- Freeradius-Users - lists.freeradius.org

Where do you split users in groups.
by jan hugo prins 04 Mar '15

04 Mar '15

Hello, Until yesterday I did not need huntgroups in my radius config because I had basicly only one usage and this was wireless access. We are now implementing 802.1x on the wired network as well, and now we need to split between wireless access and wired access and I have started using huntgroups to do the basic selection when selecting what I have to send back to the user. A part of my users file looks like this: DEFAULT ldap_bedrijf1-Ldap-Group == "werkneme-bedrijf1", Realm == "bedrijf1.com", Huntgroup-Name == "wireless" Aruba-User-Vlan = 101, Aruba-User-Role = "authenticated" DEFAULT ldap_bedrijf1-Ldap-Group == "wireless-bedrijf1", Realm == "bedrijf1.com", Huntgroup-Name == "wireless" Aruba-User-Vlan = 2261, Aruba-User-Role = "guest" DEFAULT ldap_bedrijf2s-Ldap-Group == "bedrijf2", Realm == "bedrijf2.nl", Huntgroup-Name == "wireless" Aruba-User-Vlan = 2268, Aruba-User-Role = "authenticated" DEFAULT ldap_bedrijf3-Ldap-Group == "bedrijf3", Realm == "bedrijf3.nl", Huntgroup-Name == "wireless" Aruba-User-Vlan = 2266, Aruba-User-Role = "authenticated" DEFAULT ldap_bedrijf1-Ldap-Group == "bedrijf1", Realm == "bedrijf1.com", Huntgroup-Name == "wireless", Auth-Type := Reject Reply-Message = "Your account does not have wireless access." DEFAULT FreeRADIUS-Proxied-To == "127.0.0.1", Auth-Type := Reject Reply-Message = "Who are you?" In the huntgroup file I match the Aruba controllers to the wireless huntgroup. I read in the huntgroup file that you can create a huntgroup that is based on both the NAS-IP and the Unix group. I don't know if you can also match a LDAP group in the huntgroups file, but if this is possible I could create something like this: werknemers NAS-IP-Address = 172.30.27.1 ldap_bedrijf1-Ldap-Group == "werkneme-bedrijf1" And then in the users file do something like: DEFAULT Realm == "bedrijf1.com", Huntgroup-Name == "werknemers" Aruba-User-Vlan = 101, Aruba-User-Role = "authenticated" If both is valid, what is the preferred way of doing this? Jan Hugo Prins

2 2

SQL replacement for users file
by HCC Lists 04 Mar '15

04 Mar '15

Hello I know that I can use SQL to replace most of what can be done in the users file. What I want to do is roughly: test Huntgroup-Name != "WAP", Cleartext-Password := "test", Auth-Type := Reject Reply-Message = "Your account is limited to WiFi." test Cleartext-Password := "test", Huntgroup-Name == "WAP" Reply-Message = "WiFi enabled." I have added SQL Huntgroup support by adding the following to sites-enabled/default right after preprocess. update request { Huntgroup-Name := "%{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress='%{Client-IP-Address}'}" } if(Huntgroup-Name == "") { update request { Huntgroup-Name !* ANY } } The idea is to limit some accounts to WiFi only using WPA2-Enterprise. I don't want those accounts to be able to connect to the VPN. I am less worried about the VPN accounts connecting to the WiFi. What I cannot figure out is what combination of entries in the radcheck, radgroupcheck, radgroupreply, and radreply will do this. I have in radcheck: Username | Attribute | op | Value ---------+---------------------+----+--------- test | Cleartext-Password | := | test In radgroupcheck GroupName | Attribute | op | Value ----------+----------------+----+--------- WAP | Huntgroup-Name | == | WAP In radgroupreply GroupName | Attribute | op | Value ----------+---------------+----+---------------- WAP | Reply-Message | = | WiFi enabled. I have nothing specific in radcheck. I have tried more combinations that I can remember with no success. I am hoping I can do this in SQL, but I suppose I can figure out how to do it using unlang. Michael

2 1

Insert accounting data in different tables based on realm
by Francisco Amaral 04 Mar '15

04 Mar '15

Hello, I am trying to insert accounting data from different realms into different tables in MySQL. I would rather not have this run on the database server as a stored procedure, or spin up another pair of radius servers for every realm if possible. For instance I would like to: insert accounting data for user(a)example.org into radiusdb.radacct insert accounting data for user(a)example.com into radiusdb.radaccttemp Could someone point me in the right direction if this is even possible in FreeRADIUS before I call support? It seems to me like this has probably been done somewhere and I would not have to re-invent the wheel. I have been searching quite a bit the last few days and can't find an example. Regards, //F Francisco Amaral Senior Wi-Fi Networks Engineer Phone: (866) 848-5848 x 318 Fax: (866) 762-2250 Mobile: (401) 862-0526 Website: http://www.towerstream.com towerstream

2 2

Howto further debug when freeradius does not respond or log anything?
by Gary Holtkamp 04 Mar '15

04 Mar '15

Hi, I have a problem with a WLAN setup with freeradius 2.1.12 and a Cisco wireless LAN controller (WLC2504 version 7.6.120). There is nothing special configured, just WPA2 Enterprise with certificates on the Windows machines. It seems to me, that from time to time (happened 3x in the past 8 months or so ...) the Cisco WLAN controller sends broken radius packages or something that freeradius doesn't like. At first, I looked into the Cisco WLAN controller logfile, it logs something like "Radius server didn't answer request". Next step was to restart freeradius manually on the console with the "-X" option to see what might be going on. But freeradius didn't log anything. Next try was with "-X -x", but also no output there. I then made sure with wireshark/tcpdump that the Cisco is really sending out radius packets and that they reach the freeradius server. They do and the packets look good in wireshark, nothing that is apparently broken with them. But freeradius is not sending out anything. When I restart the Cisco, the problem goes away, so I'm quite sure that it's the Cisco that is sending broken packets somehow. Does anybody have an idea how to debug this further? I could ask Cisco, but they'll probably blame it on freeradius :-) best regards, Gary _____________________________________________________________ Washington DC's Largest FREE Email service. ---> http://www.DCemail.com ---> A Washington Online Community Member ---> http://www.DCpages.com

2 1

Accept all users?
by Dominik Menke 04 Mar '15

04 Mar '15

Hello list, I'm trying to secure my wireless networks with RADIUS, so that any combination of username/password will let the user in. So far I tried to add this line to my `users` file: DEFAULT Auth-Type := Accept With radtest I could get a positive feedback, but when I wire up the RADIUS server with my wireless AP and try to connect (via EAP-TTLS/MSCHAPv2), no connection is established. This happens on both a TP-Link router with OpenWRT and an Ubiquity UniFy AP as access point. Here's the debug output of freeradius (excerpt, the full log is attached): > rad_recv: Access-Request packet from host 192.168.8.1 port 60199, id=16, length=190 > User-Name = "foousername" > Called-Station-Id = "C2-4A-00-6C-F1-53:use.any.password" > NAS-Port-Type = Wireless-802.11 > NAS-Port = 1 > Calling-Station-Id = "E8-DE-27-1D-04-02" > Connect-Info = "CONNECT 54Mbps 802.11g" > Acct-Session-Id = "54EC901D-00000008" > Framed-MTU = 1400 > EAP-Message = 0x029f001001666f6f757365726e616d65 > Message-Authenticator = 0xd8aca58525e34524e692e7a0d3f6eab9 > # Executing section authorize from file /etc/freeradius/sites-enabled/default > +group authorize { > ++[preprocess] = ok > ++[chap] = noop > ++[mschap] = noop > [eap] EAP packet type response id 159 length 16 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] = updated > [files] users: Matched entry DEFAULT at line 1 > ++[files] = ok > ++[logintime] = noop > [pap] WARNING: Auth-Type already set. Not setting to PAP > ++[pap] = noop > +} # group authorize = updated > Found Auth-Type = Accept > Auth-Type = Accept, accepting the user > # Executing section post-auth from file /etc/freeradius/sites-enabled/default > +group post-auth { > ++[exec] = noop > +} # group post-auth = noop > Sending Access-Accept of id 16 to 192.168.8.1 port 60199 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 0 ID 16 with timestamp +5 The "sites-enabled/default" config is pretty much untouched from installation. For me it seems like a successful user authorization? When running tcpdump on the access point, I only see the outgoing EAP package. I'm a bit clueless now... Greetings, Dominik

4 5

Re: Question about multiple sql databases!
by Haviaras Kostas 04 Mar '15

04 Mar '15

Thanks for your responses Alan, can you guide me where to look? Thanks again

1 0

Re: Question about multiple sql databases!
by Haviaras Kostas 04 Mar '15

04 Mar '15

It matters if the user have the same username in the three databases??

2 1

Re: Question about multiple sql databases!
by Haviaras Kostas 04 Mar '15

04 Mar '15

>> I just tested, you are right, I am getting the same result! You know how to >> solve this ??? > > Configure multiple SQL modules. One for each virtual server. > > Or, update the queries to include a “database table” field. Take that field from a RADIUS >attribute. Probably one you create yourself (see raddb/dictionary). Then, in each virtual server, set > the value of that attribute to the correct database table. And then use the same SQL module in >all 3 virtual servers. > > Alan DeKok. Thanks for your response Alan, I have configure 3 SQL modules in the sql file, one for each virtual server and when I am connecting to one virtual server it is connect also to the other 2. My sql module is like this: /etc/freeradius/mods-enabled/sql: sql{ } sql fordb1{ } sql fordb2{ } sql fordb3{ } And my virtual servers are in the /etc/freeradius/sites-enabled/server1 server server1{ listen { type = auth ipaddr = * port = 50002 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = acct ipaddr = * port = 50003 limit { } } listen { type = auth ipv6addr = :: port = 50002 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 50003 type = acct limit { } } authorize { filter_username preprocess chap mschap digest suffix eap { ok = return } files fordb1 checkthetime1 -ldap expiration logintime pap } authenticate{ Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest eap } preacct { preprocess acct_unique suffix files } accounting { detail unix fordb1 exec attr_filter.accounting_response } session { fordb1 } post-auth { fordb1 exec remove_reply_message_if_eap Post-Auth-Type REJECT { fordb1 attr_filter.access_reject eap remove_reply_message_if_eap } } pre-proxy { } post-proxy { eap } } And similary I have create the other 2 virtual servers. I have to configure anything to radiusd.conf? I don't know if I am missing something here. Thanks

2 1

Re: Freeradius-Users Digest, Vol 119, Issue 17
by kanmongkhon buasa 04 Mar '15

04 Mar '15

http://paidvertsmoneynew.blogspot.com/ 2015-03-04 21:36 GMT+07:00 <freeradius-users-request(a)lists.freeradius.org>: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Weird issue - threads bottleneck in post-proxy section > (Alan DeKok) > 2. Re: Question about multiple sql databases! (Alan DeKok) > 3. Insert accounting data in different tables based on realm > (Francisco Amaral) > 4. Re: Question about multiple sql databases! (Haviaras Kostas) > 5. redis Module "rlm_redis" not available in Freeradius 2.2.5 ? > (tom greisch) > 6. Re: redis Module "rlm_redis" not available in Freeradius > 2.2.5 ? (Herwin Weststrate) > 7. Re: Question about multiple sql databases! (Haviaras Kostas) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 4 Mar 2015 07:54:17 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Weird issue - threads bottleneck in post-proxy section > Message-ID: <51284ED0-4211-4D88-8047-4B9CC62864E9(a)deployingradius.com> > Content-Type: text/plain; charset=windows-1252 > > On Mar 4, 2015, at 3:53 AM, RESTOUX, Loïc <loic.restoux(a)capgemini.com> > wrote: > > Do you mean that you reach 20K pps with time-consuming processing in > post-proxy ? > > I mean there’s 20K PPS with a carefully crafted configuration. So > FreeRADIUS *can* do 20Kpps proxying. > > > It's a critical point, because it means that there is something bad in > our overall environment, not in FreeRADIUS. > > Yes. There is nothing in the server which is designed to destroy > performance. The server core is designed to run as fast as possible. > > But… if you use EAP (TLS), performance drops about 90%. That’s due to > the CPU overhead of calculating the RSA keys. If you use a database, > performance drops a similar amount. Because databases have to write to > disk, and disks are slow. > > I have *never* seen the server proxy 100 pps, even with complex rules in > pre and post-proxy. So there’s something weird about your local system. > > Alan DeKok. > > > > > ------------------------------ > > Message: 2 > Date: Wed, 4 Mar 2015 07:57:41 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Question about multiple sql databases! > Message-ID: <7C10500A-FCCF-4079-8B86-B54B06A8DF6A(a)deployingradius.com> > Content-Type: text/plain; charset=windows-1252 > > On Mar 4, 2015, at 2:50 AM, Haviaras Kostas <koshalirod(a)gmail.com> wrote > > I just tested, you are right, I am getting the same result! You know how > to > > solve this ??? > > Configure multiple SQL modules. One for each virtual server. > > Or, update the queries to include a “database table” field. Take that > field from a RADIUS attribute. Probably one you create yourself (see > raddb/dictionary). Then, in each virtual server, set the value of that > attribute to the correct database table. And then use the same SQL module > in all 3 virtual servers. > > Alan DeKok. > > > > > ------------------------------ > > Message: 3 > Date: Wed, 4 Mar 2015 13:07:10 +0000 > From: Francisco Amaral <famaral(a)towerstream.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: Insert accounting data in different tables based on realm > Message-ID: <1425474427863.49191(a)towerstream.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > > > I am trying to insert accounting data from different realms into different > tables in MySQL. I would rather not have this run on the database server as > a stored procedure, or spin up another pair of radius servers for every > realm if possible. > > > For instance I would like to: > > > insert accounting data for user(a)example.org into radiusdb.radacct > > insert accounting data for user(a)example.com into radiusdb.radaccttemp > > > Could someone point me in the right direction if this is even possible in > FreeRADIUS before I call support? It seems to me like this has probably > been done somewhere and I would not have to re-invent the wheel. > > > I have been searching quite a bit the last few days and can't find an > example. > > > Regards, > > > //F > > > Francisco Amaral > Senior Wi-Fi Networks Engineer > Phone: (866) 848-5848 x 318 > Fax: (866) 762-2250 > Mobile: (401) 862-0526 > Website: http://www.towerstream.com > towerstream > > > > ------------------------------ > > Message: 4 > Date: Wed, 4 Mar 2015 15:41:00 +0200 > From: Haviaras Kostas <koshalirod(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Question about multiple sql databases! > Message-ID: > < > CAMALVUM9-t3_AH2D1OrX8UGXHS-mfhfBFWGRKYfqZqwjaLvB7Q(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > >> I just tested, you are right, I am getting the same result! You know how > to > >> solve this ??? > > > > Configure multiple SQL modules. One for each virtual server. > > > > Or, update the queries to include a “database table” field. Take that > field from a RADIUS >attribute. Probably one you create yourself (see > raddb/dictionary). Then, in each virtual server, set > the value of that > attribute to the correct database table. And then use the same SQL module > in >all 3 virtual servers. > > > > Alan DeKok. > > Thanks for your response Alan, I have configure 3 SQL modules in the sql > file, one for each virtual server and when I am connecting to one virtual > server it is connect also to the other 2. My sql module is like this: > /etc/freeradius/mods-enabled/sql: > sql{ > } > sql fordb1{ > > } > sql fordb2{ > > } > sql fordb3{ > > } > And my virtual servers are in the /etc/freeradius/sites-enabled/server1 > server server1{ > > listen { > type = auth > ipaddr = * > port = 50002 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > > listen { > type = acct > ipaddr = * > port = 50003 > limit { > } > } > > listen { > type = auth > ipv6addr = :: > port = 50002 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > > listen { > ipv6addr = :: > port = 50003 > type = acct > limit { > } > } > > authorize { > filter_username > preprocess > chap > mschap > digest > suffix > eap { > ok = return > } > files > fordb1 > checkthetime1 > -ldap > expiration > logintime > pap > } > > authenticate{ > Auth-Type PAP { > pap > } > Auth-Type CHAP { > chap > } > Auth-Type MS-CHAP { > mschap > } > digest > eap > } > > preacct { > preprocess > acct_unique > suffix > files > } > > accounting { > detail > unix > fordb1 > exec > attr_filter.accounting_response > } > > session { > fordb1 > } > > post-auth { > fordb1 > exec > remove_reply_message_if_eap > Post-Auth-Type REJECT { > fordb1 > attr_filter.access_reject > eap > remove_reply_message_if_eap > } > } > > pre-proxy { > } > > post-proxy { > eap > } > } > And similary I have create the other 2 virtual servers. I have to configure > anything to radiusd.conf? I don't know if I am missing something here. > Thanks > > > ------------------------------ > > Message: 5 > Date: Wed, 4 Mar 2015 14:27:06 +0000 (UTC) > From: tom greisch <tom.greisch(a)yahoo.de> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: redis Module "rlm_redis" not available in Freeradius 2.2.5 ? > Message-ID: > <124032476.4603484.1425479226428.JavaMail.yahoo(a)mail.yahoo.com> > Content-Type: text/plain; charset=UTF-8 > > Hello everybody, > I try to install Freeradius on a Debian 8.0 Testmaschine.I used the > Standard Packetmanager for Installation. So i got Freeradius > 2.2.5.Authentication works against Active Directory -> everything OK > After that i wanted to use the redis Module to cache AD User Groups. So i > configured a Redis Server and the "../freeradius/modules/redis" File. > > But when i start Freeradius in debugging Mode i get the following Messages: > etc/freeradius/modules/redis[10]: Failed to link to module 'rlm_redis': > file not found > /etc/freeradius/sites-enabled/inner-tunnel[307]: Failed to find "redis" in > the "modules" section. > /etc/freeradius/sites-enabled/inner-tunnel[263]: Errors parsing post-auth > section. > > My Question is: > -Is the Redis Module (rlm_redis) not part of the standard Freeradius 2.2.5 > Installation? > > > > ------------------------------ > > Message: 6 > Date: Wed, 04 Mar 2015 15:35:42 +0100 > From: Herwin Weststrate <herwin(a)quarantainenet.nl> > To: tom greisch <tom.greisch(a)yahoo.de>, FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: redis Module "rlm_redis" not available in Freeradius > 2.2.5 ? > Message-ID: <54F7183E.2030300(a)quarantainenet.nl> > Content-Type: text/plain; charset=utf-8 > > On 04-03-15 15:27, tom greisch wrote: > > Hello everybody, > > I try to install Freeradius on a Debian 8.0 Testmaschine.I used the > Standard Packetmanager for Installation. So i got Freeradius > 2.2.5.Authentication works against Active Directory -> everything OK > > After that i wanted to use the redis Module to cache AD User Groups. So > i configured a Redis Server and the "../freeradius/modules/redis" File. > > > > But when i start Freeradius in debugging Mode i get the following > Messages: > > etc/freeradius/modules/redis[10]: Failed to link to module 'rlm_redis': > file not found > > /etc/freeradius/sites-enabled/inner-tunnel[307]: Failed to find "redis" > in the "modules" section. > > /etc/freeradius/sites-enabled/inner-tunnel[263]: Errors parsing > post-auth section. > > > > My Question is: > > -Is the Redis Module (rlm_redis) not part of the standard Freeradius > 2.2.5 Installation? > > It is not listed as a stable module (src/modules/stable), which means > the Debian package doesn't include it. > > -- > Herwin Weststrate > > > ------------------------------ > > Message: 7 > Date: Wed, 4 Mar 2015 16:36:13 +0200 > From: Haviaras Kostas <koshalirod(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Question about multiple sql databases! > Message-ID: > < > CAMALVUNjCs7coV6dE_w4gZk9zMz+UorYdUSsYf12PE_D1C6OUw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > It matters if the user have the same username in the three databases?? > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 119, Issue 17 > ************************************************* >

1 0

redis Module "rlm_redis" not available in Freeradius 2.2.5 ?
by tom greisch 04 Mar '15

04 Mar '15

Hello everybody, I try to install Freeradius on a Debian 8.0 Testmaschine.I used the Standard Packetmanager for Installation. So i got Freeradius 2.2.5.Authentication works against Active Directory -> everything OK After that i wanted to use the redis Module to cache AD User Groups. So i configured a Redis Server and the "../freeradius/modules/redis" File. But when i start Freeradius in debugging Mode i get the following Messages: etc/freeradius/modules/redis[10]: Failed to link to module 'rlm_redis': file not found /etc/freeradius/sites-enabled/inner-tunnel[307]: Failed to find "redis" in the "modules" section. /etc/freeradius/sites-enabled/inner-tunnel[263]: Errors parsing post-auth section. My Question is: -Is the Redis Module (rlm_redis) not part of the standard Freeradius 2.2.5 Installation?

2 1