October 2017 - Freeradius-Users - lists.freeradius.org

allow_expired_crl
by Jonathan Gazeley 02 Oct '17

02 Oct '17

Hi folks, I maintain a Puppet module which manages FreeRADIUS deployments[1]. A user has opened a feature request asking me to add support for the undocumented boolean "allow_expired_crl"[2]. While I like to be as helpful as I can be when improving my module, is it really a good idea to use undocumented features, and to appear to encourage others to do so? Is use of this setting supported in any way? [1] https://github.com/djjudas21/puppet-freeradius [2] https://github.com/FreeRADIUS/freeradius-server/search?utf8=%E2%9C%93&q=all… Thanks, Jonathan

2 1

Freeradius issues related with DMZ firewall
by Ramon Escriba 02 Oct '17

02 Oct '17

Hi Experts, I have a 'funny' problem with my freeradius 3.0.4 and our Aruba controller. I am testing a freeradius with 802.1x (EAP-MSCHAPv2: WPA2-Ent+AES+PEAP) configuration that works pretty well when both, radius & Aruba, are in our internal network. So works fine with Mac,Win7,Android,iphone, etc The problem came when we moved the Machine to DMZ (Pfsense fw). Lots of small problems (dns's, hosts,etc) raised and were solved. I used the eapol_test successfully on an internal linux that connects successfully to de radius in DMZ, so I went ahead. But when we do the same Mac,Win7,Android,etc WiFIi connection tests with the radius in DMZ, the authentication fails (see radius -X log below). To test if it was a Firewall issues, UDP/TCP ports are fully open between radius(DMZ) & Aruba(internal), in both ways. We opened dmz radius to the internal DNS, I used a Firewall catch all rule to get any ipv4+6 that goes missing by the Firewall rules, but nothing shows up. I tried to Wireshark the Wifi connection from the client win7 without success. Well, I hope someone else had a similar problem and could share the solution, or any clue. Logs of the failing connection ( Win7 -> Aruba ->radius DMZ) , maybe you can see something strange: 10.10.10.10: Aruba 84.84.84.84: Radius at DMZ Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 User-Name = 'test(a)acme.com' NAS-IP-Address = 10.10.10.10 NAS-Port = 0 NAS-Identifier = '10.10.10.10' NAS-Port-Type = Wireless-802.11 Calling-Station-Id = 'A4C494Exxxxx' Called-Station-Id = '000B866xxxxx' Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0xx400xxxxxx146xxxxxxxxxxxc673 Aruba-Essid-Name = 'TEST_SSID' Aruba-Location-Id = 'AP1' Aruba-AP-Group = 'default' Message-Authenticator = 0xbxxx268xxxxxxxxxxxxc10f08dae88 (0) Received Access-Request packet from host 10.10.10.10 port 32866, id=111, length=205 (0) User-Name = 'test(a)acme.com' (0) NAS-IP-Address = 10.10.10.10 (0) NAS-Port = 0 (0) NAS-Identifier = '10.10.10.10' (0) NAS-Port-Type = Wireless-802.11 (0) Calling-Station-Id = 'A4C494XXXXXX' (0) Called-Station-Id = ''000B86xxxxxx' (0) Service-Type = Login-User (0) Framed-MTU = 1100 (0) EAP-Message = 0x02040019017465xxxxxxxxxxxx4063656c6c732e6573 (0) Aruba-Essid-Name = 'TEST_SSID' (0) Aruba-Location-Id = 'AP1' (0) Aruba-AP-Group = 'default' (0) Message-Authenticator = 0xb268fe2779551dxxxxxxxxxxxx08dae88 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addres s}}/auth-detail-%Y%m%d (0) auth_log : --> /var/log/radius/radacct/10.10.10.10/auth-detail-20170929 (0) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addres s}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.10.10.10/auth-detail-20170929 (0) auth_log : EXPAND %t (0) auth_log : --> Fri Sep 29 16:42:40 2017 (0) [auth_log] = ok (0) [mschap] = noop (0) suffix : Checking for suffix after "@" (0) suffix : Looking up realm "acme.com" for User-Name = "test(a)acme.com" (0) suffix : Found realm "acme.com" (0) suffix : Adding Realm = "acme.com" (0) suffix : Authentication realm is LOCAL (0) [suffix] = ok (0) eap : Peer sent code Response (2) ID 4 length 25 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Peer sent method Identity (1) (0) eap : Calling eap_peap to process EAP data (0) eap_peap : Flushing SSL sessions (of #0) (0) eap_peap : Initiate (0) eap_peap : Start returned 1 (0) eap : New EAP session, adding 'State' attribute to reply 0x7317e1da7312f877 (0) [eap] = handled (0) } # authenticate = handled (0) Sending Access-Challenge packet to host 10.10.10.10 port 32866, id=111, length=0 (0) EAP-Message = 0x010500061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x7317e1da7312f877fca7b6e2bbfa846d Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 EAP-Message = 0x010500061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7317e1da7312f877fca7b6e2bbfa846d (0) Finished request Waking up in 0.3 seconds. Waking up in 6.6 seconds. Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 Waking up in 999993.0 seconds. Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 Waking up in 1999986.0 seconds. Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 Waking up in 3999977.0 seconds.

2 1

I want change reply-message for all users
by تعلم البرمجة 02 Oct '17

02 Oct '17

hello iam using freeradius 3.0.11 and i want change reply message Hello $(user-name) for All clients I am using sql i can change when reject but when accept I cant Sorry For My English

3 9

ERROR: ^ Invalid variable expansion 3.0.11
by تعلم البرمجة 01 Oct '17

01 Oct '17

Hello , I am Using freeradius 3.0.11 and send attributes to php page and get this error Executing: /usr/bin/php5 /var/www/html/new/set_idle_timeout.php %{User-Name} %{User-Password} %{Framed-IP-Address} %(Calling-Station-Id) 7 : (0) EXPAND %{User-Name} (0) --> 12 (0) EXPAND %{User-Password} (0) --> (0) EXPAND %{Framed-IP-Address} (0) --> 10.40.47.250 (0) ERROR: %(Calling-Station-Id) (0) ERROR: ^ Invalid variable expansion Sorry If my english is bad

3 4

add attribute FreeRADIUS-Client-NAS-Type in req accounting?
by Dmitry Yashin 01 Oct '17

01 Oct '17

hi, how i can add attribute FreeRADIUS-Client-NAS-Type in accounting, i load &FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE host = '%{Packet-Src-IP-Address}'}" from dynamic_clients , and in preacct { update request { &Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" &FreeRADIUS-Client-NAS-Type := &control:FreeRADIUS-Client-NAS-Type } } accounting { # ok rest } but in post on rest not see FreeRADIUS-Client-NAS-Type in log Thu Sep 28 21:40:30 2017 : Debug: (324) # Executing section preacct from file /etc/raddb/radiusd.conf Thu Sep 28 21:40:30 2017 : Debug: (324) preacct { Thu Sep 28 21:40:30 2017 : Debug: (324) update request { Thu Sep 28 21:40:30 2017 : Debug: (324) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} Thu Sep 28 21:40:30 2017 : Debug: (324) --> 9f7d7ee63b81739f567f5703597b1556 Thu Sep 28 21:40:30 2017 : Debug: (324) &Acct-Unique-Session-Id := 9f7d7ee63b81739f567f5703597b1556 Thu Sep 28 21:40:30 2017 : Debug: (324) No attributes updated Thu Sep 28 21:40:30 2017 : Debug: (324) No attributes updated Thu Sep 28 21:40:30 2017 : Debug: (324) No attributes updated Thu Sep 28 21:40:30 2017 : Debug: (324) } # update request = noop Thu Sep 28 21:40:30 2017 : Debug: (324) } # preacct = noop Thu Sep 28 21:40:30 2017 : Debug: (324) # Executing section accounting from file /etc/raddb/radiusd.conf Thu Sep 28 21:40:30 2017 : Debug: (324) accounting { Thu Sep 28 21:40:30 2017 : Debug: (324) modsingle[accounting]: calling rest (rlm_rest)

2 3