- Freeradius-Users - lists.freeradius.org

unlang mapping different users to different authentication source
by James Chen 02 Feb '16

02 Feb '16

Hi! Experts Sorry for wide distributing, we want to use unlang to mapping different users to different authentication module. For example, mapping all users from SSID gold to LDAP module and mapping all users from SSID silver to SQL module. Below is our simple test unlang configuration: if ("%{request:Aruba-Essid-Name}" == "microshield-test" ) { ldap } else { sql } But from the "radius -X” debug message we found the freeREDIUS will still go through both LDAP and SQL module: # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++? if ("%{request:Aruba-Essid-Name}" == "microshield-test" ) expand: %{request:Aruba-Essid-Name} -> ? Evaluating ("%{request:Aruba-Essid-Name}" == "microshield-test" ) -> FALSE ++? if ("%{request:Aruba-Essid-Name}" == "microshield-test" ) -> FALSE ++else else { [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '娴?璇?ㄦ?风' ORDER BY id [sql] User found in group 娴?璇?ㄦ?风 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '娴?璇?ㄦ?风' ORDER BY id rlm_sql (sql): Released sql socket id: 3 +++[sql] = ok ++} # else else = ok ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '娴?璇?ㄦ?风' ORDER BY id [sql] User found in group 娴?璇?ㄦ?风 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '娴?璇?ㄦ?风' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] = ok [ldap] performing user authorization for test [ldap] expand: (sAMAccountName=%{User-Name}) -> (sAMAccountName=test) [ldap] expand: dc=ms,dc=local -> dc=ms,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 192.168.254.102:389, authentication 0 [ldap] bind as cn=Administrator,cn=Users,dc=ms,dc=local/1qaz!QAZ to 192.168.254.102:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=ms,dc=local, with filter (sAMAccountName=test) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] Setting Auth-Type = LDAP [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlytrafficcounter] = noop rlm_sqlcounter: Entering module authorize code WARNING: Please replace '%k' with '${key}' sqlcounter_expand: 'SELECT SUM(acctsessiontime - GREATEST((1454256000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1454256000'' [monthlycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1454256000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1454256000' -> SELECT SUM(acctsessiontime - GREATEST((1454256000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='test' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1454256000' WARNING: Please replace '%S' with '${sqlmod-inst}' sqlcounter_expand: '%{sql:SELECT SUM(acctsessiontime - GREATEST((1454256000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='test' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1454256000'}' [monthlycounter] sql_xlat [monthlycounter] expand: %{User-Name} -> test [monthlycounter] sql_set_user escaped user --> 'test' [monthlycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1454256000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='test' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1454256000' -> SELECT SUM(acctsessiontime - GREATEST((1454256000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='test' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1454256000' rlm_sql (sql): Reserving sql socket id: 1 [monthlycounter] row[0] returned NULL rlm_sql (sql): Released sql socket id: 1 [monthlycounter] expand: %{sql:SELECT SUM(acctsessiontime - GREATEST((1454256000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='test' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1454256000'} -> rlm_sqlcounter: No integer found in string "" ++[monthlycounter] = noop +} # group authorize = ok Found Auth-Type = LDAP # Executing group from file /etc/raddb/sites-enabled/default +group LDAP { [ldap] login attempt by "test" with password "123456" [ldap] user DN: CN=test,CN=Users,DC=ms,DC=local [ldap] (re)connect to 192.168.254.102:389, authentication 1 [ldap] bind as CN=test,CN=Users,DC=ms,DC=local/123456 to 192.168.254.102:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user test authenticated succesfully ++[ldap] = ok +} # group LDAP = ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +group post-auth { ++? if (control:Auth-Type == 'LDAP') ? Evaluating (control:Auth-Type == 'LDAP') -> TRUE ++? if (control:Auth-Type == 'LDAP') -> TRUE ++if (control:Auth-Type == 'LDAP') { +++update reply { expand: We are using %{control:Auth-Type} authentication -> We are using LDAP authentication +++} # update reply = noop ++} # if (control:Auth-Type == 'LDAP') = noop +} # group post-auth = noop Sending Access-Accept of id 73 to 127.0.0.1 port 51620 Reply-Message = "We are using LDAP authentication" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 73 with timestamp +4 Ready to process requests. Is this the expected behavior? We want to use only one module depend on request attribute, is this achievable? Thanks for your help! BR! Chen Jiang Microshield Technology Co., Ltd 北京市海淀区西三环北路50号豪柏大厦C2座18-19层 100048 (86)10-88518768 (86)18612696123

3 2

%Z variable or otherwise
by Louis Munro 02 Feb '16

02 Feb '16

Hello, There used to be a %Z variable which held the whole request in FR 2 and older. I understand that it’s gone in FR 3. Is there a way to get the same behaviour in 3.xx with another variable or some other unlang way? I used to send it to a database (with the sql post-auth query) indexed by username / calling station-id so I could look up the exact request after the fact and see all attributes sent by the NAS. ‘%Z’ allowed me to insert it in the database without having to know in advance what attributes would be sent. Thank you for your help, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 2

Make file error on Solaris
by Marco 02 Feb '16

02 Feb '16

Hi, i trying to install the Freeradius Server v3.0.11 on the Solaris 5.10 sparc i have installed latest gnu release of the grep and awk tools, i've also listed their paths on the first position of the PATH to set these as default tools Starting from a fresh installation, these are the steps: # ./configure --prefix=<install-dir> (this seems completed with minor warnings) # gmake CC jlibtool.c HEADER src/include/attributes.h /bin/sh: ATTRIBUTE: not found Usage: grep [OPTION]... PATTERN [FILE]... Try 'grep --help' for more information. /bin/sh: VALUE: not found Usage: grep [OPTION]... PATTERN [FILE]... Try 'grep --help' for more information. HEADER src/include/features.h /bin/sh: s,#[\\t ]*ifdef[\\t ]*" $2 "$,#if "$3 ",g;s,#[\\t ]*ifndef[\\t ]*" $2 "$,#if !"$3 ",g;s,defined(" $2 ")," $3 ",g;"}: not found gmake: *** [src/include/autoconf.sed] Error 1 Usage: grep [OPTION]... PATTERN [FILE]... Try 'grep --help' for more information. it seems related to the processing of the file src/include/all.mk i can't go ahead.... I have a very similar problem with the v3.0.10, while no problems with v2.2.0 & v2.2.9 in the same machine (All works fine on Linux) any advice? Thanks Marco

3 8

Removal of built in OpenSSL TLS cache in v3.1.x
by Arran Cudbard-Bell 02 Feb '16

02 Feb '16

The built in OpenSSL TLS cache has been permanently disabled in v3.1.x as per https://github.com/FreeRADIUS/freeradius-server/issues/1493. The new TLS cache uses a virtual-server with different Autz-Type sections representing the different cache actions. The TLS session blob is made available in &session-state:TLS-Session-Data and the session ID is available in &TLS-Session-ID. Certificate attributes have been moved to the &session-state: list for easy caching. The tls-cache virtual server and cache_tls_module instance are included in the default config, and replicate the behaviour of the OpenSSL cache. The current cache drivers are: - memcached - redis - rbtree If people think it would be valuable, I have about 50% of an rlm_cache driver that stores cache entries using a file system, it can be prioritised for completion before v3.2.0 is released. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

TLS: warning: cacertdir not implemented for gnutls
by Will W. 01 Feb '16

01 Feb '16

Hey Guys, Did a fresh pull of freeradius 3.1.0 this morning on a new ubuntu 14.04 instance. Trying to get my LDAP configured and I am getting an error with TLS: warning: cacertdir not implemented for gnutls lm_ldap (ldap) - libldap vendor: OpenLDAP, version: 20431 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap) - Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 retry_delay = 30 spread = no } rlm_ldap (ldap) - Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap) - Connecting to ldaps://ldap.myhost.com:636 TLS: gcry_control GCRYCTL_SET_RNDEGD_SOCKET failed TLS: warning: cacertdir not implemented for gnutls rlm_ldap (ldap) - Failed setting connection option new TLS context: Unknown error rlm_ldap (ldap) - Opening connection failed (0) rlm_ldap (ldap) - Removing connection pool /etc/freeradius/mods-enabled/ldap[8]: Instantiation failed for module "ldap" freeradius -X output http://pastebin.com/hg8TMXKn <http://pastebin.com/hg8TMXKn> I am trying to see if there is something I can change in freeradius while I am tracking it down on the gnutls as well. thanks Will

3 5

Requiring a valid user-group-groupcheck before sending a response
by Benjamin Oh 01 Feb '16

01 Feb '16

Is it possible to authenticate or deny a request based on the radgroupcheck and radusergroup being 'satisfied'? Basically I want to make sure that all 3 of the following are satisfied: 1) the user is in a proper group (radusergroup) 2) the request is coming from a valid IP (radgroupcheck using NAS-IP-Address) 3) the user/password is valid of course (radcheck) The issue I have is a user can supply a valid user/password combination, but not have the required group membership in radusergroup, but still be pass authentication which only looks at radcheck (user/password) and nothing else. My desire is to be able to isolate different environments by group and NAS-IP-Address. There may be a much more elegant way of getting this done, which I'm open to as well.

1 0

cui question FR 3.0.11
by Alex Sharaz 01 Feb '16

01 Feb '16

Hi, Just been browsing through my cui config on a FR 3.0.11 outward facing server and found the following accounting detail logging ...... FreeRADIUS-Acct-Session-Start-Time = "Feb 1 2016 09:39:17 GMT" Module-Failure-Message = "regex failed: Found null in subject at offset 18. String unsafe for evaluation" Module-Failure-Message = "Failed retrieving values required to evaluate condition" Acct-Unique-Session-Id = "0ab90a46c2f04499b46b7d9265696856" Stripped-User-Name = "jcm1k" Realm = "DEFAULT" SQL-User-Name = "jcm1k" Chargeable-User-Identity = 0x ........ So, 1). Module-Failure-Message - never seen this in a debug log before. Assuming its something specific to FR 3.x. What's it associated with? 2). Chargeable-User-Identity = 0x Should I see this or should I see the whole string? A

3 5

Freeradius 3.x For Openwrt, Please ?
by Bruno D'Ambrosio 01 Feb '16

01 Feb '16

Hi Mate I would like to know if it is already available FreeRADIUS 3.x for openwrt? By Bruno D'Ambrosio

2 2

v3.1.x - Directory specific admonitions
by Arran Cudbard-Bell 30 Jan '16

30 Jan '16

Added some basic directory fingerprinting... rlm_ldap (ldap) - Opening additional connection (0), 1 of 24 pending slots used rlm_ldap (ldap) - Connecting to ldap://192.168.43.57:389 rlm_ldap (ldap) - Waiting for bind result... rlm_ldap (ldap) - Bind successful rlm_ldap (ldap) - Performing search in "" with filter "(objectclass=*)", scope "base" rlm_ldap (ldap) - Waiting for search result... rlm_ldap (ldap) - Directory type: OpenLDAP if (!fr_pair_find_by_num(request->config, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY) && !fr_pair_find_by_num(request->config, 0, PW_NT_PASSWORD, TAG_ANY) && !fr_pair_find_by_num(request->config, 0, PW_USER_PASSWORD, TAG_ANY) && !fr_pair_find_by_num(request->config, 0, PW_PASSWORD_WITH_HEADER, TAG_ANY) && !fr_pair_find_by_num(request->config, 0, PW_CRYPT_PASSWORD, TAG_ANY)) { if (!inst->directory->cleartext_password) switch (inst->directory->type) { case LDAP_DIRECTORY_ACTIVE_DIRECTORY: RWDEBUG("!!! Found map between LDAP attribute and a FreeRADIUS password attribute"); RWDEBUG("!!! Active Directory does not allow passwords to be read via LDAP"); RWDEBUG("!!! Remove the password map and either:"); RWDEBUG("!!! - List %s in the authenticate section, and set attribute " "&control:Auth-Type := '%s' (pap only)", inst->name, inst->name); RWDEBUG("!!! - Configure authentication via ntlm_auth (mschapv2 only)"); RWDEBUG("!!! - Configure authentication via wbclient (mschapv2 only)"); break; case LDAP_DIRECTORY_EDIRECTORY: RWDEBUG("!!! Found map between LDAP attribute and a FreeRADIUS password attribute"); RWDEBUG("!!! eDirectory does not allow passwords to be retrieved via LDAP search"); RWDEBUG("!!! Remove the password map and either:"); RWDEBUG("!!! - Set 'edir = yes' and enable the universal password feature on your " "eDir server (recommended)"); RWDEBUG("!!! - List %s in the authenticate section, and set attribute " "&control:Auth-Type := '%s' (pap only)", inst->name, inst->name); break; default: no_password: if (!inst->admin_identity) { RWDEBUG("No \"known good\" password added. Ensure \"%s\" has permission to " "read the user's password attribute", inst->admin_identity); } else { RWDEBUG("No \"known good\" password added. Set 'identity' to the dn of an " "account that has permission to read the user's password attribute"); } break; } else goto no_password; } The first user to post either of those messages to the list earns an instaban ;) -Arran

1 0

trying to get PAP-inside-TTLS working for PAM
by Michael Martinez 29 Jan '16

29 Jan '16

I am running freeradius-2.1.12. According to the last post of the following thread - http://lists.freeradius.org/pipermail/freeradius-users/2013-February/064927… - it is possible to get radius to authenticate against PAM by configuring it to use PAP inside of TTLS. The first and final posts of that thread provide the configuration that the poster used to get it working. In /etc/freeradius/users, I have DEFAULT Auth-Type := PAM In /etc/pam.d/radiusd, I have the following: ## auth requisite /lib/arm-linux-gnueabihf/security/pam_google_authenticator.so secret=/home/${USER}/.google_authenticator nullok forward_pass auth sufficient pam_ldap.so use_first_pass auth required pam_unix.so use_first_pass ## In /etc/pam.d/sshd, I have the following lines immediately before the usual @include common-auth line: auth sufficient pam_radius_auth.so # Additionally, I have mimick'ed the configuration given in the aforementioned thread - the the eap.conf changes, and sites-enabled changes. This configuration works perfectly for ssh clients. It works for both ldap users and local unix users who ssh in from another linux box. I can see in /var/log/auth.log and the radius debug log that the user's verfication code is being checked and that their password is being checked against ldap. But this setup is not working for network devices such as iPad, that are connecting to a wireless access point, and trying to login with an ldap user. Said network devices do work but only for users explicitly given in the /etc/freeradius/users file with a plaintext password attribute. The wireless device is configured to use PAP inside TTLS, as per instructions here: http://cloudessa.com/tips-and-tricks/how-to-setup-eap-ttls-with-inner-pap-o… Freeradius debug log: EAP-Message = 0x0201000a017465737432 Message-Authenticator = 0xe3e9b79324821a27d40811ef6a24de9a Fri Jan 22 23:43:36 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri Jan 22 23:43:36 2016 : Info: +- entering group authorize {...} Fri Jan 22 23:43:36 2016 : Info: ++[preprocess] returns ok Fri Jan 22 23:43:36 2016 : Info: ++[chap] returns noop Fri Jan 22 23:43:36 2016 : Info: ++[mschap] returns noop Fri Jan 22 23:43:36 2016 : Info: ++[digest] returns noop Fri Jan 22 23:43:36 2016 : Info: [suffix] No '@' in User-Name = "test2", looking up realm NULL Fri Jan 22 23:43:36 2016 : Info: [suffix] No such realm "NULL" Fri Jan 22 23:43:36 2016 : Info: ++[suffix] returns noop Fri Jan 22 23:43:36 2016 : Info: [eap] EAP packet type response id 1 length 10 Fri Jan 22 23:43:36 2016 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Fri Jan 22 23:43:36 2016 : Info: ++[eap] returns updated Fri Jan 22 23:43:36 2016 : Info: [files] users: Matched entry DEFAULT at line 216 Fri Jan 22 23:43:36 2016 : Info: ++[files] returns ok Fri Jan 22 23:43:36 2016 : Info: ++[expiration] returns noop Fri Jan 22 23:43:36 2016 : Info: ++[logintime] returns noop Fri Jan 22 23:43:36 2016 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Fri Jan 22 23:43:36 2016 : Info: ++[pap] returns noop Fri Jan 22 23:43:36 2016 : Info: Found Auth-Type = PAM Fri Jan 22 23:43:36 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri Jan 22 23:43:36 2016 : Info: +- entering group authenticate {...} Fri Jan 22 23:43:36 2016 : Auth: rlm_pam: Attribute "User-Password" is required for authentication. Fri Jan 22 23:43:36 2016 : Info: ++[pam] returns invalid Fri Jan 22 23:43:36 2016 : Info: Failed to authenticate the user. Fri Jan 22 23:43:36 2016 : Info: Using Post-Auth-Type Reject Fri Jan 22 23:43:36 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri Jan 22 23:43:36 2016 : Info: +- entering group REJECT {...} - Michael Martinez -- ---

3 3