December 2017 - Freeradius-Users - lists.freeradius.org

Wrong Called-station-id in Mysql
by Marco Ramian 22 Dec '17

22 Dec '17

Hi Guys, Need your help please. i see the right called-station-id in freeradius Logs. but in Mysql table the wrong one, almost all the time (90%) see the same Mac address ( 28-6f-7f-ef-f3-33 ) as called station id in mysql ! but see right one in freeradius logs ! what can be the problem ? FreeRadius Logs : Fri Dec 22 10:10:00 2017 : Auth: Login OK: [ "e05f45657d2d/e05f45657d2d] (from client BUS port 1 cli e0-5f-45-65-7d-2d) 04-62-73-9b-19-e0:@MobiConnect-freeWiFi Mysql: "radacctid" "acctsessionid" "acctuniqueid" "username" "groupname" "realm" "nasipaddress" "nasportid" "nasporttype" "acctstarttime" "acctstoptime" "acctsessiontime" "acctauthentic" "connectinfo_start" "connectinfo_stop" "acctinputoctets" "acctoutputoctets" "calledstationid" "callingstationid" "acctterminatecause" "servicetype" "framedprotocol" "framedipaddress" "acctstartdelay" "acctstopdelay" "xascendsessionsvrkey""789" "5a3cd47c/e0:5f:45:65:7d:2d/568133" "86da51b5fbcb4136" "e0-5f-45-65-7d-2d" "" "" "172.25.31.68" "1" "Wireless-802.11" "2017-12-22 10:46:39" \N "0" "RADIUS" "" "" "0" "0" "28-6f-7f-ef-f3-33" "e0-5f-45-65-7d-2d" "" "" "" "172.16.67.157" "0" "0" "" Thank you

2 1

Freeradius 3.0.15 + redis
by Bassem Mettichi 21 Dec '17

21 Dec '17

Hello, has any one tested freeradius 3.0.15 + redis database? i have compiled freeradius 3.0.015 and i have linked redis and rediswh from mods-available to mods-enable but when i try to start freeradius debug mode i get this error: /opt/freeradius/v.3.0.15/etc/raddb/mods-enabled/redis[10]: Failed to link to module 'rlm_redis': /opt/freeradius/v.3.0.15/lib/rlm_redis.so: cannot open shared object file: No such file or directory Please i need your help could someone tell me how to correct this? Best Regards Mettichi Bassem

2 1

Revisiting June 4, 2017 thread, "WARNING: Outer and inner identities are the same."
by David Hendricks 20 Dec '17

20 Dec '17

Forgive me. I have the same issue as mentioned in the June 4, 2017 archived thread. It seems to me the issue is explained but not how to fix it. Question: Which file must be edited and in which manner to eliminate this warning about user privacy being compromised due to the same outer and inner identities? Details: 3.0.15 FreeRADIUS build, in a lab environment. My only edits are to add a user, add a client, and make fresh certificates. The NAS is an Aruba 7005 wireless controller. Authentication succeeds if I configure the client not to validate the certificate, but I see this in the freeradius -X output: (7) authenticate { (7) eap: Expiring EAP session with state 0xf00edcbdf607c57b (7) eap: Finished EAP session with state 0xf00edcbdf607c57b (7) eap: Previous EAP request found for state 0xf00edcbdf607c57b, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state WAITING FOR INNER IDENTITY (7) eap_peap: Identity - guest123 (7) eap_peap: Got inner identity 'guest123' (7) eap_peap: Setting default EAP type for tunneled EAP session (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x0209000d016775657374313233 (7) eap_peap: Setting User-Name to guest123 (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x0209000d016775657374313233 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "guest123" (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x0209000d016775657374313233 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "guest123" (7) WARNING: Outer and inner identities are the same. User privacy is compromised.

4 4

SQL module - merging radcheck/radreply
by Maxime Gerges 20 Dec '17

20 Dec '17

Hello folks, I have some quick questions regarding the freeradius SQL module and the different implemented tables. As far as I know these are the tables defined in the default SQL schema for freeradius : - radcheck : attributes in this table are only internal to freeradius and not used in the radius reply (confirm ?) - radreply : attributes in this table are used as reply attributes sent to the NAS - radgroupcheck : same as radcheck only for groups - radgroupreply : same as radreply only for groups Would it be possible to merge both tables (radcheck & radreply or radgroupcheck & radgroureply) as the attributes in radcheck would already be considered as internal and not send in the reply according to their VSA number ? As far as I know these internal attributes (located in radcheck) are considered control attributes when their VSA number is 1000+, and placed in the corresponding chain after being extracted from the database. From your point of you, does it make sense to merge both table ? Thanks for your clarification. Maxime.

2 1

RADIUS and user names
by JCA 19 Dec '17

19 Dec '17

I have configured my Linux system so that access to it over SSH is authenticated by a remote RADIUS servers. This works fine, but the user must be defined locally, and it must have a home directory. In my efforts to dispense with these requirements, I used a combination of the NSS and PAM. This works, but it requires another server out there, be it NIS, or LDAP, or something like that. Is it not possible to do what I need with a RADIUS server alone? Or is it the case tha RADIUS such does not have such capabilities?

3 2

AW: AW: AW: After Upgrade from freeradius 2 to 3 (Debian 8 - 9): TLS Alert write:fatal:unsupported certificate
by Gladewitz, Robert 19 Dec '17

19 Dec '17

Hello Boris, so a create a pcap and also an log. I hope, you will found some think :-( Robert -----Ursprüngliche Nachricht----- Von: Boris Lytochkin [mailto:lytboris@yandex-team.ru] Gesendet: Sonntag, 17. Dezember 2017 20:44 An: Gladewitz, Robert <Robert.Gladewitz(a)dbfz.de> Betreff: Re: AW: AW: After Upgrade from freeradius 2 to 3 (Debian 8 - 9): TLS Alert write:fatal:unsupported certificate Hi. Should be. On 17.12.2017 22:30, Gladewitz, Robert wrote: > Hello Boris, > > are the dumps from radius service interface also ok?? > > Regards > Robert > > -----Ursprüngliche Nachricht----- > Von: Boris Lytochkin [mailto:lytboris@yandex-team.ru] > Gesendet: Sonntag, 17. Dezember 2017 16:44 > An: Gladewitz, Robert <Robert.Gladewitz(a)dbfz.de>; FreeRadius users > mailing list <freeradius-users(a)lists.freeradius.org> > Betreff: Re: AW: After Upgrade from freeradius 2 to 3 (Debian 8 - 9): > TLS Alert write:fatal:unsupported certificate > > Hi. > > Can you take a SPAN capture on phone port and attach it into this thread so whole EAP-TLS session can be read (ether-type 0x888e for tcpdump filter will do)? This capture will help a lot to give you a hint how to proceed with this issue. > > On 17.12.2017 12:44, Gladewitz, Robert via Freeradius-Users wrote: >> Hallo Alan, >> >> thank you for your answere. The problem only happening on Cisco CAPF Certificates, which will be created by cisco callmanager self for all ip phones. All other authentification (Windows client, WPA etc.) in our enviroment working fine. >> >> But on cisco call manager/CUCM, there is no option that can change the certificate attributes. >> >> Also interess is, that the openssl verify is working fine! >> >> Ist there may a possebility to skip the internal certificate check and use only an external cammand (like verify -> client)? For me it will be ok without any certificate check also. But i need eap-tls for set the voice vlan. >> >> Regards >> >> Robert >> >> >> >> -----Ursprüngliche Nachricht----- >> Von: Alan DeKok [mailto:aland@deployingradius.com] >> Gesendet: Samstag, 16. Dezember 2017 20:37 >> An: Gladewitz, Robert <Robert.Gladewitz(a)dbfz.de>; FreeRadius users >> mailing list <freeradius-users(a)lists.freeradius.org> >> Betreff: Re: After Upgrade from freeradius 2 to 3 (Debian 8 - 9): TLS >> Alert write:fatal:unsupported certificate >> >> On Dec 15, 2017, at 1:28 PM, Gladewitz, Robert via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: >>> after update to version 3 we get the followong error on module eap-tls: >> It's not just FreeRADIUS that's been updated. But also OpenSSL. Which implements the TLS portion of EAP-TLS. >> >>> (59) eap_tls: ERROR: SSL says error 26 : unsupported certificate purpose >> The certificates don't have the extended key usage OIDs. Windows needs them. >> >> The certs created by the scripts included with FreeRADIUS work. >> >>> In do not understand, why i get this error. If i use manually >>> openssl verify all seems ok. >> OpenSSL doesn't verify the extended key usage fields. >> >>> In some discusion i find out, that some think is wron with the >>> extendet attributes. But in this case, why it is working fine in >>> freeradius 2 and 1 implemtations. >> No idea. >> >> But you didn't create the certificates correctly. >> >> You'll need to regenerate the certs with the correct information. Use the scripts in the raddb/certs/ directory. >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > -- > Boris Lytochkin > Yandex NOC > +7 (495) 739 70 00 ext. 7671 > -- Boris Lytochkin Yandex NOC +7 (495) 739 70 00 ext. 7671

1 0

error when adding Primary-DNS
by J E H A N Z A I B 19 Dec '17

19 Dec '17

Hi team, I am getting below error when I add in my radgroupreply . I am using other parameter like Framed-Pool and its working fine. Anyidea what it could be ? | 5 | testgroup | Primary-DNS | := | xx.xx.xx.xx | (80) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname ='testgroup' ORDER BY id (80) sql: ERROR: Failed to create the pair: Unknown name "Primary-DNS" (80) sql: ERROR: Error parsing user data from database result (80) sql: ERROR: Error retrieving reply pairs for group testgroup Regards, J

4 7

Multiple authorize methods with python module
by Gary Gwin 18 Dec '17

18 Dec '17

I need two distinct python module authorize methods. One for client authentication with the dynamic_clients virtual server and the other for user authorization in the default virtual server. I can detect state in a single python authorize method using various RADIUS request variables, but that seems fragile. What I'd really like is a way to use a different python authorize method for each the of the dynamci_clients and default virtual servers. Have had no luck configuring and referencing unique instance names as suggested in radiusd.conf: # python mypython1 { # config_item = value # ... # } # python mypython2 { # config_item = value # ... # } I've tried various other configuration options. Is this possible? If yes, what needs to be done? Thanks, Gary

3 4

(no subject)
by Yoyo Chen 18 Dec '17

18 Dec '17

Hi all, I am trying to figure out what CoA can do and how to configure it. I read the documents in official site, and try to google any resources which can help me. Bad luck. ** Environemnt ** 1. I have installed FreeRADIUS 2.1.12 on Ubuntu 14.04, IP: 192.168.10.6 2. A NAS(L2 switch), IP: 192.168.10.7 3. A PC without Wireshark, IP: 192.168.10.8 4. All of them connected by a hub ** Status ** 1. I add client 192.168.10.0/24 { secret = 123456 } in clients.conf, and add yoyo Cleartext-Password := 111111 cisco-avpair = "shell:priv-lvl=10" in the users After complete the configuration in NAS, the NAS can get Access-Accept with AVP correctly. 2. I am stuck on how to move forward on CoA ** Questions need help ** Q1. Is there any article or book can help me to configure about CoA? Q2. Will FreeRADIUS send CoA-Request out when someone modify the priv-lvl in users? Or what is a good way for me to test and understand the behavior of CoA? Thanks for any help and suggestions! Sincerely, 陳明正 Yoyo Chen https://yoyochen.blogspot.tw

2 1

After Upgrade from freeradius 2 to 3 (Debian 8 - 9): TLS Alert write:fatal:unsupported certificate
by Gladewitz, Robert 17 Dec '17

17 Dec '17

Hello, after update to version 3 we get the followong error on module eap-tls: <SNIP> (59) eap_tls: Continuing EAP-TLS (59) eap_tls: Peer indicated complete TLS record size will be 1321 bytes (59) eap_tls: Got complete TLS record (1321 bytes) (59) eap_tls: [eaptls verify] = length included (59) eap_tls: TLS_accept: SSLv3/TLS write server done (59) eap_tls: <<< recv TLS 1.0 Handshake [length 0353], Certificate (59) eap_tls: Creating attributes from certificate OIDs (59) eap_tls: TLS-Cert-Serial := "5871a15a20dc203cceb13b568ad905f9" (59) eap_tls: TLS-Cert-Expiration := "220309050842Z" (59) eap_tls: TLS-Cert-Subject := "/C=DE/O=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH/OU=IT/CN=CAPF-1b0db5b4/ST=Sachsen/L=Leipzig" (59) eap_tls: TLS-Cert-Issuer := "/C=DE/O=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH/OU=IT/CN=CAPF-1b0db5b4/ST=Sachsen/L=Leipzig" (59) eap_tls: TLS-Cert-Common-Name := "CAPF-1b0db5b4" (59) eap_tls: ERROR: SSL says error 26 : unsupported certificate purpose (59) eap_tls: >>> send TLS 1.0 Alert [length 0002], fatal unsupported_certificate (59) eap_tls: ERROR: TLS Alert write:fatal:unsupported certificate tls: TLS_accept: Error in error (59) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (59) eap_tls: ERROR: System call (I/O) error (-1) (59) eap_tls: ERROR: TLS receive handshake failed during operation (59) eap_tls: ERROR: [eaptls process] = fail </SNIP> In do not understand, why i get this error. If i use manually openssl verify all seems ok. Also, freeraduus do not use the comment define in tls -> verify -> client. My relatet tls config <SNIP> tls-config tls-common { require_client_cert = no certdir = ${confdir}/certs.8021x cadir = ${confdir}/certs.ciscophone private_key_password = myspecpass private_key_file = ${certdir}/cert-srv-dbfz-radius01.pem certificate_file = ${certdir}/cert-srv-dbfz-radius01.pem ca_file = ${cadir}/CAPF.pem dh_file = ${certdir}/dh random_file = /dev/urandom check_crl = no check_all_crl = no ca_path = ${cadir} check_cert_issuer = "/C=DE/O=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH/OU=IT/CN=CAPF-1b0db5b4/ST=Sachsen/L=Leipzig" cipher_list = "DEFAULT" ecdh_curve = "prime256v1" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 # hours max_entries = 255 #name = "EAP module" #persist_dir = "${logdir}/tlscache" } verify { skip_if_ocsp_ok = no tmpdir = /var/lib/freeradius/temp client = "/usr/bin/openssl verify -CAfile ${confdir}/certs.8021x/CAPF.pem %{TLS-Client-Cert-Filename}" # client = "/usr/local/bin/checkcert.sh verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" } tls { require_client_cert = no tls = tls-common # virtual_server = check-eap-tls } </SNIP> In some discusion i find out, that some think is wron with the extendet attributes. But in this case, why it is working fine in freeradius 2 and 1 implemtations. Regards Robert

3 4