June 2015 - Freeradius-Users - lists.freeradius.org

Unknown module "clients"
by Stefano Zanmarchi 23 Jun '15

23 Jun '15

Hello, I'm performing some filtering, based on the client, in the authorize section of inner-tunnel: authorize { preprocess rewrite.calling_station_id if ("%{clients:shortname}" =~ /internal_radius_(.*)/i) { ok update control { Auth-Type := Accept } } ... } The output logs in debug mode show the following warning: .. ++? if ("%{clients:shortname}" =~ /internal_radius_(.*)/i) WARNING: Unknown module "clients" in string expansion "%" .. Does this mean that the 'if ("%{clients:shortname}"...' clause is not being evaluated? How can I solve the problem generating the warning? Thank you, Stefano

3 3

Service-Type
by Randeep 23 Jun '15

23 Jun '15

Hi, What is the actual use of Service-Type. For PPP we need to give Service-Type = Framed-User and for hotspot we need to give Service-Type = Login ? Also the usergroupreply parameters for PPP and Hotspot will be same or we need to specify separate? Please advice. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 3

Logrotate for FreeRadius 3.0.8
by Sunil Kulkarni -X (sunikulk - PERSISTENT SYSTEMS INC at Cisco) 23 Jun '15

23 Jun '15

Hello All, I am using FreeRadius 3.0.8. To setup the log rollover, I did the following steps. 1. Copy the attached radius file into /etc/logrotate.d/radius 2. Attached radius file contains information about the log. I am expected logrotate will create a log file on daily basis, because global setting in radiusd file is daily. But log file is not created on daily basic. When I have executed radiusd forcefully using logrotate -v -f /etc/logrotate.d/radiusd command. It is created compressed file and create a new log for logging. Am I missing anything in configuration? --- Thanks, Sunil Kulkarni

3 2

Authenticate to LDAP with GSSAPI
by William 22 Jun '15

22 Jun '15

Hi, I have researched this topic and am unable to find examples or previous mailing lists queries about this specific issue. My issue is NOT using GSSAPI/krb5 to authenticate users and LDAP for user details. I have LDAP for authentication and user details with EAP, but I wish for the radiusd ldap connections to authenticate to the ldap server with GSSAPI (IE keytab / service account). The equivalent commands in userspace is: ldapsearch -Y GSSAPI '(objectClass=*)' I am unable to find references in the documentation as to how to achieve this. For example my current setup is: mods-enabled/ldap ldap { # ... snip ... identity = "krbprincipalname=radius/example.com,cn=services,cn=accounts,dc=example ,dc=com" password = foo } I would hopefully aim to have something akin to: ldap { # ... snip ... identity = "krbprincipalname=radius/example.com,cn=services,cn=accounts,dc=example ,dc=com" krb5_keytab = /etc/raddb/krb5.keytab krb5_principal = radius/example.com } Or even a combination of the keytab settings in mods-enabled/krb5 and mods-enabled/ldap. Does anyone have any experience with such configuration or whether freeradius supports the behaviour I would like to achieve? Sincerely, William

6 35

Setting up centralized authentication for Linux SSH users
by Daniel Bray 22 Jun '15

22 Jun '15

I'm starting to wonder if I've selected the wrong tool for the job here. Hoping to gather some guidance, and help. The environment is 99% Linux servers with various Cisco equipment. I was thinking that a Freeradius solution would be a simple approach to get all the SSH devices (Linux and Cisco) pointing to a single server for authentication purposes. I would also like to setup groups, so that our Vendors that also require SSH access can be setup and assigned to specific groups that then can only SSH into specific servers. Am I heading in the right direction by selecting Freeradius to do this job? Here comes the issues I face. I got everything setup on a Linux server, and using MySQL as the backend. I'm also using daloRADIUS as the web frontend for management. I was able to get the test Linux servers PAM configured to point to the Freeradius server, and I can authenticate myself, and the other admins. However, it appears that, by default, all users can SSH into any of the NAS devices I've configured. This is the main issues I'm trying to solve. How, exactly, do I configure Freeradius to only allow certain vendor accounts SSH access into specific NAS devices? Thank you

3 7

radiusd debug understanding help needed (EAP session for state 0x... did not finish)
by Zeus Panchenko 22 Jun '15

22 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, please, help me to be sure I understand `radiusd -X' output right way ... some period of time, FR with EAP-TLS + LDAP was working in "test mode" ... now it is not and I'm trying to understand why FR: server is v.2.2.6 on FreeBSD 10.1R WS: wpa_supplicant client on FreeBSD 10.1R network (LAN) topology: FR <-> 100Mb Switch <-> WS FR configured with EAP + LDAP and EAP/md5 for MAC auth works fine. but EAP/tls spawns: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x8c1a57f7885a5afa did not finish! WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! on this wiki page for this case it is told: - - Follow the instructions given above. it is what I have folowed - - Consider to decreasing the tunnel MTU there is no tunnel, but decreasing MTU on NIC didn't help last time I faced this very problem on my VPN and MTU decreasing to 1250 helped well, but now it is not ... in `radiusd -X' I see this: - ---[ quotation start ]------------------------------------------- ... [files] expand: %{User-Name}, you have came from %{NAS-IP-Address} copper port %{NAS-Port}. -> jdoe-eap, you have came from 192.168.0.1 copper port 14. ++[files] = ok ++[expiration] = noop ++[logintime] = noop ++[pap] = noop [ldap] performing user authorization for jdoe-eap [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> jdoe-eap [ldap] expand: (&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(|(authorizedService=802.1x-mac@xyz)(authorizedService=802.1x-eap@xyz)(authorizedService=802.1x@xyz))) -> (&(cn=jdoe-eap)(|(autho rizedService=802.1x-mac@xyz)(authorizedService=802.1x-eap@xyz)(authorizedService=802.1x@xyz))) [ldap] expand: ou=People,dc=xyz -> ou=People,dc=xyz [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=xyz, with filter (&(cn=jdoe-eap)(|(authorizedService=802.1x-mac@xyz)(authorizedService=802.1x-eap@xyz)(authorizedService=802.1x@xyz))) [ldap] performing search in cn=ethernet,ou=rad-profiles,dc=xyz, with filter (objectclass=radiusprofile) [ldap] radiusTunnelMediumType -> Tunnel-Medium-Type:0 = IEEE-802 [ldap] radiusTunnelType -> Tunnel-Type:0 = VLAN [ldap] radiusSessionTimeout -> Session-Timeout = 900 [ldap] looking for check items in directory... [ldap] userPassword -> Cleartext-Password == "jdoe-eap" [ldap] userPassword -> Password-With-Header == "jdoe-eap" [ldap] looking for reply items in directory... [ldap] radiusTunnelPrivateGroupId -> Tunnel-Private-Group-Id:0 = "3495" [ldap] radiusTunnelMediumType -> Tunnel-Medium-Type:0 = IEEE-802 [ldap] radiusTunnelType -> Tunnel-Type:0 = VLAN [ldap] radiusServiceType -> Service-Type = Framed-User [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok - ---[ quotation end ]------------------------------------------- so, am I correct? here it is written that LDAP auth performed successfully further: - ---[ quotation start ]------------------------------------------- ++? if (notfound) ? Evaluating (notfound) -> FALSE ++? if (notfound) -> FALSE ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled ... - ---[ quotation end ]------------------------------------------- what does these rows mean? - ---[ quotation start ]------------------------------------------- [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled - ---[ quotation end ]------------------------------------------- wpa_supplicant debug shows this: - ---[ quotation start ]------------------------------------------- ... 1434988426.933490: SSL: (where=0x1001 ret=0x1) 1434988426.933492: SSL: SSL_connect:SSLv3 read server hello A 1434988426.933731: TLS: tls_verify_cb - preverify_ok=1 err=0 (ok) ca_cert_verify=1 depth=1 buf='/C=AU/ST=SDN/L=Sidney/O=RADIUS/OU=RADIUS/CN=changeme/emailAddress=security@xyz' 1434988426.933736: igb0: CTRL-EVENT-EAP-PEER-CERT depth=1 subject='/C=AU/ST=SDN/L=Sidney/O=RADIUS/OU=RADIUS/CN=xyz-ca/emailAddress=security@xyz' 1434988426.933738: EAP: Status notification: remote certificate verification (param=success) 1434988426.933814: TLS: tls_verify_cb - preverify_ok=1 err=0 (ok) ca_cert_verify=1 depth=0 buf='/C=AU/ST=SDN/L=Sidney/O=RADIUS/OU=RADIUS/CN=office1.xyz/emailAddress=security@xyz' 1434988426.933818: igb0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/C=AU/ST=SDN/L=Sidney/O=RADIUS/OU=RADIUS/CN=office1.xyz/emailAddress=security@xyz' 1434988426.934102: EAP: Status notification: remote certificate verification (param=success) 1434988426.934106: SSL: (where=0x1001 ret=0x1) 1434988457.029252: SSL: SSL_connect:SSLv3 write finished A 1434988457.029254: SSL: (where=0x1001 ret=0x1) 1434988457.029255: SSL: SSL_connect:SSLv3 flush data 1434988457.029257: SSL: (where=0x1002 ret=0xffffffff) 1434988457.029258: SSL: SSL_connect:error in SSLv3 read finished A 1434988457.029260: SSL: SSL_connect - want more data 1434988457.029262: SSL: 2750 bytes pending from ssl_out 1434988457.029264: SSL: 2750 bytes left to be sent out (of total 2750 bytes) 1434988457.029266: SSL: sending 1398 bytes, more fragments will follow 1434988457.029268: EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL 1434988457.029270: EAP: EAP entering state SEND_RESPONSE 1434988457.029272: EAP: EAP entering state IDLE 1434988457.029273: EAPOL: SUPP_BE entering state RESPONSE 1434988457.029274: EAPOL: txSuppRsp 1434988457.029276: TX EAPOL: dst=01:80:c2:00:00:03 1434988457.029278: TX EAPOL - hexdump(len=1412): 01 00 ... ... 1 09 01 16 0c 73 65 63 75 72 69 74 79 40 69 62 73 30 1e 17 0d 31 34 30 33 31 30 31 1434988457.030267: EAPOL: SUPP_BE entering state RECEIVE ... 1434989781.980570: igb0: RX EAPOL from 34:db:fd:81:43:2b 1434989781.980571: RX EAPOL - hexdump(len=46): 01 00 00 04 04 cf 00 04 00 00 ... 1434989781.980579: EAPOL: Received EAP-Packet frame 1434989781.980580: EAPOL: SUPP_BE entering state REQUEST 1434989781.980581: EAPOL: getSuppRsp 1434989781.980582: EAP: EAP entering state RECEIVED 1434989781.980584: EAP: Received EAP-Failure 1434989781.980585: EAP: Status notification: completion (param=failure) 1434989781.980587: EAP: EAP entering state FAILURE 1434989781.980589: igb0: CTRL-EVENT-EAP-FAILURE EAP authentication failed 1434989781.980590: EAPOL: SUPP_PAE entering state HELD 1434989781.980591: EAPOL: Supplicant port status: Unauthorized 1434989781.980593: EAPOL: SUPP_BE entering state RECEIVE 1434989781.980594: EAPOL: SUPP_BE entering state FAIL 1434989781.980595: EAPOL: SUPP_BE entering state IDLE 1434989781.980596: EAPOL authentication completed unsuccessfully ... - ---[ quotation end ]------------------------------------------- looks like OpenSSL related something, is it? so, may somebody advise where to look at? how to know who is guilty? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlWIPOgACgkQr3jpPg/3oyqAegCfVNKW6lZOzF9kFjka1Oi+cOJQ kCsAoNO4YFZzECe011mf1bh9yY3TumW5 =2YxD -----END PGP SIGNATURE-----

1 0

Error binding to 0.0.0.0 port for port 1812
by jose luis sanchez ortiz 22 Jun '15

22 Jun '15

hello friends I'm desperate because I have to support my graduation project in 1 week and the radius server AROJA me this error: Error binding to 0.0.0.0 port for port 1812 I'm using Debian 8 jessie FreeRADIUS Version 2.2.5 only localhost and the server works in clients.conf. radtest project radtest 123 1812 testing123 192.168.0.1 (router) does not work I got the solution "killall freeradius" but I run it stops working the radtest project radtest 123 127.0.0.1 1812 testing123 (localhost) radtest project radtest 123 1812 testing123 192.168.0.2 (server radius ________________________ the ports no listen freeradiu 2478 freerad 39u IPv4 17470 0t0 UDP *:radius freeradiu 2478 freerad 40u IPv4 17471 0t0 UDP *:radius-acct freeradiu 2478 freerad 41u IPv4 17472 0t0 UDP localhost:18120 freeradiu 2478 freerad 42u IPv4 17473 0t0 UDP *:1814 freeradiu 2478 freerad 43u IPv4 17474 0t0 UDP *:34602 thanks in advance. please help me ... and excuse me for my English

8 30

FR3 and EAP-TLS session cache
by Jyri Palis 22 Jun '15

22 Jun '15

Hi, I have been trying to get FR (3.0.4) EAP-TLS session caching to work with ‘check-eap-tls’ virtual server, so far no luck. Initial EAP-TLS session is established correctly and Windows 7 clients get access to protected WLAN but requests following initial request fail to utilise data stored TLS session cache data client is force to proceed with full TLS handshake. Virtual server 'check-eap-tls’ which is configured to verify client certificates fails when cached TLS session calls this method, variables needed for verification are not propagated correctly. server check-eap-tls { authorize { if ("%{TLS-Client-Cert-Subject-Alt-Name-Upn}" =~ /^([a-z0-9]|[\w\.-]?)+\(a)example\.com$/i) { update config { Auth-Type := Accept } } elsif ("%{TLS-Client-Cert-Subject-Alt-Name-Dns}" =~ /^([a-z0-9]|[\w\-]?)+\.example\.com$/i) { update config { Auth-Type := Accept } } else { update config { Auth-Type := Reject } } } This is a fragment from log file: Sun Jun 14 14:56:11 2015 : Auth: (44) Login incorrect (eap: Failed continuing EAP TLS (13) session. EAP sub-module failed): [host/xxxxx.example.com/<via Auth-Type = EAP>] (from client wc-s1-01 port 2 cli 00-24-d7-03-2b-38) Sun Jun 14 14:56:16 2015 : Error: Couldn't open /var/log/radius/tlscache/c0373a395b8cc8bc3bd2fe453c3f235454b5216a47c1cb66e30580cd697033f1.vps for reading: No such file or directory Sun Jun 14 14:56:16 2015 : Auth: (52) Login OK: [host/xxxxx.example.com] (from client wc-s1-01 port 2 cli 00-24-d7-03-2b-38 via TLS tunnel) Sun Jun 14 14:56:16 2015 : Auth: (52) Login OK: [host/xxxxx.example.com] (from client wc-s1-01 port 2 cli 00-24-d7-03-2b-38) So is there a way to check session status in ‘authorize’ block and accept auth when cached TLS session is detected? This is written to stdout when running in debug mode (15) eap_tls : Length Included (15) eap_tls : eaptls_verify returned 11 (15) eap_tls : (other): before/accept initialization (15) eap_tls : TLS_accept: before/accept initialization (15) eap_tls : <<< TLS 1.0 Handshake [length 007c], ClientHello SSL: Client requested cached session f35d02540a8e9c4faf8620dfe25e4e82941192f8686390ec3591df41ba22f967 reading pairlist file /var/log/radius/tlscache/f35d02540a8e9c4faf8620dfe25e4e82941192f8686390ec3591df41ba22f967.vps Couldn't open /var/log/radius/tlscache/f35d02540a8e9c4faf8620dfe25e4e82941192f8686390ec3591df41ba22f967.vps for reading: No such file or directory SSL: could not load persisted VPs for session f35d02540a8e9c4faf8620dfe25e4e82941192f8686390ec3591df41ba22f967 (15) eap_tls : TLS_accept: SSLv3 read client hello A (15) eap_tls : >>> TLS 1.0 Handshake [length 0059], ServerHello (15) eap_tls : TLS_accept: SSLv3 write server hello A (15) eap_tls : >>> TLS 1.0 Handshake [length 0c46], Certificate (15) eap_tls : TLS_accept: SSLv3 write certificate A (15) eap_tls : >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (15) eap_tls : TLS_accept: SSLv3 write key exchange A (15) eap_tls : >>> TLS 1.0 Handshake [length 005b], CertificateRequest (15) eap_tls : TLS_accept: SSLv3 write certificate request A (15) eap_tls : TLS_accept: SSLv3 flush data (15) eap_tls : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode Regards, Jyri.

4 23

Fwd: (0) No reply from server for ID 168 socket 3
by jose luis sanchez ortiz 20 Jun '15

20 Jun '15

---------- Forwarded message ---------- From: jose luis sanchez ortiz <docentesanortiz(a)gmail.com> Date: 2015-06-20 9:12 GMT-05:00 Subject: (0) No reply from server for ID 168 socket 3 To: Freeradius-Devel(a)lists.freeradius.org Hi friend I need help, I finish my graduation project I run radtest and show 3 time Sent Access-Request Id 168 from 0.0.0.0:48323 to 127.0.0.1:1812 length 78 User-Name = 'proyecto' User-Password = '123' NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = '123' (0) No reply from server for ID 168 socket 3 thanks in advance

1 0

Sql counter
by Randeep 20 Jun '15

20 Jun '15

Hi, I'm trying to set maximum data limit for a user. In the /etc/raddb/sql/mysql/counter.conf I have created this. sqlcounter testcounter { counter-name = Max-Data-Used check-name = Max-Data sqlmod-inst = sql key = User-Name reset = daily reply-message = “You have reached your bandwidth limit” sqlmod-inst = sql query = “SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username=’%{%k}'” } } When I checked the accounting flow, the flow is as follows, New acct request -> Preacct ->accounting -> Send response So I tried to put the testcounter in /etc/raddb/sites-enabled/default In preacct and accounting blocks. But it gave me errors Sat Jun 20 13:12:54 2015 : Error: /etc/raddb/sites-enabled/default[389]: "SQL Counter" modules aren't allowed in 'accounting' sections -- they have no such method. Sat Jun 20 13:12:54 2015 : Error: /etc/raddb/sites-enabled/default[382]: Errors parsing accounting section. Also I'm confused about the parameters in the testcounter. We have to declare these two variables anywhere? counter-name = Max-Data-Used check-name = Max-Data Where we can specify the max data limit to the user. Please advice. Also please give some links if you which I can refer. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr

1 1