- Freeradius-Users - lists.freeradius.org

sending Challenge + EAP-Notification before Reject?
by Stefan Winter 19 Feb '14

19 Feb '14

Hello, recently, RFC4284 was brought to my attention, which speaks of ways to notify EAP peers that there is no service for them - with a displayable message as EAP-Notification in a Access-Challenge before the final EAP-Failure in a Reject. Is this in any way doable with FreeRADIUS? I'm thinking of two scenarios primarily: * FreeRADIUS proxy can't reach home server, so writes "Sorry, your home server is unreachable" in a Challenge+EAP-Notification and after the next Request then crafts Reject. * FreeRADIUS sees the realm, figures that it's not wanted, so writes "We don't serve that realm here." and then after the subsequent Request sends Access-Reject. I could also imagine that it could signal its own module failures as reason; e.g. if an rlm_sql doesn't work, instead of an immediate reject or do_not_reply it could send an extra round with "Unable to authenticate you: rlm_sql failed. Try again later"; and only then the Reject. I have no clue how to configure such a behaviour. Is it possible at all? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

4 5

FR 3.x | rlm_ldap | bind as user?
by Erwann Thoraval 19 Feb '14

19 Feb '14

Hello list, With FR 2.2.0 (fedora 18), my users are authenticated using "bind as user" from rlm_ldap (EAP/TTLS-PAP). However, i am not able to have the same behaviour with FR 3.0.1 (fedora 20). I didn't copy my old ldap configuration from 2.2 to 3.0, but created a new one from the sample file. Is it still possible to authenticate with ldap "bind as user" in FR 3.0? Or do i need to provide an admin account to rlm_ldap for browsing into the ldap database? Cheers, Erwann

2 6

FR 3.0.1 + CUI + MS-MPPE-*-Key issues
by stefan.paetow＠diamond.ac.uk 19 Feb '14

19 Feb '14

Hi, As part of the Moonshot project, I've upgraded my FR to 3.0.1 (plus the MySQL schema and the SQLite API fixes, because both are required here). I've now discovered an issue (I don't know if this is similar to what Stefan Winter raised recently about "Re: 3.0.x: Session resumption and CUI calculation" or not), where I have two scenarios and two items in Access-Accept that need to be there, CUI and the MS-MPPE-*-Key attributes: 1. FR 3.0.1 with use_tunneled_reply = yes, cui-inner.post-auth left as-is. - auth with pam_gss: CUI present, multiple sets of MS-MPPE-*-Key present. (boo! GSS doesn't like multiple sets!) - auth with rad_eap_test: CUI present, one set of MS-MPPE-*-Key present. (hooray! I have a CUI!) 2. FR 3.0.1 with use_tunneled_reply = no, cui-inner.post-auth modified to update outer.reply - auth with pam_gss: CUI present, one set of MS-MPPE-*-Key present. (hooray! GSS now works!) - auth with rad_eap_test: NO CUI present, one set of MS-MPPE-*-Key present. (boo! No CUI = problem!) So, my question is, is this intended or unintended behaviour, and if it is unintended, is there anything we can do (with unlang or the like)? I've compressed the four sets of authentications and parked them here (apologies for that, but I believe the mailing list has an attachment limit): https://www.dropbox.com/s/zvi7x0w3llzlhie/fr301.zip With Regards Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

3 6

Question on dictionary usage
by Mathieu Simon (Lists) 19 Feb '14

19 Feb '14

Hi I'm preparing another little patch to dictionaries but I'd like to make its use correctly commented in the dictionary. One of the Blue Coat attributes is a string Blue-Coat-Group which they document by example with a FreeRADIUS users.conf* i.e.: admin2 User-Password == "pass2" Blue-Coat-Group += "BCadmin", Blue-Coat-Group += "FTP" I don't have a device available that does support such attributes, less so specifically from Blue Coat. But the NAS can receive multiple group indications and put the respective user in these 2 groups (or more). Now this (at first sight) looks equaling to a comma-separated list i.e. Blue-Coat-Admin ="BCAdmin,FTP" ? If yes, I'd add a comment about being a comma-separated list of groups to make it obvious that there are > 1 group memberships allowed. -- Mat *https://kb.bluecoat.com/index?page=content&id=FAQ1963&actp=LIST

1 0

FreeRadius Mikrotik-Rate-Limit attribute limit
by Lalit Choudhary 18 Feb '14

18 Feb '14

Hi all, I configured freeradius (FreeRADIUS Version 2.2.2) with mysql,While testing Mikrotik NAS i found that Mikrotik-Total-Limit attribute it works upto 4gb then Mikrotik-Total-Limit-Gigawords for more than 4gb (4294967296 in bytes).If i set Mikrotik-Total-Limit value more then 3.9 GB ,it's taking random value or 0 for this attribute. Currently my hotspot ,wifi users data usage limit set in database, using store procedure it's calculating value for Mikrotik-Total-Limit and assigning other attributes. Today i tried by sending both attributes(Mikrotik-Total-Limit-Gigawords and Mikrotik-Total-Limit) in redreply, Sending Access-Accept of id 61 to 192.168.53.157 port 48563 Mikrotik-Rate-Limit = "15M/16M" Mikrotik-Total-Limit = 5242880 (this value in bytes) Mikrotik-Total-Limit-Gigawords = 1 (this value in GB) Session-Timeout = 0 Idle-Timeout = 0 Port-Limit = 1 I'm assuming that it will Terminate the session after 1026 mb usage (Mikrotik-Total-Limit + Mikrotik-Total-Limit-Gigawords), but user session not Terminating even after 1026 mb usage . I am not sure whether Mikrotik-Total-Limit-Gigawords taking value in GB or bytes. Please suggest how i can use Mikrotik-Total-Limit-Gigawords for more then 4 GB data limit. Thanks, Lalit Choudhary

4 3

Unknown Attribute "Max-Daily-Session" on freeradius3
by Marco Marino 17 Feb '14

17 Feb '14

Hi, I'm trying to use freeradius3, but i have this error on a Access-Request packet rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Users' ORDER BY id' rlm_sql: Failed to create the pair: Unknown attribute "Max-Daily-Session" rlm_sql (sql): Error getting data from database (0) ERROR: sql : Error retrieving check pairs for group Users with freeradius 2.2.3 it works. I have the "Max-Daily-Session" attribute in a table named "dictionary" in the radius database. How can i tell to radius that dictionary is in the database? Thanks

2 7

Multiple attributes / extraction of a specific value with unlang regex ?
by Chaigneau, Nicolas 17 Feb '14

17 Feb '14

Hello, I'm working with FreeRADIUS 3.0.1. I'm trying to extract a value from an array of attributes, such as : Cisco-AVPair = "<prefix>=<value>" There are multiple Cisco-AVPair values in packet, I want to extract <value> from the attribute starting with "<prefix>=". I read this from unlang man page : %{Attribute-Name[*]} Expands to a single string, with the value of each array member separated by a newline. (note that it seems members are separated by ",", not by a newline) So I tried the following : if ("%{Cisco-AVPair[*]}" =~ /circuit-id-tag=([^,]*)/ ) { update control { My-Cisco-Circuit-Id := "%{1}" } } This works, but is not good enough because <value> might contain a comma. Is there a better way to do this with unlang ? Thanks. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

3 3

Advanced mapping of users file into SQL
by Ondrej Jombik 17 Feb '14

17 Feb '14

This is about having multiple entries for one user in SQL. I have feeling it is not possible, but whenever I read about SQL module, it always states something like this: # # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql Mirror obviously means that whatever is in `users' file, can be mapped into SQL tables. So if you guys can help me transform this structure from `users' into SQL, that would be great: user MD5-Password := '88****************************40', NAS-IP-Address = '192.168.143.55' APC-Service-Type = 'Outlet', APC-Outlets = '8' user MD5-Password := '88****************************40', NAS-IP-Address = '192.168.143.91' APC-Service-Type = 'Outlet', APC-Outlets = '1,2' Basically I want to reply different APC-Outlets according to NAS-IP-Address. I do not consider this as something advanced, but I really have hard-time to grasp it under SQL. Thank you for any possible suggestion Ondrej -- Ondrej JOMBIK Platon Technologies s.r.o., Hlavna 3, Sala SK-92701 +421 903 PLATON - info(a)platon.org - http://platon.org My current location: Phoenix, Arizona My current timezone: -0700 UTC (MST) (updated automatically)

1 0

Re: PEAP auth rejected due to different inner and outer user-id
by douglas eseng 16 Feb '14

16 Feb '14

Trying to find a configuration that allow accurate accounting when PEAP / TTLS having anonymous outer user-id. Using FR 2.2.3 with default configuration. - add a testing user - enable eap.conf use_tunneled_reply for both PEAP & TTLS Observed that, - PEAP sent inner user-id in the Access-Accept - TTLS-PAP sent outer user-id in the Access-Accept instead. (debug output attached) Additionally enable 'update outer.reply' in post-auth section for the inner-tunnel virtual server. Observed that, - PEAP failed due to identity mismatch. (debug output attached) - TTLS-PAP sent inner user-id in the Access-Accept. Seem like both use_tunneled_reply option and update outer.reply in post-auth section have inconsistent behavior. What would be the correct configuration to allow accurate accounting? Thanks. On Sat, Feb 15, 2014 at 11:43 PM, douglas eseng <douglas.eseng(a)gmail.com>wrote: > Trying to find a configuration that allow accurate accounting when PEAP / > TTLS having anonymous outer user-id. > > Using FR 2.2.3 with default configuration. > - add a testing user > - enable eap.conf use_tunneled_reply for both PEAP & TTLS > > Observed that, > - PEAP sent inner user-id in the Access-Accept > - TTLS-PAP sent outer user-id in the Access-Accept instead. (debug output > attached) > > Additionally enable 'update outer.reply' in post-auth section for the > inner-tunnel virtual server. > > Observed that, > - PEAP failed due to identity mismatch. (debug output attached) > - TTLS-PAP sent inner user-id in the Access-Accept. > > Seem like both use_tunneled_reply option and update outer.reply in > post-auth section have inconsistent behavior. > > What would be the correct configuration to allow accurate accounting? > > Thanks. >

2 3

rlm_sql: The 'Attribute' field is empty or NULL
by Mehdi Ravanbakhsh 16 Feb '14

16 Feb '14

Hi All I have this error in my log file : Sun Feb 16 09:17:57 2014 : Error: rlm_sql: The 'Attribute' field is empty or NULL, skipping the entire row. Sun Feb 16 09:17:57 2014 : Error: rlm_sql (sql): Error getting data from database Sun Feb 16 09:17:57 2014 : Error: [sql] SQL query error; rejecting user Sun Feb 16 09:18:00 2014 : Error: rlm_sql: The 'Attribute' field is empty or NULL, skipping the entire row. Sun Feb 16 09:18:00 2014 : Error: rlm_sql (sql): Error getting data from database Sun Feb 16 09:18:00 2014 : Error: [sql] SQL query error; rejecting user Do I have null attribute in my database ? or this null attribute is in request packet from NAS ? Best regards.

3 4