- Freeradius-Users - lists.freeradius.org

Accept all Auth requests while replying individual parameters
by Pavel Uhliar 21 Feb '16

21 Feb '16

Hi guys. I am trying to modify existing FreeRADIUS setup (version 2.1.12) to accept all Auth requests, while responding to them with individual parameters (Framed-IP-Address and Framed-Route) based on Calling-Station-Id. I am in a running environment, where until now login requests are authorized by User-Name/Password based on radcheck table and individual parameters are sent based on the User-Name from radreply table and combined with group parameters from radgroupreply table (all MySQL). Users are paired to groups by individual entries in usergroup table I would like to keep intact as much of the structure as possible, I just need to stop verifying User-Name/Password (because now whoever is able to access physical infrastructure is authorized to use it) and change the individual responses to be based on Calling-Station-Id instead of User-Name. I don't care about group, I do not need to distinguish between groups anymore, so I can move group parameters to default response once I solve the major issue with sending the individual parameters. First I thought the solution will be quite simple: 1) I change the SQL query selecting from radreply table to be based on Calling-Station-Id 2) I add "DEFAULT Auth-Type := Accept" and "Fall-Through=Yes" in /etc/raddb/users file Step 1 is OK, no problem (change in /etc/raddb/sql/mysql/dialup.conf) Problem is in Step 2. It does authorize all requests as expected (even those not matching User-Name/Password records in radcheck table), but when the User-Name/Password in request does not match User-Name/Password in radcheck, RADIUS skips querying the radreply table for additional parameters. This results in Auth response containing only parameters from radgroupreply table, but none from radreply. Requests containing User-Name/Password matching to those in radcheck get full responses (with radgroupreply and radreply) Here is comparison of debug output between authorization with valid credentials and invalid ones: Valid: [files] users: Matched entry DEFAULT at line 46 ++[files] returns ok [sql] expand: %{User-Name} -> XXXX [sql] sql_set_user escaped user --> 'XXXX' rlm_sql (sql): Reserving sql socket id: 7 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE ... ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE ... ORDER BY id [sql] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='XXXX' [sql] expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id [sql] User found in group YYYY [sql] expand: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 7 ++[sql] returns ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user expand: Auth-Type: %{control:Auth-Type} -> Auth-Type: Accept Login OK: [XXXX] (from client xxx port xxx cli xxx) Auth-Type: Accept Invalid credentials (output is the same, just the radreply query is missing). [files] users: Matched entry DEFAULT at line 46 ++[files] returns ok [sql] expand: %{User-Name} -> XXXX [sql] sql_set_user escaped user --> 'XXXX' rlm_sql (sql): Reserving sql socket id: 9 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='XXXX' [sql] expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id [sql] User found in group YYYY [sql] expand: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 9 ++[sql] returns ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user expand: Auth-Type: %{control:Auth-Type} -> Auth-Type: Accept Login OK: [XXXX] (from client xxx port xxx cli xxx) Auth-Type: Accept I was trying to find some solution, did try "query_on_not_found" configuration directive, did play with "Fall-Through", but nothing seems to work. I was not able to force RADIUS to do the radreply query for not-matched credentials. As other ways to solve the problem, I was trying to use policy to rewrite User-Name/Password in request to a Calling-Station-Id/<universal-password> to have all request authorized under my control, but this is not feasible as devices do not use only PAP, but also CHAP and MSCHAP, and password rewriting does not work for CHAP/MSCHAP requests. Another way I was trying was to setup policy that will add parameters "by hand" based on SQL query to radreply table. This I can do for Framed-IP-Address (which is only one for each user), but I am not able to do it for Framed-Route, as there can be zero or multiple Framed-Route entries for every user. I am dead stuck, I will appreciate any hints to solve the problem. Thanks a lot, Pavel

3 4

openssl gendh during make install
by Michael Ströder 19 Feb '16

19 Feb '16

HI! Is it really necessary to invoke "openssl gendh" during "make install"? It wastes time on automated build systems, especially when building in VMs for armv6. After installing RPMs one would have to regenerate DH params anyway. Ciao, Michael.

3 3

No Logon Servers error with FreeRADIUS + NTLM
by Stefan Paetow 19 Feb '16

19 Feb '16

Hi, I know this is not a problem with FreeRADIUS, however, there are several people on this list who run FreeRADIUS with Active Directory as a back end and I need their advice on this. I've run into the dreaded "No logon servers (0xc000005e)" error with NTLM. In the past I've found that the computer password for the server expired on AD and that it was either fixed by rejoining, or by tweaking the password's expiry. Do any AD folk on the list know what we can do to get this stable and that this does not occur again? Any ideas will be very useful. :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 1

Simple questiona about RadSec - Freeradius 3.0.10
by Neuton Martins 19 Feb '16

19 Feb '16

Hello Guys, I have a simple question about RadSec, but after a lot of research on the web i cant't figure out the solution. I have a federated FreeRADIUS scenario, where one central server answer requests and N other server who sent them requests. Everything is working fine without RadSec. But for security reasons i'm trying to configure RadSec. In my central server i have setup the RadSec sites-avaiable properly, but at my distributed clients i can't figure out what and where i have to change for client FreeRADIUS to proxy request as RadSec. In my research i found about radsecproxy, but i Think FreeRADIUS 3.0.X don't need that right? I'm using FreeRADIUS 3.0.10 compiled from source. My proxy config is like: realm central { type = auth authhost = centralradius.my.domain secret = secrect nostrip } So guys, what and where i have to change to this scenario works? With regards, Neuton Martins Costa

3 3

Freeradius + mysql in OpenSUSE
by Daniel Lopez 18 Feb '16

18 Feb '16

Here goes a dumb question: After building freeradius 3.0.11 in OpenSUSE 13.1, four .RPM files was created in /usr/src/packages/RPMS/x86_64/ I installed those files: freeradius-server-3.0.11-0.x86_64.rpm freeradius-server-devel-3.0.11-0.x86_64.rpm freeradius-server-libs-3.0.11-0.x86_64.rpm freeradius-server-utils-3.0.11-0.x86_64.rpm I noticed there isn't a freeradius-server-mysql... package. I've readed that SUSE already includes the rlm_sql_mysql module as part of the freeradius-server package. But I'm new in SUSE (and relatively in freeradius too -:)) and maybe there may be differences configuring mysql module in suse and ubuntu, for instance: there isn't an "$INCLUDE sql.conf " line in radius.com file. In short: I need some help with mysql module configuration in SUSE, maybe i'm missing something obvious. Thanks in advance

2 1

Why do some module call have a 'minus' sign in front in the config file ?
by Sylvain Munaut 18 Feb '16

18 Feb '16

Hi, Some of the modules sometimes have a "minus" (-) sign in front of them in config files like -sql -ldap What purpose does it serve ? Can't really find this mentioned anywhere. Cheers, Sylvain

3 3

linelog oddity on 3.1.x
by Jonathan Gazeley 18 Feb '16

18 Feb '16

Yesterday I built 3.1.x from git and today I'm tidying up the rough edges in my config. I spotted that my instantiation of linelog is not behaving quite as I'd expect, as it appears not to tag the syslog_facility, and then rsyslog makes up whatever it feels like. This behaviour has changed since 3.0.11 on the same box. Here's my linelog module: linelog logtosyslog { destination = syslog syslog { syslog_facility = local5 } # Default log message format = "" # Match packet type to blocks below reference = "logtosyslog.%{%{reply:Packet-Type}:-format}" logtosyslog { Access-Accept = "%{Virtual-Server}: Login OK: [%{User-Name}] (from client %S cli %{Calling-Station-Id})" Access-Reject = "%{Virtual-Server}: Login incorrect: [%{User-Name}] (from client %S cli %{Calling-Station-Id})" } } And here's what the server prints when run in -X: # Loading module "logtosyslog" from file /etc/raddb/mods-enabled/logtosyslog linelog logtosyslog { destination = "syslog" delimiter = " " file { permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } Looks like it's just not picking up on the syslog_facility config item. Any pointers for beating it into submission? Thanks, Jonathan

2 1

Migrate "Steel-Belted Radius" to FreeRADIUS.
by Meike Stone 18 Feb '16

18 Feb '16

Hello dear list, I like to migrate from "Steel-Belted Radius" to FreeRADIUS. I've seen, that the user base can exported via XML, but the passwords are encoded. Does anyone did this already and can give any recommendations? ( ..or usable scripts, to convert the User-Database?) Many thanks Meike!

2 1

hints file based rewrite does not work (migration from freeradius 1.1.x to 3.0.x)
by Bernd 18 Feb '16

18 Feb '16

Hi list, we're about to move from a freeradius (freeradius-1.1.3-1.6.el5 on CentOS 5) to a HA freeradius (freeradius-3.0.4-6.el7.x86_64 on CentOS 7) environment. We're almost there, however, I ran into an issue: I have to rewrite an "%" character to "@". My 'hints' file on the old installation did this perfectly well: DEFAULT User-Name =~ "bla\-bla\/([^%]+)%kroenchenstadt.de" User-Name := "%{1}(a)kroenchenstadt.de" However, freeradius BLA throws an error (running as 'radius -X' for debugging purposes): (0) ERROR: preprocess : bla\-bla\/(^%)%kroenchenstadt.de (0) ERROR: preprocess : ^ Invalid variable expansion Any idea what goes possibly wrong here? How could I circumvent the problem? Thanks, Bernd

4 14

users configuration and certs
by gahn 18 Feb '16

18 Feb '16

hello: would you please advice how to proceed this issue? here is what i am trying to do after authenticated with certs (compiled per "http://deployingradius.com/documents/configuration/certificates.html"): * radius will assign a vlan id* and IP address here is the configuration: user1 User-Password == "user1" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-ID = "vlan1", Framed-IP-Address = 10.0.0.101, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP user2 User-Password == "user2" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-ID = "vlan2", Framed-IP-Address = 10.0.4.101, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP i tested md5 first and it works (i think) but not able to bring up tunnel, so not able to get vlan id and ip addresses: Ready to process requests (0) Received Access-Request Id 148 from 100.64.8.3:51157 to 10.85.19.162:1812 length 170 (0) User-Name = "tester4" (0) NAS-Port = 82 (0) EAP-Message = 0x0200000c0174657374657234 (0) Message-Authenticator = 0xb19c034e8325fa37e7c8555a7323de40 (0) Acct-Session-Id = "8O2.1x81310900000b65a7" (0) NAS-Port-Id = "ge-0/0/16.0" (0) Calling-Station-Id = "08-ed-2a-81-00-00" (0) Called-Station-Id = "00-26-88-7c-c4-00" (0) NAS-Identifier = "jtac-EX4200-48T-r064" (0) NAS-Port-Type = Ethernet (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "tester4", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 0 length 12 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 1 length 22 (0) eap: EAP session adding &reply:State = 0x221d73df221c7755 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Sent Access-Challenge Id 148 from 10.85.19.162:1812 to 100.64.8.3:51157 length 0 (0) EAP-Message = 0x0101001604104f25d10e53221ba2241dc31da1154f5c (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x221d73df221c7755f69b930716c7d1dc (0) Finished request Waking up in 4.9 seconds. Waking up in 6.9 seconds. Waking up in 13.9 seconds. Waking up in 30.9 seconds. (0) Cleaning up request packet ID 148 with timestamp +14 i copied "client.pem" from the server to client side and tried "tls". this time i don't see any outputs from "radiusd -sX" (i think because of failed certs and 802.1x didn't even finish its process) the client side showed failed message: "Validated, Test cannot continue, a fatal error encountered when working with certificates" how could i troubleshoot this? is it an issue of certs? thanks _dave

2 1