- Freeradius-Users - lists.freeradius.org

RE: FR3.0.1Problems with raddebug and radmin
by Palmer J.D.F. 27 Mar '14

27 Mar '14

Hi Alan, I'm having problems with raddebug/radmin in FR3.0.2, which seem more terminal than before. When running radmin I get the error message below, this occurs regardless of whether radiusd is running. It appears to be failing on the if conditions within ./raddb/policy.d/eap # ./build/bin/local/radmin -u testuser(a)swan.ac.uk Thu Mar 27 10:55:00 2014 : Error: /usr/local/etc/raddb/policy.d/eap[10]: Parse error in condition radmin: Errors reading or parsing /usr/local/etc/raddb/radiusd.conf Usage: radmin [ args ] -d raddb_dir Configuration files are in "raddbdir/*". -e command Execute 'command' and then exit. -E Echo commands as they are being executed. -f socket_file Open socket_file directly, without reading radius.conf -h Print usage help information. -i input_file Read commands from 'input_file'. -n name Read raddb/name.conf instead of raddb/radiusd.conf -o output_file Write commands to 'output_file'. -q Quiet mode. Any ideas? Thanks, Jezz. > -----Original Message----- > From: freeradius-users- > bounces+j.d.f.palmer=swansea.ac.uk(a)lists.freeradius.org [mailto:freeradius- > users-bounces+j.d.f.palmer=swansea.ac.uk(a)lists.freeradius.org] On Behalf Of > Alan DeKok > Sent: 27 February 2014 13:34 > To: FreeRadius users mailing list > Subject: Re: FR3.0.1Problems with raddebug and radmin. > > Palmer J.D.F. wrote: > > But I'm still struggling with raddebug. > > It looks like the condition is having an issue escaping the "'s which > > have been introduced in FR3* > > This has been fixed in the v3.0.x branch. > > > However, if I hack the raddebug script and change the line... > > u) condition="(User-Name == $OPTARG )" > > to > > u) condition="(User-Name == \\\"$OPTARG\\\")" > > > > raddebug -u bob@bobville works as expected > > A different fix has already been pushed. We're doing some last-minute testing, > and hope to release v3.0.2 soon. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

rlm_rest JSON format for multiple attributes
by Werner Stucky 27 Mar '14

27 Mar '14

Hi Guys I've ran into a problem with rlm_rest and specifying VPs with JSON. I need to return multiple Framed-Route attributes. So now I have : {'Framed-Route':'1.2.3.4/32'} I can't add any additional Framed-Route attributes because the JSON format is a set of key value pairs and the key is unique. >From RFC4627: --------------- An object structure is represented as a pair of curly brackets surrounding zero or more name/value pairs (or members). A name is a string. A single colon comes after each name, separating the name from the value. A single comma separates a value from a following name. *The names within an object SHOULD be unique.---------------* Is there a way to support an array of values? eg. {'Framed-Route':['1.2.3.4/32','5.6.7.8/32']} Thank you Werner Stucky

2 7

freeradius3 authorize_group_check_query/ authorize_group_reply_query don't start
by George Koulyabin 27 Mar '14

27 Mar '14

Hi. I'm using FreeRADIUS 3.0.1 The authorize_group_check_query/ authorize_group_reply_query don't start. Listing of authorizize section: authorize { # filter_username preprocess auth_log chap mschap pap digest suffix # unix # files -sql # daily expiration logintime } DEBUG output: Skipping... Loaded module rlm_sql Skipping... read_groups = yes Skipping... authorize_group_check_query = "SELECT id, GroupName, Attribute, Value, op FROM radius.radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value, op FROM radius.radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id" group_membership_query = "SELECT GroupName FROM radius.radusergroup WHERE UserName='%{User-Name}' ORDER BY priority" Skipping... (0) sql : User found in radreply table (0) sql : expand: "SELECT GroupName FROM radius.radusergroup WHERE UserName='%{User-Name}' ORDER BY priority" -> 'SELECT GroupName FROM radius.radusergroup WHERE UserName='test' ORDER BY priority' rlm_sql (sql): Executing query: 'SELECT GroupName FROM radius.radusergroup WHERE UserName='test' ORDER BY priority' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (2) rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 881 seconds rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (0): Hit idle_timeout, was idle for 881 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_postgresql: Socket destructor called, closing socket (0) [-sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) } # authorize = ok ... End of DEBUG OUTPUT What's wrong? Why didn't authorize_group_check_query/ authorize_group_reply_query start? I tried to add Fall-Through = Yes to radreply for this user. Unsuccessfully. Thanks.

2 1

IP-Address
by Bruce Richardson 26 Mar '14

26 Mar '14

Hi, I have been using freeradius for many years now to authenticate WiFi users against active directory, and it all works perfectly. I am now trying to integrate it with the identity awareness built into our Checkpoint firewall system, this is able to take radius authentication packets and build a list of users against IP addresses. I understand that you can replicate the accounting data on from freeradius but for this to work obviously the WiFi client's IP address needs to be in the radius accounting data. At the moment it isn't because at the point when the accounting data is sent the client has not yet sent its DHCP request. Am I correct that to get the IP address into the radius accounting the freeradius server needs to be configured to send out the IP addresses rather than different DHCP server. If this is correct, could I create different IP pools to be used for each site, and have the correct IP data sent out for for different sets of wifi access points (NAS). Many thanks for reading this, I just want know I am going in the correct direction. Regards, Bruce Richardson -- This e-mail and any attachments are confidential and solely for the use of the intended recipient. They may contain material protected by legal professional or other privilege. If you receive it in error, please delete it from your system, make no copies of it, do not disclose its contents to any third party or use it for your own or any other person's benefit. Please advise the sender of its receipt as soon as possible. Although this email and its attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by the company for any loss or damage arising from receipt or use thereof. Any opinions expressed that do not relate to the official business of the company are those of the author, not the United Biscuits group of companies. United Biscuits (UK) Limited Registered in England number 2506007 Registered Office: Hayes Park, Hayes End Road, Hayes, Middlesex, UB4 8EE

9 25

Version 3.0.2 has been released
by Alan DeKok 26 Mar '14

26 Mar '14

ChangeLog here: http://freeradius.org/version3.html There have been a large number of minor bug fixes, and a few major ones. The major ones caused the delay of the release. There are a number of useful new features. The "unpack" module will help deal with vendors who pack multiple fields into one attribute. Secrets and passwords to databases are no longer printed in debugging mode. DHCP has been updated for sqlite. "unlang" is getting smarter. The goal for 3.0.3 is to more compile-time optimizations. e.g. update reply { Filter-ID := "%{sql: ...}" } Right now, the string "%{sql: ...}" is parsed at run-time for every request. This is slow, and means that we can't do syntax checks when the server starts. For 3.0.3, dynamically expanded strings will be checked when the server starts. update reply { Filter-ID := "%{no_such_module: ...}" } In 3.0.2, the server will start, and you will see run-time failures, when the expansion doesn't exist. In 3.0.3, the server will refuse to start, as the configuration is wrong. Alan DeKok.

2 2

LDAP and/or Active Directory
by David Peterson 26 Mar '14

26 Mar '14

I have a WiMax customer who would like to authorize against an Active directory server. I noticed in the inner-tunnel config it says that the Auth-Type LDAP means that EAP won't work. Am I misunderstanding how to properly set up LDAP? Or would the active directory set up be better for an authorization requiring EAP-TTLS. David

6 9

DHCPv6 support
by Nikolaos Milas 26 Mar '14

26 Mar '14

Hi, Are there any plans to provide DHCPv6 functionality any time soon? All the best, Nick

5 6

Re: IP-Address
by Bruce Richardson 26 Mar '14

26 Mar '14

Hi, thanks for all the replies to my query. They have helped me understand the problem and backed up what I already knew. Hopefully others will find the thread useful in the future. After having another in-depth look at it yesterday I have come to the conclusion that the elderly Cisco WiFi APs I am using are just too old to support all the features needed. Annoyingly the AP does know what the IP address is because you can see it on the connections table, but it refuses to paste it into the accounting data. I've tried various commands to force it. I have proved it can work because I have some Aerohive test kit that works perfectly. Freeradius passes the data to Checkpoint and the correct identity awareness is set up correctly. Thanks again Bruce. -- This e-mail and any attachments are confidential and solely for the use of the intended recipient. They may contain material protected by legal professional or other privilege. If you receive it in error, please delete it from your system, make no copies of it, do not disclose its contents to any third party or use it for your own or any other person's benefit. Please advise the sender of its receipt as soon as possible. Although this email and its attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by the company for any loss or damage arising from receipt or use thereof. Any opinions expressed that do not relate to the official business of the company are those of the author, not the United Biscuits group of companies. United Biscuits (UK) Limited Registered in England number 2506007 Registered Office: Hayes Park, Hayes End Road, Hayes, Middlesex, UB4 8EE

1 0

No remote authentication
by Benoit 26 Mar '14

26 Mar '14

Hello, This might have been asked before (and I hope so), but I can't get my freeradius server to respond remote authentications requests. I got the SQL authentication set up and things seem to work in local. radtest works for me with this command: radtest myuser mypass 127.0.0.1 1812 test which would be in my NAS: client 127.0.0.1{ ipaddr = 127.0.0.1 secret = test } -> I see the package accepted from debug mode on server. Now if I want to test through the Internet, using NTRadPing, I am not sure how I should set up my client, I tried (with xx.xx.xx.xx my IP as seen through the Internet): client xx.xx.xx.xx{ ipaddr = xx.xx.xx.xx secret = test } but the server debug mode (server side) does not react at all and stay in the waiting for requests state, while the client gets its requests to timeout. What am I missing? Did I get the IP thing right anyways?

6 10

how to organize groups of users getting access to groups of servers
by Jan-Frode Myklebust 25 Mar '14

25 Mar '14

I want to use freeradius to authenticate different groups of users (from LDAP) to sets of network devices, potentially with different access levels, but have a bit hard time understanding how this is supposed to be configured. Would be nice with some advice.. What I have so far is: # Give ldap group "firewall" super-user privilege on juniper firewalls: DEFAULT Ldap-Group == "cn=firewall,cn=groups,cn=accounts,dc=example,dc=com" Auth-Type := LDAP Juniper-Local-User-Name := "super-users", # Give ldap group "netadmin" "enable" access on cisco routers: DEFAULT Ldap-Group == "cn=netadmin,cn=groups,cn=accounts,dc=example,dc=com" Auth-Type := LDAP cisco-avpair = "shell:priv-lvl=15" But this doesn't work for users that are member of both groups, so I need to say that the first rule is limited to a set of juniper devices, and the second is limited to a set of cisco devices. What's the strategy we should use for expressing this? Is it possible without having to specify one rule for each NAS-IP-Address? I.e. being able to do some kind og grouping of clients to match on would be very helpful.. -jf

2 3