November 2013 - Freeradius-Users - lists.freeradius.org

Password script
by Miroslav Lednicky 13 Nov '13

13 Nov '13

Hello, I have Freeradius 2.1.10. I need use script for getting cleartext passwords from external system. I try this in authorize section: update control { Cleartext-Password = `%{exec:/usr/local/bin/my-script %{User-Name}}` } But in freeradius -X is: Executing /usr/local/bin/my-script %{User-Name} expand: %{User-Name} -> testuser result 0 expand: %{exec:/usr/local/bin/my-script %{User-Name}} -> Exec-Program output: Exec-Program: FAILED to execute : No such file or directory Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute : No such file or directory Exec-Program: returned: 1 But it is not true: ls -l /usr/local/bin/my-script -rwxr-xr-x 1 root root 580 Nov 13 14:08 /usr/local/bin/my-script Please, help me, what can be wrong? Thank you, Miroslav

3 3

attrs.filter differences between FR 2.2.0 and FR 3
by Palmer J.D.F. 13 Nov '13

13 Nov '13

Hello, I'm just putting together a dev install of FR3 but am struggling with porting the attribute filter for post-proxy. In FR 2.2.0 I have the section below is in my attrs.post-proxy file, which matches Access-Accept packets from the jrs realm, i.e. when a visiting eduroam user authenticates successfully. Access-Accept.jrs User-Name =* ANY, Reply-Message =* ANY, State =* ANY, Class =* ANY, ... However, in FR 3 the Access-Accept not matched, the section it is only matched if I remove the Access-Accept to just leave the realm. The file is located at /usr/local/raddb/mods-config/attr_filter/post-proxy And I've added the following section to /usr/local/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = ${modconfdir}/${.:name}/post-proxy } Is this feature no longer available, or am I missing something? Many thanks, Jezz. Jezz Palmer Information Services and Systems Swansea University Singleton Park Swansea SA2 8PP

5 13

Post-Proxy-Type Reject handling
by Julius Plenz 13 Nov '13

13 Nov '13

Hi, I'm a little bit confused by the change introduced in commit 4b9d325515 ("Set Post-Proxy-Type Reject if the request was rejected by the proxy server") from 19 Dec 2012. I think most users, including me, expect that a Reject reply received from a remote RADIUS server is automatically forwarded by the mediating RADIUS server to the client. But it seems this patch changes the default behaviour. What I'm seeing is that such a Reject reply will be silently discarded and *not* forwarded to the client. This may break a few setups. Sadly, the Post-Proxy-Type "Reject" is not even mentioned anywhere in the example config files. Especially I would suggest adding a hint akin to the "Fail" case in "raddb/sites-available/default". What is the correct move to make FreeRADIUS behave like pre-2.2.1, i.e. just forwarding the proxy reply? I'm guessing I should duplicate my "post-proxy" modules again inside a Post-Proxy-Type Reject {} stanza? Thank you, Julius

4 9

Question about how to find unfinished requests
by John Douglass 13 Nov '13

13 Nov '13

I am trying to debug an issue on my servers with the following configuration: freeradius 2.2.0 -> proxy to AD server running radius for auth -> return auth (yes/no) then my server appends the necessary vlan attributes from its local DB I am seeing a number of these messages: Nov 11 17:57:31 dvlanc radiusd[17781]: Received conflicting packet from client resnet4-WiSM-A port 32770 - ID: 18 due to unfinished request 928878. Giving up on old request. Nov 11 17:57:35 dvlanc radiusd[17781]: Received conflicting packet from client Rich-core-WiSM-B port 32770 - ID: 205 due to unfinished request 929613. Giving up on old request. Nov 11 17:57:37 dvlanc radiusd[17781]: Received conflicting packet from client Rich-core-WiSM-B port 32770 - ID: 36 due to unfinished request 929843. Giving up on old request. Nov 11 17:57:41 dvlanc radiusd[17781]: Received conflicting packet from client Rich-core-WiSM-B port 32770 - ID: 205 due to unfinished request 930139. Giving up on old request. Nov 11 17:57:41 dvlanc radiusd[17781]: Received conflicting packet from client Rich-core-WiSM-B port 32770 - ID: 216 due to unfinished request 929934. Giving up on old request. Nov 11 17:57:44 dvlanc radiusd[17781]: Received conflicting packet from client resnet4-WiSM-A port 32770 - ID: 253 due to unfinished request 929666. Giving up on old request. Nov 11 17:57:44 dvlanc radiusd[17781]: Received conflicting packet from client Rich-core-WiSM-B port 32770 - ID: 36 due to unfinished request 930099. Giving up on old request. How do I view "into the beast" to find the start of these requests? For example, I see no way to locate the stream of events for request 928878 so that I can narrow down where the problem is. My gut says it's located down the chain at the AD server (accessed via the radius protocol) taking too long but I have to prove it before I can get some action. Would tcpdump/tshark/etc be the way to attempt to follow these authentications or is there a better way with some enhanced logging parameters? If we know the request numbers, how do you pair those with any internal logging (via maybe radmin). It would be useful if, say, all log messages like Nov 11 17:57:21 dvlanc radiusd[17781]: Login OK: [mbaker66] (from client Rich-core-WiSM-B port 13 cli e0-c9-7a-55-9b-f5) Nov 11 17:57:21 dvlanc radiusd[17781]: Login OK: [fpeterson99] (from client resnet4-WiSM-A port 13 cli a8-96-8a-f3-5f-5b) Nov 11 17:57:21 dvlanc radiusd[17781]: Login OK: [gabriwal3] (from client resnet4-WiSM-A port 13 cli 3c-d0-f8-61-f3-27) included the request numbers in their logging output (or actually ANY log messages should include the request number it is involved in). We are having some major problems as the freeradius server gets hit with load between classes and starts losing auth. We are attempting to remove the dependence upon samba by going with configuring a proxy to AD over radius for authentication rather than rely upon an ntlm_auth. Thanks for any input/advice.

5 5

Problem with using MySQL for radius clients
by Mik J 10 Nov '13

10 Nov '13

Hello, I know that by default you configure your radius clients in the file /etc/raddb/clients.conf However I would like them to be entered in MySQL I have modified the file /etc/raddb/sites-enabled/default and I expect the Freeradius server to check the clients in MySQL instead of clients.conf authorize { sql #files } And added an input into the nas table INSERT INTO nas VALUES (NULL , '192.168.0.1', 'myNAS', 'other', NULL , 'mysecret', NULL , NULL , 'RADIUS Client' ); Unfortunately this doesn't work because 1) $ radtest testuser passsecret 127.0.0.1 1812 testing123 <= works and testing123 is what is specified in clients.conf 2) $ radtest testuser passsecret 127.0.0.1 1812 mysecret <= doesn't work and what's specified in the nas table Since I have commented "files" I would also expect the freeradius server not to check clients.conf Could someone point out my misunderstanding ? Thank you

3 5

Populate an array with several accounts from radcheck.
by Alexander Silveröhrt 09 Nov '13

09 Nov '13

Hiya, I have a problem with the time it takes to initiate the DBI connection in a pre_auth script hook using rlm_perl. This is the time recorded for some parts in the code. rlm_perl: DEBUG: Time between DBI initialization start and DBI initialization stop was: 0.013145! rlm_perl: DEBUG: Time between SQL Query LIKE start and SQL Query LIKE stop was: 0.001079! rlm_perl: DEBUG: Time between SCRIPT start and SCRIPT stop was: 0.014898! I was hoping to be able to cut off a lot of time by using freeradius already open MYSQL connection and make a SQL QUERY in ulang and populate an ARRAY with the result from a SQL LIKE query. And from that QUERY then use the SQL result in the ARRAY attribute inside the perl script instead of letting the script do a database query? Today in the perl hook the query is and it should be the same when using ulang. $sth = $dbh->prepare("SELECT DISTINCT username FROM radcheck where username LIKE '$SUBSCRIBER_ACCOUNT%'"); where $SUBSCRIBER_ACCOUNT% is the received USERNAME. The SQL result could be anything from 1 account to 8 accounts for instance +----+----------------------------------------+-----------+----+--------+ | id | username | attribute | op | value | +----+----------------------------------------+-----------+----+--------+ | 17 | 10.33.1.4_GigabitEthernet0/0/2 CH_VoIP | Auth-Type | := | Accept | | 18 | 10.33.1.4_GigabitEthernet0/0/2 CH_IPTV | Auth-Type | := | Accept | | 19 | 10.33.1.4_GigabitEthernet0/0/2 | Auth-Type | := | Accept | +----+----------------------------------------+-----------+----+--------+ We have tried several ways and tried to find any references in the manual to populate ARRAYs to be able to do this but when we try the resulting variable only contains one account? And also where should we put the query to be able to use the SQL result in the pre-auth script.? Should it be in servers sites-available/sitename before the perl call? I hope someone can help. Thanks Alex ********* DISCLAIMER ********* This message and any attachment are confidential and may be privileged or otherwise protected from disclosure and may include proprietary information. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person

2 1

Help
by Wederson Rodrigues 09 Nov '13

09 Nov '13

Hi guys, I need to release the authentication (no username and password) for certain realm (anything @ domain1 connect with any username and password. domain2 users continue normally. Is it possible? -- []'s ----------------------------------------- .'. Wederson Rodrigues .'. (CeBoLaRk) VIP - Vilhena Internet Provider Gerente de T.I. http://www.vipvilhena.com.br MSN: cebolark(a)hotmail.com SKYPE: cebolark EMAIL: wederson(a)vipvilhena.com.br INOC VOIP: 28240*100 Celular: 0xx69 8437-0186 Fixo: 0xx69 3322-2244 -----------------------------------------

2 1

chain certificate problem
by Thierry Chich 08 Nov '13

08 Nov '13

Hello, I have a problem with the certificate I use for my eap-peap. It seems that the certificate is not recognized. What I know: 1) the chain is complete : radius:/etc/freeradius/certs# c_rehash certificatAP/ ... radius:/etc/freeradius/certs# openssl verify -CApath certificatAP/ certificatAP/certificat20sept2014.pem certificatAP/certificat20sept2014.pem: OK 2) it is a problem of certificate: windows accept to connect if I ask him to not vaidate the certificate server. With other os than windows, I have more details. OSX is claiming that my certificate is not verified. It is not OS related. 3) The root certificate is accepted in both OS. What the point ? Should I have all the intermediate certificate in the store of my clients ? Is it a way to present the whole chain to the client, the same way it can be done by http servers ? Regards, -- Thierry CHICH

4 6

fr 3.0.0 - peap problem
by Polish 08 Nov '13

08 Nov '13

Hello all, I want to test new features of freeradius 3.0.0 from tarball, but I don't be able run successfull PEAP - MS-CHAPv2 authentization. Testing environment: freeradius 3.0.0 local user in users file (cleartext password: ferda Cleartext-Password := "hello") testing certificates generated by bootstrap Result in debug log: (12) eap_peap : Tunneled authentication was successful. (12) eap_peap : SUCCESS (12) eap : New EAP session, adding 'State' attribute to reply 0xbb50c041b359d9c3 (12) [eap] = handled (12) } # authenticate = handled ... 13) # Executing group from file /etc/freeradius/sites-enabled/default (13) authenticate { (13) eap : Expiring EAP session with state 0xbb50c041b359d9c3 (13) eap : Finished EAP session with state 0xbb50c041b359d9c3 (13) eap : Previous EAP request found for state 0xbb50c041b359d9c3, released from the list (13) eap : Peer sent PEAP (25) (13) eap : EAP PEAP (25) (13) eap : Calling eap_peap to process EAP data (13) eap_peap : processing EAP-TLS (13) eap_peap : eaptls_verify returned 7 (13) eap_peap : Done initial handshake (13) eap_peap : eaptls_process returned 7 (13) eap_peap : FR_TLS_OK (13) eap_peap : Session established. Decoding tunneled attributes. (13) eap_peap : Peap state send tlv success (13) eap_peap : EAP type NAK (3) (13) eap_peap : We sent a success, but received something weird in return. SSL: Removing session 370322346fc943fdb1aad36f4480d755e0cbe3cea31c375242d599bc8f16ad4e from the cache (13) ERROR: eap : Failed continuing EAP PEAP (25) session. EAP sub-module failed (13) eap : Failed in EAP select (13) [eap] = invalid (13) } # authenticate = invalid (13) Failed to authenticate the user. radtest results: # test of inner-tunnel root@ferda:/etc/freeradius# radtest ferda hello localhost:18120 0 testing123 Sending Access-Request of id 124 from 0.0.0.0 port 51463 to 127.0.0.1 port 18120 User-Name = 'ferda' User-Password = 'hello' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 rad_recv: Access-Accept packet from host 127.0.0.1 port 18120, id=124, length=20 root@ferda:/etc/freeradius# radtest -t mschap ferda hello localhost:18120 0 testing123 Sending Access-Request of id 207 from 0.0.0.0 port 56629 to 127.0.0.1 port 18120 User-Name = 'ferda' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0xcf018e925195d3d9 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000c1dbccbde8a3f351c6abf211ec362574a0791cbeb4d5e93a rad_recv: Access-Accept packet from host 127.0.0.1 port 18120, id=207, length=84 MS-CHAP-MPPE-Keys = 0xfda95fbeca288d44ac0782e2de2337dee40e54ee732c1af5 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed # test on default port root@ferda:/etc/freeradius# radtest ferda hello localhost 0 testing123 Sending Access-Request of id 34 from 0.0.0.0 port 58221 to 127.0.0.1 port 1812 User-Name = 'ferda' User-Password = 'hello' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=34, length=20 root@ferda:/etc/freeradius# radtest -t mschap ferda hello localhost 0 testing123 Sending Access-Request of id 58 from 0.0.0.0 port 50981 to 127.0.0.1 port 1812 User-Name = 'ferda' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x3391672449586edb MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000cd40eb3770183e9a6ee3cc67da194680f1abb095c7561f41 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=58, length=84 MS-CHAP-MPPE-Keys = 0xfda95fbeca288d44ac0782e2de2337dee40e54ee732c1af5 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed I don't know where is problem. Thanks for tips and advises. Best regards Pavel Polacek

4 7

validate server certificate fails
by Khapare Joshi 08 Nov '13

08 Nov '13

I have tested selfsing certificate, it works. I had to copy the ca.cert into windows client. Pretty much what this link describes. http://kirkkosinski.com/2012/10/securing-wi-fi-with-peap-and-freeradius-on-… Now, i have signed certificate from our CA added into eap.conf then imported ca.pem into windows machine. 7 machine and try to authenticate, it always fails. but If I check off the validate server certificate on M$$$$$client machine it works. I have following in my eap.conf tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/myhost.example.key certificate_file = ${certdir}/myhost.example.crt CA_file = ${certdir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } freeradius version is freeradius-2.1.10-5.el6.x86_64 and Red Hat Enterprise Linux Server release 6.1 This M$ is giving me nightmare :) any idea on this would be great

2 2