January 2013 - Freeradius-Users - lists.freeradius.org

FreeRadius Accounting for Fortigate 311B
by Alireza Goftari 25 Jan '13

25 Jan '13

Hi, I’m trying to deploy FreeRadius as an accounting solution in my network. my scenario is like this: [image attached] Fortigate Firewall is already integrated with Active Directory and may send authenticated requests to FreeRadius, which is as well integrated with Active Directory. The work to be done: 1. using NAS (Fortigate Firewall in this case) attributes to do the accounting; 2. Specifying special Active Directory groups in FreeRadius configuration to have Internet access. May you help me with the solution or at least give me some hints? Thanks, Alireza Goftari

1 0

helps with User-Password
by Hocine M 25 Jan '13

25 Jan '13

Hello, A little question, when i run freeradius in debug mode ( freeradius -XX), ii can't see the User-Password! Sending Access-Request of id 167 to 195.220.94.130 port 1812 NAS-Port-Id = "AP41/1" Calling-Station-Id = "74-2F-68-ED-12-1C" Called-Station-Id = "00-0B-0E-A9-58-80:eduroam" Service-Type = Framed-User EAP-Message = 0x0201001a01756e69762d6c696c6c65332e6672406372752e6672 User-Name = "univ-lille3.fr(a)cru.fr" NAS-Port = 61847 This attibute must be displayed? Thanks

3 4

Dialup Admin
by Shawky Skaff 25 Jan '13

25 Jan '13

I was wondering if you can point me in the right direction for a couple of issues that I'm having - When I view a session of a user, it says user "bla" has 0 open session, which it weird because the user is connected. Where does radius get this info from? Is there anything that I need to change to fix it? - Is radkill still used? Is there anywhere I can obtain this from, the ftp link in the wiki times out after a while

2 2

Freeradius CoA - Need Help
by Nasser Heidari 24 Jan '13

24 Jan '13

Hi, I'm going to setup Freeradius CoA Virtual Server, I have already gone through originate-coa document, but need some help. This is the way that I traditionally originate CoA or POD packets: - I have wrote a Perl scripts that it listens on port 1810. - when I want to disconnect a user , I use another script to get user session info from DB , and then send it's information (User-Name, Acct-Session-ID, NAS IP Address) to port 1810 - then simply my perl scripts generates radclient commend and sends it to appropriate NAS. For the CoA it's same , the only different is that I send more AVP's to my script. Now what I couldn't understand is that, How should I trigger CoA server to send appropriate AVP's to NAS? How should I tell that I need these AVP's to be sent? I have Googled it but I couldn't find any sample. Thanks in advance. Regards, Nasser

2 2

Filter and attribute
by Emmanuel BILLOT 24 Jan '13

24 Jan '13

Hi, In LDAP config module, we can find filter = "(|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(mail=%{%{Stripped-User-Name}:-%{User-Name}}))" Users authenticate in freeradius with login like pierre.dupont@12345678 We want to use both parts of adress in LDAP filter. pierre.dupont is %{User-Name} what should be the name of the variable for 12345678 ? -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 5

Re: Video installation for freeradius with smsotp
by Thomas Glanzmann 24 Jan '13

24 Jan '13

Hello Lasse, * Lasse Odden <lasse.odden(a)gmail.com> [2013-01-24 11:48]: > Long time since we spoke, but you told me you should try to find time > to do a new video with instructions. Could you please help me out > with this installation? I currently don't have the time, but if you have specific question, ask me. Thomas

1 0

Realm
by Miha 24 Jan '13

24 Jan '13

Hi, my radius client is sending with user-name and password aslo realm. I can not disable sending realm, is it possible to configure radius that will not user realm with user-name (user-name@realm)? [digest] Digest-Attributes look OK. Converting them to something more usful. *Digest-User-Name = "018108500"* *Digest-Realm = "test1.opensips.softnet.si"* Digest-Nonce = "510001fb00000006c9cc728438be21e324f917a5ea234380" Digest-URI = "sip:+38588888882@test1.opensips.test.si" Digest-Method = "INVITE" [digest] Adding Auth-Type = DIGEST ++[digest] returns ok [suffix] Looking up realm "test1.opensips.softnet.si" for User-Name = *"018108500(a)test1.opensips.**test.si*" [suffix] No such realm "test1.opensips.softnet.si" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> *018108500(a)test1.opensips.**test.si* Radius will need to chack only user-name (*018108500*). Thanks! Miha

3 3

suddenly problem with certificates / error in SSLv3 read client certificate B
by Stephan Manske 24 Jan '13

24 Jan '13

Hello! I have a huge problem with freeradius 2.2.0 on my eisfair server (www.eisfair.org) and users using certificates to authenticate. first of all: this should not be a "how must I config my freeradius to work?" problem. These installation with these certificates and these config worked for over 8 month very well. And suddenly I got the problem. Every client with user/pass works still fine. The problem is about the users with certificates (windows xp and android). the certificates are not outdated: list of active certificates: V 13-01-28 13:16:17 Z 01 unknown /C=DE/ST=Somewhere/O=Manske EIS/OU=Radius_Managment/CN=Manske Radius/emailAddress=xxx (the server certificate) V 14-02-17 13:16:54 Z 02 unknown /C=DE/ST=Somewhere/O=Manske EIS/OU=Radius_Managment/CN=User Name/emailAddress=xxx (one of the problematic user certificates) I tried it with check_crl = yes and no changes before the problem occurs: I updated openssl-packages from Internal Program Version: OpenSSL 1.0.0j also included the old version 0.9.7m also included the old version 0.9.8x to Internal Program Version: OpenSSL 1.0.1c also included the old version 0.9.8x But I did this over three days before the errors occured. In the meantime freeradius worked well. So, here is a shorten output of radiusd -X (I hope I do not shorten important things - btw, are there parts of such an debug output I should keep secret?) Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.x.x port 2049, id=2, length=141 User-Name = "User Name" NAS-IP-Address = 192.168.x.x # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "User Name", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry User Name at line 8 [files] expand: Hello, %{User-Name} -> Hello, User Name ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/tls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.x.x port 2049 Reply-Message = "Hello, User Name" EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000xx State = 0x7d1f9f227c1d92c8e39xxxxxxxxx Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.x.x port 2049, id=2, length=227 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry User Name at line 8 [files] expand: Hello, %{User-Name} -> Hello, User Name ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 77 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0048], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 08bb], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00b8], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 77 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0048], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 08bb], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00b8], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.x.x port 2049 Reply-Message = "Hello, User Name" EAP-Message = 0x010304000dc0000009b316030100310200002d030150e4ae0ed21d8 EAP-Message = 0x3017060355040313104d616e736b6520526164697573204341301e1 EAP-Message = 0xce7ab5f8c7edc84656371d677436108b21313e1ea308f55566b8684 EAP-Message = 0x25040c300a06082b06010505070301300d06092a864886f70d01010 EAP-Message = 0xb12f24c809d9d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7d1f9f227f1c92c8e3xxxxxx Finished request 2. Going to the next request [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Sending Access-Challenge of id 2 to 192.168.x.x port 2049 Reply-Message = "Hello, User Name" EAP-Message = 0x010404000dc0000009b3301 EAP-Message = 0x3130323136313231325a17: Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.x.x port 2049 Reply-Message = "Hello, User Name" EAP-Message = 0x010404000dc0000009bxxxxxx EAP-Message = 0xfdf4cec951566e50d17 EAP-Message = 0xca21c0f495c75a3a13d EAP-Message = 0x01ff300d06092a86488 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7d1f9f227e1b92c8e39 Finished request 3. Going to the next request and so on ... but here it might be important: # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03de], Certificate [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = User Name [tls] --> BUF-Name = Radius CA [tls] --> subject = /C=DE/ST=Somewhere/L=Somewhere/O=Manske EIS/OU=Radius_Managment/emailAddress=radius@xxxx [tls] --> issuer = /C=DE/ST=Somewhere/L=Somewhere/O=Manske EIS/OU=Radius_Managment/emailAddress=radius@xxxx [tls] --> verify return:1 --> verify error:num=7:certificate signature failure [tls] >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:04067084:rsa routines:RSA_EAY_PUBLIC_DECRYPT:data too large for modulus SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect (certificate signature failure): [User Name/<via Auth-Type = EAP>] (from client xxxx Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> User Name attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 2 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 2 to 192.168.x.x port 2049 TIIA, Stephan

4 14

freeradius 2.2.0 stop authorization
by Wedel Blake 23 Jan '13

23 Jan '13

I setup a centos 6.2 server that has freeradius 2.2.0 running on it. I have the mysql module running. Based on simple mac authentication with the username and password the mac address of the computer it appears to be working fine. What I want to do is setup ldap to authenticate against our Windows 2010 server where the computers are a part of the domain. I would like for it to query mysql first and then query ldap if it didn't find the computer in mysql. If I remove ldap for the defaults file I get an Access-Accept reply as expected. It just that if there is anything after sql in the defaults file then it will continue on to try and authenticate against another module. Below you can see a simple query with 'blake' being sent as both the user-name and password. It queries the db and finds it (as expected). However it continues to go to ldap and tries to find it to which I get an error. I understand that I don't have ldap working properly right now. However, first I just want to get the logic setup to where after finding a name in mysql it will stop and reply back with an Access-Accept and not query ldap. Is there a setting you have to put in a conf file? rad_recv: Access-Request packet from host 10.220.1.107 port 52258, id=10, length=45 User-Name = "blake" User-Password = "blake" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "blake", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> blake [sql] expand: %{%{User-Name}:-DEFAULT} -> blake [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> blake [sql] sql_set_user escaped user --> 'blake' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'blake' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'blake' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'blake' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'blakegroup' ORDER BY id [sql] User found in group blakegroup [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'blakegroup' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [ldap] performing user authorization for blake [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> blake [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=blake) [ldap] expand: o=My Org,c=UA -> o=My Org,c=UA [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.193.0.90:389, authentication 0 [ldap] bind as CN=srvacct,OU=misc,OU=TechAdmin,OU=District,OU=Staff,DC=crcsd,DC=abc/ to 10.193.0.90:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in o=My Org,c=UA, with filter (uid=blake) [ldap] ldap_search() failed: Operations error [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> blake attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.7 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 10 to 10.220.1.107 port 52258 Waking up in 4.9 seconds. Cleaning up request 0 ID 10 with timestamp +3 Ready to process requests. Thanks in advance! -b

2 2

Freeradius and EAP_TLS Problem:
by Armin Maier 23 Jan '13

23 Jan '13

Hello! I have been using Windows 7, Freeradius 2.1.10 from Debian Squeeze, HP MSM710 WLAN controller and EAP_TLS Computer Certificate Authentication for a log time and worked perfect. I used Certificates created on the Debian server by openssl including the extensions for Client Authentication and Server Authentication. Now we want to activate port security on our physical switches and use the same radius server, so we installed a Windows Enterprise Root CA for autoenrollment of the Client and server certificates. I also created an RAS IAS Certificate for the Radius Server and installed them, they are loaded without any problems, but authentication of the Windows 7 client do not work anymore. I searched the internet for a compareable setup but i cannot find any hints for using Microsoft Enterprise CA with freeradius server, may everywhere else it works like a charm :) , but cannot believe it! So my first question, does someone use Microsoft Enterprise CA Certificates with freeradius in a working environment, and o i have to regard something special? Running "freeradius -X" gives me the following errors: ... Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 95 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 005a], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 08d7], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0062], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled ... I updated to Debian wheezy to get a newer freeradius version, but nothing changed. The Radius Server Certificate include the following Attribute (output of "openssl x509 -text -in <cert> -noout"): X509v3 extensions: X509v3 Key Usage: Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Subject Key Identifier: 1D:22:6F:1B:8B:F9:DE:C7:D2:FC:8A:17:97:87:EA:8B:D0:0D:27:31 X509v3 Authority Key Identifier: keyid:0F:BB:BB:14:63:C3:07:52:CE:D9:74:94:6A:83:83:45:A4:94:2A:5B Authority Information Access: CA Issuers - URI:ldap:///CN=xxx%20Certificate%20Services%20A,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=xxx,DC=xx?cACertificate?base?objectClass=certificationAuthority 1.3.6.1.4.1.311.21.7: 0..&+.....7.....c..;.......^...S.*..........d... 1.3.6.1.4.1.311.21.10: 0.0 ..+.......0 ..+....... The Client Certificates include the following Attributes: Key usage: Digital Signature, Key Encipherment (a0) Enhanded Key Usage: Client Authentication (1.3.6.1.5.5.7.3.2) The client attributes also include - Authority Information Access - CRL Distribution Points - Certificate Template Information which have very long values with special caracters like _%/=:?, may this be a problem?

2 2