- Freeradius-Users - lists.freeradius.org

Preserve ldap attributes after proxy
by Tamás Becz 11 Nov '14

11 Nov '14

Hi everyone, I'm trying to wrap my head around this, digging in the archives and the wiki with no luck, so I'm looking for a few pointers. We are currently using freeradius to to proxy requests to a central One-Time-password server (which is outside our control). This is purely authentication, we send the cleartext token we received from the NAS, they check and either reject or reply. (The only reason we do this is because the upstream organization is not willing to deal with the administration of the NASes and we've been asked to aggregate traffic) Now with a new solution I also need to query a central ldap database for authorization info: I need to get a given attribute off of user records and present them to the NAS. I was pointing my finger at Filter-Id, but purely because the NAS docs points at it, it could really be anything. If I omit the proxy part, then it's just a straightforward ldap config with adding the attribute as a reply Item mapped to Filter-ID in the ldap.attrmap with +=, getting rid of reading the userPassword so that no one tries to auth against the password there and enable ldap in the authorize section. However, when I then proxy the request these extra Filter-Ids are lost: they are neither proxied (which is just as well, I really don't know what would the homeserver do about it) nor are they sent in my reply. I've found traces of something like this being discussed that this is because there is a separate data structure, but that is over a decade old, and I'm a bit confused on how this supposed to work. Is there a way to keep does attributes (or to get them after proxying, either in post-proxy or post-auth maybe?) by using rlm_ldap? I could probably write a short perl that queries this directly in post-auth, but basically the reason I want to do this in radius instead of the NAS is because I would need a mild hack on my networking to allow it to directly reach the ldap, so I though that, the radius box can reach the ldap, it can talk ldap, the nas is connected anyway.. But if it's troublesome with radius, then I'd rather not hack it. Does anyone have a pointer on what track should I go down? Thanks! tamas

3 9

statistics with radsniff and collectd
by Louis Munro 10 Nov '14

10 Nov '14

Hello, I am trying to integrate radsniff with collectd as described on the wiki : http://wiki.freeradius.org/guide/stats-with-radsniff#collectd I have compiled radsniff 3 statically (it is to be used on a 2.2.5 server) and it seems to be working fine as long as I don't try to write to the collectd socket. When I do however I get these errors back from collectd: radsniff: Failed PUTVAL "pf-auth1-ddc.net.utah.edu/radsniff-exchanged/radius_count-coa_nak" interval=10 1415655243 : Server error: Type `radius_count' isn't defined. radsniff: Failed PUTVAL "pf-auth1-ddc.net.utah.edu/radsniff-exchanged/radius_latency-coa_nak" interval=10 1415655243 : Server error: Type `radius_latency' isn't defined. radsniff: Failed PUTVAL "pf-auth1-ddc.net.utah.edu/radsniff-exchanged/radius_rtx-coa_nak" interval=10 1415655243 : Server error: Type `radius_rtx' isn't defined. So it looks like I need to define the types for the radius statistics in collectd's Types.db. Has anyone got this working? The question is rhetorical as I assume that the wiki's author (at least) got it to work but I don't seem to have the relevant definitions with my version of collectd (5.4.1). Would anyone care to share their type definitions? I would be much obliged. Regards, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 2

FR 3.0.5 Expected Debug
by Patrick Gawthorne 10 Nov '14

10 Nov '14

Hi All, First time using FR 3, after configuring to authenticate with AD the debug that gets spat out appears quite long. I am just making sure this is normal, expected behaviour and if not what I have done wrong.. I've attached the radiusd -X output of one client (iPad) connecting. Config items should all be default except things like mods-available/mschap, mods-available/eap, as per http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HO… .. Thanks to anyone willing to help. :) Cheers, Pat This email, together with any attachments, is intended for the named recipient(s) only and may contain privileged and confidential information. If received in error, please inform the sender as quickly as possible and delete this email and any copies from your computer network. If not an intended recipient of this email, you must not copy, distribute or rely on it, and any form of disclosure, modification, distribution and/or publication of this email is prohibited. Unless stated otherwise, this email represents only the views of the sender and not the views of Pacific Lutheran College.

4 4

populate a reply with ldap generic attributes
by Nicolas Edel 10 Nov '14

10 Nov '14

Hi, Using LDAP for both autorization and authentification, I learnt how to populate a reply request with generics in the autorize. Works fine. Now I am wondering if it would be possible to populate the reply with generics using a dn specified in an ldap attribute. The goal of this is to have predefined profiles to specify user rights (such as read-only, operator, admin, etc) specified only once and to refer to them into the user profile. Since these are generic attributes (of type radiusAttribute), I can't see anyway to use xlat for this. I would be pleased if someone could provide me any hint. Thanks. :Nicolas

3 5

Dailycounter not working
by Matej Žerovnik 07 Nov '14

07 Nov '14

Hello! I'm trying to use dailycounter on a LDAP authenticated user and it doesn't seem to work. I think I did all steps correctly, but then again, i have been wrong before:) In radcheck table I added: testuser Max-Daily-Session := 600 I enabled dailycounter in counters.conf: sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(`Acct-Session-Time` - \ GREATEST((%b - UNIX_TIMESTAMP(`Acct-Start-Time`)), 0)) \ FROM accounting WHERE `User-Name` = '%{${key}}' AND \ UNIX_TIMESTAMP(`Acct-Start-Time`) + `Acct-Session-Time` > '%b'" } In sites-available/default I have the following: authorize { if (User-Password) { update control { Auth-Type := ldap Ldap-UserDN := "eduPersonPrincipalName=%{User-Name},dc=example,dc=com" } } sql dailycounter } authenticate { Auth-Type LDAP { ldap } } Debug output: rad_recv: Access-Request packet from host 10.10.10.10 port 33651, id=75, length=202 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:24:D7:47:1C:XX" Called-Station-Id = "hs-kit-testing" NAS-Port-Id = "bridge-bralci" User-Name = "testuser" NAS-Port = 2151677975 Acct-Session-Id = "80400017" Framed-IP-Address = 192.168.81.198 Mikrotik-Host-IP = 192.168.81.198 User-Password = "password" Service-Type = Login-User WISPr-Logoff-URL = "http://192.168.81.1" NAS-Identifier = "kit-testing" NAS-IP-Address = 192.168.1.116 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++? if (User-Password) ? Evaluating (User-Password) -> TRUE ++? if (User-Password) -> TRUE ++- entering if (User-Password) {...} expand: eduPersonPrincipalName=%{User-Name},dc=example,dc=comsi -> eduPersonPrincipalName=testuser,dc=example,dc=com +++[control] returns notfound ++- if (User-Password) returns notfound [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User testuser not found ++[sql] returns notfound *rlm_sqlcounter: Entering module authorize code** **rlm_sqlcounter: Could not find Check item value pair** **++[dailycounter] returns noop* Found Auth-Type = LDAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "testuser" with password "password" [ldap] user DN: eduPersonPrincipalName=testuser,dc=example,dc=com [ldap] (re)connect to ldaps.example.com:636, authentication 1 [ldap] setting TLS mode to 1 [ldap] bind as eduPersonPrincipalName=testuser,dc=example,dc=com/password to ldaps.example.com:636 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user testuser authenticated succesfully ++[ldap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 75 to 10.10.10.10 port 33651 Why doesn't radius find Check item value pair? It does exists in radcheck table... Does it only work for local mysql users? Matej -- --- Matej Zerovnik

2 6

Freeradius V1 and V2
by Service Technique AreA 07 Nov '14

07 Nov '14

Hello, I'm currently using version 1.188.2.3 a hotspot system with a captive portal . I am trying to install a new server with Ubuntu 12.04 LTS. Can I use this version 1.188.2.3 this OS or should I spend the 2.2.5 version? They are the differences between the two versions of Freeradius for Hotspot system? Do you have a detailed tutorial to install and configure freeradius? thank you kind regards

4 3

unlang vs suffix
by Rui Ribeiro 07 Nov '14

07 Nov '14

Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro

7 8

Multi-tenancy setup
by Ilavajuthy Palanisamy 06 Nov '14

06 Nov '14

Hi All, We are hosting an application in the cloud which is managing multiple customers. Customers will be authenticated using the FreeRadius server. We are planning to use the user authentication through the database(PostgreSQL). I have configured the radcheck table and able to make the user authentication successfully. In order to support multiple customers, what are all the options/design available in FreeRadius. One option we are thinking is to modify the schema to introduce customer-id and modify the sql module to support the new schema. If this is possible, please provide pointers in achieving this. If there are other options available, please provide pointers. Thanks, Ila.

5 7

EAP-TLS not initializing
by Ben Tucker 06 Nov '14

06 Nov '14

Not a very affluent Linux user here but this issue is beyond me. I think its something simple to solve but can't figure it out for the life of me. When running radius in debug mode it is giving me a permission denied message when trying to load the certificates. The certs are there in the correct directory. What else am I missing here? [root@lasamiq3 raddb]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1940] Unknown module "eap". radiusd.conf[1887] Failed to parse authenticate section. [root@lasamiq3 raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib64 Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/radius-priv-key.pem" tls: certificate_file = "/etc/raddb/certs/radius-priv-cert.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "mercury" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1940] Unknown module "eap". radiusd.conf[1887] Failed to parse authenticate section. [root@lasamiq3 raddb]# [root@lasamiq3 raddb]# [root@lasamiq3 raddb]# [root@lasamiq3 raddb]# dir -l certs total 64 -rw-r--rwx 1 root radiusd 721 Dec 4 2009 cert-clt.der -rw-r--rwx 1 root radiusd 1741 Dec 4 2009 cert-clt.p12 -rw-r--rwx 1 root radiusd 2452 Dec 4 2009 cert-clt.pem -rw-r--rwx 1 root radiusd 717 Dec 4 2009 cert-srv.der -rw-r--rwx 1 root radiusd 1733 Dec 4 2009 cert-srv.p12 -rw-r--rwx 1 root radiusd 2439 Dec 4 2009 cert-srv.pem drw-r--rwx 2 root radiusd 4096 Nov 4 23:07 demoCA -rw-r--rwx 1 root radiusd 0 Dec 4 2009 dh -rw-r--rwx 1 root radiusd 2913 Dec 4 2009 newcert.pem -rw-r--rwx 1 root radiusd 1753 Dec 4 2009 newreq.pem -rwxr-xr-x 1 root root 3016 Nov 5 18:50 radius-srv-pri-cert.pem -rwxr-xr-x 1 root root 1606 Nov 5 16:59 radius-srv-pri-key.pem -rw-r--rwx 1 root radiusd 1024 Dec 4 2009 random -rw-r--rwx 1 root radiusd 431 Dec 4 2009 README -rw-r--rwx 1 root radiusd 954 Dec 4 2009 root.der -rw-r--rwx 1 root radiusd 1973 Dec 4 2009 root.p12 -rw-r--rwx 1 root radiusd 2764 Dec 4 2009 root.pem [root@lasamiq3 raddb]# dir -l certs/demoCA total 20 -rwxr-xr-x 1 root radiusd 1074 Nov 5 18:48 cacert.pem -rw-r--rwx 1 root radiusd 276 Dec 4 2009 index.txt -rw-r--rwx 1 root radiusd 140 Dec 4 2009 index.txt.old -rw-r--rwx 1 root radiusd 3 Dec 4 2009 serial -rw-r--rwx 1 root radiusd 3 Dec 4 2009 serial.old [root@lasamiq3 raddb]#

4 12

Blank value of temporary variable in Unlang
by Mrinal K 06 Nov '14

06 Nov '14

I am implementing a setup where we return expiry date value as per a user's settings. For this I have added a column in radcheck table called ExpiryDate. I have added following in authorize section in sites-available/defaults update control{ My-Local-Int-1 := "%{sql: select id from radcheck where username='%{User-Name}' order by id desc limit 1}" } update reply{ WISPr-Session-Terminate-Time = "%{sql: select ExpiryDate from radcheck where id = '%{My-Local-Int-1}'}" } The username I am testing with has ExpiryDate value in radcheck table, however mysql query log shows me blank value for '%{My-Local-Int-1}' for query in update reply {.. } section. Please suggest what I am doing wrong. My-Local-Int-1 has been defined in dictionary as integer.

4 6