- Freeradius-Users - lists.freeradius.org

unlang question
by Peter Balsianok 25 Apr '15

25 Apr '15

Hi, In documentation (3.0.8) is module if (reject) { ... } But in case of rlm_perl i need to use (this works) perl { reject = 1 } if (reject) { ... } Thx.

2 3

Authenticating users on LDAP based on Group name
by Jose Torres-Berrocal 24 Apr '15

24 Apr '15

I am using the Freeradius2 2.1.12_1/2.2.5_3 pkg v1.6.10 in pfsense 2.1.5 I can't modify the conf files manually. I have to use the pfsense WebGui. I could authenticate the users of the LDAP succesfully but when I try to authenticate using group membership options it fails with the following logs. Wed Mar 25 13:39:09 2015 : Info: Loaded virtual server <default> Wed Mar 25 13:39:09 2015 : Info: Ready to process requests. Wed Mar 25 13:39:27 2015 : Auth: Invalid user ( [ldap] Pairs do not match): [administrator] (from client squid port 111) Wed Mar 25 13:39:33 2015 : Auth: Invalid user ( [ldap] Pairs do not match): [administrator] (from client squid port 111) Wed Mar 25 13:39:34 2015 : Auth: Invalid user ( [ldap] Pairs do not match): [administrator] (from client squid port 111) On pfsense I do not see an option to run in debug mode, but probably you can help me with the pfsense produced ldap conf file. I do not use fancy stuff. After I get it working I may try to add TLS configuration to have encrypted comm or passwords. The LDAP is an Active Directory on a Windows 2003 Server. The group name is InternetAccess. (Is this case sensitive?) I do not have a radiusprofile, where there is mention of radiusprofile is a default generated line. (In pfsense I may change the line but can not removed it or comment it.) LDAP CONF: /usr/pbi/freeradius-i386/etc/raddb/modules/ldap # -*- text -*- # # $ # Lightweight Directory Access Protocol (LDAP) # # This module definition allows you to use LDAP for # authorization and authentication. # # See raddb/sites-available/default for reference to the # ldap module in the authorize and authenticate sections. # # However, LDAP can be used for authentication ONLY when the # Access-Request packet contains a clear-text User-Password # attribute. LDAP authentication will NOT work for any other # authentication method. # # This means that LDAP servers don't understand EAP. If you # force "Auth-Type = LDAP", and then send the server a # request containing EAP authentication, then authentication # WILL NOT WORK. # # The solution is to use the default configuration, which does # work. # # Setting "Auth-Type = LDAP" is ALMOST ALWAYS WRONG. We # really can't emphasize this enough. # ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "jetsms-srv2003.jetdom.local" port = "389" identity = "cn=pfsense,cn=Users,dc=jetdom,dc=local" password = Mypassword basedn = "cn=Users,dc=jetdom,dc=local" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 # # LDAP_OPT_TIMELIMIT is set to this value. timelimit = 3 # # seconds to wait for response of the server. (network # failures) default: 10 # # LDAP_OPT_NETWORK_TIMEOUT is set to this value. net_timeout = 1 # # This subsection configures the tls related items # that control how FreeRADIUS connects to an LDAP # server. It contains all of the "tls_*" configuration # entries used in older versions of FreeRADIUS. Those # configuration entries can still be used, but we recommend # using these. # tls { # Set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # # The StartTLS operation is supposed to be # used with normal ldap connections instead of # using ldaps (port 689) connections start_tls = no cacertfile = /usr/pbi/freeradius-i386/etc/raddb/certs/ca_ldap1_cert.pem cacertdir = /usr/pbi/freeradius-i386/etc/raddb/certs/ certfile = /usr/pbi/freeradius-i386/etc/raddb/certs/radius_ldap1_cert.crt keyfile = /usr/pbi/freeradius-i386/etc/raddb/certs/radius_ldap1_cert.key randfile = /usr/pbi/freeradius-i386/etc/raddb/certs/random # Certificate Verification requirements. Can be: # "never" (don't even bother trying) # "allow" (try, but don't fail if the certificate # can't be verified) # "demand" (fail if the certificate doesn't verify.) # # The default is "allow" require_cert = "never" } ### default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" ### ### profile_attribute = "radiusProfileDn" ### ### access_attr = "dialupAccess" ### # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap ################## THE BELOW IS NOT COMPILED WITH FREERADIUS ################################# # Set password_attribute = nspmPassword to get the # user's password from a Novell eDirectory # backend. This will work ONLY IF FreeRADIUS has been # built with the --with-edir configure option. # # See also the following links: # # http://www.novell.com/coolsolutions/appnote/16745.html # https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.S… # # Novell may require TLS encrypted sessions before returning # the user's password. # # password_attribute = userPassword # Un-comment the following to disable Novell # eDirectory account policy check and intruder # detection. This will work *only if* FreeRADIUS is # configured to build with --with-edir option. # edir_account_policy_check = no ################## THE ABOVE IS NOT COMPILED WITH FREERADIUS ################################# # # Group membership checking. Disabled by default. # groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = InternetAccess compare_check_items = yes do_xlat = yes access_attr_used_for_allow = yes # # The following two configuration items are for Active Directory # compatibility. If you see the helpful "operations error" # being returned to the LDAP module, uncomment the next # two lines. # ### MS Active Directory Compatibility is disabled ### # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # THIS WILL ONLY WORK FOR PAP AUTHENTICATION. # # THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes # ldap_debug: debug flag for LDAP SDK # (see OpenLDAP documentation). Set this to enable # huge amounts of LDAP debugging on the screen. # You should only use this if you are an LDAP expert. # # default: 0x0000 (no debugging messages) # Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS) #ldap_debug = 0x0028 # # Keepalive configuration. This MAY NOT be supported by your # LDAP library. If these configuration entries appear in the # output of "radiusd -X", then they are supported. Otherwise, # they are unsupported, and changing them will do nothing. # keepalive { # LDAP_OPT_X_KEEPALIVE_IDLE idle = 60 # LDAP_OPT_X_KEEPALIVE_PROBES probes = 3 # LDAP_OPT_X_KEEPALIVE_INTERVAL interval = 3 } }

4 24

3.0.8: Request log filename for virtual servers with a hythen
by Lai Fu Keung 24 Apr '15

24 Apr '15

Hi, I configured my 3.0.8 to have a separate log for all requests based on virtual servers. That is, in radiusd.conf, I uncomment the following line: requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log For "inner-tunnel" virtual server, the filename turns out to be "radiusd-inner----tunnel-20150424.log" (3 more hythens between "inner" and "tunnel"). The filename was fine in 3.0.7. Bug? My mistake? Fu

2 1

3.0.8 struct and function name changes
by unbeliever012000 24 Apr '15

24 Apr '15

I was surprised to find two changes in 3.0.8 which effect C module developers; config_items within the rad_request structure was renamed to config fr_connection_pool_delete was renamed to fr_connection_pool_free I thought 3.0.7 had been tagged as stable and thus the variable and function names were locked to allow developers to migrate. For me this was not a problem, but it is worrying as it makes it more difficult to convince people with their own modules to migrate off of 2.x. Thus I am curious as to if this was a leak from 3.1.x where such changes should be expected? Or is 3.0.8 really the first stable release of 3.0.x and the previous update to the web site was in preparation for it? Geoff

2 1

unlang problem/feature
by Peter Balsianok 24 Apr '15

24 Apr '15

Hi, Is it correct ? May i use %{tolower:&Called-Station-Id} ? Wrong: (0) update request { (0) EXPAND %{Calling-Station-Id}@%{tolower:&Called-Station-Id} (0) --> 421917446704@&called-station-id (0) User-Name := 421917446704@&called-station-id (0) } # update request = noop Thx.

2 1

Freeradius 3.0.7 and multiple buffered-sql servers - detail file issues
by Rygl Aleš 24 Apr '15

24 Apr '15

Hello all. I am trying to migrate the freeradius 2.2.5 to 3.0.7. The server is doing just Acounting request processing and is loading requests to MariaDB with radacct table on InnoDB engine allowing row level locking. There are 128 detail files derived from Calling-Station-Id attribute using mod 128: Queue-Number = "%{expr: %{Calling-Station-Id} %% 128 }" detailfile = ${radacctdir}/detail.mobile/queue-${Queue-Number}/detail-%Y%m%d-%H Then there are 128 buffered-sql servers reading these detail files and feeding the radacct table: server buffered-sql-0 { listen { type = detail filename = "${radacctdir}/detail.mobile/queue-0/detail-*" load_factor = 85 track = yes poll_interval = 5 retry_interval = 30 } preacct { acct_unique } accounting { sql if (noop) { ok } } } . . . server buffered-sql-127 { listen { type = detail filename = "${radacctdir}/detail.mobile/queue-127/detail-*" load_factor = 85 track = yes poll_interval = 5 retry_interval = 30 } preacct { acct_unique } accounting { sql if (noop) { ok } } } This setup is working fine with 2.2.5 version and is very fast. I am able to process more that 1.500 Acct req/s realtime. When I try to use 3.0.7, I am facing some issues: 1. Bad file descriptor message. Looks like it is caused by track = yes config option. When switched to no, it dissapears. What is the problem here? Thu Apr 16 15:58:52 2015 : Warning: Failed marking detail request as done: Bad file descriptor Thu Apr 16 15:58:52 2015 : Warning: Failed marking detail request as done: Bad file descriptor Thu Apr 16 15:58:52 2015 : Warning: Failed marking detail request as done: Bad file descriptor 2. When the server is loaded with ~350 req/s, it is ok. When the load is ~1500 req/s, I can see tons of errors in the log file: Thu Apr 16 16:24:38 2015 : ERROR: (585809) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-58/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585810) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-28/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585811) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-122/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585812) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-102/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585813) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-10/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585814) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-118/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585815) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-0/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585816) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-36/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585817) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-0/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585818) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-32/detail-2015041616: Too many different filename The config: sites-enabled/acct_detail server acct.mobile { listen { ipaddr = * port = 2813 type = acct limit { } } preacct { preprocess acct_unique_mobile } accounting { detail.mobile if (noop) { ok } } } sites-enabled/buffered-sql-mobile-0 server buffered-sql-0 { listen { type = detail filename = "${radacctdir}/detail.mobile/queue-0/detail-*" load_factor = 85 track = no poll_interval = 5 retry_interval = 120 } preacct { } accounting { sql_instance_mobile if (noop) { ok } } } mods-enabled/detail.mobile detail detail.mobile { Queue-Number = "%{expr: %{Calling-Station-Id} %% 128 }" filename = ${radacctdir}/detail.mobile/queue-${Queue-Number}/detail-%Y%m%d%H locking = yes } ./mods-available/sql_ar sql sql_instance_mobile { driver = "rlm_sql_mysql" dialect = "mysql" server = "localhost" port = 3306 login = "radius" password = "xxxxxxxxxxxxxxx" radius_db = "gprscalls" acct_table1 = "radacct_test" acct_table2 = "radacct_test" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" delete_stale_sessions = yes logfile = ${logdir}/sqllog_mobile.sql pool { start = 128 min = 128 # max = ${thread[pool].max_servers} max = 128 spare = 5 uses = 0 lifetime = 0 idle_timeout = 60 } client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries_mobile.conf } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} modconfdir = ${confdir}/mods-config certdir = ${confdir}/certs cadir = ${confdir}/certs run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid max_request_time = 10 cleanup_delay = 5 max_requests = 20000 hostname_lookups = no log { destination = files colourise = yes file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } checkrad = ${sbindir}/checkrad security { user = freerad group = freerad allow_core_dumps = no max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = 'CVE-2014-0160' } $INCLUDE clients.conf thread pool { start_servers = 512 max_servers = 2000 min_spare_servers = 100 max_spare_servers = 300 max_requests_per_server = 0 auto_limit_acct = no } modules { $INCLUDE mods-enabled/ } instantiate { } policy { $INCLUDE policy.d/ } $INCLUDE sites-enabled/ Thanks With regards Ales

6 30

Linelog
by Franks Andy (IT Technical Architecture Manager) 23 Apr '15

23 Apr '15

Hi all, Just a quick question - just trying out the newest version in the git branch - 3.1.0 (git #390f216). Is there any reason that the default reference in the linelog module is set to: reference = "messages.%{%{Packet-Type}:-default}" I had to change the reference attribute to Reply:Packet-Type to get this to match access-rejects, otherwise it always resolves to Access-Request, I guess because it references the request packet? Thanks Andy

1 0

authentication options
by john espiro 23 Apr '15

23 Apr '15

I installed my certs on my Android phones... it asked for the password for the key, andI was off... just set it to 802.1x TLS and it worked. Now, on my Nook Color, I was able to add my cert, but this time, it only let me choose 802.1x EAP. That's fine I thought, but then it was looking for a username/password for a user in my MySQL database on the radius server. That's fine with me too, but I am trying to understand why that one device was the only one that wanted a username/password. Now, on Ubuntu, if I choose PEAP, it only asks for the cacert plus a use/pass from my mysql database.

3 2

Question regarding redundant-load-balance
by Sebastian Hagedorn 23 Apr '15

23 Apr '15

Hi, we've been using freeradius for many years, but now we're setting up new servers (3.0.8 as of today) and I'm testing configuration options we've never used before. Currently I'm trying to figure out how to achieve maximum resilience using LDAP backends. We're using LDAP the "right" way, i.e. we query for the password during authorize. That works just fine. Here's the problem: I'm trying to use redundant-load-balance like this - I set up separate modules with one LDAP server each: # # The ldap module reads passwords from the LDAP database. # redundant-load-balance { rrzk-ldap-centos rrzk-ldap-mailldap } If both LDAP servers are up when I start radiusd, all is well, even if I stop one of the LDAP servers later. But if one of them is down during startup of radiusd, this happens: # radiusd -X ... rlm_ldap (rrzk-ldap-centos): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_ldap (rrzk-ldap-centos): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (rrzk-ldap-centos): Connecting to ldap://redacted:389 rlm_ldap (rrzk-ldap-centos): Could not start TLS: Can't contact LDAP server rlm_ldap (rrzk-ldap-centos): Opening connection failed (0) rlm_ldap (rrzk-ldap-centos): Removing connection pool /etc/raddb/mods-enabled/rrzk-ldap-centos[8]: Instantiation failed for module "rrzk-ldap-centos" # What do I have to do to make freeradius ignore that it can't instantiate the module during startup? Or what else am I doing wrong? Thanks Sebastian -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

2 3

linelog (special character)
by Peter Balsianok 23 Apr '15

23 Apr '15

Hi, Is it possible to use special character 0x00 – 0x0F in linelog (freeradius 3.0.7)? Example: Start = "%l[special character e.g. \n]%{Acct-Status-Type}[special character e.g. \n]%{Acct-Session-Id}[special character e.g. \n]%{User-Name}" Thx.

3 7