Post-Auth LDAP with computer names rather than usernames
I currently have dynamic vlans working with post-auth user authentication but my boss would like to do it based off computer name. I have searched and become a little confused as how to proceed. In the LDAP conf do I change stripped username to stripped computer name or is it more complicated than that? ________________________________ From: Freeradius-Users <freeradius-users-bounces+kevin.virk=faithlife.com@lists.freeradius.org> on behalf of freeradius-users-request@lists.freeradius.org <freeradius-users-request@lists.freeradius.org> Sent: Monday, September 3, 2018 10:19 AM To: freeradius-users@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 161, Issue 2 Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users<http://lists.freeradius.org/mailman/listinfo/freeradius-users> or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: VLan affect based on ldap attribute freeradius v3 (jehan procaccia INT) 2. rlm_sql not checking radgroupreply (tomas.meier@fettabernett.de) ---------------------------------------------------------------------- Message: 1 Date: Mon, 3 Sep 2018 16:04:11 +0200 From: jehan procaccia INT <jehan.procaccia@int-evry.fr> To: FreeRadius users mailing list <Freeradius-Users@lists.freeradius.org> Cc: aland@deployingradius.com, Christophe GABORET <Christophe.Gaboret@tem-tsp.eu> Subject: Re: VLan affect based on ldap attribute freeradius v3 Message-ID: <f6b5995f-5959-a196-5bb0-513525683e5a@int-evry.fr> Content-Type: text/plain; charset=utf-8 Hello sucessfull reponses below ... Le 31/08/2018 à 14:59, Alan DeKok a écrit :
On Aug 31, 2018, at 4:45 AM, jehan procaccia INT <jehan.procaccia@int-evry.fr> wrote:
unfortunatly it fails, User-Category attribute fetch from ldap edupersonPrimaryAffiliation doesn't pass though different states/modules apparently Yes, it does. You should be able to tell what's going on by reading the debug output. *Or* by posting the ENTIRE debug output here, and letting someone else read it.
You're falling into a common trap. You're trying all kinds of random things. Without really understanding what's going on, or why. You're posting *small* bits of the debug output, in the hope that those bits are useful.
They're not.
Post the FULL DEBUG OUTPUT.
And make sure it's for ONE USER. We're not going to read through thousands of lines of logs about accounting packets, in order to solve an authentication issue. you're right, after a weekend reading thouroughly http://networkradius.com/doc/FreeRADIUS Technical Guide.pdf<http://networkradius.com/doc/FreeRADIUS Technical Guide.pdf> and wiki thingsget better now , althought it's not easy to get a single user debug output from production . fortunatly you gave me the right answer with
"use_tunneled_reply = yes" adding that not only (which was already set) to mods-enabled/eap section: eap { ttls { but moreover to peap { which is our prevalent method used, now makes the attribute correctly flowed in the process chapter 4.3 of the tech guide is important to understand the iteractive / recursive processing of the configuration sections and modules . the debug output seems very repetitive whitout that and https://wiki.freeradius.org/guide/radiusd-X<https://wiki.freeradius.org/guide/radiusd-X> helps a lot to . thanks for your help , now it work fine ;-) Regards PS my connection as an employee (ldap) and associated vlan accordingly : (86) prod: reply:Reply-Message := 'employee' (86) prod: reply:User-Category += 'employee' (86) Virtual server sending reply (86) Reply-Message := "employee" (86) User-Category += "employee" (86) eap_peap: Got tunneled reply RADIUS code 2 (86) eap_peap: Reply-Message := "employee" (86) eap_peap: User-Category += "employee" (88) eap_peap: Using saved attributes from the original Access-Accept (88) eap_peap: Reply-Message := "employee" (88) eap_peap: User-Category += "employee" (88) [eap] = ok (88) } # authenticate = ok (88) # Executing section post-auth from file /etc/raddb/sites-enabled/default (88) post-auth { (88) update { (88) No attributes updated (88) } # update = noop (88) reply_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (88) reply_log: --> /var/log/radius/radacct/10.91.10.10/reply-detail-20180903 (88) reply_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (88) reply_log: EXPAND %t (88) reply_log: --> Mon Sep 3 09:24:23 2018 (88) [reply_log] = ok (88) [exec] = noop (88) policy remove_reply_message_if_eap { (88) if (&reply:EAP-Message && &reply:Reply-Message) { (88) if (&reply:EAP-Message && &reply:Reply-Message) -> TRUE (88) if (&reply:EAP-Message && &reply:Reply-Message) { (88) update reply { (88) &Reply-Message !* ANY (88) } # update reply = noop (88) } # if (&reply:EAP-Message && &reply:Reply-Message) = noop (88) ... skipping else: Preceding "if" was taken (88) } # policy remove_reply_message_if_eap = noop (88) policy debug_reply { (88) if ("%{debug_attr:reply:}" == '') { (88) Attributes matching "reply:" (88) &reply:User-Category += employee (88) &reply:Stripped-User-Name = procacci (88) if ("%{debug_attr:reply:}" == '') -> TRUE (88) if ("%{debug_attr:reply:}" == '') { (88) [noop] = noop (88) } # if ("%{debug_attr:reply:}" == '') = noop (88) } # policy debug_reply = noop (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) -> TRUE (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (88) update reply { (88) Tunnel-Private-Group-Id := 903
even with the usage of session-state (replacing "reply") it fails
here's a new radiusd -X experiment :
1) ldap does find the attribute and associated value (here employee)
rlm_ldap (prod): Reserved connection (7) (93) prod: reply:Reply-Message := 'employee' (93) prod: reply:User-Category += 'employee'
2) eap-peap has it
(93) post-auth { (93) if (0) { (93) if (0) -> FALSE (93) } # post-auth = noop (93) Login OK: [radu/<via Auth-Type = eap>] (from client prod port 0 via TLS tunnel) (93) } # server inner-tunnel (93) Virtual server sending reply (93) Reply-Message := "employee" (93) *User-Category += "employee"* (93) eap_peap: Got tunneled reply code 2 (93) eap_peap: Reply-Message := "employee" (93) eap_peap: *User-Category += "employee"* Note that's all in packet 93. AND in the "inner tunnel" virtual server.
3) eap_peap is success
(94)*eap_peap: Success* Which is packet 94. Note that "94" is NOT THE SAME as "93".
i.e. it's a different packet. So unless you made sure to get the attribute from packet 93 inner tunnel reply to packet 94 outer reply... the attribute won't be in packet 94.
should I see something like &reply:User-Category above No.
? not been present means it's already lost ? It hasn't been lost.
All you need to do is read mods-available/eap, and set "use_tunneled_reply = yes". And read the comments for that configuration item. They explain what it is, why you need it, and when you want to use it.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html>
------------------------------ Message: 2 Date: Mon, 3 Sep 2018 19:18:59 +0200 From: tomas.meier@fettabernett.de To: freeradius-users@lists.freeradius.org Subject: rlm_sql not checking radgroupreply Message-ID: <trinity-fc960aa8-16ac-446d-81e3-a3045449cc19-1535995139876@3c-app-gmx-bs44> Content-Type: text/plain; charset="UTF-8" Hello, I am using FreeRADIUS 3.0.17 in a MySQL setup that seems to not check radgroupreply. "radtest" gets user attributes but does not receive attributes of associated group at all. Complete debug output of radiusd -X: FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/sql including configuration file /usr/local/etc/raddb/mods-config/sql/main/sqlite/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/realm including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/accounting including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "#@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_exec # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_radutmp # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_sql # Loading module "sql" from file /usr/local/etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "sql.mydomain.de<http://sql.mydomain.de>" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-Group}' AND acctstoptime IS NULL" safe_characters = "#@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } accounting-off { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', %{%{integer:Event-Timestamp}:-date('now')}, %{%{integer:Event-Timestamp}:-date('now')}, NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = %{%{integer:Event-Timestamp}:-date('now')}, acctinterval = 0, framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0}, acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } instantiate { } # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "[1]http://127.0.0.1/ocsp/<http://127.0.0.1/ocsp/>" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "sql" from file /usr/local/etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 10.1.26-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Adding client 10.0.0.1 (RAS1) to global clients list rlm_sql (10.0.0.1): Client "RAS1" (sql) added [...] rlm_sql (sql): Adding client 192.168.100.1 (radius.mydomain.de<http://radius.mydomain.de>) to global clients list rlm_sql (192.168.100.1): Client "radius.mydomain.de<http://radius.mydomain.de>" (sql) added rlm_sql (sql): Adding client 127.0.0.1<http://127.0.0.1> (localhost) to global clients list rlm_sql (127.0.0.1<http://127.0.0.1>: Client "localhost" (sql) added rlm_sql (sql): Released connection (0) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipv4addr = 192.168.100.1 port = 1812 limit { max_connections = 64 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv4addr = 192.168.100.1 port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1<http://127.0.0.1> port = 18120 } Listening on auth address 192.168.100.1 port 1812 bound to server default Listening on acct address 192.168.100.1 port 1813 bound to server default Listening on auth address 127.0.0.1<http://127.0.0.1> port 18120 bound to server inner-tunnel Ready to process requests References 1. http://127.0.0.1/ocsp/<http://127.0.0.1/ocsp/> ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html> ------------------------------ End of Freeradius-Users Digest, Vol 161, Issue 2 ************************************************
On Fri, 2018-10-19 at 20:06 +0000, Kevin Virk wrote:
I currently have dynamic vlans working with post-auth user authentication but my boss would like to do it based off computer name. I have searched and become a little confused as how to proceed. In the LDAP conf do I change stripped username to stripped computer name or is it more complicated than that?
It's more complicated than that. What attributes are in the request? If the computer name is there, you can use it. If it's not there, then... you can't. Closest approximation might be the MAC address in Calling-Station-Id, maybe. The computer name is usually only included in EAP-TLS when you're using a certificate with the name of the computer in it. Which sounds unlikely: you'll have one or the other, and you've got the user name instead. -- Matthew
On Fri, Oct 19, 2018 at 09:13:38PM +0100, Matthew Newton wrote:
If the computer name is there, you can use it. If it's not there, then... you can't. Closest approximation might be the MAC address in Calling-Station-Id, maybe.
Hmm, MAC addresses are not cryptographically signed, though... Meaning you can't rely on them to be genuine. HC
On Fri, 2018-10-19 at 23:31 +0200, Hans-Christian Esperer wrote:
On Fri, Oct 19, 2018 at 09:13:38PM +0100, Matthew Newton wrote:
If the computer name is there, you can use it. If it's not there, then... you can't. Closest approximation might be the MAC address in Calling-Station-Id, maybe.
Hmm, MAC addresses are not cryptographically signed, though... Meaning you can't rely on them to be genuine.
Never said it was a good replacement, just a close approximation. Sometimes you have to work with what you've got. -- Matthew
On Fri, Oct 19, 2018 at 10:39:33PM +0100, Matthew Newton wrote:
Never said it was a good replacement, just a close approximation.
Sometimes you have to work with what you've got.
I don't agree that it is an approximation, let alone a close one. TBH, I don't understand at all why MAC addresses are used everywhere in security relevant contexts. All these wifi "portals" are fundamentally flawed because of this. HC
On 19 October 2018 22:45:22 BST, Hans-Christian Esperer <hc@hcesperer.org> wrote:
On Fri, Oct 19, 2018 at 10:39:33PM +0100, Matthew Newton wrote:
Never said it was a good replacement, just a close approximation.
Sometimes you have to work with what you've got.
I don't agree that it is an approximation, let alone a close one.
Given we don't even know if the OP is using EAP or not, that might be all they've got to work with.
TBH, I don't understand at all why MAC addresses are used everywhere in security relevant contexts. All these wifi "portals" are fundamentally flawed because of this.
Because nothing's perfect, and sometimes you can only work with what you've got. Like I said last time. Nobody said you have to like it, or that web portals are secure. -- Matthew
On Oct 19, 2018, at 5:45 PM, Hans-Christian Esperer <hc@hcesperer.org> wrote:
On Fri, Oct 19, 2018 at 10:39:33PM +0100, Matthew Newton wrote:
Never said it was a good replacement, just a close approximation.
Sometimes you have to work with what you've got.
I don't agree that it is an approximation, let alone a close one.
You're welcome to your opinion. Unfortunately, your opinion can't change reality. The issues you bring up have been known for years, if not decades.
TBH, I don't understand at all why MAC addresses are used everywhere in security relevant contexts. All these wifi "portals" are fundamentally flawed because of this.
Because it's all we have. As Matthew said, we're limited by what we have. We *cannot* upgrade tens of millions of access points and end devices. So any *realistic* security solution uses the available tools to come up with the best possible solution, given the limitations we have. Denying that is a fools dream. Alan DeKok.
Well, we don't even know yet what the original poster's intention was. Maybe it can be solved in a secure and a less secure way? Why point out the less secure way first? All I meant to do was point out that the mac approach has disadvantages to the original approach, maybe that's something that wasn't taken into consideration by the original poster. On a personal sidenode, my original motivation to look into freeradius in the first place was precisely that I wanted to avoid them portals. =) Not only are they utterly insecure, they are also incredibly inconvenient if what you want is a stable and long lived wifi connection... HC
On Oct 20, 2018, at 8:38 AM, Hans-Christian Esperer <hc@hcesperer.org> wrote:
Well, we don't even know yet what the original poster's intention was.
That's where it's helpful to ask good questions. And give useful information, like "we're using WiFi with EAP".
Maybe it can be solved in a secure and a less secure way? Why point out the less secure way first?
Because of the vague nature of the question. The MAC approach is almost always available.
All I meant to do was point out that the mac approach has disadvantages to the original approach,
Which was what? The "original approach" didn't actually describe the authentication that was being used.
maybe that's something that wasn't taken into consideration by the original poster.
At this point, we're all just guessing.
On a personal sidenode, my original motivation to look into freeradius in the first place was precisely that I wanted to avoid them portals. =) Not only are they utterly insecure, they are also incredibly inconvenient if what you want is a stable and long lived wifi connection...
Hotspot 2.0 is supposed to solve a lot of these problems. My point is that it's not useful to complain about the insecurity of MAC addresses. Everyone knows, and has known for years. So comments like this: "I don't understand at all why MAC addresses are used everywhere in security relevant contexts" Just show a lack of understanding of *how* things work. Since solutions are driven by available information, the answer to "why" is simple: It's often the only choice. Alan DeKok.
On Oct 19, 2018, at 4:06 PM, Kevin Virk <Kevin.Virk@faithlife.com> wrote:
I currently have dynamic vlans working with post-auth user authentication but my boss would like to do it based off computer name. I have searched and become a little confused as how to proceed. In the LDAP conf do I change stripped username to stripped computer name or is it more complicated than that?
If you need to send a message to the mailing list, just send a message. Don't reply to a digest message. And don't include hundreds of lines of useless text in your message. Alan DeKok.
participants (4)
-
Alan DeKok -
Hans-Christian Esperer -
Kevin Virk -
Matthew Newton