- Freeradius-Users - lists.freeradius.org

checkItem not being checked
by Victor Tarhon-Onu 03 Oct '14

03 Oct '14

Hello Everyone, Before proceeding further I'm going to describe shortly what I want to do and what I did so far. Initially the requirement was to pull some authentication data from an LDAP server so that we can make some custom equipments to authenticate those LDAP users. These equipments can use only radius for authentication. This works just fine. Later the requirement was changed and I was asked to do some privilege separation based on the group each LDAP user is in. So it seemed to be easier just to map the LDAP gidNumber entry for each user to a radius check item: /etc/raddb/ldap.attrmap:checkItem Group-ID gidNumber /etc/raddb/dictionary:ATTRIBUTE Group-ID 3000 integer So in /etc/raddb/users I added something like DEFAULT Auth-Type = LDAP Service-Type = Login, Fall-Through = Yes DEFAULT Group-ID == 100 Service-Type := Shell-User DEFAULT Group-ID == 101 Service-Type := Dialout-Framed-User The problem is that the Service-Type never changes because the Group-ID doesn't match any of those checks. It remains set to the value (Login) I've set as default at the beginning of the file. However, when running the radius server in debug mode, I can see that the Group-ID is set correctly for each authenticated user: rlm_ldap: Adding gidNumber as Group-ID, value 100 & op=21 ...but I'm not sure if it's exported (or even supposed to be) out from rlm_ldap. The freeradius version is 1.1.3 (freeradius-1.1.3-1.6.el5). I am inserting below the entire output of the radius server during an authentication/authorization attempt: rad_recv: Access-Request packet from host 127.0.0.1:44291, id=235, length=57 User-Name = "testuser" User-Password = "testpassword" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 6 modcall[authorize]: module "files" returns ok for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser radius_xlat: '(&(objectClass=posixAccount)(uid=testuser))' radius_xlat: 'dc=mydomain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldapserver.mydomain.com:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/share/ssl/certs/mydomain-CA.crt rlm_ldap: setting TLS CACert Directory to /usr/share/ssl/certs/ rlm_ldap: starting TLS request done: ld 0xb8b6c708 msgid 1 rlm_ldap: bind as / to ldapserver.mydomain.com:389 rlm_ldap: waiting for bind result ... request done: ld 0xb8b6c708 msgid 2 rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mydomain,dc=com, with filter (&(objectClass=posixAccount)(uid=testuser)) request done: ld 0xb8b6c708 msgid 3 rlm_ldap: looking for check items in directory... rlm_ldap: Adding gidNumber as Group-ID, value 504 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 modcall: leaving group redundant (returns ok) for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "testuser" with password "testpassword" rlm_ldap: user DN: uid=testuser,ou=People,dc=mydomain,dc=com rlm_ldap: (re)connect to ldapserver.mydomain.com:389, authentication 1 rlm_ldap: setting TLS CACert File to /usr/share/ssl/certs/mydomain-CA.crt rlm_ldap: setting TLS CACert Directory to /usr/share/ssl/certs/ rlm_ldap: starting TLS request done: ld 0xb8befaa8 msgid 1 rlm_ldap: bind as uid=testuser,ou=People,dc=mydomain,dc=com/testpassword to ldapserver.mydomain.com:389 rlm_ldap: waiting for bind result ... request done: ld 0xb8befaa8 msgid 2 rlm_ldap: Bind was successful rlm_ldap: user testuser authenticated succesfully modcall[authenticate]: module "ldap1" returns ok for request 0 modcall: leaving group redundant (returns ok) for request 0 modcall: leaving group LDAP (returns ok) for request 0 Login OK: [testuser] (from client localhost port 0) Sending Access-Accept of id 235 to 127.0.0.1 port 44291 Service-Type = Login-User Finished request 0 --

2 1

Re: VSA processing in avpair.c in the client : (unknown Vendor-Id)
by bmoyni01＠vodafone.ie 02 Oct '14

02 Oct '14

well, I dont need to do anything specific with the VSA attrs. I;m interfacing with a server that can invariably sent these parameters. but because it is not recognized, the other normal attrs are not getting a chance to be processed. specifically the reply in the accept as part of AUTH. as outlined earlier, I think this is a bug. The VSAs get precedence over the normal attrs but if the VSAs are not decoded correctly then the function prematurely returns. thats my take, but could be wrong. let me know what you think. Thanks. ----Original Message---- From: aland(a)deployingradius.com Date: 02-Oct-2014 21:51 To: "bmoyni01(a)vodafone.ie"<bmoyni01(a)vodafone.ie> Cc: "FreeRadius users mailing list"<freeradius-users(a)lists.freeradius. org> Subj: Re: VSA processing in avpair.c in the client : (unknown Vendor- Id) bmoyni01(a)vodafone.ie wrote: > thanks for info. > > I took a copy of the https://github.com/FreeRADIUS/freeradius- > server/blob/master/share/dictionary.microsoft file > and integrated it into the /etc directory in the client code. > > built fine, but still have the same issue with unknown vendor id. > > Is this correct or can you advise on alternative approach. You will have to edit the source code. Even then, it won't help. Decoding the attribute is simple. Deciding what to *do* with it is hard. Alan DeKok. I'm using Vodafone Mail - to get your free mobile email account go to http://www.vodafone.ie Use of Vodafone Mail is subject to Terms and Conditions http://www.vodafone.ie/terms/website

2 1

Re: VSA processing in avpair.c in the client : (unknown Vendor-Id)
by bmoyni01＠vodafone.ie 02 Oct '14

02 Oct '14

thanks for info. I took a copy of the https://github.com/FreeRADIUS/freeradius- server/blob/master/share/dictionary.microsoft file and integrated it into the /etc directory in the client code. built fine, but still have the same issue with unknown vendor id. Is this correct or can you advise on alternative approach. Thanks. ----Original Message---- From: aland(a)deployingradius.com Date: 02-Oct-2014 14:37 To: "bmoyni01(a)vodafone.ie"<bmoyni01(a)vodafone.ie>, "FreeRadius users mailing list"<freeradius-users(a)lists.freeradius.org> Subj: Re: VSA processing in avpair.c in the client : (unknown Vendor- Id) bmoyni01(a)vodafone.ie wrote: > I'm not using the free radius server I did figure that out. > and I cannot find information on > enabling the client with this information. The client comes with dictionaries. > Also, I understand what you stating below. > But my point is that if the client cannot recognize the VSA, should it > not just skip over and process the rest. > (ie including the Normal attributes) It should keep processing the *next* attribute. It shouldn't recurse and process the VSAs in *this* attribute. > Instead it returns what is has without processing the code under / * > Normal */ Send a patch. Alan DeKok. I'm using Vodafone Mail - to get your free mobile email account go to http://www.vodafone.ie Use of Vodafone Mail is subject to Terms and Conditions http://www.vodafone.ie/terms/website

2 1

Ipad 7.0.4 EAP-TTLS PAP Problem
by Puzzel 02 Oct '14

02 Oct '14

Hi there, I've got some issue with ipad device. I have settings EAP-TTLS PAP with working fine certificate tested on Windows (7,8,8.1), Android etc. Certificate is from TERENA (Root AdTrust certificate). When i want to connect from ipad with 7.0.3(11B511) version of firmware i can't connect and in logs i have something like that: Oct 1 13:06:38 radius radiusd[8232]: TLS Alert read:warning:close notify Oct 1 13:06:38 radius radiusd[8232]: TLS_accept: failed in SSLv3 read client certificate A Oct 1 13:06:38 radius radiusd[8232]: rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure Oct 1 13:06:38 radius radiusd[8232]: SSL: SSL_read failed in a system call (-1), TLS session fails. Any other systems this certificate work fine. Tnx for reply Thomas

3 4

Re: VSA processing in avpair.c in the client : (unknown Vendor-Id)
by bmoyni01＠vodafone.ie 02 Oct '14

02 Oct '14

hi. I'm not using the free radius server and I cannot find information on enabling the client with this information. If this available? Also, I understand what you stating below. But my point is that if the client cannot recognize the VSA, should it not just skip over and process the rest. (ie including the Normal attributes) Instead it returns what is has without processing the code under / * Normal */ thanks. ----Original Message---- From: aland(a)deployingradius.com Date: 02-Oct-2014 14:18 To: "bmoyni01(a)vodafone.ie"<bmoyni01(a)vodafone.ie>, "FreeRadius users mailing list"<freeradius-users(a)lists.freeradius.org> Subj: Re: VSA processing in avpair.c in the client : (unknown Vendor- Id) bmoyni01(a)vodafone.ie wrote: > The comment would suggest that we just log and move on, but there is a > return > and process recursively leg of code is not given a chance. It can't recurse into the VSA because it doesn't know what format the VSA is in. > So a couple of questions: > > 1/ is the return valid Yes. > 2/ how can the the client be enabled to understand the Vendor-Id 311 ( > MSFT) Add it to the dictionaries. Alan DeKok. I'm using Vodafone Mail - to get your free mobile email account go to http://www.vodafone.ie Use of Vodafone Mail is subject to Terms and Conditions http://www.vodafone.ie/terms/website

2 1

VSA processing in avpair.c in the client : (unknown Vendor-Id)
by bmoyni01＠vodafone.ie 02 Oct '14

02 Oct '14

Hi. I'm getting the following log: rc_avpair_gen: received VSA attribute with unknown Vendor-Id 311 Just looking at rc_avpair_gen() in avpair.c /* VSA */ if (attribute == PW_VENDOR_SPECIFIC) { if (attrlen < 4) { rc_log(LOG_ERR, "rc_avpair_gen: received VSA " "attribute with invalid length"); goto shithappens; } memcpy(&lvalue, ptr, 4); vendorpec = ntohl(lvalue); if (rc_dict_getvend(rh, vendorpec) == NULL) { /* Warn and skip over the unknown VSA */ rc_log(LOG_WARNING, "rc_avpair_gen: received VSA " "attribute with unknown Vendor-Id %d", vendorpec); return pair; } /* Process recursively */ return rc_avpair_gen(rh, pair, ptr + 4, attrlen - 4, vendorpec); } The comment would suggest that we just log and move on, but there is a return and process recursively leg of code is not given a chance. So a couple of questions: 1/ is the return valid 2/ how can the the client be enabled to understand the Vendor-Id 311 ( MSFT) Thanks. I'm using Vodafone Mail - to get your free mobile email account go to http://www.vodafone.ie Use of Vodafone Mail is subject to Terms and Conditions http://www.vodafone.ie/terms/website

2 1

Problem with the sqlcounter!
by Haviaras Kostas 02 Oct '14

02 Oct '14

Hello, I have configure my FreeRadius to work with MySQL, I also add the sqlcounter to count the hours user after the first login. Here is my code: mods-enabled/sqlcounter: sqlcounter checkthetime { sql_module_instance = sql dialect = ${modules.sql.dialect} counter_name = All-Hours-Passed check_name = Max-Hours-Passed reply_name = Session-Timeout key = User-Name reset = never $INCLUDE ${modconfdir}/sql/counter/${dialect}/${.:instance}.conf } checkthetime.conf: query = "\ SELECT HOUR(SEC_TO_TIME(UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime))) \ FROM radacct \ WHERE UserName = '%{${key}}' LIMIT 1;" sites-available/default: authorize { .... sql checkthetime .... } I am getting this message from the debug mode: (0) WARNING: checkthetime : Couldn't find control attribute 'control:Max-Hours-Passed' I don't know if I have make any syntax error! Thanks for your attention and time!

3 2

Re: Ipad 7.0.4 EAP-TTLS PAP Problem
by Rui Ribeiro 02 Oct '14

02 Oct '14

Hi Thomas, Before I forget, please when talking about a problem, be sure to include the freeradius version. If in freeradius 3, be sure that in mods-enabled/eap you have commented ca_file and ca_path. I had the same problem in iOS, and I could *swear* it was that. Let me know if it helps. iOS and in particular iPhones are much more picky about this kind of stuff than other platforms. I could swear that for the intermediate certificates Terena is giving was the intermediate chain was not there before iOS 8.0. So I had to build a certificate with the complete chain for the RADIUS service. Regards, Rui Ribeiro https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > Message: 1 > Date: Wed, 1 Oct 2014 13:33:36 +0200 > From: "Puzzel" <puzzel1982(a)gmail.com> > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Subject: Ipad 7.0.4 EAP-TTLS PAP Problem > Message-ID: <017701cfdd6b$8b6fe8c0$a24fba40$@com> > Content-Type: text/plain; charset="us-ascii" > > Hi there, > > > > I've got some issue with ipad device. > > I have settings EAP-TTLS PAP with working fine certificate tested on > Windows > (7,8,8.1), Android etc. > > Certificate is from TERENA (Root AdTrust certificate). > > When i want to connect from ipad with 7.0.3(11B511) version of firmware i > can't connect and in logs i have something like that: > > > > Oct 1 13:06:38 radius radiusd[8232]: TLS Alert read:warning:close notify > > Oct 1 13:06:38 radius radiusd[8232]: TLS_accept: failed in SSLv3 read > client certificate A > > Oct 1 13:06:38 radius radiusd[8232]: rlm_eap: SSL error error:140940E5:SSL > routines:SSL3_READ_BYTES:ssl handshake failure > > Oct 1 13:06:38 radius radiusd[8232]: SSL: SSL_read failed in a system call > (-1), TLS session fails. > > > > Any other systems this certificate work fine. > > > > Tnx for reply > > Thomas > > >

1 0

FreeRADIUS 3.0.4 terminates with "Error: Failed adding event handler for socket!"
by Stefan Paetow 01 Oct '14

01 Oct '14

Hi, By accident I just spotted this message in /var/log/radius/radius.log on a RHEL 6.5 box with FreeRADIUS 3.0.4 installed: Wed Oct 1 13:45:01 2014 : Error: Failed adding event handler for socket! After that, FR terminated. I've restarted it, but unfortunately I don't have any other information. Alan, Arran, under what conditions does that error occur? Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK’s research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 2

EAP-GTC & Yubikey
by cellkites＠hushmail.com 01 Oct '14

01 Oct '14

I've been attempting to integrate yubikeys with freeradius and have had great success with the included yubikey module authenticating against both stored aes keys and a private otp validation server. However I am now attempting to use them in conjunction with EAP-GTC and am slightly lost. Under the gtc section of the eap module config i see that a user password is returned from the connecting client and passed onto another module for authentication. Is it possible to then pass this to the yubikey module to extract the otp portion, authenticate the otp and then continue with PAP authentication using the users password? Is there another way i should be going about this?

3 4