- Freeradius-Users - lists.freeradius.org

About dubblicate username.
by Serkan Kasap 01 Dec '15

01 Dec '15

> Hi, > am not professional like yours. > İs it possible to use dubblicate user name in radius with mysql connection. When i do. Login error. > > Serkan

2 1

Doubts about redundant { ...} section
by Jorge Pereira 01 Dec '15

01 Dec '15

Hi, Anyone know if is possible to retrieve a rcode from redundant section? e.g: redundant { sql_accounting detail_buffered_queue } if (rcode != ok) { linenlog-problems-with-redundant-acct } -- Jorge Pereira

2 2

different logs for different failures
by Stefano Zanmarchi 01 Dec '15

01 Dec '15

Hallo, we are allowing access only to users with correct password (obviously), given that some conditions based on a sql query are met: server eduroam-inner-tunnel { authorize { preprocess rewrite.calling_station_id if ("%{sql:SELECT count(*) FROM ... WHERE ... AND condition1 AND condition2 AND condition3}" >= 1) { ok update control { Auth-Type := Accept } } else { reject } auth_log eap openldap mschap } authenticate { ntlm_auth Auth-Type MS-CHAP { mschap } eap } post-auth { if ( "%{outer.request:User-Name}" != "%{User-Name}" ){ reject } reply_log Post-Auth-Type REJECT { reply_log } } I't working fine, but the logs always show "Login incorrect", without detailing what caused the failure: Nov 30 15:28:50 radius1 freeradius[2248]: Login incorrect: [myuser(a)myorg.it] (from client foobar.myorg.it port 0 cli F8450AEFD221) I'd like to have something like: Nov 30 15:28:51 radius1 freeradius[2248]: Condition1 not met: [ myuser(a)myorg.it] (from client foobar.myorg.it port 0 cli F8450AEFD221) Nov 30 15:28:52 radius1 freeradius[2248]: Login incorrect: [ youruser(a)myorg.it] (from client foobar.myorg.it port 0 cli F8450AEFD222) Nov 30 15:28:53 radius1 freeradius[2248]: Condition2 not met: [ hisuser(a)myorg.it] (from client foobar.myorg.it port 0 cli F8450AEFD223) Is it possible to achieve this? Thank you very much for your help, Stefano

8 21

Logging the home server in post_proxy logs
by Chris Taylor (chtaylo2) 01 Dec '15

01 Dec '15

Hi, I have have 4 home servers configured which radius request are proxied to using type = fail-over and would like to log which home server handle a request at any given time. In the Post proxy logs: detail post_proxy_log { detailfile = ${radacctdir}/%d/post-proxy-detail-%H:00 header = "%{NAS-IP-Address} - %t" detailperm = 0600 } Is there a way to log which server handled the proxy in this log or even the main radiusd.conf log? Thanks

3 3

How to configure Radius to provide Linux user permissions and rights
by Michael Martinez 30 Nov '15

30 Nov '15

A radius 2.2.9 server authenticates Linux users via the pam module. Is it possible for Radius to not only very password, but also provide the users with their Linux permissions - their group memberships and other such things? If so, how to configure this? Other traditional ways of doing this, such as ldap or NIS, work by interacting with PAM or nsswitch, and can be cached in nscd. But I'm not seeing a way to integrate radius into this. Different sources online mention that radius can pass group membership back to the client but they don't explain how to configure it. Any help appreciated, Michael -- ---

2 2

RE: UPN and mschap issues
by Franks Andy (IT Technical Architecture Manager) 29 Nov '15

29 Nov '15

Thanks all for your contributions on this, REALLY appreciate this list! I'll keep coming here, until the management replace it all with clearpass or something equally non-fun, looming sadly.. Andy ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of A.L.M.Buxey(a)lboro.ac.uk [A.L.M.Buxey(a)lboro.ac.uk] Sent: 28 November 2015 12:12 To: FreeRadius users mailing list Subject: Re: UPN and mschap issues Hi, dont use User-Name - you cant play with that..instead either work on the stripped-user-name or create your own attribute locally and use that on the ntlm_auth line what you need to do is some regex to turn the current User-Name, or stripped-user-name that has already dealt with the realm part giving you just the stripped name.... into the format you need for it to match the saMAccountname perhaps some people should have been made aware of all this in some form of change management process before the AD was messed around with? FreeRADIUS will let you do what you want using regex and recombining the results of the regex into the format you want..... but external systems like Office365...well, they will probably be a big headache if you migrate to them alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

UPN and mschap issues
by Franks Andy (IT Technical Architecture Manager) 28 Nov '15

28 Nov '15

Hi all, I'm a bit stuck again. FR 3.1.0. For various reasons, we've had to start changing our AD samaccountname and upn values to be slightly different. We can't get around this. When they were the same, the various canonicalization routines stripped off the domain and the result was the same, username == samaccountname == stripped upn. This worked fine with ntlm and mschap based auth, even if the user was logged into the machine with their UPN (the default for PEAP-EAP-MSCHAP is that it uses the logged in credentials with Windows). Now, since the UPN format is "firstname.surname@domain<mailto:firstname.surname@domain>" and samaccountname is "surnameinitial" we have issues. The LDAP lookup is fine with an "OR" operator on the filter so PEAP-EAP-TLS and EAP-TLS work, and I can do a (nasty) UPN -> Samaccountname lookup via an LDAP xlat when matching the UPN format so NTLM auth is fine for PAP, as long as we tell it to use the new user name (I update Stripped-User-Name and tell ntlm_auth to use that, not sure if that's a horrible thing to do). Anything inside the EAP tunnel doesn't like you playing with the username though, so we can't do UPN based MSCHAPv2 lookup - UPN format doesn't work, as far as I can tell, with the ntlm_auth program and I can't update the username. I can force the mschap auth process to use an alternative user name, but the hash then doesn't work, and I can't work out how to update the mschap:user-name. All this is nasty. Has anyone ever done anything better? I can't really find many people being successful with ntlm_auth and upn format, I can't do ldap - mschapv2 auth afaik, so maybe I just state that we can't do upn -> mschapv2 and stick to certs? Maybe there's something really obviously simple that I'm missing.. Sorry for the disjointed ramble. Thanks Andy

4 3

RE: UPN and mschap issues
by Franks Andy (IT Technical Architecture Manager) 28 Nov '15

28 Nov '15

Thanks Phil, Suspected as much, I've checked the previous Samba mailing lists but can't see much, I'll give it a go anyway, posted here as it may have been a common issue, or someone may have jumped up and said "highly experimental feature X/ *libwbclient?* fixes that".. Thanks again Andy > Anything inside the EAP tunnel doesn't like you playing with the > username though, so we can't do UPN based MSCHAPv2 lookup - UPN format > doesn't work, as far as I can tell, with the ntlm_auth program and I > can't update the username. I can force the mschap auth process to use > an alternative user name, but the hash then doesn't work, and I can't > work out how to update the mschap:user-name. All this is Altering the in-packet username or the username on the ntlm_auth command line is futile; as you've indicated, the client does the crypto on the basis of the UPN, and that's what you need to pass to ntlm_auth so that it can be in turn passed to the DC and mixed into the chal/resp verification/calculation correctly. I was under the impression that ntlm_auth should work with a UPN where LHS != samaccountname, but it's really a Samba question - I'd suggest asking on the Samba list. I don't have any easy way to test locally I'm afraid. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

3.0.10: crash seemingly related to EAP-pwd
by Stefan Winter 27 Nov '15

27 Nov '15

Hi, I finally was able to catch thecrash which I see very intermittently with 3.0.10. Today, it happened in a sequence every some 30 seconds; apparently a continued authentication attempt by one user always triggered the fatal code path. After switching runtime perms to root/root, gdb actually worked and provided a backtrace. I'm attaching the gdb session log. I see EAP sub-module failed, and EAP-pwd, so I think it's got to be in that area. I also configured the system to dump a core. As soon as I find it on the filesystem, I can send it off-list to a developer who cares about it :-) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 3

checking errcode in the sql_snprint_error function of rlm_sql_oracle.c
by Kyuyoung Kim 27 Nov '15

27 Nov '15

Hello, First, I want to say that I don't know well OCI programming. I'm trying to make interface between FreeRADIUS and Oracle. I found this code in the rlm_sql_oracle module. This part seems a bit strange. If there are errors, errcode variable is larger than 0. but, the function returns -1. I think if errcode is large than 0, function should return 0 not -1. Can you tell me what is correct? static int sql_snprint_error(char *out, size_t outlen, rlm_sql_handle_t *handle, UNUSED rlm_sql_config_t *config) { sb4 errcode = 0; rlm_sql_oracle_conn_t *conn = handle->conn; rad_assert(conn); out[0] = ''; OCIErrorGet((dvoid *) conn->error, 1, (OraText *) NULL, &errcode, (OraText *) out, outlen, OCI_HTYPE_ERROR); if (!errcode) return -1; return 0; }

2 1