- Freeradius-Users - lists.freeradius.org

How to configure LDAP
by Sautron Nick 18 Feb '15

18 Feb '15

Hello everyone, I want to know, how to configure ldap with freeradius 2 please ? Best regards

4 8

RE: Freeradius-Users Digest, Vol 118, Issue 30
by Sander Eerdekens 17 Feb '15

17 Feb '15

> -----Oorspronkelijk bericht----- > Date: Tue, 17 Feb 2015 09:17:44 -0500 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > Subject: Re: compiling Freeradius v3 on Solaris 11 > > > We are currently migrating to new servers for our freeradius setup, > > And would like to take the opportunity to switch from freeradius v2 to > freeradius v3 as well. > > I am having some problems compiling freeradius v3 on Solaris 11, Though. > > Until now we compiled Freeradius v2 on Solaris 10. > > You could take this opportunity to migrate away from solaris? :) I am stuck on SPARC/Solaris hardware for anything unix-like. Building is hard, but one we get it build I cannot complain. ;) > > Now, we are trying to compile freeradius 3.0.6 on solaris 11.2 (SPARC). > > Mm that's going to be fun. > > > Is there anything I can do to help get this issue fixed? > > From previous notes/rants, you need to define -D_XOPEN_SOURCE to match > the C standard used. Thank, I will look into this. For now I used Alan's suggestion, which seemed to help. > > Some other problems I ran into but managed to circumvent: > > - I have to use gmake, make gives an error on Make.inc, line 33: > Unexpected end of line seen > > Same issue as http://lists.freeradius.org/pipermail/freeradius- > users/2014-June/072411.html > > - I tried using solaris studio's cc, here I get stuck on "checking for > talloc.h", even though I include -- with-talloc-include-dir with configure, cc > does not know the -isystem it seems > > Ok. Well, you're welcome to write a patch to check for -isystem to > enable/disable it. Or use gcc/clang. Just thought I would mentioned it (also helpful for other people trying to compile on solaris in the future), I myself have not the knowledge to write good patches, but I am perfectly happy using this workaround, or using gcc. > > If I try to compile the snippet itself I get a warning that the last return > was not reached. > > Is my compiler broken, of what could be the issue here? > > Hm. Fixed that. It's being extra picky. Thanks! > > With GCC I do not have this issue, but I end up in the problem that gcc > does not know the -KPIC option, > > If I adjust the source to -fPIC, I end up in the same situation above with > the udpfromto error. > > > Solaris is a complete pain to build on. I managed to do with with the ldap > module disabled. > > -Arran It seems with some effort, I managed to build 3.0.6 with rlm_ldap. I do compile my own ldap libraries, I do not use the built-in solaris headers/libs. I'll try to test if the rlm_ldap function actually works, but will have to familiarize myself with the v3 config files first. If the rlm_ldap function actually works I will keep you up-to-date. Thank you, Arran and Alan :) Kind regards Sander Eerdekens

2 1

Re: Info about rlm_yubikey
by Arran Cudbard-Bell 17 Feb '15

17 Feb '15

> On 17 Feb 2015, at 08:54, Stefano Cailotto [EDALab] <stefano.cailotto(a)edalab.it> wrote: > > Hello Arran, > excuse me if I write you directly but I'd need some information asap (due to a customer pressing me). CCing this to FreeRADIUS users, just in case this might help someone. > My situation is as follows: > I've a FreeRadius (FR) server using OpenLDAP as a backend, containing also yubikeys for users (http://www.logix.cz/michal/devel/yubikey-ldap/) > 2Factor Authentication works perfectly in Linux,as users are prompted for Yubikey OTP and then for their ldap passwd. > > I'm trying rlm_yubikey on FR 3.0.6 and a Cisco Router. > I can autheniticate users using yubikey module (passing ldap passwd+otp when prompted for password). > What I can't do is to bind one or more yubikey to a user as it happens for example with pam_yubico (verified also for Linux auth through pam) or rlm-yubico module (I read there's a parameter "Place username → YubiKey mappings in /etc/yubico/rlm/ykmapping" in the doc). At the moment, a user can authenticate with his/her passwd and any valid Yubikey (i.e. validated by Yubico Validation Server). > > I tried also with pam (yubico+ldap), but it seems the pam_yubico module is passed the username as OTP. > > So, my final question (sorry to be very verbose) is: > Is there a way to map yubikey(s) <-> users with rlm_yubikey? Yes. Read the Yubikey config file etc/raddb/yubikey. It documents all the attributes available. The request flow would be something like: authorize { yubikey if (ok) { update control { Auth-Type := yubikey } } } authenticate { auth-type yubikey { yubikey # does decryption of the key ldap # authenticates the user, retrieves key binding attributes, # puts them in control:Yubikey-Private-Id } } post-auth { if (&Yubikey-Private-Id != &control:Yubikey-Private-ID[*]) { update reply { Reply-Message := "Token not allowed for use by user %{User-Name}" } reject } } In the ldap config file, uncomment valuepair_attribute. In LDAP add radiusAttribute values in the format: radiusAttribute: control:Yubikey-Private-ID+='<modhex>' For that attribute to be available you'll need to have loaded the FreeRADIUS schema: https://github.com/FreeRADIUS/freeradius-server/blob/master/doc/schemas/lda… and added objectClass: radiusProfile to the user objects. Or you can use your own attribute instead of radiusAttribute if that's easier. It's all configurable. If you want to do dynamic binding, that's possible too. Just use the Post-Auth stuff in rlm_ldap to update the directory. Use slapo-constraint to prevent the same ID being added multiple times (or not if you want multiple users to share a key). Binding isn't a magical feature. The rlm_yubikey module was written to support multiple user scenarios, that's why all the extracted info is exposed as attributes. They're available for you to implement whatever local restrictions and policies you want. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

RE: Freeradius-Users Digest, Vol 118, Issue 29
by Sander Eerdekens 17 Feb '15

17 Feb '15

> Date: Tue, 17 Feb 2015 07:36:35 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: compiling Freeradius v3 on Solaris 11 > > > The issue I am bumping into is the same as described here: > > http://lists.freeradius.org/pipermail/freeradius-users/2014- > June/072438.html > > (compiling Freeradius 3.0.3 at Solaris). > > src/lib/udpfromto.c:251:6: error: 'struct msghdr' has no member named > 'msg_control' > > > > Is there anything I can do to help get this issue fixed? > > This should help: ./configure —help > > ./configure ----with-udpfromto=no Thank you, I overlooked this, this helps! > > - I have tried compiling arran's Freeradius 3.0.7 RC0, but keep getting an > error that my compiler must support C11, > > I am using Solaris Studio 12.4, whoch should support C11: > > > https://docs.oracle.com/cd/E37069_01/html/E37074/appxc.html#scrolltoc > > Is my compiler broken? > > I’d say so. > > > If I try to compile the snippet itself I get a warning that the last return > was not reached. > > It’s a warning. Not an error. Yes, but with the -Werror option that the configure script passes, all warnings are treated as errors. Furthermore, Configure does not seem to set the RADIUSD_VERSION constant in /src/include/features.h and /src/include/autoconf.h RADIUSD_VERSION_STRING in these files were set to the correct version. If I set RADIUSD_VERSION to 030006 manually, I can compile and get 3.0.6 running. Thank you very much! One more comment: If I try to build 3.0.7 using the same settings as above, RADIUS_VERSION_STRING is set to 3.1.0, and I get this error further on: Undefined first referenced symbol in file rad_suid_set_down_uid build/objs/src/main/mainconfig.o ld: fatal: symbol referencing errors collect2: error: ld returned 1 exit status gmake: *** [build/bin/local/radiusd] Error 1 Am I the only one? :) Kind regards Sander Eerdekens

3 2

write accounting of concrete NAS to separate file
by Vld 17 Feb '15

17 Feb '15

Hello! With Freeradius 2.1.x brach is it possible to exclude accounting data of specific NAS (or may be by user-name) from general detail and redirect it to another separate file? Thanks!

3 3

compiling Freeradius v3 on Solaris 11
by Sander Eerdekens 17 Feb '15

17 Feb '15

Hello, We are currently migrating to new servers for our freeradius setup, And would like to take the opportunity to switch from freeradius v2 to freeradius v3 as well. I am having some problems compiling freeradius v3 on Solaris 11, Though. Until now we compiled Freeradius v2 on Solaris 10. Now, we are trying to compile freeradius 3.0.6 on solaris 11.2 (SPARC). I am using GCC 4.8.2 and gmake. The issue I am bumping into is the same as described here: http://lists.freeradius.org/pipermail/freeradius-users/2014-June/072438.html (compiling Freeradius 3.0.3 at Solaris). src/lib/udpfromto.c:251:6: error: 'struct msghdr' has no member named 'msg_control' Is there anything I can do to help get this issue fixed? Some other problems I ran into but managed to circumvent: - I have to use gmake, make gives an error on Make.inc, line 33: Unexpected end of line seen Same issue as http://lists.freeradius.org/pipermail/freeradius-users/2014-June/072411.html - I tried using solaris studio's cc, here I get stuck on "checking for talloc.h", even though I include -- with-talloc-include-dir with configure, cc does not know the -isystem it seems I can circumvent this issue by passing the dir in CCFLAGS in my environment variable Snippet from config.log: === configure:7294: cc -c -g -mt -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -isystem /opt/csw/include/ conftest.c >&5 cc: Warning: Option -ystem passed to ld, if ld is invoked, ignored otherwise === Upon setting CFLAGS=' -L/opt/csw/lib -R/opt/csw/lib -I/opt/csw/include', this is resolved - I have tried compiling arran's Freeradius 3.0.7 RC0, but keep getting an error that my compiler must support C11, I am using Solaris Studio 12.4, whoch should support C11: https://docs.oracle.com/cd/E37069_01/html/E37074/appxc.html#scrolltoc Is my compiler broken? Relevant info from config.log: ==== checking for the compiler flag to enable C11 support cc -c -Werror -std=c11 conftest.c >&5 configure: failed program was: <snip> | int | main () | { | | struct foo { | union { | int a; | int b; | }; | } bar; | return 0; | | ; | return 0; | } ==== If I try to compile the snippet itself I get a warning that the last return was not reached. Is my compiler broken, of what could be the issue here? With GCC I do not have this issue, but I end up in the problem that gcc does not know the -KPIC option, If I adjust the source to -fPIC, I end up in the same situation above with the udpfromto error. My apologies for combining so much info in one mail, but I tried to be as thorough as I could in combining everything I have tried until now :) Thank you very much in advance Kind regards Sander Eerdekens

3 2

using multiple python modules.
by Kyuyoung Kim 17 Feb '15

17 Feb '15

Hello. I'm trying to use rlm_python module. but, I cannot use two modules. I want to know that is using two python modules possible or not. If you have some experience for Python module, a little help would be appreciated. thanks. -- radiusd logs Mon Feb 16 19:30:52 2015 : Debug: Loading library using absolute path "/usr/lib64/freeradius/rlm_python.so" Mon Feb 16 19:30:52 2015 : Debug: Loaded rlm_python, checking if it's valid Mon Feb 16 19:30:52 2015 : Debug: # Loaded module rlm_python Mon Feb 16 19:30:52 2015 : Debug: # Instantiating module "python2" from file /etc/raddb/mods-enabled/python2 Mon Feb 16 19:30:52 2015 : Debug: python python2 { Mon Feb 16 19:30:52 2015 : Debug: mod_instantiate = "example2" Mon Feb 16 19:30:52 2015 : Debug: func_instantiate = "instantiate" Mon Feb 16 19:30:52 2015 : Debug: mod_authorize = "example2" Mon Feb 16 19:30:52 2015 : Debug: func_authorize = "authorize" Mon Feb 16 19:30:52 2015 : Debug: mod_authenticate = "example2" Mon Feb 16 19:30:52 2015 : Debug: func_authenticate = "authenticate" Mon Feb 16 19:30:52 2015 : Debug: mod_preacct = "example2" Mon Feb 16 19:30:52 2015 : Debug: mod_accounting = "example2" Mon Feb 16 19:30:52 2015 : Debug: mod_checksimul = "example2" Mon Feb 16 19:30:52 2015 : Debug: mod_pre_proxy = "example2" Mon Feb 16 19:30:52 2015 : Debug: mod_post_proxy = "example2" Mon Feb 16 19:30:52 2015 : Debug: mod_post_auth = "example2" Mon Feb 16 19:30:52 2015 : Debug: mod_recv_coa = "example2" Mon Feb 16 19:30:52 2015 : Debug: mod_send_coa = "example2" Mon Feb 16 19:30:52 2015 : Debug: mod_detach = "example2" Mon Feb 16 19:30:52 2015 : Debug: func_detach = "instantiate" Mon Feb 16 19:30:52 2015 : Debug: } Mon Feb 16 19:30:52 2015 : Debug: mod_init done .... Mon Feb 16 19:30:52 2015 : Debug: # Instantiating module "python1" from file /etc/raddb/mods-enabled/python1 Mon Feb 16 19:30:52 2015 : Debug: python python1 { Mon Feb 16 19:30:52 2015 : Debug: mod_instantiate = "example1" Mon Feb 16 19:30:52 2015 : Debug: func_instantiate = "instantiate" Mon Feb 16 19:30:52 2015 : Debug: mod_authorize = "example1" Mon Feb 16 19:30:52 2015 : Debug: func_authorize = "authorize" Mon Feb 16 19:30:52 2015 : Debug: mod_authenticate = "example1" Mon Feb 16 19:30:52 2015 : Debug: func_authenticate = "authenticate" Mon Feb 16 19:30:52 2015 : Debug: mod_preacct = "example1" Mon Feb 16 19:30:52 2015 : Debug: mod_accounting = "example1" Mon Feb 16 19:30:52 2015 : Debug: mod_checksimul = "example1" Mon Feb 16 19:30:52 2015 : Debug: mod_pre_proxy = "example1" Mon Feb 16 19:30:52 2015 : Debug: mod_post_proxy = "example1" Mon Feb 16 19:30:52 2015 : Debug: mod_post_auth = "example1" Mon Feb 16 19:30:52 2015 : Debug: mod_recv_coa = "example1" Mon Feb 16 19:30:52 2015 : Debug: mod_send_coa = "example1" Mon Feb 16 19:30:52 2015 : Debug: mod_detach = "example1" Mon Feb 16 19:30:52 2015 : Debug: func_detach = "instantiate" Mon Feb 16 19:30:52 2015 : Debug: } Mon Feb 16 19:07:55 2015 : Error: rlm_python:mod_load_function: module 'example1' is not found Mon Feb 16 19:07:55 2015 : Error: rlm_python:EXCEPT:: local variable 'bError' referenced before assignment Mon Feb 16 19:07:55 2015 : Error: rlm_python:mod_load_function: failed to import python function example1.instantiate' Mon Feb 16 19:07:55 2015 : Error: /etc/raddb/mods-enabled/python1[9]: Instantiation failed for module "python1" -- execution environments export PYTHONPATH=/etc/raddb/mods-config/python i exported python module path. -- mods-enabled python python1 { module = example1 mod_instantiate = ${.module} func_instantiate = instantiate mod_detach = ${.module} func_detach = instantiate mod_authorize = ${.module} func_authorize = authorize mod_authenticate = ${.module} func_authenticate = authenticate mod_preacct = ${.module} # func_preacct = preacct mod_accounting = ${.module} # func_accounting = accounting mod_checksimul = ${.module} # func_checksimul = checksimul mod_pre_proxy = ${.module} # func_pre_proxy = pre_proxy mod_post_proxy = ${.module} # func_post_proxy = post_proxy mod_post_auth = ${.module} # func_post_auth = post_auth mod_recv_coa = ${.module} # func_recv_coa = recv_coa mod_send_coa = ${.module} # func_send_coa = send_coa } python python2 { module = example2 mod_instantiate = ${.module} func_instantiate = instantiate mod_detach = ${.module} func_detach = instantiate mod_authorize = ${.module} func_authorize = authorize mod_authenticate = ${.module} func_authenticate = authenticate mod_preacct = ${.module} # func_preacct = preacct mod_accounting = ${.module} # func_accounting = accounting mod_checksimul = ${.module} # func_checksimul = checksimul mod_pre_proxy = ${.module} # func_pre_proxy = pre_proxy mod_post_proxy = ${.module} # func_post_proxy = post_proxy mod_post_auth = ${.module} # func_post_auth = post_auth mod_recv_coa = ${.module} # func_recv_coa = recv_coa mod_send_coa = ${.module} # func_send_coa = send_coa }

2 1

Problem - Duplicating IPs
by Marcelo Santoro 17 Feb '15

17 Feb '15

Hi Friends… I am facing a problem here in my ISP. I have radippool configured in my freeradius 3.0.6 server and some times my customers are receiving Duplicated IP address, Example 1: ================== Customer: login1 IP 186.227.32.1 NAS: 1 Service: pppoe Customer: login2 IP: 186.227.32.1 NAS: 2 Service: pppoe ================== Example 2: ================== Customer: login1 IP 186.227.32.1 NAS: 1 Service: pppoe Customer: login2 IP: 186.227.32.1 NAS: 1 Service: hotspot ================== Example 3: ================== Customer: login1 IP 186.227.32.1 NAS: 1 Service: hotspot Customer: login2 IP: 186.227.32.1 NAS: 2 Service: pppoe ================== This is what i detected …. but i don`t know how to solve that problem. To fix fast… i created a php script that connect in my Mikrotik Routers and look for logins with duplicated IPs and disconnect these customers in case they exist. But i have a delay of 3 minutes between checks, and while they are connected i have a “loop” in my network. Please friends… how can i fix it ? Is there any configuration to be made in radippool configuration ? Thank you friends. Best Regards.

3 2

Re: Problem - Duplicating IPs
by Rui Ribeiro 17 Feb '15

17 Feb '15

Hi Alan, Forgive my ignorance, but are you implying DHCP is keeping up with accounting data? I tried to write a script to identify users via a web page to give some accounting stats and quickly reached the conclusion it was not real time (i.e. if done immediately upon login it would often show the previous user). When in Meru training they also confirmed me the delay when receiving accounting data could be up to 3 minutes for their equipment, if I am not wrong, giving the delay from the top of my head. So the idea I have is whilst accounting is very useful, it is not exactly real-time, correct? Regards > Message: 4 > Date: Mon, 16 Feb 2015 08:44:22 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Problem - Duplicating IPs > Message-ID: <067378F3-DD2D-4CAE-9CAE-9CD20275DACD(a)deployingradius.com> > Content-Type: text/plain; charset=windows-1252 > > On Feb 16, 2015, at 7:37 AM, Marcelo Santoro <santoro.ice(a)gmail.com> > wrote: > > I am facing a problem here in my ISP. > > > > I have radippool configured in my freeradius 3.0.6 server and some times > my customers are receiving Duplicated IP address, > > Fix your NAS so that it sends the correct accounting packets. > > FreeRADIUS *assumes* that the accounting information in SQL is correct. > If the NAS doesn’t behave properly, the data in SQL will be wrong. And the > server will assign duplicate IPs. > > Until you get a real NAS (or fix your current one), the best solution > would be to write a script to read IPs from SQL, and then scan those in the > network. If there’s a response, update SQL to mark the IPs as still in use. > > Alan DeKok. > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 2

auxiliary tool to facilitate the administration
by Osvaldo T Crispim Filho 17 Feb '15

17 Feb '15

I want to contribute to the project with an auxiliary tool , web and desktop , open source , to facilitate the administration of freeradius . What features can not miss ? -- - Osvaldo T Crispim Filho -

1 0