- Freeradius-Users - lists.freeradius.org

Re: Can Radius pass client ip details to Windows AD during ntlm authentication ?.
by Eby Mani 14 Mar '16

14 Mar '16

@Alan DeKok >AD shows the IP that the login request came from. In this case, that's the RADIUS server. There is no way I know to pass more information in the login request. Now understand why it only show the last user in Single-SignOn client when multiple clients are connected thru RADIUS server. Perhaps another way exist to pass more information after authentication ?. @Matthew Newton >Look at the logs on the RADIUS server RADIUS Accounting log contain client info, included for ref. @Brian Julin & @Scott Armitage >What you may be able to do is set up the WiFi controller to send accounting packets when it discovers the IP, which includes the username, then shell out to a script to do something to inject log entries into the AD server. >The best you can do is configure your wireless to send RADIUS accounting with interim updates. Interesting, RADIUS server is doing the accounting. WLC have the option to set accounting packets to another server. To which Server the WLC should send Accounting packets to ?. When WLC is configured to use Windows NPS for AAA, wireless network access is granted, but only windows-computers joined to the particular domain is able to access certain networks(protected & internet) as those are configured with Single-SignOn. Linux systems joined to domain(realmd / ssssd / likewise open) doesn't even show up in Firewall single-signon agent installed in AD. Here is RADIUS accounting log. *********************************************** Mon Mar 14 13:06:55 2016 Acct-Status-Type = Interim-Update NAS-IP-Address = 10.225.253.10 User-Name = '0129' NAS-Port = 0 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = '***' Called-Station-Id = '####' Framed-IP-Address = 10.225.251.33 Acct-Multi-Session-Id = '***-233931' Acct-Session-Id = 'F05C1986E781-***-39CCB' Acct-Delay-Time = 0 Aruba-Essid-Name = 'VOIP-DEMO' Aruba-Location-Id = '####' Aruba-User-Vlan = 111 Acct-Input-Octets = 22221 Acct-Output-Octets = 5160 Acct-Input-Packets = 341 Acct-Output-Packets = 26 Acct-Session-Time = 277 Event-Timestamp = 'Mar 14 2016 13:06:55 IST' Acct-Unique-Session-Id = '6546072bc6e91077cfb7572486c87dc5' Timestamp = 1457941015 Mon Mar 14 13:07:46 2016 Acct-Status-Type = Interim-Update NAS-IP-Address = 10.225.253.10 User-Name = 'pt1479' NAS-Port = 0 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = '***' Called-Station-Id = '####' Framed-IP-Address = 10.225.251.32 Acct-Multi-Session-Id = '***-482768' Acct-Session-Id = 'F05C1986E261-***-76980' Acct-Delay-Time = 0 Aruba-Essid-Name = 'VOIP-DEMO' Aruba-Location-Id = '####' Aruba-User-Vlan = 111 Acct-Input-Octets = 10912 Acct-Output-Octets = 5416 Acct-Input-Packets = 100 Acct-Output-Packets = 27 Acct-Session-Time = 154 Event-Timestamp = 'Mar 14 2016 13:07:46 IST' Acct-Unique-Session-Id = 'b4cc8c7562777c2569e0ce29e596022e' Timestamp = 1457941066 *********************************************** Eby

2 1

Can Radius pass client ip details to Windows AD during ntlm authentication ?.
by Eby Mani 13 Mar '16

13 Mar '16

Can Radius Server pass client ip details to Windows AD during ntlm authentication ?. Here is the scenario, WirelessLanController is configured to provide access only after authenticating using Radius. Radius server is configured for WPA2 Enterprise with Active Directory integration using samba/winbind (ntlm_auth). I can login to the wireless network using AD username and password. The trouble is, AD doesn't know my real ip. It shows my username, Radius server IP and system name when searching for details. Thanks Eby

7 6

Ldap query
by Franks Andy (IT Technical Architecture Manager) 12 Mar '16

12 Mar '16

Hi all, FR 3.1.0 64aa7f9 I'm trying to get to the bottom of the ldap issues we're seeing with AD within freeradius. Basically when we take down one AD server (we have two sites, doesn't matter which it is), the ldap lookups from Freeradius have massive issues with timeouts, failure to bind errors etc. Now, I'd say this was an issue with AD, but we've tried this with various tools now, both linux and windows based, and we don't see any issues using, for example, ldapsearch, from the same server where FR is struggling. Obviously I would love it if someone would say "oh yes, you need to change /etc/ldap/ ... " but that's not so likely, so I wanted just any information on what ldap libraries FR uses, whether some of the code is internal or not so I can start to try and find a solution as I'm guessing this will be a management reason to go towards clearpass. Thanks! Andy

4 5

Re: rlm_sql_db2 sql server configuration
by Abdurrohman Muhammad 12 Mar '16

12 Mar '16

is there any configuration example to try? since the documentation for db2 is not writen yet abdurrm | Sent from my Huawei Mobile -------- Original Message -------- Subject: Re: rlm_sql_db2 sql server configuration From: Alan DeKok To: FreeRadius users mailing list CC: On Mar 12, 2016, at 7:53 AM, abdurrm(a)ub.ac.id wrote: > > I forced configure to compile rlm_sql_db2 using libdb2 V10.5 instead of IBM DB2 UDB V7 as mention in rlm_sl_db2.c > I have read IBM cli SQLConnect() documentation, about what argument should been sent. (because SQLConnect() using DSN/Data Source instead of Server's IP Address. and my V10.5-libdb2 is works with my php-pecl-db2 module) > is there any special configuration in etc/raddb/mods-enabled/sql for db2? notably "server" and "radius-db"? There should be no special configuration. > I've beed compile both stable 3.0.4 and last master-branch 3.1.x and keep give me error "rlm_sql_db2 - could not connect to DB2 server [idontknowwhatshouldisethere" Is that really the error message? If it can't connect to the SQL server, read the SQL server documentation for what connection parameters are used. > Here is my sql configuration : > > dialect = "db2" > server = "my.db.2.serv" > #server = "(DATABASE=db2admin;HOSTNAME=x.x.x.x;PORT=50000;PROTOCOL=TCPIP;UID=d b2inst1;PWD=xxx)" # i have tried to use PHP-PECL-DB2 DSN based, it also wont work. That shouldn't be hard to figure out. You have a database, hostname, port, etc. in that connection string. And you have similar options in the SQL module configuration. How about using the parameters from PHP-PECL-DB2 in the FreeRADIUS configuration? radius_db = db2admin server = x.x.x. port = 50000 login = db2inst1 password = xxx Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- This email was virus checked by UB Mail Gateway -- This email was virus checked by UB Mail Gateway Secure by Sophos

1 0

rlm_sql_db2 sql server configuration
by abdurrm＠ub.ac.id 12 Mar '16

12 Mar '16

hello everyone, I am trying to connect FR v3 with DB2EC V10.5. I forced configure to compile rlm_sql_db2 using libdb2 V10.5 instead of IBM DB2 UDB V7 as mention in rlm_sl_db2.c I have read IBM cli SQLConnect() documentation, about what argument should been sent. (because SQLConnect() using DSN/Data Source instead of Server's IP Address. and my V10.5-libdb2 is works with my php-pecl-db2 module) is there any special configuration in etc/raddb/mods-enabled/sql for db2? notably "server" and "radius-db"? I've beed compile both stable 3.0.4 and last master-branch 3.1.x and keep give me error "rlm_sql_db2 - could not connect to DB2 server [idontknowwhatshouldisethere" Here is my sql configuration : dialect = "db2" server = "my.db.2.serv" #server = "(DATABASE=db2admin;HOSTNAME=x.x.x.x;PORT=50000;PROTOCOL=TCPIP;UID=db2inst1;PWD=xxx)" # i have tried to use PHP-PECL-DB2 DSN based, it also wont work. port = 50000 login = "db2inst1" password = "xxx" radius_db = "radiusdb" pool { start = 1 min = 0 max = 1 spare = 0 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } # i set to 1 connection only to db2, it is also doesnt work with default configuration CentOS Linux release 7.1.1503 (Core) Linux 3.10.0-229.14.1.el7.x86_64 x86_64 GNU/Linux DB2/LINUXX8664 10.5.5 FreeRADIUS Version 3.1.0, for host x86_64-unknown-linux-gnu, built on Mar 12 2016 at 11:43:10 (my current build) I knew DB2 is an experimental modul, but Alan DeKok said it works, and people using it. Can someone help.. I have no more idea :( -- This email was virus checked by UB Mail Gateway Secure by Sophos

1 0

Stripping prefix with unlang
by Bernd 11 Mar '16

11 Mar '16

Hi, I am pulling my hears for two hours now. I'd like to strip a prefix off a request and I'm trying to use unlang in policy.d/filter to do that. if (User-Name =~ /adsl\-bla\/([^%%]+)%%adsl-bla.kroenchenstadt.de/) { update request { User-Name := "([^%%]+)%%adsl-sbt.kroenchenstadt.de/" } } doesn't work, as if (User-Name =~ /adsl\-bla\/ { update request { User-Name -= "adsl\-bla\/" } } also refuses to be that what I need. I just need to strip ``adsl-bla/'' off the login request. Help much appreciated — thanks! Bernd

3 4

rlm_redis_ippool_tool
by O'Connell, Ryan 10 Mar '16

10 Mar '16

Looking for an example/guidance of using the rim_redis_ippool_tool to add a subnet to a fresh installation (Redis running localhost)? I have the (3.1.0) server up and connected to Redis and can submit a simulated request but there are no IP’s to assign. I have tried following the help (-h) and man pages for the tool without success. Debug output below. Thanks, Ryan --- [root@dhcp02 ~]# rlm_redis_ippool_tool -x -f bootstrap.conf 127.0.0.1:6379 Nothing to do! [root@dhcp02 ~]# cat bootstrap.conf ippool local { range-start = 192.0.2.0 range-stop = 192.0.2.255 session-db = /etc/raddb/ip-pool.db ip-index = /etc/raddb/ip-index.db } [root@dhcp02 ~]# rlm_redis_ippool_tool -xS 127.0.0.1:6379 rlm_redis_ippool_tool [1] - Opening additional connection (0), 1 of 10 pending slots used ------ FreeRADIUS Version 3.1.0 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog /etc/raddb/mods-enabled/linelog[114]: Reference "${..pool}" not found /etc/raddb/mods-enabled/linelog[127]: Reference "${..pool}" not found including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/redis including configuration file /etc/raddb/mods-enabled/redis_ippool including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/vendor including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/dhcp main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 continuation_timeout = 15 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 2 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dynamic = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 queue_priority = "default" auto_limit_acct = no } WARNING: Ignoring "max_spare_servers = 10", forcing to "max_spare_servers = 3" # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest # Creating Auth-Type = eap listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 recv_buff = 0 } listen { type = "dhcp" ipaddr = 127.0.0.1 port = 6700 recv_buff = 0 No "interface" setting is defined. Only unicast DHCP will work src_ipaddr = 127.0.0.1 } radiusd: #### Loading modules #### modules { # Loaded module "rlm_always" # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module "rlm_attr_filter" # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" relaxed = no } # Loaded module "rlm_cache" # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module "rlm_chap" # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module "rlm_detail" # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module "rlm_dhcp" # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module "rlm_digest" # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module "rlm_dynamic_clients" # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module "rlm_eap" # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" ignore_unknown_eap_types = no cisco_accounting_username_bug = no } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" require_client_cert = yes } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls - Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls - Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module "rlm_exec" # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module "rlm_expiration" # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module "rlm_expr" # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module "rlm_files" # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module "rlm_linelog" # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { destination = "file" delimiter = " " file { filename = "/var/log/radius/linelog" permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { port = 514 timeout = 2.000000 } udp { port = 514 timeout = 2.000000 } } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { destination = "file" delimiter = " " file { filename = "/var/log/radius/linelog-accounting" permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } # Loaded module "rlm_logintime" # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module "rlm_mschap" # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module "rlm_pap" # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module "rlm_passwd" # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module "rlm_preprocess" # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module "rlm_radutmp" # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module "rlm_realm" # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module "rlm_replicate" # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module "rlm_soh" # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module "rlm_unix" # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module "rlm_unpack" # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module "rlm_utf8" # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module "rlm_redis" # Loading module "redis" from file /etc/raddb/mods-enabled/redis redis { server = "127.0.0.1" port = 6379 database = 0 max_nodes = 20 max_alt = 3 max_redirects = 2 } libfreeradius-redis: libhiredis version: 0.12.1 # Loaded module "rlm_redis_ippool" # Loading module "redis_ippool" from file /etc/raddb/mods-enabled/redis_ippool redis_ippool { copy_on_update = yes redis { server = "localhost" port = 6379 database = 0 max_nodes = 20 max_alt = 3 max_redirects = 2 } } instantiate { } } # modules # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache_eap - Driver rlm_cache_rbtree loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log) - 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading file /etc/raddb/mods-config/files/authorize reading file /etc/raddb/mods-config/files/accounting reading file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap: using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading file /etc/raddb/mods-config/preprocess/huntgroups reading file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "redis" from file /etc/raddb/mods-enabled/redis rlm_redis (redis) [1] - Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } rlm_redis (redis) [1] - Opening additional connection (0), 1 of 32 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Opening additional connection (1), 1 of 31 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Opening additional connection (2), 1 of 30 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Opening additional connection (3), 1 of 29 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Opening additional connection (4), 1 of 28 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Reserved connection (0) rlm_redis (redis): Bootstrap server "127.0.0.1" returned: rlm_redis (redis) [1] - Released connection (0) rlm_redis (redis) [1] - Need 5 more connections to reach 10 spares rlm_redis (redis) [1] - Opening additional connection (5), 1 of 27 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 # Instantiating module "redis_ippool" from file /etc/raddb/mods-enabled/redis_ippool rlm_redis (redis) [1] - Initialising connection pool pool { start = 0 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } rlm_redis (redis) [1] - 0 of 0 connections in use. You may need to increase "spare" rlm_redis (redis) [1] - Opening additional connection (0), 1 of 32 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Reserved connection (0) rlm_redis (redis): Bootstrap server "localhost" returned: rlm_redis (redis) [1] - Released connection (0) rlm_redis (redis) [1] - Need 2 more connections to reach 10 spares rlm_redis (redis) [1] - Opening additional connection (1), 1 of 31 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Reserved connection (0) rlm_redis (redis) [1] - Released connection (0) radiusd: #### Loading Virtual Servers #### server default { # from file /etc/raddb/sites-enabled/default Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel } # server inner-tunnel server dhcp { # from file /etc/raddb/sites-enabled/dhcp # Loading dhcp DHCP-Discover {...} # Loading dhcp DHCP-Request {...} # Loading dhcp DHCP-Decline {...} # Loading dhcp DHCP-Inform {...} # Loading dhcp DHCP-Release {...} # Loading dhcp DHCP-Lease-Query {...} } # server dhcp radiusd: #### Opening IP addresses and Ports #### Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on dhcp address 127.0.0.1 port 6700 bound to server dhcp Listening on proxy address * port 43002 Ready to process requests (0) Received DHCP-Discover Id 3b426982 from 127.0.0.1:6701 to 127.0.0.1:6700 via lo length 300 (0) &request:DHCP-Opcode = Client-Message (0) &request:DHCP-Hardware-Type = Ethernet (0) &request:DHCP-Hardware-Address-Length = 6 (0) &request:DHCP-Hop-Count = 0 (0) &request:DHCP-Transaction-Id = 994208130 (0) &request:DHCP-Number-of-Seconds = 0 (0) &request:DHCP-Flags = 0 (0) &request:DHCP-Client-IP-Address = 0.0.0.0 (0) &request:DHCP-Your-IP-Address = 0.0.0.0 (0) &request:DHCP-Server-IP-Address = 0.0.0.0 (0) &request:DHCP-Gateway-IP-Address = 0.0.0.0 (0) &request:DHCP-Client-Hardware-Address = 00:a0:bc:00:00:00 (0) &request:DHCP-Message-Type = DHCP-Discover (0) Trying sub-section dhcp DHCP-Discover {...} (0) dhcp DHCP-Discover { (0) update reply { (0) &reply:DHCP-Message-Type = DHCP-Offer (0) } # update reply (noop) (0) update reply { (0) &reply:DHCP-Domain-Name-Server = 127.0.0.1 (0) &reply:DHCP-Domain-Name-Server = 127.0.0.2 (0) &reply:DHCP-Subnet-Mask = 255.255.255.0 (0) &reply:DHCP-Router-Address = 192.0.2.1 (0) &reply:DHCP-IP-Address-Lease-Time = 86400 (0) &reply:DHCP-DHCP-Server-Identifier = 192.0.2.1 (0) } # update reply (noop) (0) update control { (0) &control:Pool-Name := local (0) } # update control (noop) (0) redis_ippool - Allocating lease from pool "local", to "00:a0:bc:00:00:00", expires in 30s (0) redis_ippool - Reserved connection (1) (0) redis_ippool - [1] >>> Sending command(s) to 127.0.0.1:6379 (0) redis_ippool - [1] <<< Returned: success (0) redis_ippool - Released connection (1) (0) redis_ippool - Need 1 more connections to reach 10 spares (0) redis_ippool - Opening additional connection (2), 1 of 30 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 (0) redis_ippool - WARNING: Pool contains no free addresses (0) redis_ippool (notfound) (0) ok (ok) (0) } # dhcp DHCP-Discover (ok) (0) ERROR: Can't assign address to client: Neither &reply:DHCP-Client-IP-Address nor &reply:DHCP-Your-IP-Address set (0) ERROR: State callback returned error (-1): Server error: NOSCRIPT No matching script. Please use EVAL. (0) Not sending reply to client. (0) Finished request (0) Cleaning up request packet ID 994208130 with timestamp +17 Ready to process requests

3 7

Can't work out HP/Huawei reply attributes
by Joel Bergmark 10 Mar '16

10 Mar '16

Hello all, I've got quite stuck regarding reply-attributes to get privileged when logging on to a HP/Comware firmware switch (HP, Huawei, 3com etc). I run Daloradius as frontend. Basically what I want is to have something similar to the "Cisco AVPair shell:priv-lvl=15". So the radius server is working and I can login to the HP in question, I have googled this for hours and tried much but to no resolution, examples is like: http://certifiedgeek.weebly.com/blog/ssh-radius-authentication-with-hp-comw… Also tried a number of variants including Cisco AVPair, most of time tried variants of this: NAS-Prompt-User Huawei-Exec-Privilege = "3" rlm_sql: Failed to create the pair: Unknown attribute "NAS-Prompt-User" requires a hex string, not "Huawei-Exec-Privilege = "3"" 3Com-User-Access-Level HP-Privelege-Level = 3 rlm_sql: Failed to create the pair: Unknown value HP-Privelege-Level = 3 for attribute 3Com-User-Access-Level 3Com-User-Access-Level HP-Privelege-Level = 3 rlm_sql: Failed to create the pair: Unknown value 3Com-User-Access-Level = 3 for attribute 3Com-User-Access-Level Basically debug gives me same issue, "failed to create the pair: Unknown value <reply attribute> for <attribute> like this: (...) [sql] expand: %{User-Name} -> hua [sql] sql_set_user escaped user --> 'hua' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'hua' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'hua' ORDER BY id rlm_sql: Failed to create the pair: Unknown value Huawei-Exec-Privilege = "3" for attribute Huawei-Exec-Privilege rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 0 ++[sql] returns fail Invalid user: [user/password] (from client dr1.xyz port 0 cli 00-00-00-00-00-00) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> hua attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 39 to X8.X3.3X.65 port 2888 This leads me to believe that there is something with the dictionary not working correct, I have tried to figure out the dictionary stuff but not sure on how to troubleshoot it. And I also have started a thread at the HP-forums to see if anyone not running windows have got it to work. Thanks for any assistance, and if solved I will as before update the wiki :-) Kind regards, Joel

3 4

Possible to have 2 authentications in sequence?
by Andy P. 10 Mar '16

10 Mar '16

Hello, Can someone tell if it is possible to have FreeRADIUS perform (as a proxy) 2 authentications in sequence on a user, such as the 1st - against an AD and if that succeeds - against another RADIUS server? Is it simply a matter of the the Authorization/Authentication sections definition, or requires some development? Thank you! BR

3 7

FR3.0.11 with ldap + 802.1x + dynamic Vlan assignment.
by Vlad Kratsberg 09 Mar '16

09 Mar '16

Hi Freeradius Users, We are using FR3.0.11 and are trying to set up 802.1x authentication. We are using eap-gtc inside peap. Here is what was configured: 1. mods-available/ldap + symlink to mods-enabled/ldap 2. mods-enabled/eap a. EAP section: changed default_eap_type to peap b. PEAP section: changed default_eap_type to gtc 3. mods-config/files/authorize Added the following: DEFAULT Ldap-Group == "juniper-admins" Service-Type = "Login-User", Idle-Timeout = 600, Juniper-Local-User-Name = "admin", Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 505, Filter-Id = "USERS-FILTER" Here is the full debug: http://pastebin.com/Lugmz3yc The result: Ldap works, user gets authenticated, and Access-Accept message is received however Vlan attributes and Filter-id are not present in Access-Accept. Freeradius-2.1.12 version returns attributes just fine. P.S: The reason why i m not using available RPM FR_3.0.4 is because when I perform change number 2.a. (eap section) as described above, freeradius doesn't recognize it and displays default config: ================================================ # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 ================================================= I would appreciate any help or point in the right direction. Thanks Vlad

2 4