disable password checking against ldap
In steel belted radius (SBR), we can setup sbr to do a simple bind to ldap database. In such as setup, sbr will omit password checking. If the bind is successful (meaning username is found in ldap) then reply accept being sent back to radius client. When I try to do this in freeradius, it passes the authentication process to ldap and insists on checking the password. How can I disable the password checking in freeRadius?
On Jul 10, 2024, at 6:04 AM, Kong Kai Chen via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
In steel belted radius (SBR), we can setup sbr to do a simple bind to ldap database. In such as setup, sbr will omit password checking. If the bind is successful (meaning username is found in ldap) then reply accept being sent back to radius client. When I try to do this in freeradius, it passes the authentication process to ldap and insists on checking the password. How can I disable the password checking in freeRadius?
You don't "disable" password checking. You just write an LDAP query which checks if the user exists. The normal ldap processing in FreeRADIUS does username / password checking. So if you want to skip the password checks, then don't use the normal LDAP processing. The documentation contains examples of how to write LDAP queries. The exact content depend on your local LDAP database and scheme. But something like this should work: authorize { ... if ("%{ldap: .... ldap query with %{User-Name} .. }") { accept } ... } i.e. "if the query to find a user by name exists, then accept the user". Alan DeKok.
Thanks, Alan. It works. sites-available/default: ("%{ldap:ldap://localhost:389/?uid?sub?(uid=%{User-Name})}") { accept } else { reject } Question 1: How can I utilize the LDAP settings defined in mods-enabled/ldap instead of hardcoding the LDAP connection here? Question 2: How can I implement load balancing across multiple LDAP servers to distribute the authentication load? Thank you.
On 10 Jul 2024, at 8:10 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 10, 2024, at 6:04 AM, Kong Kai Chen via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
In steel belted radius (SBR), we can setup sbr to do a simple bind to ldap database. In such as setup, sbr will omit password checking. If the bind is successful (meaning username is found in ldap) then reply accept being sent back to radius client. When I try to do this in freeradius, it passes the authentication process to ldap and insists on checking the password. How can I disable the password checking in freeRadius?
You don't "disable" password checking. You just write an LDAP query which checks if the user exists.
The normal ldap processing in FreeRADIUS does username / password checking. So if you want to skip the password checks, then don't use the normal LDAP processing.
The documentation contains examples of how to write LDAP queries. The exact content depend on your local LDAP database and scheme. But something like this should work:
authorize { ...
if ("%{ldap: .... ldap query with %{User-Name} .. }") { accept } ... }
i.e. "if the query to find a user by name exists, then accept the user".
Alan DeKok.
On Jul 11, 2024, at 10:33 AM, (null) (null) via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Thanks, Alan. It works.
That's good.
Question 1: How can I utilize the LDAP settings defined in mods-enabled/ldap instead of hardcoding the LDAP connection here?
You can't, unfortunately. That's not the way the LDAP expansions works.
Question 2: How can I implement load balancing across multiple LDAP servers to distribute the authentication load?
Unfortunately it's not really possible in v3 with the LDAP module. Most LDAP servers should be able to keep up with the load. In many cases, extra redundancy is just a way to have more things which will break. Alan DeKok.
When I startup using radiusd -X, it doesn't give me the error and radius server start successfully attached is the debug log details. But if I startup using the "systemctl start radiusd.service”, it failed to start and radius.log appear the following message # systemctl start radiusd.service Job for radiusd.service failed because the control process exited with error code. See "systemctl status radiusd.service" and "journalctl -xe" for details. Thu Jul 18 09:59:19 2024 : Info: Debugger not attached Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql1): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql2): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Thu Jul 18 09:59:19 2024 : Warning: rlm_sql (sql1): Ignoring read_groups as group_membership_query is not configured Thu Jul 18 09:59:19 2024 : Info: rlm_sql_mysql: libmysql version: 5.6.51 Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql1): Attempting to connect to database "radius" Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql1): Opening additional connection (0), 1 of 1 pending slots used Thu Jul 18 09:59:19 2024 : Warning: rlm_sql (sql2): Ignoring read_groups as group_membership_query is not configured Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql2): Attempting to connect to database "radius" Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql2): Opening additional connection (0), 1 of 1 pending slots used Thu Jul 18 09:59:19 2024 : Error: rlm_sql_mysql: Couldn't connect to MySQL server root@10.0.0.3:radius Thu Jul 18 09:59:19 2024 : Error: rlm_sql_mysql: MySQL error: Can't connect to MySQL server on '10.0.0.3' (13) Thu Jul 18 09:59:19 2024 : Error: rlm_sql (sql2): Opening connection failed (0) Thu Jul 18 09:59:19 2024 : Error: Failed to load clients from SQL Thu Jul 18 09:59:19 2024 : Error: /etc/raddb/mods-enabled/sql[47]: Instantiation failed for module "sql2" 
sites-enabled/default reply_log mods-available/detail.log detail reply_log { #filename = ${radacctdir}/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/%{User-Name}/reply-detail-%Y%m%d permissions = 0600 } It produced the below reply-detail-{date} file. Thu Jul 18 11:40:26 2024 Packet-Type = Access-Accept Framed-IPv6-Pool = "POOL-1" Framed-Protocol = PPP Huawei-Output-Average-Rate = 300000000 Huawei-Input-Average-Rate = 300000000 Huawei-Primary-DNS = 110.110.110.10 Huawei-Secondary-DNS = 110.110.110.12 Timestamp = 1721274026 Question: Is it possible to include username in the reply detail log?
On Jul 18, 2024, at 12:03 AM, (null) (null) <kckong1@yahoo.com> wrote:
Question: Is it possible to include username in the reply detail log?
That configuration logs what's in the reply. So is the User-Name in the reply? If you want the User-Name logged in the reply, then add the User-Name to the reply. Alan DeKok.
Hi, On Thu, Jul 18, 2024 at 10:11:41AM +0800, (null) (null) wrote: -------------------------------------------^ you have a strange email setup...
When I startup using radiusd -X, it doesn't give me the error and radius server start successfully attached is the debug log details. ... # systemctl start radiusd.service Job for radiusd.service failed because the control process exited with error code. See "systemctl status radiusd.service" and "journalctl -xe" for details. ... Thu Jul 18 09:59:19 2024 : Error: rlm_sql_mysql: Couldn't connect to MySQL server root@10.0.0.3:radius Thu Jul 18 09:59:19 2024 : Error: rlm_sql_mysql: MySQL error: Can't connect to MySQL server on '10.0.0.3' (13)
look for permission differences, for example: Are you using for debugging the same user as configured in the systemd units config? Greetings Hermann
If starting using radiusd -X as root user with no error's means that you have a problem with file/folder permissions if the service has errors. Check as which user the radiusd service starts and that that user has full permissions to write to and read from files, such as the /var/log/radius folder and the contents of that folder. If the radiusd service is run as the radius user and radius group, then: chown -R radius:radius /var/log/radius Should resolve the issue. On 2024/07/18 07:55, Hermann.Lauer@uni-heidelberg.de wrote:
Hi,
On Thu, Jul 18, 2024 at 10:11:41AM +0800, (null) (null) wrote: -------------------------------------------^ you have a strange email setup...
When I startup using radiusd -X, it doesn't give me the error and radius server start successfully attached is the debug log details. ... # systemctl start radiusd.service Job for radiusd.service failed because the control process exited with error code. See "systemctl status radiusd.service" and "journalctl -xe" for details. ... Thu Jul 18 09:59:19 2024 : Error: rlm_sql_mysql: Couldn't connect to MySQL serverroot@10.0.0.3:radius Thu Jul 18 09:59:19 2024 : Error: rlm_sql_mysql: MySQL error: Can't connect to MySQL server on '10.0.0.3' (13) look for permission differences, for example: Are you using for debugging the same user as configured in the systemd units config?
Greetings Hermann - List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/users.html
On Jul 17, 2024, at 10:11 PM, (null) (null) via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
When I startup using radiusd -X, it doesn't give me the error and radius server start successfully attached is the debug log details.
But if I startup using the "systemctl start radiusd.service”, it failed to start and radius.log appear the following message ... Thu Jul 18 09:59:19 2024 : Error: rlm_sql_mysql: Couldn't connect to MySQL server root@10.0.0.3:radius Thu Jul 18 09:59:19 2024 : Error: rlm_sql_mysql: MySQL error: Can't connect to MySQL server on '10.0.0.3' (13)
That message says that the MySQL server isn't running. So... make sure that the MySQL server is running before FreeRADIUS is started. Alan DeKok.
I want to report a bug on FreeRADIUS Version 3.0.13, it does not allow any other sql port number other than 3306. Below is the error when I change the port to other number eg. 33061. Both mysql database is running, when I change back to default port number 3306, no error. The weird thing is this only happen if I use the systemctl command. No error if I use radiusd -X Is that a bug fix? sql sql1 { dialect = "mysql" driver = "rlm_sql_mysql" server = “10.0.0.1" port = 3306 login = "root" password = "password" radius_db = “radius" } sql sql2 { dialect = "mysql" driver = "rlm_sql_mysql" server = “10.0.0.2" port = 33061 login = "root" password = “password" radius_db = “radius" } systemctl restart radiusd.service -- Unit radiusd.service has begun starting up. Jul 23 08:25:11 radius1 systemd[1]: radiusd.service: control process exited, code=exited status=1 Jul 23 08:25:11 radius1 systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. -- Subject: Unit radiusd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit radiusd.service has failed. radius.log Tue Jul 23 08:15:00 2024 : Error: /etc/raddb/mods-enabled/sql[53]: Instantiation failed for module “sql2" # radiusd -v radiusd: FreeRADIUS Version 3.0.13, for host x86_64-redhat-linux-gnu, built on May 24 2020 at 15:07:49 FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
On 18 Jul 2024, at 10:11 AM, (null) (null) <kckong1@yahoo.com> wrote:
When I startup using radiusd -X, it doesn't give me the error and radius server start successfully attached is the debug log details.
But if I startup using the "systemctl start radiusd.service”, it failed to start and radius.log appear the following message
# systemctl start radiusd.service Job for radiusd.service failed because the control process exited with error code. See "systemctl status radiusd.service" and "journalctl -xe" for details.
Thu Jul 18 09:59:19 2024 : Info: Debugger not attached Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql1): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql2): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Thu Jul 18 09:59:19 2024 : Warning: rlm_sql (sql1): Ignoring read_groups as group_membership_query is not configured Thu Jul 18 09:59:19 2024 : Info: rlm_sql_mysql: libmysql version: 5.6.51 Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql1): Attempting to connect to database "radius" Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql1): Opening additional connection (0), 1 of 1 pending slots used Thu Jul 18 09:59:19 2024 : Warning: rlm_sql (sql2): Ignoring read_groups as group_membership_query is not configured Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql2): Attempting to connect to database "radius" Thu Jul 18 09:59:19 2024 : Info: rlm_sql (sql2): Opening additional connection (0), 1 of 1 pending slots used Thu Jul 18 09:59:19 2024 : Error: rlm_sql_mysql: Couldn't connect to MySQL server root@10.0.0.3:radius Thu Jul 18 09:59:19 2024 : Error: rlm_sql_mysql: MySQL error: Can't connect to MySQL server on '10.0.0.3' (13) Thu Jul 18 09:59:19 2024 : Error: rlm_sql (sql2): Opening connection failed (0) Thu Jul 18 09:59:19 2024 : Error: Failed to load clients from SQL Thu Jul 18 09:59:19 2024 : Error: /etc/raddb/mods-enabled/sql[47]: Instantiation failed for module "sql2"
<debug20240718.log>
On Jul 22, 2024, at 5:27 PM, (null) (null) <kckong1@yahoo.com> wrote:
I want to report a bug on FreeRADIUS Version 3.0.13,
We are not going to issue fixes for a version which is many years out of date. There's no reason to re-check issues which are already found and fixed years ago.
it does not allow any other sql port number other than 3306. Below is the error when I change the port to other number eg. 33061.
That's not a FreeRADIUS issue. Your local OS is limiting the ports.
Both mysql database is running, when I change back to default port number 3306, no error. The weird thing is this only happen if I use the systemctl command. No error if I use radiusd -X
Is that a bug fix?
Blame your local OS. FreeRADIUS has no limits on outbound ports for SQL databases. Alan DeKok.
Thanks for your feedback and input. Yes, you’re right, it’s an OS issue related to SELinux (Security-Enhanced Linux) policy settings. Adding or modifying the policy settings in SELinux will resolve the issue. Thank you very much. # semanage port -a -t mysqld_port_t -p tcp 33061
On 23 Jul 2024, at 8:34 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 22, 2024, at 5:27 PM, (null) (null) <kckong1@yahoo.com> wrote:
I want to report a bug on FreeRADIUS Version 3.0.13,
We are not going to issue fixes for a version which is many years out of date. There's no reason to re-check issues which are already found and fixed years ago.
it does not allow any other sql port number other than 3306. Below is the error when I change the port to other number eg. 33061.
That's not a FreeRADIUS issue. Your local OS is limiting the ports.
Both mysql database is running, when I change back to default port number 3306, no error. The weird thing is this only happen if I use the systemctl command. No error if I use radiusd -X
Is that a bug fix?
Blame your local OS. FreeRADIUS has no limits on outbound ports for SQL databases.
Alan DeKok.
participants (5)
-
(null) (null) -
Alan DeKok -
Conrad Classen -
Hermann.Lauer＠uni-heidelberg.de -
Kong Kai Chen