November 2017 - Freeradius-Users - lists.freeradius.org

Any last requests for 3.0.16?
by Alan DeKok 28 Nov '17

28 Nov '17

I think we're pretty much good to go for 3.0.16. Any last requests / bugs to report? If not, I'll release 3.0.16 later this week. Alan DeKok.

4 10

Re: Accoiunting proxy Issue
by Richard J Palmer 27 Nov '17

27 Nov '17

Hi Matthew It is indeed... I've already spoken to Adrian on this - but it's not a quick fix from their side - but they are looking at it - hence the seeing what we can do for now If I can work round it while Adrian looks it's the best of both > --- Original message --- > Subject: Re: Accoiunting proxy Issue > From: Matthew Newton <matthew(a)newtoncomputing.co.uk> > To: <freeradius-users(a)lists.freeradius.org> > Date: Monday, 27/11/2017 2:20 PM > > On Mon, 2017-11-27 at 14:08 +0000, Richard J Palmer wrote: >> >> It all seems to make sense but if I have any questions I'll ask but >> that looks to be enough to me > > Assuming this is a FireBrick from RevK (of Andrews & Arnold), I would > definitely raise it with them, and would be fairly surprised if it > wasn't fixed. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: Accoiunting proxy Issue
by Richard J Palmer 27 Nov '17

27 Nov '17

Thanks Alan That sounds sensible - I'll have a look at this - it looks very sensible. It all seems to make sense but if I have any questions I'll ask but that looks to be enough to me Thanks again for your help Richard On Monday 27/11/2017 at 1:40 pm, Alan DeKok wrote: > On Nov 26, 2017, at 3:28 PM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> However the firebrick does not provide the username in interim updates >> or stop messages - which means that the proxy based on realm fails >> (the username / realm is not there). > > That's just stupid. I mean, how hard is to to follow a spec which > was written 20 years ago? > >> >> Is there a way using unlang to proxy these - I was looking at the >> lines in detail - we do also have the records in our SQL server and >> from the AcctSessionID I can look up the username which is possible >> >> I do have one other possibility. The Interim updates have a field: >> Chargeable-User-Identity = "XXXXX" >> Which I can set as part of the auth process (I already add some >> fields in post_proxy). Is there a way in FreeRadius to inspect this >> field in a accounting packet and if set to 'resellerx' set the packet >> to be sent to their proxy / home server ? > > You can do anything in "unlang". > > - in "post-auth", create a Chargeable-User-Identity > - store the Chargeable-User-Identity and User-Name into the radacct > table via an SQL statement > > - in "preacct", look up Chargeable-User-Identity in SQL, and get the > User-Name > > > The simple way is to just mangle the incoming packet (no one cares > about this by the time post-auth is called): > > post-auth { > ... > ... create Chargeable-User-Identity in the reply ... > ... > > update request { > Acct-Status-Type = Start # pretend we're starting a session > Chargeable-User-Identity := &reply:Chargeable-User-Identity > ... anything else you need... > } > sql.accounting # store the packet into radacct > ... > } > > and then in preacct: > > preacct { > ... > > if (!User-Name && Chargeable-User-Identity) { > update request { > User-Name := "%{sql:SELECT username from radacct where cui = > %{Chargeable-User-Identity} > } > > } > > ... and proxying, suffix, etc. > > } > > You'll need to add a ''cui' column to the radacct table. And, > update the accounting 'start' query to store Chargeable-User-Identity > in the 'cui' column. > > But that's about it. The details matter, but it's not *too* > complex. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Accoiunting proxy Issue
by Richard J Palmer 27 Nov '17

27 Nov '17

Hi there We use firebrick Routers as LNS routers and they have worked fine in the past. However I have a new requirement to proxy one realm (authentication and accounting) to a remote server for a customer. I have the auth side working find - and the account start packet. However the firebrick does not provide the username in interim updates or stop messages - which means that the proxy based on realm fails (the username / realm is not there). Is there a way using unlang to proxy these - I was looking at the lines in detail - we do also have the records in our SQL server and from the AcctSessionID I can look up the username which is possible I do have one other possibility. The Interim updates have a field: Chargeable-User-Identity = "XXXXX" Which I can set as part of the auth process (I already add some fields in post_proxy). Is there a way in FreeRadius to inspect this field in a accounting packet and if set to 'resellerx' set the packet to be sent to their proxy / home server ? The second I assume would be faster .... I have also emailed the router manufacturer to see if the username can be added easily in a software patch but that may take time ... An example current accounting packet is: Sun Nov 26 20:00:05 2017 Acct-Status-Type = Interim-Update Chargeable-User-Identity = "BBEU12345675" Event-Timestamp = "Nov 26 2017 20:00:00 GMT" Acct-Input-Octets = 7137840 Acct-Input-Gigawords = 0 Acct-Output-Octets = 487340050 Acct-Output-Gigawords = 0 Acct-Session-Time = 576 Acct-Input-Packets = 99535 Acct-Output-Packets = 342237 Tunnel-Client-Endpoint:0 = "ADSL" NAS-Identifier = "aglovale.merula.net" Acct-Session-Id = "S600000269717072AECC00" NAS-IP-Address = 1.2.3.4 NAS-Port = 697 Connect-Info = "39550000/1000000000" Acct-Unique-Session-Id = "c89cbc69ab30d4afaff763c46057b04e" Timestamp = 1511726405 I would be grateful for any suggestions Richard

2 1

ntlm...ldap
by Carlos Bordon 24 Nov '17

24 Nov '17

Hi , > > I worte from argentina, i want ask you something please, > > i configure the freeradius with ntlm, but now need take groups of AD for the vlans, > > i have to do this part with ldap? > in resume, authentication with ntlm and groups with ldap, is right? > > Regards ands congratulations for this aplication. > Carlos

2 1

Module eap - attributes ca_file and ca_path
by Jérôme BERTHIER 24 Nov '17

24 Nov '17

Hello, Just a question about the section "tls-config tls-common" of the module eap file. Do both attributes ca_file and ca_path permit to verify a client certificate in an EAP-TLS authentication ? And so, if we do NOT want to permit EAP-TLS authentication, we have to : - comment out the attributes ca_file AND ca_path - concatenate the server certificate and the CA certificate (as explained in comments) This setup should allow to establish TLS tunnel for other EAP method (TTLS, PEAP) but refuse an EAP-TLS request. Is it correct ? our am I wrong ? Regards, -- Jérôme BERTHIER

2 2

PEAP correct client certificate
by Oliver Tollning 23 Nov '17

23 Nov '17

Hello, I'm currently setting up a RADIUS server(v. 2.2.8) for the first time. I followed the instructions and could connect with EAP and PEAP to my server. Since I only want to use PEAP I disabled every other authentication method by commenting out everything else in /sites-enabled/default. This works fine, since I cant connect with normal EAP anymore. I went through the process of creating my own certificate with openssl and set everything up in eap.conf under eap-tls{}. In peap{} I added EAP-TLS-Require-Client-Cert = Yes. The problem is, that the client can connect to the server even though he doesnt have the correct client certificate. How can I tell the server to check the client certificate?

4 12

Compiling freeRadius with latest OPENSSL
by kavita jindal 23 Nov '17

23 Nov '17

Hi, I am trying to compile Freeradius 3.0.x with openSSL 1.1.0g . I am getting following errors. openssl version gives following output: OpenSSL 1.1.0g 2 Nov 2017 /modules/rlm_eap/libeap/eapsimlib.c CC src/modules/rlm_eap/libeap/fips186prf.c CC src/modules/rlm_eap/libeap/comp128.c CC src/modules/rlm_eap/libeap/eap_tls.c In file included from src/modules/rlm_eap/libeap/eap_tls.c:46:0: src/modules/rlm_eap/libeap/eap_tls.h:58:1: error: unknown type name ‘fr_tls_status_t’ fr_tls_status_t eaptls_process(eap_handler_t *handler); ^ src/modules/rlm_eap/libeap/eap_tls.h:62:36: error: unknown type name ‘tls_session_t’ int eaptls_request(EAP_DS *eap_ds, tls_session_t *ssn) CC_HINT(nonnull); ^ In file included from src/modules/rlm_eap/libeap/eap_tls.c:46:0: src/modules/rlm_eap/libeap/eap_tls.h:66:45: error: unknown type name ‘SSL’ void eaptls_gen_mppe_keys(REQUEST *request, SSL *s, char const *prf_label); ^ src/modules/rlm_eap/libeap/eap_tls.h:67:28: error: unknown type name ‘SSL’ void eapttls_gen_challenge(SSL *s, uint8_t *buffer, size_t size); ^ src/modules/rlm_eap/libeap/eap_tls.h:68:48: error: unknown type name ‘SSL’ void eaptls_gen_eap_key(RADIUS_PACKET *packet, SSL *s, uint32_t header); ^ src/modules/rlm_eap/libeap/eap_tls.h:69:35: error: unknown type name ‘SSL’ void eap_fast_tls_gen_challenge(SSL *ssl, uint8_t *buffer, uint8_t *scratch, size_t size, char const *prf_label) CC_HINT(nonnull); ^ src/modules/rlm_eap/libeap/eap_tls.h:103:1: error: unknown type name ‘tls_session_t’ tls_session_t *eaptls_session(eap_handler_t *handler, fr_tls_server_conf_t *tls_conf, bool client_cert); ^ src/modules/rlm_eap/libeap/eap_tls.h:103:55: error: unknown type name ‘fr_tls_server_conf_t’ tls_session_t *eaptls_session(eap_handler_t *handler, fr_tls_server_conf_t *tls_conf, bool client_cert); ^ src/modules/rlm_eap/libeap/eap_tls.h:107:1: error: unknown type name ‘fr_tls_server_conf_t’ fr_tls_server_conf_t *eaptls_conf_parse(CONF_SECTION *cs, char const *key); ^ src/modules/rlm_eap/libeap/eap_tls.c:64:1: error: unknown type name ‘tls_session_t’ tls_session_t *eaptls_session(eap_handler_t *handler, fr_tls_server_conf_t *tls_conf, bool client_cert) ^ src/modules/rlm_eap/libeap/eap_tls.c:64:55: error: unknown type name ‘fr_tls_server_conf_t’ If i compile with openssl 1.0.0f it works fine. Is it possible to compile freeradius with latest OPENSSL version. I have a requirement for using latest SSL. Regard Kavita

2 5

ssl3_get_client_hello:no shared cipher
by kavita jindal 23 Nov '17

23 Nov '17

Hi All, I am using free radius 3.0.15 ,while using i am getting following error I searched the forums ,some people have already raised the issue but i could not find any solution. eap_tls: (other): before/accept initialization (1) eap_tls: TLS_accept: before/accept initialization (1) eap_tls: <<< recv TLS 1.2 [length 0042] (1) eap_tls: >>> send TLS 1.2 [length 0002] (1) eap_tls: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error tls: TLS_accept: Error in error (1) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher (1) eap_tls: ERROR: System call (I/O) error (-1) (1) eap_tls: ERROR: TLS receive handshake failed during operation (1) eap_tls: ERROR: [eaptls process] = fail (1) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (1) eap: Sending EAP Failure (code 4) ID 96 length 4 Also when i use ,its shows my ciphersuite : openssl ciphers 'ALL' | grep ECDHE-ECDSA-AES128-GCM-SHA256 In eap file,i have used: default_eap_type = tls cipher_list = "ALL" Please help,i am stuck. Regards Kavita

2 1

virtual servers
by Andrew Meyer 22 Nov '17

22 Nov '17

If I wanted to setup Virtual servers w/ FreeRADIUS 3 could I copy the files in /etc/raddb/sites-enabled/ to a different name and change the server name and the ip address it lives on? I have tried doing this and gotten the following error: Failed binding to auth address 10.2.0.11 port 1812 bound to server wireless: Cannot assign requested address /etc/raddb/sites-enabled/wireless[59]: Error binding to port for 10.2.0.11 port 1812 I am running this on CentOS 7 latest.

2 2