell 05 May '16

05 May '16

rlm_python from v3.1.x has been backported to the v3.0.x branch. This addresses all but 1 of the ~7 rlm_python issues that had accumulated in the issue tracker. Namely: - Instantiation and destruction with multiple instances is always clean, and should never result in a SEGV. - The module is 'threaded', without any side effects (race conditions or crashes). - Thread Local Storage is now distinct between instances of rlm_python - Multiple sub interpreters can be used, but this is disabled by default in v3.0.x because of compatibility issues with some C extensions to python. - Double quotes are no longer escaped. - Constants are synced with the server constants. In v3.1.x I also added conversion to proper Python types, i.e. unsigned/signed integers get converted to Python Long numbers, floats get converted to decimals, strings get converted from UTF-8 to UTF-16 (and are binary safe), octet strings are left in their original form (not converted to hex). Conversion back to C types is still done with string parsing. That can be addressed by someone sufficiently motivated. I don't think it's significantly more difficult than conversion to Python types. Encourage anyone that depends on Python in v3.0.x to test *before* 3.0.12 is released and report any issues. Thanks to Guillaume Pannatier for all the recent testing and automated test cases, and to all those that opened issues against rlm_python. No thanks to the Python team for creating an extraordinarily obtuse C API. My favourite, lease favourite part is this: /* * Initialise a new module, with our default methods */ inst->module = Py_InitModule3("radiusd", module_methods, "FreeRADIUS python module"); if (!inst->module) { error: python_error_log(); PyEval_SaveThread(); return -1; } /* * Py_InitModule3 returns a borrowed ref, the actual * module is owned by sys.modules, so we also need * to own the module to prevent it being freed early. */ Py_IncRef(inst->module); Just wow... -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0