- Freeradius-Users - lists.freeradius.org

populate a reply with ldap generic attributes
by Nicolas Edel 10 Nov '14

10 Nov '14

Hi, Using LDAP for both autorization and authentification, I learnt how to populate a reply request with generics in the autorize. Works fine. Now I am wondering if it would be possible to populate the reply with generics using a dn specified in an ldap attribute. The goal of this is to have predefined profiles to specify user rights (such as read-only, operator, admin, etc) specified only once and to refer to them into the user profile. Since these are generic attributes (of type radiusAttribute), I can't see anyway to use xlat for this. I would be pleased if someone could provide me any hint. Thanks. :Nicolas

3 5

Dailycounter not working
by Matej Žerovnik 07 Nov '14

07 Nov '14

Hello! I'm trying to use dailycounter on a LDAP authenticated user and it doesn't seem to work. I think I did all steps correctly, but then again, i have been wrong before:) In radcheck table I added: testuser Max-Daily-Session := 600 I enabled dailycounter in counters.conf: sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(`Acct-Session-Time` - \ GREATEST((%b - UNIX_TIMESTAMP(`Acct-Start-Time`)), 0)) \ FROM accounting WHERE `User-Name` = '%{${key}}' AND \ UNIX_TIMESTAMP(`Acct-Start-Time`) + `Acct-Session-Time` > '%b'" } In sites-available/default I have the following: authorize { if (User-Password) { update control { Auth-Type := ldap Ldap-UserDN := "eduPersonPrincipalName=%{User-Name},dc=example,dc=com" } } sql dailycounter } authenticate { Auth-Type LDAP { ldap } } Debug output: rad_recv: Access-Request packet from host 10.10.10.10 port 33651, id=75, length=202 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:24:D7:47:1C:XX" Called-Station-Id = "hs-kit-testing" NAS-Port-Id = "bridge-bralci" User-Name = "testuser" NAS-Port = 2151677975 Acct-Session-Id = "80400017" Framed-IP-Address = 192.168.81.198 Mikrotik-Host-IP = 192.168.81.198 User-Password = "password" Service-Type = Login-User WISPr-Logoff-URL = "http://192.168.81.1" NAS-Identifier = "kit-testing" NAS-IP-Address = 192.168.1.116 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++? if (User-Password) ? Evaluating (User-Password) -> TRUE ++? if (User-Password) -> TRUE ++- entering if (User-Password) {...} expand: eduPersonPrincipalName=%{User-Name},dc=example,dc=comsi -> eduPersonPrincipalName=testuser,dc=example,dc=com +++[control] returns notfound ++- if (User-Password) returns notfound [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User testuser not found ++[sql] returns notfound *rlm_sqlcounter: Entering module authorize code** **rlm_sqlcounter: Could not find Check item value pair** **++[dailycounter] returns noop* Found Auth-Type = LDAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "testuser" with password "password" [ldap] user DN: eduPersonPrincipalName=testuser,dc=example,dc=com [ldap] (re)connect to ldaps.example.com:636, authentication 1 [ldap] setting TLS mode to 1 [ldap] bind as eduPersonPrincipalName=testuser,dc=example,dc=com/password to ldaps.example.com:636 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user testuser authenticated succesfully ++[ldap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 75 to 10.10.10.10 port 33651 Why doesn't radius find Check item value pair? It does exists in radcheck table... Does it only work for local mysql users? Matej -- --- Matej Zerovnik

2 6

Freeradius V1 and V2
by Service Technique AreA 07 Nov '14

07 Nov '14

Hello, I'm currently using version 1.188.2.3 a hotspot system with a captive portal . I am trying to install a new server with Ubuntu 12.04 LTS. Can I use this version 1.188.2.3 this OS or should I spend the 2.2.5 version? They are the differences between the two versions of Freeradius for Hotspot system? Do you have a detailed tutorial to install and configure freeradius? thank you kind regards

4 3

unlang vs suffix
by Rui Ribeiro 07 Nov '14

07 Nov '14

Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro

7 8

Multi-tenancy setup
by Ilavajuthy Palanisamy 06 Nov '14

06 Nov '14

Hi All, We are hosting an application in the cloud which is managing multiple customers. Customers will be authenticated using the FreeRadius server. We are planning to use the user authentication through the database(PostgreSQL). I have configured the radcheck table and able to make the user authentication successfully. In order to support multiple customers, what are all the options/design available in FreeRadius. One option we are thinking is to modify the schema to introduce customer-id and modify the sql module to support the new schema. If this is possible, please provide pointers in achieving this. If there are other options available, please provide pointers. Thanks, Ila.

5 7

EAP-TLS not initializing
by Ben Tucker 06 Nov '14

06 Nov '14

Not a very affluent Linux user here but this issue is beyond me. I think its something simple to solve but can't figure it out for the life of me. When running radius in debug mode it is giving me a permission denied message when trying to load the certificates. The certs are there in the correct directory. What else am I missing here? [root@lasamiq3 raddb]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1940] Unknown module "eap". radiusd.conf[1887] Failed to parse authenticate section. [root@lasamiq3 raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib64 Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/radius-priv-key.pem" tls: certificate_file = "/etc/raddb/certs/radius-priv-cert.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "mercury" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1940] Unknown module "eap". radiusd.conf[1887] Failed to parse authenticate section. [root@lasamiq3 raddb]# [root@lasamiq3 raddb]# [root@lasamiq3 raddb]# [root@lasamiq3 raddb]# dir -l certs total 64 -rw-r--rwx 1 root radiusd 721 Dec 4 2009 cert-clt.der -rw-r--rwx 1 root radiusd 1741 Dec 4 2009 cert-clt.p12 -rw-r--rwx 1 root radiusd 2452 Dec 4 2009 cert-clt.pem -rw-r--rwx 1 root radiusd 717 Dec 4 2009 cert-srv.der -rw-r--rwx 1 root radiusd 1733 Dec 4 2009 cert-srv.p12 -rw-r--rwx 1 root radiusd 2439 Dec 4 2009 cert-srv.pem drw-r--rwx 2 root radiusd 4096 Nov 4 23:07 demoCA -rw-r--rwx 1 root radiusd 0 Dec 4 2009 dh -rw-r--rwx 1 root radiusd 2913 Dec 4 2009 newcert.pem -rw-r--rwx 1 root radiusd 1753 Dec 4 2009 newreq.pem -rwxr-xr-x 1 root root 3016 Nov 5 18:50 radius-srv-pri-cert.pem -rwxr-xr-x 1 root root 1606 Nov 5 16:59 radius-srv-pri-key.pem -rw-r--rwx 1 root radiusd 1024 Dec 4 2009 random -rw-r--rwx 1 root radiusd 431 Dec 4 2009 README -rw-r--rwx 1 root radiusd 954 Dec 4 2009 root.der -rw-r--rwx 1 root radiusd 1973 Dec 4 2009 root.p12 -rw-r--rwx 1 root radiusd 2764 Dec 4 2009 root.pem [root@lasamiq3 raddb]# dir -l certs/demoCA total 20 -rwxr-xr-x 1 root radiusd 1074 Nov 5 18:48 cacert.pem -rw-r--rwx 1 root radiusd 276 Dec 4 2009 index.txt -rw-r--rwx 1 root radiusd 140 Dec 4 2009 index.txt.old -rw-r--rwx 1 root radiusd 3 Dec 4 2009 serial -rw-r--rwx 1 root radiusd 3 Dec 4 2009 serial.old [root@lasamiq3 raddb]#

4 12

Blank value of temporary variable in Unlang
by Mrinal K 06 Nov '14

06 Nov '14

I am implementing a setup where we return expiry date value as per a user's settings. For this I have added a column in radcheck table called ExpiryDate. I have added following in authorize section in sites-available/defaults update control{ My-Local-Int-1 := "%{sql: select id from radcheck where username='%{User-Name}' order by id desc limit 1}" } update reply{ WISPr-Session-Terminate-Time = "%{sql: select ExpiryDate from radcheck where id = '%{My-Local-Int-1}'}" } The username I am testing with has ExpiryDate value in radcheck table, however mysql query log shows me blank value for '%{My-Local-Int-1}' for query in update reply {.. } section. Please suggest what I am doing wrong. My-Local-Int-1 has been defined in dictionary as integer.

4 6

Multivalued attribute[*] comparisons
by Arran Cudbard-Bell 06 Nov '14

06 Nov '14

Master branch which will become 3.1 now supports multivalued conditions. If an attribute with the '*' index is used in a condition, all values of that attribute will be evaluated against the other operand. If one set of values evaluates to true, no further values are checked and the condition returns true. update request { Tmp-String-0 := 'foo' Tmp-String-0 += 'bar' Tmp-String-0 += 'baz' Tmp-String-1 := 'aaa' Tmp-String-1 += 'bbb' Tmp-String-1 += 'ccc' Tmp-String-1 += 'bar' } # # Yes this is O(N^2) - worse case here is 12 comparisons # if (&Tmp-String-0[*] == &Tmp-String-1[*]) -> TRUE if (&Tmp-String-1[*] =~ /cc$/) -> TRUE If used with capture groups, contents will be from the first value that matched. if (&Tmp-String-1 == 'bar') -> FALSE if (&Tmp-String-1[*] == 'bar') -> TRUE In theory this will allow update request { Admin-Groups := 'admins' Admin-Groups += 'net-admins' Admin-Groups += 'Administrators' } if (LDAP-Group == &Admin-Groups[*]) But I believe the parser's condition rules will currently prevent that (will be fixed before 3.1 is released). It also works for integers: update request { Tmp-Integer-0 := 5 Tmp-Integer-0 += 10 Tmp-Integer-0 += 15 } if (Tmp-Integer-0[*] > 15) -> FALSE if (Tmp-Integer-0[*] < 5) -> FALSE if (Tmp-Integer-0[*] < 10) -> TRUE The evaluation code also avoids many of the temporary mallocs that it previously did, as the cast and comparison functions have been updated to work with value data, as well as value pairs. The main use case for this feature is checking multiple group or authorizational attributes for a value. It also works with tag qualifiers. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

RE: Multivalued attribute[*] comparisons
by Franks Andy (RLZ) IT Systems Engineer 06 Nov '14

06 Nov '14

This is great news for us, will make condition checking much more straightforward. Thanks Arran! .. now waiting for multiple SQL attributes from a single xlat.. :-) :-) :-) -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 05 November 2014 22:59 To: FreeRadius users mailing list Subject: Multivalued attribute[*] comparisons Master branch which will become 3.1 now supports multivalued conditions. If an attribute with the '*' index is used in a condition, all values of that attribute will be evaluated against the other operand. If one set of values evaluates to true, no further values are checked and the condition returns true. update request { Tmp-String-0 := 'foo' Tmp-String-0 += 'bar' Tmp-String-0 += 'baz' Tmp-String-1 := 'aaa' Tmp-String-1 += 'bbb' Tmp-String-1 += 'ccc' Tmp-String-1 += 'bar' } # # Yes this is O(N^2) - worse case here is 12 comparisons # if (&Tmp-String-0[*] == &Tmp-String-1[*]) -> TRUE if (&Tmp-String-1[*] =~ /cc$/) -> TRUE If used with capture groups, contents will be from the first value that matched. if (&Tmp-String-1 == 'bar') -> FALSE if (&Tmp-String-1[*] == 'bar') -> TRUE In theory this will allow update request { Admin-Groups := 'admins' Admin-Groups += 'net-admins' Admin-Groups += 'Administrators' } if (LDAP-Group == &Admin-Groups[*]) But I believe the parser's condition rules will currently prevent that (will be fixed before 3.1 is released). It also works for integers: update request { Tmp-Integer-0 := 5 Tmp-Integer-0 += 10 Tmp-Integer-0 += 15 } if (Tmp-Integer-0[*] > 15) -> FALSE if (Tmp-Integer-0[*] < 5) -> FALSE if (Tmp-Integer-0[*] < 10) -> TRUE The evaluation code also avoids many of the temporary mallocs that it previously did, as the cast and comparison functions have been updated to work with value data, as well as value pairs. The main use case for this feature is checking multiple group or authorizational attributes for a value. It also works with tag qualifiers. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Objections to releasing version 2.2.6?
by Alan DeKok 05 Nov '14

05 Nov '14

The zip file can be downloaded from github: https://github.com/FreeRADIUS/freeradius-server/archive/v2.x.x.zip I'm inclined to avoid making a release candidate. There has been very little changed from 2.2.5. About the only change I think could be added is to allow TLS 1.1 and TLS 1.2. Right now they're forbidden. Alan DeKok.

5 11