- Freeradius-Users - lists.freeradius.org

Vendor attributes not copied to inner tunnel ?
by Sylvain Munaut 23 Feb '16

23 Feb '16

Hi, I'm in a PEAP setup and trying to match the SSID as part of the group_checks. This is an example request coming in : (17) Received Access-Request Id 59 from 192.168.10.237:1645 to 192.168.10.1:1812 length 201 (17) User-Name = "test_pwd_1" (17) Framed-MTU = 1400 (17) Called-Station-Id = "0000.0000.0000" (17) Calling-Station-Id = "0000.0000.0000" (17) Cisco-AVPair = "ssid=TestMain" (17) Service-Type = Login-User (17) Message-Authenticator = XXX (17) EAP-Message = XXX (17) NAS-Port-Type = Wireless-802.11 (17) NAS-Port = 542 (17) NAS-Port-Id = "542" (17) State = XXX (17) NAS-IP-Address = 192.168.10.237 As you can see, there is the ssid the user tries to connect to that's included as an Cisco-AVPair and I wanted to be able to match on it Unfortunately it turns out the this attribute is apparently not copied from the outer request to the inner one, despite copy_request_to_tunnel being set to true. I tried parsing it in the default authorize {} using : if (Cisco-AVPair[*] =~ /ssid=(.*)/i) { update request { Called-Station-SSID := "%{1}" } } Hoping that Called-Station-SSID would then be copied. However it's not copied either. Finally I tried adding this in the inner-tunnel authorize {} if (&outer.request:Called-Station-SSID) { update request { &Called-Station-SSID := &outer.request:Called-Station-SSID } } And this indeed seems to work and I can match on it. However I have a couple questions : - Why wasn't the Cisco-AVPair and/or the Called-Station-SSID attributes copied ? Other attrs like Service-Type / Called-Station-Id / ... all are copied properly. - Does it look like the right thing to do ? Cheers, Sylvain Munaut

3 6

FR Crash during ldap issues
by Franks Andy (IT Technical Architecture Manager) 22 Feb '16

22 Feb '16

Hi all, We've been having a few ldap timeouts and other weirdness. Unfortunately this has had the effect of stopping freeradius. The backtrace is below - any chance of someone taking a look and commenting? Thanks very much Andy rlm_ldap (ldap_sath): Deleting inviable connection (46672) Program received signal SIGPIPE, Broken pipe. 0x00007ffff6cdac3d in write () at ../sysdeps/unix/syscall-template.S:81 81 ../sysdeps/unix/syscall-template.S: No such file or directory. (gdb) bt #0 0x00007ffff6cdac3d in write () at ../sysdeps/unix/syscall-template.S:81 #1 0x00007fffef2a95e8 in ?? () from /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 #2 0x00007ffff1abade7 in ?? () from /usr/lib/x86_64-linux-gnu/libgnutls.so.26 #3 0x00007ffff1ab818c in gnutls_bye () from /usr/lib/x86_64-linux-gnu/libgnutls.so.26 #4 0x00007fffef4e8872 in ?? () from /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 #5 0x00007fffef2aa762 in ber_int_sb_close () from /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 #6 0x00007fffef4d4072 in ldap_free_connection () from /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 #7 0x00007fffef4cb747 in ldap_ld_free () from /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 #8 0x00007fffef70ea49 in _mod_conn_free (conn=0x149bf90) at src/modules/rlm_ldap/ldap.c:1519 #9 0x00007ffff70f2d28 in ?? () from /usr/lib/x86_64-linux-gnu/libtalloc.so.2 #10 0x00007ffff70ef76b in _talloc_free () from /usr/lib/x86_64-linux-gnu/libtalloc.so.2 #11 0x00007ffff794f0b9 in _fr_trigger_talloc_ctx_free (trigger=0x13be190) at src/lib/misc.c:81 #12 0x00007ffff70f2d28 in ?? () from /usr/lib/x86_64-linux-gnu/libtalloc.so.2 #13 0x00007ffff70ef76b in _talloc_free () from /usr/lib/x86_64-linux-gnu/libtalloc.so.2 #14 0x00007ffff7b9dc21 in fr_connection_close_internal (pool=0x111d950, this=0x1427820) at src/main/connection.c:565 #15 0x00007ffff7b9f231 in fr_connection_reconnect (pool=0x111d950, conn=0x149bf90) at src/main/connection.c:1431 #16 0x00007fffef70d159 in rlm_ldap_search (result=0x7fffffffd130, inst=0xf23cb0, request=0x1430250, pconn=0x7fffffffd138, dn=0x144d5b0 "dc=SATH,dc=nhs,dc=uk", scope=2, filter=0x14e66c0 "sAMAccountName=2c1f23d63980", attrs=0x13964c0, serverctrls=0x0, clientctrls=0x0) at src/modules/rlm_ldap/ldap.c:973 #17 0x00007fffef706534 in ldap_xlat (out=0x7fffffffd1c0, outlen=2048, mod_inst=0xf23cb0, xlat_inst=0x0, request=0x1430250, fmt=0x15358e0 "ldaps:///dc=SATH,dc=nhs,dc=uk?description?sub?sAMAccountName=2c1f23d63980") at src/modules/rlm_ldap/rlm_ldap.c:323 #18 0x00007ffff7bc1771 in xlat_aprint (ctx=0x1430250, request=0x1430250, node=0x122f2f0, escape=0x0, escape_ctx=0x0, lvl=0) at src/main/xlat.c:2369 #19 0x00007ffff7bc1a64 in xlat_process (out=0x7fffffffd350, request=0x1430250, head=0x122f2f0, escape=0x0, escape_ctx=0x0) at src/main/xlat.c:2456 #20 0x00007ffff7bc1d6d in xlat_expand_struct (out=0x7fffffffd450, outlen=0, request=0x1430250, node=0x122f2f0, escape=0x0, escape_ctx=0x0) at src/main/xlat.c:2528 #21 0x00007ffff7bc22c5 in radius_axlat_struct (out=0x7fffffffd450, request=0x1430250, xlat=0x122f2f0, escape=0x0, ctx=0x0) at src/main/xlat.c:2676 #22 0x00007ffff7bab00e in map_to_vp (ctx=0x1430250, out=0x7fffffffd4e0, request=0x1430250, map=0x122e560, uctx=0x0) at src/main/map.c:821 #23 0x00007ffff7babfc6 in map_to_request (request=0x1430250, map=0x122e560, func=0x7ffff7baabe2 <map_to_vp>, ctx=0x0) at src/main/map.c:1141 #24 0x0000000000430eaa in modcall_update (request=0x1430250, stack=0x7fffffffd7d0, presult=0x7fffffffd770, priority=0x7fffffffd76c) at src/main/interpreter.c:587 #25 0x00000000004316c4 in modcall_recurse (request=0x1430250, stack=0x7fffffffd7d0, presult=0x7fffffffd7cc, ppriority=0x7fffffffd7c8) at src/main/interpreter.c:839 #26 0x0000000000431ad4 in modcall (component=MOD_AUTHORIZE, c=0x121ff10, request=0x1430250) at src/main/interpreter.c:1002 #27 0x0000000000427c2e in indexed_modcall (comp=MOD_AUTHORIZE, idx=0, request=0x1430250) at src/main/modules.c:977 #28 0x0000000000429dd0 in process_authorize (autz_type=0, request=0x1430250) at src/main/modules.c:2080 #29 0x000000000040f993 in rad_authenticate (request=0x1430250) at src/main/auth.c:435 #30 0x000000000043ad2b in request_running (request=0x1430250, action=1) at src/main/process.c:1482 #31 0x0000000000439a3f in request_queue_or_run (request=0x1430250, process=0x43abc9 <request_running>) at src/main/process.c:953 #32 0x000000000043b642 in request_receive (ctx=0x142feb0, listener=0xdd8620, packet=0x142ff10, client=0xdd3760, fun=0x40f6ee <rad_authenticate>) at src/main/process.c:1739 #33 0x00000000004199f9 in auth_socket_recv (listener=0xdd8620) at src/main/listen.c:1898 #34 0x00000000004427a9 in event_socket_handler (xel=0x13575d0, fd=13, ctx=0xdd8620) at src/main/process.c:4542 #35 0x00007ffff796ee5d in fr_event_loop (el=0x13575d0) at src/lib/event.c:637 #36 0x0000000000444694 in radius_event_process () at src/main/process.c:5585 #37 0x00000000004326ec in main (argc=2, argv=0x7fffffffe6a8) at src/main/radiusd.c:586 Unfortunately I need the process to carry on, so I can't debug any further (until the problem happens again). Hopefully the above will be sufficient for someone. Thanks Andy

2 1

Freeradius+CMTS
by Suporte2 - TVC Tubarão 22 Feb '16

22 Feb '16

Also I am trying to implement the freeradius DHCP with a cable modem network. What could so far has been listening to port 67, receive the request of the CMTS have the SQL query and return to the CMTS. Log in to CMTS in dhcp(d), but in freeradius debug appear as sent to the CMTS. Someone who has gone through this problem you can help me? I believe that all routing settings are made. I'm getting the requisiçãoe as debug Freeradius is sending. For testing, before putting on the network, I am using a BSR2000. In debug freeradius Received DHCP-Discover of id 072b475c from 10.250.0.1:68 to 172.18.1.54:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 120276828 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 10.250.0.1 DHCP-Client-Hardware-Address = 00:21:43:27:31:5e DHCP-Message-Type += DHCP-Discover DHCP-DHCP-Maximum-Msg-Size += 600 DHCP-Vendor-Class-Identifier += "docsis2.0:053501010102010203010104010105010106010107010f0801100901000a01010 b01180c01010d0200700e0200100f0101100400000004" DHCP-Parameter-Request-List += DHCP-TFTP-Server-Name DHCP-Parameter-Request-List += DHCP-Boot-File-Name DHCP-Parameter-Request-List += DHCP-Subnet-Mask DHCP-Parameter-Request-List += DHCP-Router-Address DHCP-Parameter-Request-List += DHCP-Time-Offset DHCP-Parameter-Request-List += DHCP-Time-Server DHCP-Parameter-Request-List += DHCP-Log-Server DHCP-Parameter-Request-List += DHCP-CCC DHCP-Client-Identifier += 00:21:43:27:31:5e DHCP-Vendor += 0x020345434d030845434d3a454d54410503312e30061e534256353132312d5349502d312e30 2e372d53434d2d30352d53485043200703382e3508063030323034300907534256353132310a 144d6f746f726f6c6120436f72706f726174696f6e0418313538333630383134373035303935 343031303131303238 DHCP-Relay-Remote-Id = 0x00214327315e server dhcp { Trying sub-section dhcp DHCP-Discover {...} +group DHCP-Discover { ++update reply { ++} # update reply = noop ++update reply { expand: %{Packet-Dst-IP-Address} -> 172.18.1.54 ++} # update reply = noop [sql] expand: %{DHCP-Client-Hardware-Address} -> 00:21:43:27:31:5e [sql] sql_set_user escaped user --> '00:21:43:27:31:5e' rlm_sql (sql): Reserving sql socket id: 25 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id; -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:21:43:27:31:5e' ORDER BY id; rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:21:43:27:31:5e' ORDER BY id; [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id; -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '00:21:43:27:31:5e' ORDER BY id; rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '00:21:43:27:31:5e' ORDER BY id; [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '00:21:43:27:31:5e' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = '00:21:43:27:31:5e' ORDER BY priority rlm_sql (sql): Released sql socket id: 25 ++[sql.authorize] = ok ++policy dhcp_sqlippool.post-auth { +++update request { expand: DHCP-%{DHCP-Client-Hardware-Address} -> DHCP-00:21:43:27:31:5e expand: %{DHCP-Client-Hardware-Address} -> 00:21:43:27:31:5e expand: %{DHCP-Gateway-IP-Address} -> 10.250.0.1 expand: %{%{DHCP-Gateway-IP-Address}:-127.0.0.1} -> 10.250.0.1 +++} # update request = noop [sqlippool] No Pool-Name defined. [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No Pool-Name defined (did cli 00:21:43:27:31:5e port user DHCP-00:21:43:27:31:5e) No Pool-Name defined (did cli 00:21:43:27:31:5e port user DHCP-00:21:43:27:31:5e) +++[sqlippool] = noop +++? if (ok) ? Evaluating (ok) -> FALSE +++? if (ok) -> FALSE ++} # policy dhcp_sqlippool.post-auth = noop ++[ok] = ok +} # group DHCP-Discover = ok DHCP: Reply will be unicast to giaddr from original packet } # server dhcp DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 120276828 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 10.250.0.100 DHCP-Your-IP-Address = 10.250.0.101 DHCP-Server-IP-Address = 172.18.1.54 DHCP-Gateway-IP-Address = 10.250.0.1 DHCP-Client-Hardware-Address = 00:21:43:27:31:5e DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "cm_mta_5121_10m.bin" DHCP-Subnet-Mask = 255.255.255.0 DHCP-Time-Offset = 4294956496 DHCP-Router-Address = 10.250.0.1 DHCP-Time-Server = 172.18.1.3 DHCP-Domain-Name-Server = 177.125.104.15 DHCP-Log-Server = 172.18.1.3 DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.18.1.54 DHCP-DHCP-Server-Identifier = 172.18.1.54 DHCP-DHCP-Maximum-Msg-Size = 600 DHCP-TFTP-Server-Name = "172.18.1.3" DHCP-CCC = 0x3137322e31382e312e35 Sending DHCP-Offer of id 072b475c from 172.18.1.54:67 to 10.250.0.1:68 Finished request 5. Cleaning up request 5 ID 120276828 with timestamp +193 Going to the next request Ready to process requests. IN CMTS show cable modem Interface Prim Connect Timing Rec Ip Address Mac Address Sid State Offset Power Cable 0/0/D0/U0/C0 0 offline 0 0.0.0.0 0024.a081.b618 Cable 0/0/D0/U0/C0 2011 dhcp(d) 1435 -.2 0.0.0.0 0021.4327.315e I can run the 'ping' command BSR2K to the DHCP server and the DHCP server to BSR2K. The 'ip-helper-address' parameter is set to my DHCP server. I see the logs that the DHCP request comes to the server, the server handles this request and delivery to the CMTS (BSR2K). I believe that the CMTS is not delivering the IP to the CM. Has anyone used the Freeradius DHCP server? Can pass the parameters in the configuration file Freeradius? I appreciate any help! --- Este email foi escaneado pelo Avast antivírus. https://www.avast.com/antivirus

3 3

Best way to deny users not matching any groups in the SQL DB
by Sylvain Munaut 22 Feb '16

22 Feb '16

Hi, I'm using radius to control access to access points (several SSIDs) using both PEAP and EAP-TLS, control a vpn server and also 802.1x switch ports. I have one group defined per service (so one per wifi SSID, one for VPN, ...) that make sure that the correct returns attributes are in the response. What I'd like is that if either : - The user doesn't exist at all in the DB - Or the user exists but it didn't match any groups (because the user doesn't have access to the particular service he's trying to use). Then access should be denied. What's the recommended way to achieve that result ? All the ones I'm thinking of seem pretty messy so I must be missing something, and given it's pretty easy to omit something and open a big security hole, I'd rather have some expert opinion here. Cheers, Sylvain Munaut

3 17

rlm_ python how to find imported modules?
by Jim Whitescarver 22 Feb '16

22 Feb '16

In sites-config/python there is python_path = ${modconfdir}/${.:name} I need /usr/lib/python2.7 in the path. I don't know hoe to add it. I tried setting the PYTHONPATH environment variabe before starting radiusd but that does not help. Thanks, Jim

4 6

How to add VAP based on LDAP group membership
by Thomas Stather 22 Feb '16

22 Feb '16

Hi I have a RADIUS setup (eduroam) where the users are authenticated against LDAP (mod_ldap, not ntlm_auth) for our own domain. All other users are proxied to a RadSec proxy. This works fine, but now we need the possibility to replace the Aruba-User-VLAN VAP with a different VLAN ID, if some users from our domain can be found in a special LDAP group (i.e. cn=testgroup). If not, the users should get assigned the Aruba-User-VLAN VAP 31. What do i have to change in my setup in order to make this work? In my /etc/raddb/sites-enabled/testsite i have: ... post-auth { #reply_log #redundant_ldap #exec Post-Auth-Type REJECT { attr_filter.access_reject } ### enable debug logging from here on #update control { # Tmp-String-0 = "%{debug:2}" #} if (Realm == "testdomain.de") { update reply { Aruba-User-Vlan = "31" } } } Best, Thomas ... -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

6 18

authenticating against local LDAP and Jumpcloud LDAP
by Michael Martinez 21 Feb '16

21 Feb '16

I'm new to Freeradius, so I'm looking either for an actual answer on how to do what I need, or to point me towards the right documentation so I can learn enough about how Freeradius config files are processed so that I can figure out the solution on my own. The situation is this: I've got a Freeradius server that successfully authenticates Wifi devices with EAP-TTLS with PAP for the inner tunnel. The system also works for ssh clients with PAM authentication. I set up it myself following different instructions, half-knowing but not really knowing what I was doing. But it works. Recently I set up an LDAP directory in Jumpcloud. Their instructions for integrating with Freeradius also are for PAP within TTLS, and involve making one change in the sites-available/inner-tunnel file: within the authorize{} block, move the following to the bottom of the block update control { Proxy-To-Realm := LOCAL } and insert Auth-Type := `/bin/bash /opt/RadiusCheck/CheckUser.sh '%{User-Name}' '%{User-Password}'` immediately after the Proxy-to-Realm line. The CheckUser.sh script is just a simple shell script that makes an LDAP query to Jumpcloud and returns a success or fail. Okay, I don't know what "update control" is for. I don't know how the authorize section works, but I made the changes and tested it out and it works fine for my Jumpcloud user. But it doesn't work anymore for my local LDAP users because irying to authenticate all users against jumpcloud. What I'd like is for the local ldap database to be queried first. And if that fails, then to check the Jumpcloud directory. Looking through the inner-tunnel file I see a few references to ldap, but these are all commented out, so I'm not clear how/where the local ldap database is being queried. -- ---

3 13

Accept all Auth requests while replying individual parameters
by Pavel Uhliar 21 Feb '16

21 Feb '16

Hi guys. I am trying to modify existing FreeRADIUS setup (version 2.1.12) to accept all Auth requests, while responding to them with individual parameters (Framed-IP-Address and Framed-Route) based on Calling-Station-Id. I am in a running environment, where until now login requests are authorized by User-Name/Password based on radcheck table and individual parameters are sent based on the User-Name from radreply table and combined with group parameters from radgroupreply table (all MySQL). Users are paired to groups by individual entries in usergroup table I would like to keep intact as much of the structure as possible, I just need to stop verifying User-Name/Password (because now whoever is able to access physical infrastructure is authorized to use it) and change the individual responses to be based on Calling-Station-Id instead of User-Name. I don't care about group, I do not need to distinguish between groups anymore, so I can move group parameters to default response once I solve the major issue with sending the individual parameters. First I thought the solution will be quite simple: 1) I change the SQL query selecting from radreply table to be based on Calling-Station-Id 2) I add "DEFAULT Auth-Type := Accept" and "Fall-Through=Yes" in /etc/raddb/users file Step 1 is OK, no problem (change in /etc/raddb/sql/mysql/dialup.conf) Problem is in Step 2. It does authorize all requests as expected (even those not matching User-Name/Password records in radcheck table), but when the User-Name/Password in request does not match User-Name/Password in radcheck, RADIUS skips querying the radreply table for additional parameters. This results in Auth response containing only parameters from radgroupreply table, but none from radreply. Requests containing User-Name/Password matching to those in radcheck get full responses (with radgroupreply and radreply) Here is comparison of debug output between authorization with valid credentials and invalid ones: Valid: [files] users: Matched entry DEFAULT at line 46 ++[files] returns ok [sql] expand: %{User-Name} -> XXXX [sql] sql_set_user escaped user --> 'XXXX' rlm_sql (sql): Reserving sql socket id: 7 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE ... ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE ... ORDER BY id [sql] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='XXXX' [sql] expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id [sql] User found in group YYYY [sql] expand: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 7 ++[sql] returns ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user expand: Auth-Type: %{control:Auth-Type} -> Auth-Type: Accept Login OK: [XXXX] (from client xxx port xxx cli xxx) Auth-Type: Accept Invalid credentials (output is the same, just the radreply query is missing). [files] users: Matched entry DEFAULT at line 46 ++[files] returns ok [sql] expand: %{User-Name} -> XXXX [sql] sql_set_user escaped user --> 'XXXX' rlm_sql (sql): Reserving sql socket id: 9 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE ... ASC LIMIT 1 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='XXXX' [sql] expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id [sql] User found in group YYYY [sql] expand: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'XXXX' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 9 ++[sql] returns ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user expand: Auth-Type: %{control:Auth-Type} -> Auth-Type: Accept Login OK: [XXXX] (from client xxx port xxx cli xxx) Auth-Type: Accept I was trying to find some solution, did try "query_on_not_found" configuration directive, did play with "Fall-Through", but nothing seems to work. I was not able to force RADIUS to do the radreply query for not-matched credentials. As other ways to solve the problem, I was trying to use policy to rewrite User-Name/Password in request to a Calling-Station-Id/<universal-password> to have all request authorized under my control, but this is not feasible as devices do not use only PAP, but also CHAP and MSCHAP, and password rewriting does not work for CHAP/MSCHAP requests. Another way I was trying was to setup policy that will add parameters "by hand" based on SQL query to radreply table. This I can do for Framed-IP-Address (which is only one for each user), but I am not able to do it for Framed-Route, as there can be zero or multiple Framed-Route entries for every user. I am dead stuck, I will appreciate any hints to solve the problem. Thanks a lot, Pavel

3 4

openssl gendh during make install
by Michael Ströder 19 Feb '16

19 Feb '16

HI! Is it really necessary to invoke "openssl gendh" during "make install"? It wastes time on automated build systems, especially when building in VMs for armv6. After installing RPMs one would have to regenerate DH params anyway. Ciao, Michael.

3 3

No Logon Servers error with FreeRADIUS + NTLM
by Stefan Paetow 19 Feb '16

19 Feb '16

Hi, I know this is not a problem with FreeRADIUS, however, there are several people on this list who run FreeRADIUS with Active Directory as a back end and I need their advice on this. I've run into the dreaded "No logon servers (0xc000005e)" error with NTLM. In the past I've found that the computer password for the server expired on AD and that it was either fixed by rejoining, or by tweaking the password's expiry. Do any AD folk on the list know what we can do to get this stable and that this does not occur again? Any ideas will be very useful. :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 1