- Freeradius-Users - lists.freeradius.org

Proxying between RADIUS servers using TLS
by Stefan Paetow 01 Apr '15

01 Apr '15

Hi, Since FR now supports TLS, how should I configure proxy.conf to specify that I want a specific realm to be handled over TLS (instead of the default UDP)? I can't find anything in the online docs (am happy to submit patches to improve this in 3.0.8 and later once I've tested that here). Alan(x2)? Arran? Any ideas? Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

4 15

which attribute identifies the client?
by Stefano Zanmarchi 01 Apr '15

01 Apr '15

Hallo, I can see in the logs the "client" calling my radius, e.g: Wed Apr 1 13:28:06 2015 : Auth: Login OK: [jsmith(a)unipd.it] (from client radius_garr_1 port 0 cli e4-d5-3d-b2-29-ca) Wed Apr 1 13:28:07 2015 : Auth: Login OK: [anonymous(a)rug.nl] (from client economia.unipd.it port 3 cli 94-eb-cd-6d-e0-ad) which is the attribute containing the "client" (radius_garr_1, economia.unipd.it,...)? I'd like to use it in the %{...} form to perform some filtering in the authorize section of inner-tunnel file. Thanks a lot, Stefano

2 1

FR 3.0.8 sql
by Marcin 01 Apr '15

01 Apr '15

Hi, #v+ if (Framed-Protocol == "PPP") { linelog sql_last_online if (fail){ ok } } #v- #v+ (2) # Executing section accounting from file /etc/freeradius/sites-enabled/default (2) accounting { (2) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (2) detail: --> /var/log/freeradius/radacct/172.21.7.176/detail-20150401 (2) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.21.7.176/detail-20150401 (2) detail: EXPAND %t (2) detail: --> Wed Apr 1 10:07:35 2015 (2) [detail] = ok (2) [unix] = ok (2) radutmp: EXPAND /var/log/freeradius/radutmp (2) radutmp: --> /var/log/freeradius/radutmp (2) radutmp: EXPAND %{User-Name} (2) radutmp: --> bobpppoe (2) [radutmp] = ok (2) if (Framed-Protocol == "PPP") { (2) if (Framed-Protocol == "PPP") -> TRUE (2) if (Framed-Protocol == "PPP") { (2) linelog: EXPAND Accounting-Request.%{%{Acct-Status-Type}:-unknown} (2) linelog: --> Accounting-Request.Start (2) linelog: EXPAND /var/log/freeradius/linelog (2) linelog: --> /var/log/freeradius/linelog (2) linelog: EXPAND %T|C|%{Acct-Unique-Session-ID}|%{Framed-IP-Address}|%{Calling-Station-Id}|%{NAS-IP-Address}|%{NAS-Identifier} (2) linelog: --> 2015-04-01-10.07.35.000000|C|2df2a8590df82d3c84648b7a1b17d357|10.5.4.3|08:00:27:D6:04:2D|172.21.7.176|TestowyMT (2) [linelog] = ok (2) sql_last_online: EXPAND %{tolower:type.%{Acct-Status-Type}.query} (2) sql_last_online: --> type.start.query (2) sql_last_online: Using query template 'query' rlm_sql (sql_last_online): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql_last_online): Opening additional connection (0), 1 of 10 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect to MySQL server myDB@127.0.0.1:myDB rlm_sql_mysql: MySQL error: Can't connect to MySQL server on '127.0.0.1' (111) rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql_last_online): Opening connection failed (0) (2) [sql_last_online] = fail (2) } # if (Framed-Protocol == "PPP") = fail (2) } # accounting = fail (2) Not sending reply to client. (2) Finished request #v- and another reqest is sending by nas. How to configure, that if sql_last_olnie module can't connect to database, then still is 'ok' and generally accounting section reply ok?

1 1

Dynamic vlan with ldap group fail
by Sautron Nick 01 Apr '15

01 Apr '15

Hello everyone, I have a problem concerning the dynamic assignment of VLAN according to ldap groups. Here is my shemas ldap: dc = company, dc = com ou = eduroam ou = groups cn = service cn = personal cn = student cn = users my users files : DEFAULT Ldap-Group == "service" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 5 DEFAULT Ldap-Group == "personnal" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 6 DEFAULT Ldap-Group == "student" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 7 DEFAULT Ldap-Group == "users" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 8 modules/ldap files : ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "********" identity = "cn=admin,ou=eduroam,dc=company,dc=fr" password = ****** basedn = "ou=People,dc=company,dc=fr" filter = "(&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(dialupAccess=true))" base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 ............ # # Group membership checking. Disabled by default. # groupname_attribute = cn groupmembership_filter = "(&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=company,dc=fr))" #groupmembership_attribute = radiusGroupName freeradius -X extract ..... [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=****,dc=fr -> ou=People,dc=*****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ***** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(dialupAccess=true)) -> (&(Login=******)(dialupAccess=true)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*******,dc=fr, with filter (&(Login=*****)(dialupAccess=true)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ****** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) -> (&(Login=******)(isMemberOf=ou=groups,ou=eduroam,dc=******,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*****,dc=fr, with filter (&(cn=service)(&(Login=*****)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group service not found or user is not a member. [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=******,dc=fr -> ou=People,dc=****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ***** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*******,dc=fr)) -> (&(Login=*******)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*****,dc=fr, with filter (&(cn=personnal)(&(Login=*******)(isMemberOf=ou=groups,ou=eduroam,dc=******,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group personnal not found or user is not a member. [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=******,dc=fr -> ou=People,dc=*****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ***** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*******,dc=fr)) -> (&(Login=*****)(isMemberOf=ou=groups,ou=eduroam,dc=*******,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=****,dc=fr, with filter (&(cn=student)(&(Login=*****)(isMemberOf=ou=groups,ou=eduroam,dc=****,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group student not found or user is not a member. [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=******,dc=fr -> ou=People,dc=****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ******* [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) -> (&(Login=****)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*******,dc=fr, with filter (&(cn=users)(&(Login=******)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group users not found or user is not a member. ++[files] returns noop [ldap] performing user authorization for ******* [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ***** [ldap] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(dialupAccess=true)) -> (&(Login=****)(dialupAccess=true)) [ldap] expand: ou=People,dc=******,dc=fr -> ou=People,dc=****,dc=fr [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=******,dc=fr, with filter (&(Login=*****)(dialupAccess=true)) .......... Someone can explain to me, why the freeradius server can not find the groups? Is this the right configuration? Best regards

2 3

Re: Freeradius-Users Digest, Vol 120, Issue 1
by Rui Ribeiro 01 Apr '15

01 Apr '15

Hi Adam, Daloradius is not maintained since 2012, and only supports FR 2.x. Configure MySQL, accounting in FR, and also your APs/controller to send accounting data. I have written some basic python scripts, and tested elastic search. Our federation has done a fantastic job with elastic search too. Regards > Message: 1 > Date: Tue, 31 Mar 2015 15:24:55 -0400 > From: Adam Schappell <aschappell(a)clearedgeit.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: integrating daloradius > Message-ID: > <CAHoRX4K1rKAoTTvs5upkmON24RwJxVaO5LXt8ej-qL= > zys7N3g(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hello, > > Has anyone been successful with integrating freeradius with daloradius? I > have freeradius running and can get to the web interface for daloradius but > do not know how to get the users that are on the wifi to show up? Also is > there any way to import users from AD (since im using MS AD for > authentication). Thanks! > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

Re: Help PLease
by Matthew Newton 31 Mar '15

31 Mar '15

Hi, Please keep replies on-list. On Thu, Mar 26, 2015 at 03:38:51PM +0000, aschappell(a)clearedgeit.com wrote: > What do I test the authentication with besides the local host? I > am new to this radius thing. When I go to login to wifi I do not > see anything in the debug output that is showing someone is > logging in. OK, so you need to make sure that your access point / wireless controllers are configured correctly and have access to your RADIUS server. You have a number of clients added in clients.conf - have you added the actual client (AP) that you are testing from? Is there a firewall in the way or iptables on the server? Start by running tcpdump on the server to make sure that the packets are actually reaching the RADIUS server. If they aren't, and there are no firewalls, then make sure your AP/wireless system is configured correctly. Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

7 52

Ready for 2.2.7?
by Alan DeKok 31 Mar '15

31 Mar '15

Any objections? I think we're pretty much OK. I also think that after 2.2.7, we will EOL the version 2 series. This means that security fixes will be added, but we will no longer be having regular releases. Now that 3.0 is available, we recommend that new deployments use that, instead of version 2. Alan DeKok.

6 25

integrating daloradius
by Adam Schappell 31 Mar '15

31 Mar '15

Hello, Has anyone been successful with integrating freeradius with daloradius? I have freeradius running and can get to the web interface for daloradius but do not know how to get the users that are on the wifi to show up? Also is there any way to import users from AD (since im using MS AD for authentication). Thanks!

2 1

Segmentation Fault after querying radgroupcheck in FR 3.0.7
by Susan Barnes 31 Mar '15

31 Mar '15

Hi, we have built and installed FR 3.0.7 RPMs on CentOS 6 with the specfile from <http://software.opensuse.org/download.html?project=home%3Afreeradius%3A3.0.…> (with minimal changes for the changes from 3.0.4 to 3.0.7) We have run into the following problem: Using SQL-Backend, we would like to authorize users according to huntgroups. We have set up a usergroup mgm-wlan-3 and then inserted the following attribute/value into radgroupcheck: insert into radgroupcheck (GroupName, Attribute, op, Value) values ('mgm-wlan-3', 'Huntgroup-Name', '==', 'submarine'); When testing the user is found, but just after querying radgroupcheck we get a seg fault if and only if the attribute in radgroupcheck does not match. output from radisud -X rlm_sql (sql): Reserved connection (9) (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00254bbf0584' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00254bbf0584' ORDER BY id (3) sql: User found in radcheck table (3) sql: Conditional check items matched, merging assignment check items (3) sql: Cleartext-Password := '00254bbf0584' (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '00254bbf0584' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '00254bbf0584' ORDER BY id (3) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (3) sql: --> SELECT groupname FROM radusergroup WHERE username = '00254bbf0584' ORDER BY priority (3) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '00254bbf0584' ORDER BY priority (3) sql: User found in the group table (3) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (3) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'mgm-wlan-3' ORDER BY id (3) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'mgm-wlan-3' ORDER BY id Segmentation fault We have looked into the source and used gdb and think the problem lies with the following lines from rlm_sql.c within rlm_sql_process_groups(): do { next: rad_assert(entry != NULL); pairstrcpy(sql_group, entry->name); . . . if ((rows > 0) && (paircompare(request, request->packet->vps, check_tmp, &request->reply->vps) != 0)) { pairfree(&check_tmp); entry = entry->next; goto next; /* != continue */ } If the attributes from radgroupcheck do not match paircompare() returns a value not 0 and then entry->next is not defined, but we still jump into the next iteration and possibly pairstrcpy() segfaults. rad_assert does not seem to do anything, because NDEBUG was set during compilation. Is this a bug or are we doing anything wrong? Thanks in advance Susan -- S.Barnes Cologne University IT/Networking Dept.

3 2

RE: Certificate information
by Franks Andy (IT Technical Architecture Manager) 31 Mar '15

31 Mar '15

Hi Arran, So, I've partly got this, but only partly! If I create a radius attribute in the dictionary of string type, how does that link to the EKU extension part of the cert? Obviously there are predefined attributes in the internal dictionary and the one I'd expect to start reporting this is (presumably multi value attribute?) ATTRIBUTE TLS-Client-Cert-X509v3-Extended-Key-Usage 1927 .. but that returns an empty string during the debugging (7) EXPAND %{TLS-Client-Cert-X509v3-Extended-Key-Usage} (7) --> (7) Reply-Message += "" If wonder if it's either due to the openssl library version or the fact that the certs are likely DER format to start with..? I know that certain attributes are required for windows to even look at a certificate for wireless use, so we can assume "client authentication" as one of the required EKUs - I'd be looking for ones over and above that as it looks like the certificates being created randomly by the domain administrator (!) contain other things like encrypting file system use and so on. Anyway, I guess the best way forward is to download the latest git and try what you added? Am I best to try and upgrade the openssl libraries too? Thanks guys, really helpful.

2 1