November 2017 - Freeradius-Users - lists.freeradius.org

is there a way to identify the very first ACCESS-REQUEST
by Michael Hocke 16 Mar '18

16 Mar '18

Hi there, I want to improve our logging and want to keep track of authentication attempts that do not complete. I was thinking of logging the very first ACCESS-REQUEST and then later on the result. Is there a good way to identify the very first ACCESS-REQUEST from the client with unlang? Maybe by checking the contents of the session-state list or some such? Any ideas? Thanks! - Michael

4 6

Cisco-AVPair regex
by Kylián Martin 23 Feb '18

23 Feb '18

Hi all, I'm trying to save some of the Cisco-AVPair attributes into sql while acounting. Specifically, I'm interested in the dhcp-options and http-tlv attributes. WLC describes the connected device in these. Unfortunately, Freeradius 3.12 expands these values unregexable way. (With_cisco_vsa_hack = yes in preprocess the result is the same) Correctly expanded is just Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859" Policy file: device_regex = '^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)' () fill_device_type { if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) { update request { &Calling-Device += "%{8} " } } } } } Processing: (98) Received Accounting-Request Id 28 from 192.168.241.30:57614 to 172.31.12.101:1813 length 482 (98) User-Name = "martin" (98) NAS-Port = 8 (98) NAS-IP-Address = 192.168.241.30 (98) Framed-IP-Address = 10.252.136.9 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = fe80::/64 (98) NAS-Identifier = "d4-wlc5520" (98) Airespace-Wlan-Id = 20 (98) Acct-Session-Id = "5968a7cb/34:ab:37:ed:a2:bb/90671" (98) NAS-Port-Type = Wireless-802.11 (98) Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859" (98) Acct-Authentic = RADIUS (98) Tunnel-Type:0 = VLAN (98) Tunnel-Medium-Type:0 = IEEE-802 (98) Tunnel-Private-Group-Id:0 = "595" (98) Event-Timestamp = "Jul 14 2017 14:47:01 CEST" (98) Cisco-AVPair = "dhcp-option=\000\014\000\0056spMK" (98) Cisco-AVPair = "http-tlv=\000\001\000\030iPhone8,2/10.3.2 (14F89)" How to regex these ? (98) Acct-Status-Type = Interim-Update (98) Acct-Input-Octets = 699538 (98) Acct-Input-Gigawords = 0 (98) Acct-Output-Octets = 2957172 (98) Acct-Output-Gigawords = 0 (98) Acct-Input-Packets = 5974 (98) Acct-Output-Packets = 5319 (98) Acct-Session-Time = 5494 (98) Acct-Delay-Time = 0 (98) Calling-Station-Id = "34-ab-37-ed-a2-bb" (98) Called-Station-Id = "d4-air1702-ap-1:UI MK tst" (98) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (98) preacct { (98) [preprocess] = ok (98) policy rewrite_called_station_id { (98) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { (98) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> FALSE (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) { (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) -> TRUE (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) { (98) update request { (98) EXPAND %{1} (98) --> d4-air1702-ap-1 (98) &Called-Station-Id := d4-air1702-ap-1 (98) EXPAND %{3} (98) --> UI MK tst (98) &Called-Station-SSID := UI MK tst (98) } # update request = noop (98) [updated] = updated (98) } # elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) = updated (98) ... skipping else: Preceding "if" was taken (98) } # policy rewrite_called_station_id = updated (98) policy fill_device_type { (98) if (&Cisco-AVPair) { (98) if (&Cisco-AVPair) -> TRUE (98) if (&Cisco-AVPair) { (98) foreach &Cisco-AVPair (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> audit-session-id=1ef1a8c000014809cba76859 (98) EXPAND %{Foreach-Variable-0} (98) --> audit-session-id=1ef1a8c000014809cba76859 (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> dhcp-option= (98) EXPAND %{Foreach-Variable-0} (98) --> dhcp-option= (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> http-tlv= (98) EXPAND %{Foreach-Variable-0} (98) --> http-tlv= Both attributes are expanded till first whitespace char (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) } # foreach &Cisco-AVPair = updated (98) } # if (&Cisco-AVPair) = updated How to get text values following whitespaces? I've already tried if ("unescape:%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) with no luck Martin Kylián

4 11

FreeRADIUS w/ LDAP and EAP-TLS
by Andrew Meyer 15 Dec '17

15 Dec '17

So yesterday after complicating my configuration I decided to completely start over. I rebuilt the server and got everything work up to the EAP-TLS. While it is clear that it says no "known good" password found, I was able to auth to LDAP prior to turning on EAP-TLS. So I suspect there is something else that I am missing. I am using the certificates that came w/ FreeRADIUS in the /etc/raddb/certs/ folder. I will be generating my own or applying ones from FreeIPA once I get this working. I followed this: http://deployingradius.com/documents/configuration/eap.html https://wiki.alpinelinux.org/wiki/FreeRadius_EAP-TLS_configuration Here is the output from debug: (2) control:Auth-Type := LDAP (2) } # update = noop (2) } # if ((ok || updated) && User-Password) = noop (2) [expiration] = noop (2) [logintime] = noop (2) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (2) pap: WARNING: Authentication will fail unless a "known good" password is available (2) [pap] = noop (2) } # authorize = ok (2) Found Auth-Type = LDAP (2) # Executing group from file /etc/raddb/sites-enabled/default (2) Auth-Type LDAP { rlm_ldap (ldap): Reserved connection (6) (2) ldap: Login attempt by "andrew.meyer" (2) ldap: Using user DN from request "uid=andrew.meyer,cn=users,cn=accounts,dc=meyer,dc=local" (2) ldap: Waiting for bind result... (2) ldap: Bind successful (2) ldap: Bind as user "uid=andrew.meyer,cn=users,cn=accounts,dc=meyer,dc=local" was successful rlm_ldap (ldap): Released connection (6) (2) [ldap] = ok (2) } # Auth-Type LDAP = ok (2) # Executing section post-auth from file /etc/raddb/sites-enabled/default (2) post-auth { (2) update { (2) No attributes updated (2) } # update = noop (2) [exec] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) } # post-auth = noop (2) Sent Access-Accept Id 16 from 10.150.10.45:1812 to 10.150.1.250:53618 length 0 (2) Finished request Waking up in 1.0 seconds. (1) Cleaning up request packet ID 15 with timestamp +68 Waking up in 3.9 seconds. (2) Cleaning up request packet ID 16 with timestamp +72 Ready to process requests

2 1

eap-sim configuration
by Josh toal 05 Dec '17

05 Dec '17

Hi Gurus I am new to freeradius. Installed freeradius 3.X and did basic configuration with the access point and it works. Now I am trying to do configuration for eap-sim authentication. I have the SIM credentials. Can somebody help me in understanding configuration required to implement eap-sim based authentication . josh

4 8

Freeradius 3 sql not working with nas entries in nas table
by .h 05 Dec '17

05 Dec '17

hi, i’m using freenas sql and want the nas to be read from the sql table nas (default). after commenting the entry for localhost in the conf file and putting them into the nas table, reloading freenas, the connection from localhost is rejected. # Set to 'yes' to read radius clients from the database ('nas' table) # Clients will ONLY be read on server startup. read_clients = yes # Table to keep radius client info client_table = „nas" ################### select * from nas; +----+-----------+-----------+-------+-------+------------+-----------+-----------+-------------------------+ | id | nasname | shortname | type | ports | secret | server | community | description | +----+-----------+-----------+-------+-------+------------+-----------+-----------+-------------------------+ | 1 | localhost | NULL | other | NULL | testing123 | 127.0.0.1 | NULL | localhost RADIUS Client | +----+-----------+-----------+-------+-------+------------+-----------+-----------+-------------------------+ 1 row in set (0.00 sec) #################### radtest user-2001 tlkieyc3 localhost 1812 testing123 Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 45483 Listening on proxy address :: port 52244 Ready to process requests Ignoring request to auth address * port 1812 bound to server default from unknown client 127.0.0.1 port 47933 proto udp Ready to process requests Ignoring request to auth address * port 1812 bound to server default from unknown client 127.0.0.1 port 47933 proto udp Ready to process requests Ignoring request to auth address * port 1812 bound to server default from unknown client 127.0.0.1 port 47933 proto udp Ready to process requests any suggestions? is there a way to get freeradius to print out the loaded nas from the db? TIA .h

4 24

unsubscribe
by osman tuzcu 30 Nov '17

30 Nov '17

30 Kas 2017 9:12 PM tarihinde "Josh toal" <joshtoal17(a)gmail.com> yazdı: > Hi Gurus > > I am new to freeradius. > > Installed freeradius 3.X and did basic configuration with the access point > and it works. > > Now I am trying to do configuration for eap-sim authentication. I have the > SIM credentials. > > Can somebody help me in understanding configuration required to implement > eap-sim based authentication . > > > > josh > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html

1 0

freeradius 3.0.13 LDAP - reply custom Vendor Specific
by Paweł Cituk 30 Nov '17

30 Nov '17

Hi I have connected freeradius to freeIPA's ldap ( https://www.freeipa.org/page/Using_FreeIPA_and_FreeRadius_as_a_RADIUS_based…) I try to authenticate IPMI server trough freeradius but it require two custom attributes (Vendor Specfic) ie for admin H=4 and I=4. How should I configure freeradius to reply for every request with custom above attributes (without adding them in the ldap schema) I found here http://wiki.freeradius.org/modules/Rlm_ldap that I should add for example: radiusReplyAttribute: Cisco-AVPair := "ip:addr-pool=dialin_pool". Unfortunately I completely dont know where in raddb/mod-avaliable/ldap should I place similar line. Any help would be very appreciated Regards, Paweł

4 9

freeradius with Active Directory via winbind or MAC address access
by Vieri 29 Nov '17

29 Nov '17

Hi, I would like to allow access when user authentication is approved by AD through winbind, OR when the MAC address is in a local file. I'm trying to follow this guide: https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind but also this other guide: https://wiki.freeradius.org/guide/mac-auth#mac-auth-or-802-1x My software versions: freeradius-3.0.14 samba-4.5.10 Samba/winbind works fine: # ntlm_auth --username=user --domain=DOMAIN Password: NT_STATUS_OK: Success (0x0) freeradius build.log looks good: checking for wbclient.h in /usr/include/samba-4.0/... yes checking for wbcCtxAuthenticateUserEx in -lwbclient... yes # grep winbind_ /etc/raddb/mods-available/mschap | grep -v ^# winbind_username = "%{mschap:User-Name}" winbind_domain = "DOMAIN" # tail -n 6 /etc/raddb/clients.conf client 10.215.144.92 { ipv4addr = 10.215.144.92 secret = testrad shortname = testsys require_message_authenticator = no } >From 10.215.144.92: # radtest -t mschap user password 10.215.144.91 0 testrad Sent Access-Request Id 181 from 0.0.0.0:39653 to 10.215.144.91:1812 length 132 User-Name = "user" MS-CHAP-Password = "password" NAS-IP-Address = 10.215.144.92 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "user" MS-CHAP-Challenge = 0x5e0a69983fa65564 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000005b82652f1e38b465daebf5a3fb1a2697b12af97676f7c721 Received Access-Reject Id 181 from 10.215.144.91:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject Radius log: (0) Received Access-Request Id 181 from 10.215.144.92:39653 to 10.215.144.91:1812 length 132 (0) User-Name = "user" (0) NAS-IP-Address = 10.215.144.92 (0) NAS-Port = 0 (0) Message-Authenticator = 0x1905f61891b983253895b1d8d33976d8 (0) MS-CHAP-Challenge = 0x5e0a69983fa65564 (0) MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000005b82652f1e38b465daebf5a3fb1a2697b12af97676f7c721 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) policy rewrite_calling_station_id { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy rewrite_calling_station_id = noop (0) if (!EAP-Message) { (0) if (!EAP-Message) -> TRUE (0) if (!EAP-Message) { (0) authorized_macs: EXPAND %{Calling-Station-ID} (0) authorized_macs: --> (0) [authorized_macs] = noop (0) if (!ok) { (0) if (!ok) -> TRUE (0) if (!ok) { (0) [reject] = reject (0) } # if (!ok) = reject (0) } # if (!EAP-Message) = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> user (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 181 from 10.215.144.91:1812 to 10.215.144.92:39653 length 20 # grep user /etc/raddb/radiusd.conf | grep -v '#' user = radius I cannot find any subdir named 'winbindd_privileged': # ls /var/lock/samba/ brlock.tdb mutex.tdb smbXsrv_session_global.tdb g_lock.tdb names.tdb smbXsrv_tcon_global.tdb gencache_notrans.tdb printer_list.tdb smbXsrv_version_global.tdb leases.tdb serverid.tdb smb_krb5 locking.tdb smbXsrv_client_global.tdb smbd_cleanupd.tdb msg.lock smbXsrv_open_global.tdb Why is my radtest above not getting an Access-Accept? Thanks, Vieri

3 6

virtual servers
by Andrew Meyer 29 Nov '17

29 Nov '17

I need some help with setting up multiple eap types. I am running CentOS 7.4. I have 2 profiles or virtual servers setup and want to use eap for one and eap-tls for the other. I am a little confused on how to set this up. For reference i've been trying to follow these sites:Freeradius Example Configuration - OTPme | | | Freeradius Example Configuration - OTPme Redmine | | | https://wiki.freeradius.org/config/Virtual-server Do I add the virtual_server=profile1 to the type of authentication in the eap config file? Thank you,

3 7

Is pkcs8 file format supported
by Sumant Gupta 28 Nov '17

28 Nov '17

Hi, I am using pkcs8 file format in private key file (eap config file) placeholder. private_key_file = ${certdir}/*DevFromRoot-Server-AABBCCDD.pkcs8* But after that when i restart freeradius i get the following error: *rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line* *rlm_eap_tls: Error reading private key file /etc/freeradius/certs/DevFromRoot-Server-AABBCCDD.pkcs8* *rlm_eap: Failed to initialize type tls* */etc/freeradius/eap.conf[17]: Instantiation failed for module "eap"* */etc/freeradius/sites-enabled/default[310]: Failed to load module "eap".* If i use the .pem file format it works! Regards Sumant

4 4