- Freeradius-Users - lists.freeradius.org

Issue with OpenLdap and FreeRadius
by Andrew Niemantsverdriet 21 Aug '14

21 Aug '14

Hi All, I'm am using FreeRadius 2.1.12 from the CentOS repo and am trying to get it working with OpenLDAP 2.3.43 also from the CentOS repo. Everything is working great until I add and ACL to OpenLDAP that gives self write access to sambaNTpassword. When that line is added FreeRadius will stop authenticating clients. I'm including a link to my log file gathered from radiusd -X > debug.txt. At the end of that file you can see where I turned off the sambaNTpassword and things start working again. Any idea on how I can fix this? https://www.dropbox.com/s/vhuolmhl62fphfd/debug.txt Thanks, -- _ /-\ ndrew Niemantsverdriet Linux System Administrator Academic Computing (406) 238-7360 Rocky Mountain College 1511 Poly Dr. Billings MT, 59102

3 7

Operator ":=" in reply packets
by Axel Luttgens 21 Aug '14

21 Aug '14

Hello, Let's define this query: authorize_reply_query = "\ SELECT 1, '%{SQL-User-Name}', 'Reply-Message', 'Hey', ':=' \ UNION \ SELECT 2, '%{SQL-User-Name}', 'Reply-Message', 'Hello', ':=' \ ORDER BY 1" In radiusd -X output, on may then read: Sending Access-Accept Id 201 from 127.0.0.1:1812 to 127.0.0.1:62417 Reply-Message = 'Hey' Reply-Message = 'Hello' A Reply-Message may indeed appear multiple times in an Acces-Accept (or -Reject or -Challenge) packet. Now, according to http://wiki.freeradius.org/config/Operators, operator ":=" has the same meaning as a reply item than as a check item. As a check item, it "replaces in the configuration items any attribute of the same name. If no attribute of that name appears in the request, then this attribute is added." How should that idea of replacement of "any attribute of the same name" then be interpreted? TIA, Axel

2 3

custom reply message
by Rando Nakarmi 21 Aug '14

21 Aug '14

Hello there, I use radutmp file for simualtanesou use and set Simultaneous-Use := 2 -- this works very well for me. but for the third connection it fails (which is normal) but I get message Invalid User in radius.log file which is in fact confusing. radiusd[26044]: Invalid user: user@localhost/<no User-Password attribute>] How do I change or where so than I can add custom message for simultaneous-Use message like "your connection exceed the limit" etc. any example or sample would help me.

1 0

Serving multiple groups of users
by Marcus Ng 21 Aug '14

21 Aug '14

Hi, I would like to configure freeradius2 to have multiple listening ports, with each port catering to a unique group of users. I.e. if a user comes in through listening port 1, his credentials will be checked against a subset of the radcheck. if a user comes in through listening port 2, his credentials will be checked against a different subset of the radcheck. The subsets do not mix. What is the easiest way to do that? I am using postgres for authorization. -Marcus

5 10

hi friends
by Ciprian ARSENIE 20 Aug '14

20 Aug '14

Hi I want to implement this tcl script on a cisco http://www.yasinkaplan.com/docs/simplelcr.pdf I have this auth querry rad_recv: Access-Request packet from host xxxxxxxxxxx port 1645, id=4, length=298 User-Name = "2001" User-Password = "" Cisco-AVPair = "call-id=77a36bec512d59f2148f4a935ed0c2f6@37.153.137.2:5060" h323-conf-id = "h323-conf-id=B6EED6D8 27D911E4 88FA91CF 8B17EE77" Cisco-AVPair = "remote-media-address=xxxxxxxx" Cisco-AVPair = "session-protocol=sipv2" Cisco-AVPair = "h323-ivr-out=transactionID:3" Called-Station-Id = "40755xxxxxxx" Service-Type = Login-User NAS-IP-Address = 46.214.35.172 And database is heare voip_cdr=# SELECT * from destinations ; prefix | destination | type | carrier --------+-------------+------------+------------ 4075 | RO ORANGE | MOB | 9901 (1 row) voip_cdr=# select * from carriers ; carrier | description ---------+------------- 9901 | orange (1 row) I m stucked heare CREATE function [dbo].[select_carrier](@dnis nvarchar(50)) returns table as return select top 1 'cisco|100' as Attribute, 'carrier:' + carrier as [Value] from destinations where prefix=substring(@dnis,1, len(prefix)) order by len(prefix) desc and as exmple of querry for freeradius is authorize_check_query = "SELECT id, UserName, Attribute, Value, Op \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" Thanks in advance

1 0

freeRADIUS -> AD Auth
by nfischer＠hush.com 19 Aug '14

19 Aug '14

Hi, after I fully crashed my freeRADIUS Server I have to ask again: It still fails with: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: hausmeister@OBLAN [mschap] Told to do MS-CHAPv2 for hausmeister@OBLAN with NT-Password [mschap] expand: %{Stripped-User-Name} -> hausmeister [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=hausmeister [mschap] Creating challenge hash with username: hausmeister@OBLAN [mschap] expand: %{mschap:Challenge} -> 01b99ad5745936be [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=01b99ad5745936be [mschap] expand: %{mschap:NT-Response} -> cfebe53922a2a18a8e0f423e8562a651148d2b18cd4fbc3e [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt- response=cfebe53922a2a18a8e0f423e8562a651148d2b18cd4fbc3e Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject so Im not sure why. I think its because hes not allowed to execute the ntlm or my mschap is cofigured wrong. (or both) I checked the users/groups: sambashare:x:111:haus-meister winbindd_priv:x:112:freerad freerad:x:113:freerad ssl-cert:x:114:freerad looks fine to me? So my NTLM_Auth string in the modules/mschap is: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" I allso tried a lot of other stuff nothing change. Hope you can help me again. -- Mit freundlichem Gruß Nicolas Fischer email: nfischer(a)hush.com jabber: jagger(a)jabber.ccc.de tel: 01573-0420888 Skype: jagger64 TOX: Just ask me :) PGP-Key: http://keyserver.ubuntu.com/pks/lookup?op=vindex&fingerprint=on&search=0xCF… If you sent me a PGP Crypted Mail I´ll be happy and will give you a free cookie :)

4 7

freeradius + firebird, how install in Ubuntu Linux
by Антон - 19 Aug '14

19 Aug '14

Good day! For begin I read the manual, FAQ and some resourses founded in web, but I can't find any complete guide, how install and configure freeradius with module rlm_sql_firebird on ubuntu server, and how I can get this module or compile it, desirable of standard package system of Ubuntu. Unfortunately, my knowledge is not enough. Please, may be I can get some little manual about this issue? Thanks in advance! p.s. I use Linux Ubuntu 12.04 LTS.

2 1

Upgrading FreeRadius
by Martin Ubank 18 Aug '14

18 Aug '14

We have FreeRadius v2.2.0 running on Centos 6 VMs and want to upgrade to v2.2.5. Various files in /usr/local/etc/raddb have been customised for use with our eduroam network. Is there a recommended upgrade method for v2.2.5? Thanks for any advice forthcoming. Martin.

3 6

OpenLDAP Group membership to Filter-ID
by Alex Gregory 17 Aug '14

17 Aug '14

Hello- I would like to make it so that the users in: ou=corp,ou=Users,dc=team,dc=company,dc=com Get mapped a Filter-ID of corp and the users in: ou=dev,ou=Users,dc=team,dc=company,dc=com Get mapped a Filter-ID of dev. I can then apply firewall rules to give them access to certain resources and not others. This will also make it so that if they access the wrong network they should not have the proper access without the correct group membership. In inner-tunnel I have: authorize { if ( Ldap-Group =~ /ou=corp,ou=Users,dc=team,dc=affirm,dc=com/ ) { update control { Tmp-String-1 := "corp" } } if ( Ldap-Group =~ /ou=dev,ou=Users,dc=team,dc=affirm,dc=com/ ) { update control { Tmp-String-1 := "dev" } } post-auth { update reply { Filter-Id := "%{control:Tmp-String-1}” } I can see in the log that its not matching which means I am not matching correctly. It ends up passing the Filter-ID which is blank. So I know the post auth section is working correctly. Here is the relevant log info: Tue Aug 12 22:50:47 2014 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel Tue Aug 12 22:50:47 2014 : Info: +- entering group authorize {...} Tue Aug 12 22:50:47 2014 : Info: ++? if (Ldap-Group =~ /ou=corp,ou=Users,dc=team,dc=company,dc=com/ ) Tue Aug 12 22:50:47 2014 : Debug: [ldap] Entering ldap_groupcmp() Tue Aug 12 22:50:47 2014 : Info: expand: ou=Users,dc=team,dc=company,dc=com -> ou=Users,dc=team,dc=company,dc=com Tue Aug 12 22:50:47 2014 : Info: expand: %{Stripped-User-Name} -> Tue Aug 12 22:50:47 2014 : Info: ... expanding second conditional Tue Aug 12 22:50:47 2014 : Info: expand: %{User-Name} -> joeuser Tue Aug 12 22:50:47 2014 : Info: expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=joeuser) Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] performing search in ou=Users,dc=team,dc=company,dc=com, with filter (uid=joeuser) Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 12 22:50:47 2014 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] performing search in ou=corp,ou=Users,dc=team,dc=company,dc=com, with filter (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Tue Aug 12 22:50:47 2014 : Debug: [ldap] object not found Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 12 22:50:47 2014 : Debug: rlm_ldap::ldap_groupcmp: Group ou=corp,ou=Users,dc=team,dc=company,dc=com not found or user is not a member. Tue Aug 12 22:50:47 2014 : Info: ? Evaluating (Ldap-Group =~ /ou=corp,ou=Users,dc=team,dc=company,dc=com/) -> FALSE Tue Aug 12 22:50:47 2014 : Info: ++? if (Ldap-Group =~ /ou=corp,ou=Users,dc=team,dc=company,dc=com/ ) -> FALSE Tue Aug 12 22:50:47 2014 : Info: ++? if (Ldap-Group =~ /ou=dev,ou=Users,dc=team,dc=company,dc=com/ ) Tue Aug 12 22:50:47 2014 : Debug: [ldap] Entering ldap_groupcmp() Tue Aug 12 22:50:47 2014 : Info: expand: ou=Users,dc=team,dc=company,dc=com -> ou=Users,dc=team,dc=company,dc=com Tue Aug 12 22:50:47 2014 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] performing search in ou=dev,ou=Users,dc=team,dc=company,dc=com, with filter (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Tue Aug 12 22:50:47 2014 : Debug: [ldap] object not found Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 12 22:50:47 2014 : Debug: rlm_ldap::ldap_groupcmp: Group ou=dev,ou=Users,dc=team,dc=company,dc=com not found or user is not a member. Tue Aug 12 22:50:47 2014 : Info: ? Evaluating (Ldap-Group =~ /ou=dev,ou=Users,dc=team,dc=company,dc=com/) -> FALSE Tue Aug 12 22:50:47 2014 : Info: ++? if (Ldap-Group =~ /ou=dev,ou=Users,dc=team,dc=company,dc=com/ ) -> FALSE Tue Aug 12 22:50:47 2014 : Info: ++[chap] returns noop Tue Aug 12 22:50:47 2014 : Info: ++[mschap] returns noop Tue Aug 12 22:50:47 2014 : Info: [suffix] No '@' in User-Name = "joeuser", looking up realm NULL Tue Aug 12 22:50:47 2014 : Info: [suffix] No such realm "NULL" Tue Aug 12 22:50:47 2014 : Info: ++[suffix] returns noop Tue Aug 12 22:50:47 2014 : Info: ++[control] returns noop Tue Aug 12 22:50:47 2014 : Info: [eap] No EAP-Message, not doing EAP Tue Aug 12 22:50:47 2014 : Info: ++[eap] returns noop Tue Aug 12 22:50:47 2014 : Info: ++[files] returns noop Tue Aug 12 22:50:47 2014 : Info: [ldap] performing user authorization for joeuser Tue Aug 12 22:50:47 2014 : Info: [ldap] expand: %{Stripped-User-Name} -> Tue Aug 12 22:50:47 2014 : Info: [ldap] ... expanding second conditional Tue Aug 12 22:50:47 2014 : Info: [ldap] expand: %{User-Name} -> joeuser Tue Aug 12 22:50:47 2014 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=joeuser) Tue Aug 12 22:50:47 2014 : Info: [ldap] expand: ou=Users,dc=team,dc=company,dc=com -> ou=Users,dc=team,dc=company,dc=com Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] performing search in ou=Users,dc=team,dc=company,dc=com, with filter (uid=joeuser) Tue Aug 12 22:50:47 2014 : Info: [ldap] No default NMAS login sequence Tue Aug 12 22:50:47 2014 : Info: [ldap] looking for check items in directory... Tue Aug 12 22:50:47 2014 : Debug: [ldap] userPassword -> Password-With-Header == "{MD5}hashreplaced" Tue Aug 12 22:50:47 2014 : Info: [ldap] looking for reply items in directory... Tue Aug 12 22:50:47 2014 : Info: [ldap] user joeuser authorized to use remote access Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 12 22:50:47 2014 : Info: ++[ldap] returns ok Tue Aug 12 22:50:47 2014 : Info: ++[expiration] returns noop Tue Aug 12 22:50:47 2014 : Info: ++[logintime] returns noop Tue Aug 12 22:50:47 2014 : Info: ++[pap] returns updated Tue Aug 12 22:50:47 2014 : Info: Found Auth-Type = PAP Tue Aug 12 22:50:47 2014 : Info: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel Tue Aug 12 22:50:47 2014 : Info: +- entering group PAP {...} Tue Aug 12 22:50:47 2014 : Info: [pap] login attempt with password "password" Tue Aug 12 22:50:47 2014 : Info: [pap] Using MD5 encryption. Tue Aug 12 22:50:47 2014 : Info: [pap] Normalizing MD5-Password from base64 encoding Tue Aug 12 22:50:47 2014 : Info: [pap] User authenticated successfully Tue Aug 12 22:50:47 2014 : Info: ++[pap] returns ok Tue Aug 12 22:50:47 2014 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel Tue Aug 12 22:50:47 2014 : Info: +- entering group post-auth {...} Tue Aug 12 22:50:47 2014 : Info: expand: %{control:Tmp-String-1} -> Tue Aug 12 22:50:47 2014 : Info: ++[reply] returns noop } # server inner-tunnel Tue Aug 12 22:50:47 2014 : Info: [ttls] Got tunneled reply code 2 Filter-Id = "" Tue Aug 12 22:50:47 2014 : Info: [ttls] Got tunneled Access-Accept Tue Aug 12 22:50:47 2014 : Info: [eap] Freeing handler Tue Aug 12 22:50:47 2014 : Info: ++[eap] returns ok Tue Aug 12 22:50:47 2014 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Tue Aug 12 22:50:47 2014 : Info: +- entering group post-auth {...} Tue Aug 12 22:50:47 2014 : Info: ++[exec] returns noop Sending Access-Accept of id 16 to xxx.xxx.xxx.xxx port 32768 Filter-Id = "" MS-MPPE-Recv-Key = 0x85725d86e7ab1448510e48ba9b900cd3cbf3d7436f36f9b391dab4d35b3d69b1 MS-MPPE-Send-Key = 0x191e9e59df4f7108ac1542e48434330db030957911f7a3fb75ae40456057bf1f EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "joeuser" Tue Aug 12 22:50:47 2014 : Info: Finished request 9. Thank you for the help. I appreciate it. BTW if this does’t make sense I can provide more details as to what I am trying to do. I figured I would spare that unless needed. Thanks, Alex

4 11

postgres cisco freeradiusd voip
by Ciprian ARSENIE 17 Aug '14

17 Aug '14

Hello I want to thank you in advance to those I will answer this question. I have configured a RADIUS server with postgresql to store cdr of a cisco 3845 . So far everything has been pretty simple. my question is how do I calculate the length of the call betwen h323disconnecttime h323connecttime. can someone help me with some postgresql Selects to retrive duration o calls /day/week/mount

1 0