- Freeradius-Users - lists.freeradius.org

EAP-TLS
by Jim Shi 01 Sep '15

01 Sep '15

Hi, I want to use EAP-TLS to verify client’s certificate and set policy based on the groups that the CN belongs to. How to do it? Thanks Jim

2 1

Postgresql groupreply problem
by georg＠wojti.de 01 Sep '15

01 Sep '15

Hello @ all, I want to change the user MAC-authentication with an HP-Switch from the users-file to postgresql. The first thing is, that I have a some lines which check whether it is a Call-Check or not. If not then the radius has to reject this. But I think it's ok if I put this into the users-file. I have written the Cleartext-Password in this file, too, because I get an chap error (chap: ERROR: &control:Cleartext-Password is required for authentication), when I put this into the database. In the Moment my configurations looks like this: -------------- users file -------------- DEFAULT Service-Type != Call-Check, Auth-Type := Reject Fall-Through = Yes DEFAULT Cleartext-Password := "xxxXXXxxx" Fall-Through = Yes DEFAULT Egress-VLANID := 0x3200005C #<-- check in server.conf; reject if it's the same -------------- server.conf -------------- ... authorize { suffix if (Realm != "NULL") { reject } chap files.sw-hp-mac-v3 sql.sw-hp-mac-v3 if (reply:Egress-VLANID == "0x3200005C") { reject } } -------------- Database -------------- (Hope that the format is ok. The tables radreply and radgroupcheck are empty) +----------------------------------------------------------------------+ | radcheck | +----+-------------------+--------------------+----+-------------------+ | id | username | attribute | op | value | +----+-------------------+--------------------+----+-------------------+ | 0 | 00:11:22:33:44:55 | Calling-Station-Id | == | 00-11-22-33-44-55 | +----+-------------------+--------------------+----+-------------------+ +-----------------------------------------------+ | radusergroup | +----+-------------------+-----------+----------+ | id | username | groupname | priority | +----+-------------------+-----------+----------+ | 0 | 00:11:22:33:44:55 | abc | 0 | +----+-------------------+-----------+----------+ +--------------------------------------------------+ | radgroupreply | +----+-----------+---------------+----+------------+ | id | groupname | attribute | op | value | +----+-----------+---------------+----+------------+ | 0 | abc | Egress-VLANID | := | 0x320000E0 | +----+-----------+---------------+----+------------+ The main problem is that the freeradius does not insert the GroupName in the sql-commands and so there is no correct reply. -------------- Debug-Log -------------- (0) Received Access-Request Id 138 from 172.16.xx.xx:1812 to 172.16.xx.xx:1816 length 321 (0) Framed-MTU = 1466 (0) NAS-IP-Address = 172.16..xx.xx (0) NAS-Identifier = "sw01" (0) User-Name = "00:11:22:33:44:55" (0) Service-Type = Call-Check (0) Framed-Protocol = PPP (0) NAS-Port = 23 (0) NAS-Port-Type = Ethernet (0) NAS-Port-Id = "A23" (0) Called-Station-Id = "a1-a2-a3-a4-a5-a6" (0) Calling-Station-Id = "00-11-22-33-44-55" (0) Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" (0) CHAP-Password = 0x366421f13cb0e52b71c59e9ec39f5a83fe (0) Message-Authenticator = 0x61c0cb3d1d3b1a2f5f634817119d999f (0) MS-RAS-Vendor = 11 (0) HP-Capability-Advert = 0x011a0000000b28 (0) HP-Capability-Advert = 0x011a0000000b2e (0) HP-Capability-Advert = 0x011a0000000b30 (0) HP-Capability-Advert = 0x011a0000000b3d (0) HP-Capability-Advert = 0x0138 (0) HP-Capability-Advert = 0x013a (0) HP-Capability-Advert = 0x0140 (0) HP-Capability-Advert = 0x0141 (0) HP-Capability-Advert = 0x0151 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/sw-hp-mac (0) authorize { (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "00:11:22:33:44:55", looking up realm NULL (0) suffix: Found realm "NULL" (0) suffix: Adding Stripped-User-Name = "00:11:22:33:44:55" (0) suffix: Adding Realm = "NULL" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) if (Realm != "NULL") { (0) if (Realm != "NULL") -> FALSE (0) chap: &control:Auth-Type := CHAP (0) [chap] = ok (0) files.sw-hp-mac-v3: users: Matched entry DEFAULT at line 4 (0) files.sw-hp-mac-v3: users: Matched entry DEFAULT at line 7 (0) [files.sw-hp-mac-v3] = ok (0) sql.sw-hp-mac-v3: EXPAND %{User-Name} (0) sql.sw-hp-mac-v3: --> 00:11:22:33:44:55 (0) sql.sw-hp-mac-v3: SQL-User-Name set to '00:11:22:33:44:55' rlm_sql (sql.sw-hp-mac-v3): Reserved connection (0) (0) sql.sw-hp-mac-v3: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql.sw-hp-mac-v3: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '00:11:22:33:44:55' ORDER BY id (0) sql.sw-hp-mac-v3: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '00:11:22:33:44:55' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) sql.sw-hp-mac-v3: User found in radcheck table (0) sql.sw-hp-mac-v3: Conditional check items matched, merging assignment check items (0) sql.sw-hp-mac-v3: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql.sw-hp-mac-v3: --> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '00:11:22:33:44:55' ORDER BY id (0) sql.sw-hp-mac-v3: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '00:11:22:33:44:55' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql.sw-hp-mac-v3: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql.sw-hp-mac-v3: --> SELECT GroupName FROM radusergroup WHERE UserName='00:11:22:33:44:55' ORDER BY priority (0) sql.sw-hp-mac-v3: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='00:11:22:33:44:55' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 (0) sql.sw-hp-mac-v3: User found in the group table (0) sql.sw-hp-mac-v3: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id (0) sql.sw-hp-mac-v3: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '' ORDER BY id (0) sql.sw-hp-mac-v3: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql.sw-hp-mac-v3: Group "abc": Conditional check items matched (0) sql.sw-hp-mac-v3: Group "abc": Merging assignment check items (0) sql.sw-hp-mac-v3: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id (0) sql.sw-hp-mac-v3: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '' ORDER BY id (0) sql.sw-hp-mac-v3: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql.sw-hp-mac-v3: Group "abc": Merging reply items rlm_sql (sql.sw-hp-mac-v3): Released connection (0) (0) [sql.sw-hp-mac-v3] = ok (0) if (reply:Egress-VLANID == "0x3200005C") { (0) if (reply:Egress-VLANID == "0x3200005C") -> TRUE (0) if (reply:Egress-VLANID == "0x3200005C") { (0) [reject] = reject (0) } # if (reply:Egress-VLANID == "0x3200005C") = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/sw-hp-mac (0) Post-Auth-Type REJECT { (0) sql.sw-hp-mac-v3: EXPAND .query (0) sql.sw-hp-mac-v3: --> .query (0) sql.sw-hp-mac-v3: Using query template 'query' rlm_sql (sql.sw-hp-mac-v3): Reserved connection (1) (0) sql.sw-hp-mac-v3: EXPAND %{User-Name} (0) sql.sw-hp-mac-v3: --> 00:11:22:33:44:55 (0) sql.sw-hp-mac-v3: SQL-User-Name set to '00:11:22:33:44:55' (0) sql.sw-hp-mac-v3: EXPAND INSERT INTO radpostauth (username, pass, reply, calledstationid, callingstationid, authdate) VALUES('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', '%{Called-Station-Id}', '%{Calling-Station-Id}', NOW()) (0) sql.sw-hp-mac-v3: --> INSERT INTO radpostauth (username, pass, reply, calledstationid, callingstationid, authdate) VALUES('00:11:22:33:44:55', 'Chap-Password', 'Access-Reject', 'a1-a2-a3-a4-a5-a6', '00-11-22-33-44-55', NOW()) (0) sql.sw-hp-mac-v3: Executing query: INSERT INTO radpostauth (username, pass, reply, calledstationid, callingstationid, authdate) VALUES('00:11:22:33:44:55', 'Chap-Password', 'Access-Reject', 'a1-a2-a3-a4-a5-a6', '00-11-22-33-44-55', NOW()) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 (0) sql.sw-hp-mac-v3: SQL query returned: success (0) sql.sw-hp-mac-v3: 1 record(s) updated rlm_sql (sql.sw-hp-mac-v3): Released connection (1) (0) [sql.sw-hp-mac-v3] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> 00:11:22:33:44:55 (0) attr_filter.access_reject: Matched entry DEFAULT at line 18 (0) [attr_filter.access_reject] = updated (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) <delay>: Sending delayed response (0) <delay>: Sent Access-Reject Id 138 from 172.16.xx.xx:1816 to 172.16.xx.xx:1812 length 20 Waking up in 3.9 seconds. (0) <delay>: Cleaning up request packet ID 138 with timestamp +10 Does anyone have an idea? Best regards.

2 2

sqlippool
by Noel Butler 31 Aug '15

31 Aug '15

In our migration test bed from our antique radius to freeradius I seem to have issue with freeradius sql dishing out IP's... if I use ippool, sure works great, but our NAS's do this now and we are trying to move away to sql, which doesn't in fact doesn't seem to even look for it using radiusd -X We have populated radippool with pool name: 'main_pool', ' i.p.add.ress' added DEFAULT Pool-Name := main_pool

2 5

Session caching in v3.0.9
by Jason Alderfer 31 Aug '15

31 Aug '15

Folks, I'm having trouble getting session caching to work in 3.0.9. In my config a user's VLAN is determined based on an LDAP search and in some cases by an external program (exec). This is done in the inner-tunnel. For session caching I added the following to post-auth of inner-tunnel: if ( reply:Tunnel-Private-group-ID ) { update reply { Cached-Session-Policy :="vlan=%{reply:Tunnel-Private-Group-ID}" } } And the following to post-auth of default: if ( reply:Cached-Session-Policy ) { if ( reply:Cached-Session-Policy =~ /vlan=(.+)/ ) { update reply { Reply-Message += "Cached policy:%{reply:Cached-Session-Policy}" Tunnel-Private-Group-ID := "%{1}" Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } } } Question 1: use_tunneled_reply. Is it truly deprecated in the case of session caching? When I use the alternative given in the example config file, I never see any .vps file saved in the disk cache though there is a .asn1 file. When I revert to use_tunneled_reply=yes the .vps files appear and their content appears correct. Question 2: See attached debug log. When a session resumes, the cached info appears to be read correctly from the cache (see "Debug: (41)") but it never gets sent back in the reply (see "Debug: (42)"). What am I doing wrong? Regards, Jason Alderfer

2 1

EAP Not Authenticating
by Syed Rais Ahmad NON DRI 31 Aug '15

31 Aug '15

I am using EAP for authenticating WiFi Clients with Certificate on their machines. However RADIUS won't authenticate. Any help is appreciated. Thanks. Rad_recv: Access-Request packet from host 10.238.250.50 port 1645, id=56, length=210 User-Name = "host/Loaner751.darden.com" Framed-MTU = 1400 Called-Station-Id = "0019.aaab.5af5" Calling-Station-Id = "100b.a988.b5a0" Cisco-AVPair = "ssid=DRI_test" WISPr-Location-Name = "4441-NC-AP1" Service-Type = Login-User Message-Authenticator = 0x0e316ee8b533416251694ad185583409 EAP-Message = 0x0202001e01686f73742f4c6f616e65723735312e64617264656e2e636f6d NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "102" NAS-Port = 102 NAS-IP-Address = 10.238.250.50 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "host/Loaner751.darden.com", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 30 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group eap { [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group eap = handled Sending Access-Challenge of id 56 to 10.238.250.50 port 1645 EAP-Message = 0x010300160410bfd16c1dfa600bd36fa2eb08ba9b5618 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcc8a4efdcc894a61cff43991e0926e2a Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.238.250.50 port 1645, id=57, length=204 User-Name = "host/Loaner751.darden.com" Framed-MTU = 1400 Called-Station-Id = "0019.aaab.5af5" Calling-Station-Id = "100b.a988.b5a0" Cisco-AVPair = "ssid=DRI_test" WISPr-Location-Name = "4441-NC-AP1" Service-Type = Login-User Message-Authenticator = 0x54d5aec97fd76f4282e2eac636980031 EAP-Message = 0x020300060319 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "102" NAS-Port = 102 State = 0xcc8a4efdcc894a61cff43991e0926e2a NAS-IP-Address = 10.238.250.50 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "host/Loaner751.darden.com", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group eap { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group eap = handled Sending Access-Challenge of id 57 to 10.238.250.50 port 1645 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcc8a4efdcd8e5761cff43991e0926e2a Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.238.250.50 port 1645, id=58, length=303 User-Name = "host/Loaner751.darden.com" Framed-MTU = 1400 Called-Station-Id = "0019.aaab.5af5" Calling-Station-Id = "100b.a988.b5a0" Cisco-AVPair = "ssid=DRI_test" WISPr-Location-Name = "4441-NC-AP1" Service-Type = Login-User Message-Authenticator = 0x9b2daf305bb49a270834f943e0206af9 EAP-Message = 0x0204006919800000005f160301005a01000056030155de2777bb843e994ac509c2e8cbb6b78411ee24c71e69bbc547a17566e65bc9000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "102" NAS-Port = 102 State = 0xcc8a4efdcd8e5761cff43991e0926e2a NAS-IP-Address = 10.238.250.50 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "host/Loaner751.darden.com", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 105 Eventually I get: Cleaning up request 6 ID 62 with timestamp +12 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xcc8a4efdca835761 did not finish! WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! rad_recv: Access-Request packet from host 10.238.250.50 port 1645, id=62, length=204 This e-mail message is for the sole use of the intended recipient and may contain information that is confidential, proprietary or privileged. Any unauthorized review, use, distribution, copying or disclosure is strictly prohibited. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, please notify sender of the delivery error by replying to this message and then delete it from your system. Receipt by anyone other than the intended recipient is not a waiver of confidentiality or privilege.

2 3

MS-CHAP2-Response is incorrect with Freeradius 2.1.12
by François Lacombe 31 Aug '15

31 Aug '15

Dear all, I'm looking for some help regarding my Freeradius 2.1.12 config. It is running on a Debian Wheezy machine. I need to authenticate my users with EAP-MSCHAPv2 method based upon information stored on a LDAP. Freeradius is bind to LDAP using a service account a retrieving NT and LM-Password hashes (smbldap-tools generated previously). I'm not using the LDAP AuthType and my users file is empty. You'll find attached my launch log and request process log. During any authentication process, Freeradius is throwing the line "Info : [mschap] FAILED : MS-CHAP2-Response is incorrect" without any more detail (line 622). It seems this line appears when NT or LM-Password are missing in the LDAP, but here Freeradius find them successfully earlier. I don't understand this message. Would you have any hint to fix this problem and make Freeradius authenticate my users ? Feel free to give any piece of advice regarding my config. All the best François -- François Lacombe @InfosReseaux

3 4

sha512 format
by Noel Butler 29 Aug '15

29 Aug '15

Howdy, Building new radius setup, and in test bed using freeradius at present, I see v3 uses SHA-2, great, it's what we are trying, but when inserting into mariadb $6$salt$foobarqwerty.... does not seems not to work (clear text of course does but thats not an option in 2015) does it expect it in some other format? Our systems use perl and systems crypt to generate sha512 for database thats used by dovecot, pureftpd and apache etc for long time, is there a trick to get sha512 and freeradius to play nice? Cheers

2 2

How does rlm_perl work with freeRADIUS 3?
by Cornelius Kölbel 28 Aug '15

28 Aug '15

Hello, I have a question regarding rlm_perl. I was using rlm_perl with FreeRADIUS 2 just fine. Now I try to use rlm_perl with FreeRADIUS 3 on CentOS 7 and I am reading this page. http://wiki.freeradius.org/modules/Rlm_perl Previously I set Auth-Type := Perl in the users file. So, now I let my sites-enabled look like this: authorize { preprocess digest suffix ntdomain #files perl if (ok || updated) { update control { Auth-Type := Perl } } expiration logintime pap } authenticate { Auth-Type Perl { perl } But then I get an invalid location for if. Ok, so I change it to authorize { ... update control { Auth-Type := Perl } But then I get an error in my authenticate section. # Creating Auth-Type = Perl # Loading authenticate {...} /etc/raddb/sites-enabled/privacyidea[25]: "System" modules aren't allowed in 'authenticate' sections -- they have no such method. /etc/raddb/sites-enabled/privacyidea[21]: Errors parsing authenticate section. Did I miss anything in the description http://wiki.freeradius.org/modules/Rlm_perl? What are "System" modules? Thanks a lot and kind regards Cornelius -- Cornelius Kölbel cornelius.koelbel(a)netknights.it +49 151 2960 1417 NetKnights GmbH http://www.netknights.it Landgraf-Karl-Str. 19, 34131 Kassel, Germany Tel: +49 561 3166797, Fax: +49 561 3166798 Amtsgericht Kassel, HRB 16405 Geschäftsführer: Cornelius Kölbel

3 5

has proxying configuration changed from 2.2.6-2.2.8 ?
by Louis Munro 28 Aug '15

28 Aug '15

Hello, I am trying to track down an odd behaviour. I have set up a simple FreeRADIUS server as proxy load balancer for two back end FR servers. All are running 2.2.8. I can’t seem to get the proxy to notice when one of the two backends is shut down. It used to be (I was running 2.2.6 before upgrading to 2.2.8) that after a few seconds the proxy would notice that the backend was not responding and start sending the requests to the other server. As in the following (radiusd -X ) where we can see it marking the server as zombie and sending status-server requests: Listening on authentication address 172.20.20.246 port 1812 Listening on accounting address 172.20.20.246 port 1813 Listening on authentication address 172.20.20.245 port 1812 as server pf.cluster Listening on accounting address 172.20.20.245 port 1813 as server pf.cluster Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address 172.20.20.246 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.20.20.14 port 61315, id=176, length=82 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x4e8b8278c6926c4400d0c821ee79a136 server pf.cluster { # Executing section authorize from file /etc/raddb/sites-enabled/pf-proxy +group authorize { ++update control { ++} # update control = noop +} # group authorize = noop } # server pf.cluster WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 169 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313736 Proxying request 0 to home server 172.20.20.184 port 1812 Sending Access-Request of id 169 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313736 Going to the next request Waking up in 0.9 seconds. Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.20.20.14 port 61315, id=176, length=82 Sending duplicate proxied request to home server 172.20.20.184 port 1812 - ID: 169 Sending Access-Request of id 169 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313736 Waking up in 1.3 seconds. Cleaning up request 0 ID 176 with timestamp +13 Marking home server 172.20.20.184 port 1812 as zombie (it looks like it is dead). Sending Status-Server of id 212 to 172.20.20.184 port 1812 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Whereas now in 2.2.8 I get the following where it never seems to notice the backend server has gone away: Listening on authentication address 172.20.20.246 port 1812 Listening on accounting address 172.20.20.246 port 1813 Listening on authentication address 172.20.20.245 port 1812 as server pf.cluster Listening on accounting address 172.20.20.245 port 1813 as server pf.cluster Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address 172.20.20.246 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.20.20.14 port 63846, id=94, length=82 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0xd591a8d2aa2abec4228666e36f21e764 server pf.cluster { # Executing section authorize from file /usr/local/etc/raddb//sites-enabled/pf-proxy +group authorize { ++update control { ++} # update control = noop +} # group authorize = noop } # server pf.cluster WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 226 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3934 Proxying request 0 to home server 172.20.20.184 port 1812 Sending Access-Request of id 226 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3934 Going to the next request Waking up in 0.9 seconds. Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.20.20.14 port 63846, id=94, length=82 Sending duplicate proxied request to home server 172.20.20.184 port 1812 - ID: 226 Sending Access-Request of id 226 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3934 Waking up in 1.3 seconds. Cleaning up request 0 ID 94 with timestamp +7 Ready to process requests. rad_recv: Access-Request packet from host 172.20.20.14 port 63846, id=94, length=82 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0xd591a8d2aa2abec4228666e36f21e764 server pf.cluster { # Executing section authorize from file /usr/local/etc/raddb//sites-enabled/pf-proxy +group authorize { ++update control { ++} # update control = noop +} # group authorize = noop } # server pf.cluster WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 167 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3934 Proxying request 1 to home server 172.20.20.184 port 1812 Sending Access-Request of id 167 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3934 Going to the next request Waking up in 0.9 seconds. Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.20.20.14 port 63846, id=144, length=82 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0xee899074a654c74b561a8a2096b9b869 server pf.cluster { # Executing section authorize from file /usr/local/etc/raddb//sites-enabled/pf-proxy +group authorize { ++update control { ++} # update control = noop +} # group authorize = noop } # server pf.cluster WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 133 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313434 Proxying request 2 to home server 172.20.20.184 port 1812 Sending Access-Request of id 133 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313434 Going to the next request Waking up in 0.6 seconds. Cleaning up request 1 ID 94 with timestamp +17 Waking up in 0.3 seconds. Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.20.20.14 port 63846, id=144, length=82 Sending duplicate proxied request to home server 172.20.20.184 port 1812 - ID: 133 Sending Access-Request of id 133 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313434 Waking up in 1.3 seconds. Cleaning up request 2 ID 144 with timestamp +22 Ready to process requests. rad_recv: Access-Request packet from host 172.20.20.14 port 63846, id=144, length=82 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0xee899074a654c74b561a8a2096b9b869 server pf.cluster { # Executing section authorize from file /usr/local/etc/raddb//sites-enabled/pf-proxy +group authorize { ++update control { ++} # update control = noop +} # group authorize = noop } # server pf.cluster WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 191 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313434 Proxying request 3 to home server 172.20.20.184 port 1812 Sending Access-Request of id 191 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313434 Going to the next request Waking up in 0.9 seconds. Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.20.20.14 port 63846, id=111, length=82 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x17409eb12db9ee58f23c08b0b5697fab server pf.cluster { # Executing section authorize from file /usr/local/etc/raddb//sites-enabled/pf-proxy +group authorize { ++update control { ++} # update control = noop +} # group authorize = noop } # server pf.cluster WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 18 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313131 Proxying request 4 to home server 172.20.20.184 port 1812 Sending Access-Request of id 18 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313131 Going to the next request Waking up in 0.6 seconds. Cleaning up request 3 ID 144 with timestamp +32 Waking up in 0.3 seconds. Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.20.20.14 port 63846, id=111, length=82 Sending duplicate proxied request to home server 172.20.20.184 port 1812 - ID: 18 Sending Access-Request of id 18 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313131 Waking up in 1.3 seconds. Cleaning up request 4 ID 111 with timestamp +37 Ready to process requests. rad_recv: Access-Request packet from host 172.20.20.14 port 63846, id=111, length=82 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x17409eb12db9ee58f23c08b0b5697fab server pf.cluster { # Executing section authorize from file /usr/local/etc/raddb//sites-enabled/pf-proxy +group authorize { ++update control { ++} # update control = noop +} # group authorize = noop } # server pf.cluster WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 93 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313131 Proxying request 5 to home server 172.20.20.184 port 1812 Sending Access-Request of id 93 to 172.20.20.184 port 1812 User-Name = "aabbccddeeff" User-Password = "aabbccddeeff" NAS-IP-Address = 192.168.239.141 NAS-Port = 11 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313131 Going to the next request Waking up in 0.9 seconds. Waking up in 4.9 seconds. Both of these outputs are from the same server and the requests were generated using radclient. These are two stock configuration as much as I could make them. The 2.2.6 was installed from packages ( 2.2.6-4.el6 on CentOS 6) whereas the 2.2.8 was compiled from the latest tarball available on http://freeradius.org/download.html. All I did was ./configure && make and then make install. The only files I had changed were the radiusd.conf, clients.conf and a sites-enabled/pf-proxy file of which the contents follow. radiusd.conf and clients.conf are the same (I reused the same file). [ pf-proxy] # cat /usr/local/etc/raddb/sites-enabled/pf-proxy listen { ipaddr = 172.20.20.245 port = 0 type = auth virtual_server = pf.cluster } listen { ipaddr = 172.20.20.245 port = 0 type = acct virtual_server = pf.cluster } home_server pf0.cluster { type = auth+acct ipaddr = 172.20.20.245 port = 1812 secret = test1234 response_window = 6 status_check = status-server revive_interval = 120 check_interval = 30 num_answers_to_alive = 3 } home_server pf1.cluster { type = auth+acct ipaddr = 172.20.20.184 port = 1812 secret = test1234 response_window = 6 status_check = status-server revive_interval = 120 check_interval = 30 num_answers_to_alive = 3 } # Put all of the servers into a pool. home_server_pool pf_pool.cluster { type = client-port-balance home_server = pf0.cluster home_server = pf1.cluster } home_server_pool pfacct_pool.cluster { type = load-balance home_server = pf0.cluster home_server = pf1.cluster } realm packetfence { auth_pool = pf_pool.cluster acct_pool = pfacct_pool.cluster } server pf.cluster { pre-proxy { # Insert pre-proxy rules here } post-proxy { } authorize { update control { Proxy-To-Realm := "packetfence" } } authenticate { } accounting { update control { Proxy-To-Realm := "packetfence" } } } When running 2.2.6 I can clearly see the status-server requests received by the (shutdown) backend: Status-Server Id 212 172.20.20.246:1814 -> 172.20.20.184:1812 +560.025 Message-Authenticator = 0x530277e3be1d44304b4d8da644b5cf79 NAS-Identifier = "Status Check. Are you alive?" No such requests are received from 2.2.8. So my question is, has proxying configuration changed between 2.2.6 and 2.2.8 in some way that would explain this? I’d be happy to provide any additional information. Any help is appreciated. -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

4 6

Prevent unnecessary checks with Ldap-Group in FR3
by Anja Ruckdaeschel 28 Aug '15

28 Aug '15

Hi there, we are doing an Ldap-Group-Check for every login. The Group contains people who are not allowed to use radius-services. So 98% of the Users are NOT in the Group. FR3 first searches in the Group for the Login-User, if he finds nothing he then checks all the groups a user is member of in reverse, which can be a lot at our site. I know, there are directories who do not impelement backreferences for user-groups, but e.g. with eDirectory it's just not necessary. So I wonder if there is a way to prevent this behavior with a config param I missed until know in FR3 ldap module config, so FR just stops after not finding the user in the group? Thu Aug 27 17:08:20 2015 : Debug: (7) policy rzur.radiusrejectcheckinner { Thu Aug 27 17:08:20 2015 : Debug: (7) if (Stripped-User-Name =~ /^[a-zA-Z]{3}[0-9]{5}$/ ) { Thu Aug 27 17:08:20 2015 : Debug: No matches Thu Aug 27 17:08:20 2015 : Debug: Adding 1 matches Thu Aug 27 17:08:20 2015 : Debug: (7) if (Stripped-User-Name =~ /^[a-zA-Z]{3}[0-9]{5}$/ ) -> TRUE Thu Aug 27 17:08:20 2015 : Debug: (7) if (Stripped-User-Name =~ /^[a-zA-Z]{3}[0-9]{5}$/ ) { Thu Aug 27 17:08:20 2015 : Debug: (7) if (Ldap-Group == "cn=radiusreject,ou=myou,o=myo,c=de") { Thu Aug 27 17:08:20 2015 : Debug: (7) Searching for user in group "cn=radiusreject,ou=myou,o=myo,c=de" Thu Aug 27 17:08:20 2015 : Debug: rlm_ldap (ldap): Connecting to ldap://ldap.example.com.de:389 Thu Aug 27 17:08:20 2015 : Debug: rlm_ldap (ldap): New libldap handle 0x7f0e35c87c50 Thu Aug 27 17:08:20 2015 : Debug: rlm_ldap (ldap): Waiting for bind result... Thu Aug 27 17:08:20 2015 : Debug: rlm_ldap (ldap): Bind successful Thu Aug 27 17:08:20 2015 : Debug: rlm_ldap (ldap): Reserved connection (0) Thu Aug 27 17:08:20 2015 : Debug: (7) EXPAND TMPL XLAT Thu Aug 27 17:08:20 2015 : Debug: (&(objectClass=inetOrgPerson)(uid=%{%{Stripped-User-Name}:-%{User-Name}})) Thu Aug 27 17:08:20 2015 : Debug: Parsed xlat tree: Thu Aug 27 17:08:20 2015 : Debug: literal --> (&(objectClass=inetOrgPerson)(uid= Thu Aug 27 17:08:20 2015 : Debug: if { Thu Aug 27 17:08:20 2015 : Debug: attribute --> Stripped-User-Name Thu Aug 27 17:08:20 2015 : Debug: } Thu Aug 27 17:08:20 2015 : Debug: else { Thu Aug 27 17:08:20 2015 : Debug: attribute --> User-Name Thu Aug 27 17:08:20 2015 : Debug: } Thu Aug 27 17:08:20 2015 : Debug: literal --> )) Thu Aug 27 17:08:20 2015 : Debug: (7) EXPAND (&(objectClass=inetOrgPerson)(uid=%{%{Stripped-User-Name}:-%{User-Name}})) Thu Aug 27 17:08:20 2015 : Debug: (7) --> (&(objectClass=inetOrgPerson)(uid=xxx12345)) Thu Aug 27 17:08:20 2015 : Debug: (7) EXPAND TMPL LITERAL Thu Aug 27 17:08:20 2015 : Debug: (7) Performing search in "c=de" with filter "(&(objectClass=inetOrgPerson)(uid=xxx12345))", scope "sub" Thu Aug 27 17:08:20 2015 : Debug: (7) Waiting for search result... Thu Aug 27 17:08:20 2015 : Debug: (7) User object found at DN "cn=xxx12345,ou=myou,o=myo,c=de" Thu Aug 27 17:08:20 2015 : Debug: (7) Checking for user in group objects Thu Aug 27 17:08:20 2015 : Debug: (&(objectClass=Group)(member=%{control:LDAP-UserDn})) Thu Aug 27 17:08:20 2015 : Debug: Parsed xlat tree: Thu Aug 27 17:08:20 2015 : Debug: literal --> (&(objectClass=Group)(member= Thu Aug 27 17:08:20 2015 : Debug: attribute --> LDAP-UserDN Thu Aug 27 17:08:20 2015 : Debug: literal --> )) Thu Aug 27 17:08:20 2015 : Debug: (7) EXPAND (&(objectClass=Group)(member=%{control:LDAP-UserDn})) Thu Aug 27 17:08:20 2015 : Debug: (7) --> (&(objectClass=Group)(member=cn\3dxxx12345\2cou\3dmyou\2co\3dmyo\2cc\3dde)) Thu Aug 27 17:08:20 2015 : Debug: (7) Performing search in "cn=radiusreject,ou=myou,o=myo,c=de" with filter "(&(objectClass=Group)(member=cn\3dxxx12345\2cou\3dmyou\2co\3dmyo\2cc\3dde))", scope "sub" Thu Aug 27 17:08:20 2015 : Debug: (7) Waiting for search result... Thu Aug 27 17:08:20 2015 : Debug: (7) Search returned no results Thu Aug 27 17:08:20 2015 : Debug: (7) Checking user object's groupMembership attributes Thu Aug 27 17:08:20 2015 : Debug: (7) Performing unfiltered search in "cn=xxx12345,ou=myou,o=myo,c=de", scope "base" Thu Aug 27 17:08:20 2015 : Debug: (7) Waiting for search result... Thu Aug 27 17:08:20 2015 : Debug: (7) Processing groupMembership value "cn=mygroup1,ou=myou,o=myo,c=de" as a DN Thu Aug 27 17:08:20 2015 : Debug: (7) Processing groupMembership value "cn=mygroup2,ou=myou,o=myo,c=de" as a DN ... about 50 Groups .... Thu Aug 27 17:08:20 2015 : Debug: rlm_ldap (ldap): Released connection (0) Thu Aug 27 17:08:20 2015 : Info: rlm_ldap (ldap): 0 of 1 connections in use. Need more spares Thu Aug 27 17:08:20 2015 : Info: rlm_ldap (ldap): Opening additional connection (1), 1 of 127 pending slots used Thu Aug 27 17:08:20 2015 : Debug: rlm_ldap (ldap): Connecting to ldap://ldap.example.com:389 Thu Aug 27 17:08:20 2015 : Debug: rlm_ldap (ldap): New libldap handle 0x7f0e35caa700 Thu Aug 27 17:08:20 2015 : Debug: rlm_ldap (ldap): Waiting for bind result... Thu Aug 27 17:08:20 2015 : Debug: rlm_ldap (ldap): Bind successful Thu Aug 27 17:08:20 2015 : Debug: (7) User is not a member of "cn=radiusreject,ou=myou,o=myo,c=de" Thu Aug 27 17:08:20 2015 : Debug: (7) if (Ldap-Group == "cn=radiusreject,ou=myou,o=myo,c=de") -> FALSE Thu Aug 27 17:08:20 2015 : Debug: (7) } # if (Stripped-User-Name =~ /^[a-zA-Z]{3}[0-9]{5}$/ ) = updated Thu Aug 27 17:08:20 2015 : Debug: (7) } # policy rzur.radiusrejectcheckinner = updated Thank you for your time, Anja

2 2