March 2017 - Freeradius-Users - lists.freeradius.org

Request number (request->number) as internal variable
by Peter Balsianok 08 Mar '17

08 Mar '17

Hi, Don't you plan to add new internal variable for request->number ? It could be used for linelog and also in modules (mod_perl). Better finding log messages belong to some request. Thank you very much

2 2

(rlm_perl ): "has_tag" value missing in debug mode
by Peter Balsianok 08 Mar '17

08 Mar '17

Hi, src/modules/rlm_perl/rlm_perl.c The module doesnt show "has_tag" value in debug mode. Line 712: RDEBUG("$%s{'%s'} = &%s:%s -> '%s'", hash_name, vp->da->name, list_name, vp->da->name, vp->vp_strvalue); change to RDEBUG("$%s{'%s'} = &%s:%s -> '%s'", hash_name, name, list_name, name, vp->vp_strvalue);

1 0

multiple EAP handler faillure | FreeRADIUS Version 3.0.11
by Johnny R 08 Mar '17

08 Mar '17

Dear List, Didn't really want to escalate this to the list and already "tried harder" but didn't find a way around it. Is it a "NAS" issue (a timer may be), or a messed up "client" (windows 7), or just me and my beloved FreeRadius server :D ... Here comes the issue: *Tue Mar 7 08:47:09 2017 : Debug: (145) eap: Expiring EAP session with state 0x4b5adc8a484dc5f7Tue Mar 7 08:47:09 2017 : Error: rlm_eap (EAP): No EAP session matching state 0x46f070be47e96990Tue Mar 7 08:47:09 2017 : Debug: (145) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-requestTue Mar 7 08:47:09 2017 : Debug: (145) eap: Failed in handler* similar log as the above ones are seen many times within the log. I thought that it was related to the timer but already adjusted that one ... and it comes back, bumping my head: *eap { default_eap_type = peap timer_expire = 120 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} tls-config tls-common { private_key_password = my_ultra_complicated_password_heh private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh* so I tried to find out what is really going on between the NAS and supplicant, and I noticed that the client is not responding to the "Access-Challenge" sent by server, but it looks like it is trying to renew the "Access-Request" it sent earlier. If someone could give a hint or encoutered the same issue ... it would really help! Regards v4s[at]#unrelated | "sh3ll is just the beginning"

2 2

EAP-TLS, session resumption and OCSP
by Stefan Winter 07 Mar '17

07 Mar '17

Hello, we are curently testing a large-scale rollout of EAP-TLS for eduroam purposes. One of the things we observed is that if an authentication uses TLS session resumption, the server does not re-check the OCSP state of the client cert that was used to login initially. So, in a scenario where - cert is valid, user authenticates with a full EAP-TLS handshake - cert gets revoked - user re-authenticates with session resumption then the authentication does NOT fail but succeed. Looking at the TLS-Client-Cert-* attributes which get restored from session cache, it looks like it could be easy to do that though - the serial number of the cert is saved; and the OCSP responder URL maybe isn't but could be. And with both pieces of information, another OCSP check can be run even on a resumed session. A related question: how is the cache lifetime determined? When config sets it to 24 hours, is that 24 hours after the initial, full, authentication, or is that lifetime refreshed with every re-auth, meaning the cache expires after 24 hours of non-use? If the latter, a revoked user could perpetually prolong his account lifetime even if OCSP wouldn't want to let him. Also, something we didn't check but that just now comes to my mind: does the server check the expiry time of the cert on a resumed session? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

4 6

Glitches in the expr engine?
by Stefan Paetow 07 Mar '17

07 Mar '17

So today I had one of my sites deploy the new moonshot-targeted-ids file in the 3.0.x branch. Everything so far, so good. Then I ask him to use a random string as the salt (which contained a closing curly bracket). The output was definitely *not* what was expected. This example below (salt = 'changeme}') illustrates the problem: -- begin -- (13) policy moonshot_host_tid.post-auth { (13) if (&outer.request:GSS-Acceptor-Host-Name) { (13) if (&outer.request:GSS-Acceptor-Host-Name) -> TRUE (13) if (&outer.request:GSS-Acceptor-Host-Name) { (13) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme}%{tolower:%{outer.request:GSS-Acceptor-Host -Name}}}" =~ /^([^ ]+)([ ]*)$/) { (13) Executing: /usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 steve(a)example.comchangeme: (13) Program returned code (0) and output '86b8d074-fe42-5dfa-b160-3fb770a96c98' (13) EXPAND %{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme}%{tolower:%{outer.request:GSS-Acceptor-Host -Name}}} (13) --> 86b8d074-fe42-5dfa-b160-3fb770a96c98debian8.localdomain} (13) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme}%{tolower:%{outer.request:GSS-Acceptor-Host -Name}}}" =~ /^([^ ]+)([ ]*)$/) -> TRUE (13) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme}%{tolower:%{outer.request:GSS-Acceptor-Host -Name}}}" =~ /^([^ ]+)([ ]*)$/) { (13) update outer.session-state { (13) EXPAND %{1}@%{tolower:%{request:Realm}} (13) --> 86b8d074-fe42-5dfa-b160-3fb770a96c98debian8.localdomain}(a)example.com (13) Moonshot-Host-TargetedId := "86b8d074-fe42-5dfa-b160-3fb770a96c98debian8.localdomain}(a)example.com" (13) } # update outer.session-state = noop (13) } # if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme}%{tolower:%{outer.request:GSS-Acceptor-Host -Name}}}" =~ /^([^ ]+)([ ]*)$/) = noop (13) } # if (&outer.request:GSS-Acceptor-Host-Name) = noop (13) } # policy moonshot_host_tid.post-auth = noop (13) update { (13) &outer.session-state:EAP-Channel-Binding-Message += &reply:EAP-Channel-Binding-Message -> 0x02001b01a406686f7374a51564656269616e382e6c6f63616c646f6d61696e (13) &outer.session-state:EAP-Message += &reply:EAP-Message -> 0x03010004 (13) &outer.session-state:Message-Authenticator += &reply:Message-Authenticator -> 0x00000000000000000000000000000000 (13) &outer.session-state:Stripped-User-Name += &reply:Stripped-User-Name -> 'steve' (13) } # update = noop -- end -- So... What is the solution to this? Expect people to escape the curly brackets in the salt? If so, I'll update the documentation to say this. The below is the correct output, by the way: -- begin -- (29) post-auth { (29) policy moonshot_host_tid.post-auth { (29) if (&outer.request:GSS-Acceptor-Host-Name) { (29) if (&outer.request:GSS-Acceptor-Host-Name) -> TRUE (29) if (&outer.request:GSS-Acceptor-Host-Name) { (29) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme\}%{tolower:%{outer.request:GSS-Acceptor-Hos t-Name}}}" =~ /^([^ ]+)([ ]*)$/) { (29) Executing: /usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 steve(a)example.comchangeme\}debian8.localdomain: (29) Program returned code (0) and output '6467194a-b3f4-56b7-bd30-6f0afac50c65' (29) EXPAND %{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme\}%{tolower:%{outer.request:GSS-Acceptor-Hos t-Name}}} (29) --> 6467194a-b3f4-56b7-bd30-6f0afac50c65 (29) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme\}%{tolower:%{outer.request:GSS-Acceptor-Hos t-Name}}}" =~ /^([^ ]+)([ ]*)$/) -> TRUE (29) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme\}%{tolower:%{outer.request:GSS-Acceptor-Hos t-Name}}}" =~ /^([^ ]+)([ ]*)$/) { (29) update outer.session-state { (29) EXPAND %{1}@%{tolower:%{request:Realm}} (29) --> 6467194a-b3f4-56b7-bd30-6f0afac50c65(a)example.com (29) Moonshot-Host-TargetedId := "6467194a-b3f4-56b7-bd30-6f0afac50c65(a)example.com" (29) } # update outer.session-state = noop (29) } # if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme\}%{tolower:%{outer.request:GSS-Acceptor-Hos t-Name}}}" =~ /^([^ ]+)([ ]*)$/) = noop (29) } # if (&outer.request:GSS-Acceptor-Host-Name) = noop (29) } # policy moonshot_host_tid.post-auth = noop (29) update { (29) &outer.session-state:EAP-Channel-Binding-Message += &reply:EAP-Channel-Binding-Message -> 0x02001b01a406686f7374a51564656269616e382e6c6f63616c646f6d61696e (29) &outer.session-state:EAP-Message += &reply:EAP-Message -> 0x03010004 (29) &outer.session-state:Message-Authenticator += &reply:Message-Authenticator -> 0x00000000000000000000000000000000 (29) &outer.session-state:Stripped-User-Name += &reply:Stripped-User-Name -> 'steve' (29) } # update = noop -- end -- Advice gladly accepted :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

2 4

Unable to find user in DB.
by mustafa mujahid 07 Mar '17

07 Mar '17

Hello all, I've been trying to get LAN authentication working on a test radius server v2.2.8 and have run into a problem. My server can't seem to find the user in database. I have verified the exact same query on th DB and it returns the correct query result but somehow radius is unable to find the user. Please see below the debug output : ... adding new socket proxy address * port 41532 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/log/radius/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.10.99.5 port 1645, id=84, length=166 User-Name = "test.user" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "F4-1F-C2-29-F2-04" Calling-Station-Id = "5C-B9-01-82-7F-64" EAP-Message = 0x02010015017a65657368616e2e6368617564617279 Message-Authenticator = 0xef5d9c130e4c84779ee2942be69f84ac NAS-Port-Type = Ethernet NAS-Port = 50004 NAS-Port-Id = "FastEthernet0/4" NAS-IP-Address = 10.10.99.5 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[digest] = noop [suffix] No '@' in User-Name = "test.user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [sql] expand: %{User-Name} -> test.user [sql] sql_set_user escaped user --> 'test.user' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM backup.radcheck_office_replica where username = '%{SQL-User-Name}' order by id -> SELECT id,UserName,Attribute,Value,op FROM backup.radcheck_office_replica where username = 'test.user' order by id rlm_sql (sql): Released sql socket id: 4 [sql] User test.user not found ++[sql] = notfound ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [test.user] (from client ops-switch port 50004 cli 5C-B9-01-82-7F-64) Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [sql] expand: %{User-Name} -> test.user [sql] sql_set_user escaped user --> 'test.user' ++[sql] = noop +} # group REJECT = noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 84 to 10.10.99.5 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 84 with timestamp +40 Ready to process requests. But when the exact same query is run on the DB it returns positive results. please see attached screen shot from DB. Currently my sql.conf file only contains : authorize_check_query ="SELECT id,UserName,Attribute,Value,op FROM ${authcheck_table} where username = '%{SQL-User-Name}' order by id" and queries for accounting but they are not of concern as I only need authentication from this radius so I can match MAC Address against user name, but that comes after. I'm stuck at the first stage. I don't understand what the issue might be . Kindly let me know if I'm missing something or if further information is required. Any help on this would be greatly appreciated. -- Mustafa

3 5

Version 3.0.13 has been released
by Alan DeKok 07 Mar '17

07 Mar '17

After a bit of a delay, we're happy to announce that 3.0.13 has been released. Change log follows: Feature improvements * Add dictionary.rfc7930. Note that we do not implement the RFC. * Added 'cipher_server_preference' to mods-available/eap Patch from #1797. * OpenSSL 1.1.0 compatibility fixes. * rlm_perl: radiusd::xlat to evaluate xlat string within perl script * Allow authentication retry in winbind. Patch from Herwin Weststrate. See raddb/mods-available/mschap. * Added "recv-coa" method to rlm_rest. It behaves the same as "authorize". * Document Trust Router tr_port option. Patch from Stefan Paetow. * Update elasticsearch/logstash examples so that they work with elastic stack v5. Patch from Matthew Newton. * Print information about packets, replies, and contents in the detail file reader. * Update abfab-tr policy. Pull request #1893 from Stefan Paetow. * Reject packets which contain User-Password and EAP-Message. * Add example for filtering Access-Challenge. See sites-enabled/default. * Pull symlink fixes from v4.0.x. Fixes #1859. * Add systemd reload. Not everything is reloaded, but some is. Fixes #1662. * Better documentation for listen "ipaddr". Fixes #1921 * Add dictionary.cnergee, updated dictionary.nomadix. * radclient no longer needs -x to print statistics with -s. Bug fixes * Minor typos. Fixes #1763 * Fix typo in RPM build. Closes #1767. * rlm_mschap check for password expiry only if password was correct. Fixes #1762. * Update debian build. * update rlm_counter "man" page. Fixes #1775. * Remove erroneous assert. Fixes #1778. * fix mschap password change test. Fixes #1792. * Cleanup config file on data remove. Fixes #1795. * passwd module returns "notfound" if not found. * Check for old OpenSSL, and don't build rlm_eap_fast if it necessary. Fixes #1803 * Cleanup memory better after ldap version query. Patch from Aleksey Katargin. * Rename lt_* functions to avoid linker issues with libtool. Fixes #1277 * Many miscellaneous fixes and typos. * Allow long strings in %{%{foo} bar:-%{baz} blah". Fixes #1866 * Fix filtering operators, along with more documentation and more tests for them. * Fix OpenSSL fixes. Fixes #1876. * Finish SQL select queries even when SELECT returns no rows. Fixes #1879. * Set Module-Failure-Message for more EAP errors. * Correct typo in dictionary.rfc5580. Fixes #1882 * Remove obselete systemd syslog.target. * Client-Port-Balance load-balancing now uses client port. * Radrelay examples fixed from Alex Clouter. * Update systemd target. Pull request #1896. * Trim starting whitespace in xlat strings. * Get MySQL result lengths using normal API. * suid down after fchown(). Fixes #1914. * Fix cases of comparing pointer to NUL character. Fixes #1915. * OpenSSL v1.1 fixes. Pull request #1921. * Better Handle v4/v6 host names. Pull request #1919. * Remove "Auth-Type = System" from docs and examples. * Don't crash on malformed %{home_server}. Fixes #1922 * fix erroneous use of talloc destructor in rlm_eap * Issue trigger modules.sql.fail. Fixes #1923 * Document python_path gotcha's. Fixes #1845 * dlopen() the specific version of Python. Fixes #1592

2 2

Group membership by SSID
by Ethariel 07 Mar '17

07 Mar '17

Hello to all again, FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 I've got two SSID (Name_Lan and Name_Perso). Freeradius authentication using Active Directory (working fine, with and without require-membership-of) I wish to have a variable in modules/mschap linked to SSID. --require-membership-of=DOMAIN/Group1 for Name_Lan --require-membership-of=DOMAIN/Group2 for Name_Perso I don't find how to replace Group1 and Group2 with a variable (which variable ?). As I understand the unlang doc I cannot create new variables. I've also try to duplicate mschap module in mschap_perso and mschap_lan, then modify sites-available/default (and inner-tunnel) to add a test in authenticate section with : rewrite.called-station-id if (Called-Station-Id == "Name_Lan") { mschap_lan } but the is a syntax conf error when starting freeradius. TL;DR : how to test user group in AD based on SSID ? Thks a lot for any help/hint

3 7

[Freeradius-Users] Execptions for users in Freeradius.
by Isidro Hortelano 06 Mar '17

06 Mar '17

Hello list, I would like to know if it's possible to configure Freeradius to have users with dual factor of authentication and create an exceptions for certain users to use just password authentication. Thanks,

2 2

maintenance of radacct table
by bbnlradius 06 Mar '17

06 Mar '17

Hi, We are running a free radius version 2.2.0. It is talking to a mariadb database having 32 gb ram with 24 core cpu. From many days we are seeing major performance issue on the radius database. Seeing radacct table getting bombarded with high hits of update statement. The radacct table has been daily partitioned and has around 6 months of data. The total rows is Data_length: 17732239360 Index_length: 27330428928 Data_free: 1644167168 Auto_increment: 131859985 I need to drop the old data by dropping the partitions, but we are seeing that the gb limit goes hay wire, when we do this. Even when the table was not partitioned we saw the same issue. Can somebody please do help me out as to how to update the right data when the radacct table data is dropped. I saw a script from my colleague who had a maintenance script for radacct, it is using rm_radacct table too, but i see no rows in this table. Is this what supposed to be? Please do help me out as to how to do maintenance of the radacct table. thanks in advance Arun

4 7