December 2017 - Freeradius-Users - lists.freeradius.org

Freeradius 3 sql not working with nas entries in nas table
by .h 05 Dec '17

05 Dec '17

hi, i’m using freenas sql and want the nas to be read from the sql table nas (default). after commenting the entry for localhost in the conf file and putting them into the nas table, reloading freenas, the connection from localhost is rejected. # Set to 'yes' to read radius clients from the database ('nas' table) # Clients will ONLY be read on server startup. read_clients = yes # Table to keep radius client info client_table = „nas" ################### select * from nas; +----+-----------+-----------+-------+-------+------------+-----------+-----------+-------------------------+ | id | nasname | shortname | type | ports | secret | server | community | description | +----+-----------+-----------+-------+-------+------------+-----------+-----------+-------------------------+ | 1 | localhost | NULL | other | NULL | testing123 | 127.0.0.1 | NULL | localhost RADIUS Client | +----+-----------+-----------+-------+-------+------------+-----------+-----------+-------------------------+ 1 row in set (0.00 sec) #################### radtest user-2001 tlkieyc3 localhost 1812 testing123 Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 45483 Listening on proxy address :: port 52244 Ready to process requests Ignoring request to auth address * port 1812 bound to server default from unknown client 127.0.0.1 port 47933 proto udp Ready to process requests Ignoring request to auth address * port 1812 bound to server default from unknown client 127.0.0.1 port 47933 proto udp Ready to process requests Ignoring request to auth address * port 1812 bound to server default from unknown client 127.0.0.1 port 47933 proto udp Ready to process requests any suggestions? is there a way to get freeradius to print out the loaded nas from the db? TIA .h

4 24

freeradius seeing anonymous identity as username
by osman tuzcu 04 Dec '17

04 Dec '17

Hi; I am using FreeRadius 3.0.15. I am trying to make 802.1x with the HP 2530 switch. When I debug with radiusd -X command, I see anonymous in username field. That's why the server rejects me. How can i fix this? __________________________________________ Packet-Type = Access-Request Framed-MTU = 1480 NAS-IP-Address = 192.168.35.5 NAS-Identifier = "HP-2530-24G" User-Name = "anonymous" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 7 NAS-Port-Type = Ethernet NAS-Port-Id = "7" Called-Station-Id = "14-02-ec-ac-12-e0" Calling-Station-Id = "f4-30-b9-a8-74-25" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" CHAP-Password = 0x0200000000000000000000000000000000 Message-Authenticator = 0xca73e90b5706a20d5d412373e07049a5 MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 Event-Timestamp = "Dec 4 2017 13:08:55 UTC" CHAP-Challenge = 0x6bc8618647749d12e3e0995e3f0c556a Timestamp = 1512392935 _________________________________________________

4 6

Problems to use regex policy
by Jérôme BERTHIER 04 Dec '17

04 Dec '17

Hi, I have a use case of EAP for which I have to verify that the outer identify has a realm. Before writing this verification under a new policy module, I just tried to use those existing by defaut under policy.d/filter. I don't know if it is really a mistake but the filter "deny_realms" seems to be wrong. I just try to call the filter "deny_realms" under the section authorize {} of the site default. I tried with freeradius 3.0.4 and 3.0.13, both packages on centOS 7.3 and 7.4. In both case, radiusd do not start because of syntax error in regex : - error on freeradius 3.0.4 /etc/raddb/policy.d/filter[6]: Invalid regular expression @|\: bad escape sequence at offset 3 - error on freeradius 3.0.13 /etc/raddb/policy.d/filter[6]: Invalid regular expression: /etc/raddb/policy.d/filter[6]: @|\ /etc/raddb/policy.d/filter[6]: ^ Pattern compilation failed: \ at end of pattern The line number 6 is this test : if (&User-Name && (&User-Name =~ /@|\\/)) { If I replace it with this test, radiusd starts correctly : if (&User-Name && (&User-Name =~ /@|\\{1}/)) { Then, after this first step, I have a second issue with the filter "filter_username". I would be interested to use it inside the inner tunnel to sanitize the inner identity. One of this tests is always true and I don't understand the reason why : if (&User-Name =~ /\.\./ ) { update request { &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s' } reject } Whatever the identity I'm using, the test on double dot caracter is verified. I tried to call the filter "filter_username" under the section authorize {} of the site default or inner-tunnel. In both cas, It seems to have issue (below log from site default). Ready to process requests (0) Received Access-Request Id 0 from 10.10.10.12:36315 to 10.10.11.11:1812 length 146 (0) User-Name = "anonymous(a)mydomain.fr" (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = "xx-xx-xx-xx-xx-xx" (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = "Test client - app" (0) EAP-Message = 0x0200001701616e6f6e796d6f757340696e7269612e6672 (0) Message-Authenticator = 0x02df880a5342968b4e6455cc5e5d9841 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> TRUE (0) if (&User-Name =~ /\.\./ ) { (0) update request { (0) &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s' (0) } # update request = noop (0) [reject] = reject (0) } # if (&User-Name =~ /\.\./ ) = reject (0) } # if (&User-Name) = reject (0) } # policy filter_username = reject (0) } # authorize = reject (0) Invalid user (Rejected: User-Name contains multiple ..s): [anonymous(a)mydomain.fr] (from client app port 0 cli xx-xx-xx-xx-xx-xx) (0) Using Post-Auth-Type Reject Later, I will try to use also the filter "filter_inner_identity". Thanks you for this ! Have a nice day Regards, -- Jérôme BERTHIER

3 3

Signature Hash Algorithm Hash configuration
by Sumant Gupta 04 Dec '17

04 Dec '17

Hi, I am sending the client Hello message ,when Freeradius recieves the Client hello it sends the Server Hello message with following data. If you see the data it contains Signature Hash Algorithm Hash:SHA1 (2) >From where does the freeradius populate that data, i want that Freeradius should send the SHA256 Hash algo value in Server Hello message.. TLSv1.2 Record Layer: Handshake Protocol: Server Key Exchange Content Type: Handshake (22) Version: TLS 1.2 (0x0303) Length: 147 Handshake Protocol: Server Key Exchange Handshake Type: Server Key Exchange (12) Length: 143 EC Diffie-Hellman Server Params Curve Type: named_curve (0x03) Named Curve: secp256r1 (0x0017) Pubkey Length: 65 Pubkey: 04674c5cbd9edc682f3483a2289c66a4ba4572fd5eea6399... Signature Hash Algorithm: 0x0203 * Signature Hash Algorithm Hash: SHA1 (2)* Signature Hash Algorithm Signature: ECDSA (3) Signature Length: 70 Signature: 3044022009266867a43817c72bd333b96d5052313cfa62d5... -sumant

2 3

EAP Re-authentication Protocol (ERP) support
by X Gao 02 Dec '17

02 Dec '17

Hello, could anyone tell me whether FreeRADIUS supports EAP-RP (RFC 5296/6696)? As far as I can tell it's not implemented but would like a confirmation. If so, is there plan to add ERP in the future? Thank you Xuanning

2 1

Problem or a question !?
by Ariel García Reyes 01 Dec '17

01 Dec '17

We have a problem or a question !? We are connecting several cell phones through 3g, our provider is routing us through an APN to a FreeRadius server that we are managing through RadiusDesk, but we would like to know how to obtain the information about the traffic that is generated by the clients in our server in a period of shorter time There is some way to force from our FreeRadius so that when the client (cellular) authenticates we can get traffic information periodically every 5 minutes for example. I have read and I know that there is a variable (Acct-Interim-Interval) that has or plays an important role, but we do not know how to use it! The configuration of the delivery time of the traffic information is configured in the ISP NAS or can we manage it in our server in some other way? -- ________________________________________________ Lic. Ariel García Reyes. GNU/Linux Registered User #357058

2 1

nas "per_socket_client" configuration -> sql
by kjonca＠o2.pl 01 Dec '17

01 Dec '17

Is it possible to have equivalent of: [...] clients alfa { client ni { ipaddr = ni.kjonca secret = verysecret nastype = other } client test { ipaddr = alfa.kjonca secret = verysecret nastype = other } } [...] listen { [...] clients = alfa } I am in doubt but maybe I missed something. KJ -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html QOTD: "I sprinkled some baking powder over a couple of potatoes, but it didn't work."

3 3