April 2017 - Freeradius-Users - lists.freeradius.org

Problem with log and PEAP/MS-CHAPv2
by Andrea Gabellini 18 Apr '17

18 Apr '17

Hi, I'm trying to setup a PEAP-MS-CHAPv2 tunnel with FR 3.0.13. It works fine but I have a little problem with the log. When a user logs in correctly I have the usual Login OK. But if the user uses a wrong password or if the username doesn't exist, I don't have any logs of it. Testing the inner tunnel with radtest logs correctly. The configuration of the server and the inner tunnel. Users are on "files" module: server wifi_tim { authorize { filter_username auth_log chap mschap eap { ok = return } wifi_tim_files pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap eap } preacct { } accounting { } session { } post-auth { update { &reply: += &session-state: } reply_log remove_reply_message_if_eap Post-Auth-Type REJECT { attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { } } server wifi_tim_inner_tunnel { listen { ipaddr = 127.0.0.1 port = 11812 type = auth } authorize { filter_username chap mschap eap { ok = return } wifi_tim_files pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap eap } session { } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } pre-proxy { } post-proxy { } } eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} tls-config tls-common { private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh ca_path = ${cadir} cipher_list = "ALL:!LOW:!SSLv2:!EXP:!aNULL" cipher_server_preference = yes ecdh_curve = "prime256v1" cache { enable = no max_entries = 255 } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "wifi_tim_inner_tunnel" } mschapv2 { send_error = yes identity = "Tism Access Server" } } Logs with radtest: Apr 12 10:47:25 radius31 radiusd[28822]: (1) Login OK: [testuser] (from client localhost port 0) Apr 12 10:47:35 radius31 radiusd[28822]: (2) Login incorrect (mschap: MS-CHAP2-Response is incorrect): [testuser] (from client localhost port 0) Apr 12 10:47:35 radius31 radiusd[28822]: (2) Rejected in post-auth: [testuser] (from client localhost port 0) Apr 12 10:55:02 radius31 radiusd[28822]: (16) Login incorrect (mschap: FAILED: No NT/LM-Password. Cannot perform authentication): [testuserx] (from client localhost port 0) Apr 12 10:55:02 radius31 radiusd[28822]: (16) Rejected in post-auth: [testuserx] (from client localhost port 0) Debug with EAP and wrong password: (162) Wed Apr 12 11:30:39 2017: Debug: Received Access-Request Id 7 from 194.183.95.46:55808 to 194.183.95.46:1812 length 276 (162) Wed Apr 12 11:30:39 2017: Debug: User-Name = "testuser" (162) Wed Apr 12 11:30:39 2017: Debug: Calling-Station-Id = "E8-3A-12-EF-30-CE" (162) Wed Apr 12 11:30:39 2017: Debug: Framed-MTU = 1400 (162) Wed Apr 12 11:30:39 2017: Debug: NAS-Port-Type = Wireless-802.11 (162) Wed Apr 12 11:30:39 2017: Debug: Connect-Info = "rad_eap_test + eapol_test" (162) Wed Apr 12 11:30:39 2017: Debug: NAS-IP-Address = 172.16.0.4 (162) Wed Apr 12 11:30:39 2017: Debug: EAP-Message = 0x02070090190017030100207ca8e68f9cc0712a093735da2c9a7a8f8880c35df3bb05407fc2ca022b33575d1703010060960e2f55b1a94c96a4197759099aaafdcabbaa6c6c0583b1c26e354da196fc30abcab796cdf83f4bc110a14559904b992bdfff46e30d60b9d6548342b5ea2fa87d4fbd3392353b (162) Wed Apr 12 11:30:39 2017: Debug: State = 0xe50e637de3097a45c917c73821ab3033 (162) Wed Apr 12 11:30:39 2017: Debug: Message-Authenticator = 0x79e6229a110fd499293f527c2f93be25 (162) Wed Apr 12 11:30:39 2017: Debug: session-state: No cached attributes (162) Wed Apr 12 11:30:39 2017: Debug: # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim (162) Wed Apr 12 11:30:39 2017: Debug: authorize { (162) Wed Apr 12 11:30:39 2017: Debug: policy filter_username { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) -> TRUE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ / /) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ / /) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /@[^@]*@/ ) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /@[^@]*@/ ) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.\./ ) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.\./ ) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (162) Wed Apr 12 11:30:39 2017: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.$/) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.$/) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /(a)\./) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /(a)\./) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: } # if (&User-Name) = notfound (162) Wed Apr 12 11:30:39 2017: Debug: } # policy filter_username = notfound (162) Wed Apr 12 11:30:39 2017: Debug: auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (162) Wed Apr 12 11:30:39 2017: Debug: auth_log: --> /var/log/radius/radacct/194.183.95.46/auth-detail-20170412 (162) Wed Apr 12 11:30:39 2017: Debug: auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/194.183.95.46/auth-detail-20170412 (162) Wed Apr 12 11:30:39 2017: Debug: auth_log: EXPAND %t (162) Wed Apr 12 11:30:39 2017: Debug: auth_log: --> Wed Apr 12 11:30:39 2017 (162) Wed Apr 12 11:30:39 2017: Debug: [auth_log] = ok (162) Wed Apr 12 11:30:39 2017: Debug: [chap] = noop (162) Wed Apr 12 11:30:39 2017: Debug: [mschap] = noop (162) Wed Apr 12 11:30:39 2017: Debug: eap: Peer sent EAP Response (code 2) ID 7 length 144 (162) Wed Apr 12 11:30:39 2017: Debug: eap: Continuing tunnel setup (162) Wed Apr 12 11:30:39 2017: Debug: [eap] = ok (162) Wed Apr 12 11:30:39 2017: Debug: } # authorize = ok (162) Wed Apr 12 11:30:39 2017: Debug: Found Auth-Type = eap (162) Wed Apr 12 11:30:39 2017: Debug: # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim (162) Wed Apr 12 11:30:39 2017: Debug: authenticate { (162) Wed Apr 12 11:30:39 2017: Debug: eap: Expiring EAP session with state 0xcb16895fcb11935b (162) Wed Apr 12 11:30:39 2017: Debug: eap: Finished EAP session with state 0xe50e637de3097a45 (162) Wed Apr 12 11:30:39 2017: Debug: eap: Previous EAP request found for state 0xe50e637de3097a45, released from the list (162) Wed Apr 12 11:30:39 2017: Debug: eap: Peer sent packet with method EAP PEAP (25) (162) Wed Apr 12 11:30:39 2017: Debug: eap: Calling submodule eap_peap to process data (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Continuing EAP-TLS (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: [eaptls verify] = ok (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Done initial handshake (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: [eaptls process] = ok (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Session established. Decoding tunneled attributes (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: PEAP state phase2 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: EAP method MSCHAPv2 (26) (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Got tunneled request (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: EAP-Message = 0x020700431a0207003e31b91e9f531a076d578b11807fa0c5e5570000000000000000c26b0fb3fc605a0e49b6dfc821e07a674b6f65c9e16dd07b007465737475736572 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Setting User-Name to testuser (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Sending tunneled request to wifi_tim_inner_tunnel (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: EAP-Message = 0x020700431a0207003e31b91e9f531a076d578b11807fa0c5e5570000000000000000c26b0fb3fc605a0e49b6dfc821e07a674b6f65c9e16dd07b007465737475736572 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: User-Name = "testuser" (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: State = 0xcb16895fcb11935b1be4d67ff3649f78 (162) Wed Apr 12 11:30:39 2017: Debug: Virtual server wifi_tim_inner_tunnel received request (162) Wed Apr 12 11:30:39 2017: Debug: EAP-Message = 0x020700431a0207003e31b91e9f531a076d578b11807fa0c5e5570000000000000000c26b0fb3fc605a0e49b6dfc821e07a674b6f65c9e16dd07b007465737475736572 (162) Wed Apr 12 11:30:39 2017: Debug: FreeRADIUS-Proxied-To = 127.0.0.1 (162) Wed Apr 12 11:30:39 2017: Debug: User-Name = "testuser" (162) Wed Apr 12 11:30:39 2017: Debug: State = 0xcb16895fcb11935b1be4d67ff3649f78 (162) Wed Apr 12 11:30:39 2017: WARNING: Outer and inner identities are the same. User privacy is compromised. (162) Wed Apr 12 11:30:39 2017: Debug: server wifi_tim_inner_tunnel { (162) Wed Apr 12 11:30:39 2017: Debug: session-state: No cached attributes (162) Wed Apr 12 11:30:39 2017: Debug: # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim_inner_tunnel (162) Wed Apr 12 11:30:39 2017: Debug: authorize { (162) Wed Apr 12 11:30:39 2017: Debug: policy filter_username { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) -> TRUE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ / /) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ / /) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /@[^@]*@/ ) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /@[^@]*@/ ) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.\./ ) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.\./ ) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (162) Wed Apr 12 11:30:39 2017: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.$/) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.$/) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /(a)\./) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /(a)\./) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: } # if (&User-Name) = notfound (162) Wed Apr 12 11:30:39 2017: Debug: } # policy filter_username = notfound (162) Wed Apr 12 11:30:39 2017: Debug: [chap] = noop (162) Wed Apr 12 11:30:39 2017: Debug: [mschap] = noop (162) Wed Apr 12 11:30:39 2017: Debug: eap: Peer sent EAP Response (code 2) ID 7 length 67 (162) Wed Apr 12 11:30:39 2017: Debug: eap: No EAP Start, assuming it's an on-going EAP conversation (162) Wed Apr 12 11:30:39 2017: Debug: [eap] = updated (162) Wed Apr 12 11:30:39 2017: Debug: wifi_tim_files: users: Matched entry testuser at line 13 (162) Wed Apr 12 11:30:39 2017: Debug: [wifi_tim_files] = ok (162) Wed Apr 12 11:30:39 2017: WARNING: pap: Auth-Type already set. Not setting to PAP (162) Wed Apr 12 11:30:39 2017: Debug: [pap] = noop (162) Wed Apr 12 11:30:39 2017: Debug: } # authorize = updated (162) Wed Apr 12 11:30:39 2017: Debug: Found Auth-Type = eap (162) Wed Apr 12 11:30:39 2017: Debug: # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim_inner_tunnel (162) Wed Apr 12 11:30:39 2017: Debug: authenticate { (162) Wed Apr 12 11:30:39 2017: Debug: eap: Expiring EAP session with state 0xcb16895fcb11935b (162) Wed Apr 12 11:30:39 2017: Debug: eap: Finished EAP session with state 0xcb16895fcb11935b (162) Wed Apr 12 11:30:39 2017: Debug: eap: Previous EAP request found for state 0xcb16895fcb11935b, released from the list (162) Wed Apr 12 11:30:39 2017: Debug: eap: Peer sent packet with method EAP MSCHAPv2 (26) (162) Wed Apr 12 11:30:39 2017: Debug: eap: Calling submodule eap_mschapv2 to process data (162) Wed Apr 12 11:30:39 2017: Debug: eap_mschapv2: # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim_inner_tunnel (162) Wed Apr 12 11:30:39 2017: Debug: eap_mschapv2: authenticate { (162) Wed Apr 12 11:30:39 2017: Debug: mschap: Found Cleartext-Password, hashing to create NT-Password (162) Wed Apr 12 11:30:39 2017: Debug: mschap: Found Cleartext-Password, hashing to create LM-Password (162) Wed Apr 12 11:30:39 2017: Debug: mschap: Creating challenge hash with username: testuser (162) Wed Apr 12 11:30:39 2017: Debug: mschap: Client is using MS-CHAPv2 (162) Wed Apr 12 11:30:39 2017: ERROR: mschap: MS-CHAP2-Response is incorrect (162) Wed Apr 12 11:30:39 2017: Debug: [mschap] = reject (162) Wed Apr 12 11:30:39 2017: Debug: } # authenticate = reject (162) Wed Apr 12 11:30:39 2017: Debug: MSCHAP-Error: E=691 R=1 C=1474492f8f426051613ac0fd4afe37b8 V=3 M=Authentication failed (162) Wed Apr 12 11:30:39 2017: Debug: Found new challenge from MS-CHAP-Error: err=691 retry=1 challenge=1474492f8f426051613ac0fd4afe37b8 (162) Wed Apr 12 11:30:39 2017: ERROR: MSCHAP Failure (162) Wed Apr 12 11:30:39 2017: Debug: eap: Sending EAP Request (code 1) ID 8 length 81 (162) Wed Apr 12 11:30:39 2017: Debug: eap: EAP session adding &reply:State = 0xcb16895fca1e935b (162) Wed Apr 12 11:30:39 2017: Debug: [eap] = handled (162) Wed Apr 12 11:30:39 2017: Debug: } # authenticate = handled (162) Wed Apr 12 11:30:39 2017: Debug: } # server wifi_tim_inner_tunnel (162) Wed Apr 12 11:30:39 2017: Debug: Virtual server sending reply (162) Wed Apr 12 11:30:39 2017: Debug: EAP-Message = 0x010800511a0407004c453d36393120523d3120433d313437343439326638663432363035313631336163306664346166653337623820563d33204d3d41757468656e7469636174696f6e206661696c6564 (162) Wed Apr 12 11:30:39 2017: Debug: Message-Authenticator = 0x00000000000000000000000000000000 (162) Wed Apr 12 11:30:39 2017: Debug: State = 0xcb16895fca1e935b1be4d67ff3649f78 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Got tunneled reply code 11 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: EAP-Message = 0x010800511a0407004c453d36393120523d3120433d313437343439326638663432363035313631336163306664346166653337623820563d33204d3d41757468656e7469636174696f6e206661696c6564 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: State = 0xcb16895fca1e935b1be4d67ff3649f78 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Got tunneled Access-Challenge (162) Wed Apr 12 11:30:39 2017: Debug: eap: Sending EAP Request (code 1) ID 8 length 123 (162) Wed Apr 12 11:30:39 2017: Debug: eap: EAP session adding &reply:State = 0xe50e637de2067a45 (162) Wed Apr 12 11:30:39 2017: Debug: [eap] = handled (162) Wed Apr 12 11:30:39 2017: Debug: } # authenticate = handled (162) Wed Apr 12 11:30:39 2017: Debug: Using Post-Auth-Type Challenge (162) Wed Apr 12 11:30:39 2017: Debug: # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim (162) Wed Apr 12 11:30:39 2017: Debug: Challenge { ... } # empty sub-section is ignored (162) Wed Apr 12 11:30:39 2017: Debug: Sent Access-Challenge Id 7 from 194.183.95.46:1812 to 194.183.95.46:55808 length 0 (162) Wed Apr 12 11:30:39 2017: Debug: EAP-Message = 0x0108007b19001703010070ebc34da12bb045acd32080fe40bc92495c6593a5e40589775105ef0f5c76cffda64ca3039931242118be0db1a39bdd811a876d7bc9e111e9e28ee633e50ceae1b4a66367000e3990c542a0aa3227b3673d58dd69d1b006db31a8859ae1fe63416e1253dec50b6fb4959a4e51 (162) Wed Apr 12 11:30:39 2017: Debug: Message-Authenticator = 0x00000000000000000000000000000000 (162) Wed Apr 12 11:30:39 2017: Debug: State = 0xe50e637de2067a45c917c73821ab3033 (162) Wed Apr 12 11:30:39 2017: Debug: Finished request no more packets are exchanged... Thanks, Andrea -- ---------------------------------------------------------------- Truth hurts... not the searching after but the running from. ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini(a)telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm

3 11

Windows 7, wired 802.1x, native EAP-TLS w/o AD, NPS
by Timo Buhrmester 18 Apr '17

18 Apr '17

Hello list, I'm trying to implement 802.1x/EAP-TLS on a wired network. Getting that to work on Linux clients was reasonably straightforward using wpa_supplicant (and freeradius as the back-end). However, we also have Windows (7) clients on the network, and I'm having issues setting that up. It is my understanding that a) EAP-TLS is mandatory for systems that claim to support 802.1x b) Windows claims to support 802.1x. Unfortunately, every resource I could find either assumes there's an Active Directory infrastructure (which, fortunately, we don't use here) and other shady things involved (NPS -- seems to be sort of an ersatz-radius), OR talks about wireless, OR refers to other versions of Windows, OR ... None seems to describe the combination Windows 7, native supplicant, freeradius, no AD/NPS. So my question, although not directly freeradius-related, is: Does anyone have experience setting up EAP-TLS on a wired network on Windows 7 clients? Is AD strictly required? If so, I wonder how Windows could get away claiming to support 802.1x. I.e.: Does anybody know whether this is possible *at all*? I'm already considering trying 3rd party supplicants, but I'd much rather go with the native one. Thanks, Timo

5 13

tip: note about -sql and -ldap
by Alan Buxey 17 Apr '17

17 Apr '17

hi, just to remind people, with version 3 of the FreeRADIUS server, a new feature arrived which was/is called "Conditional modules". TL;DR -sql and -ldap are calls to the SQL and LDAP modules respectively that work if those modules are configured and enabled The conditional modules feature is documented in very few locations , the main reference source in the configuration files being the mods-available/README.rst file (if using a distribution version then I really hope they keep that file present!) this can be found online here: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai… what this feature means is that as the default server ships, the config files have a lots of features ready for use but not active. all you need to do is configure either sql or ldap modules (or both!), link the mods-available to mods-enabled and then the server will read the module config, note that SQL and/or LDAP are configured and then automatically use them - previously if you wanted to use SQL or LDAP, not only did you have to configure the modules but you then also had to try guessing where to stick the 'sql' or 'ldap' calls into the configuration - a nice game of whack-a-mole that many people failed at, sticking the calls into all kinds of places ;-) note, as it says in the documentation , not very useful for production environments because normally by then you will know what modules/options you want and whether you need/want any of those modules...at which point, you comment out the non needed stuff and can convert (or would convert ) -sql into sql etc as you know its configured and you want it. personally, would like to see many other modules become conditional so the server works out of the box and you just configure the modules/features you want, then go through removing all the modules not needed (flagged in debug yellow with "Ignoring module....." ) rather than guessing if something is needed....a final pass would then convert all remaining -module with module. et voila! :) alan

1 0

RE: Acct-Status-Type = 7 [SOLVED]
by Oscar Jofre 17 Apr '17

17 Apr '17

Hi, [SOLVED] As you told Alan, I did uncomment on accounting if (noop) { ok } And then on production Accounting-on worked with user informed and user not informed. But I wandered why on TEST environment with that lines comment worked. Finally a saw the differences. If you have uncommented details on accounting section then Accounting-on works always, with user informed and not informed --> that’s why on TEST was working, and on production that details are commented the Accounting-on with no user defined was not responding. So: THIS WORKS: accounting { ... detail ... # if (noop) { # ok # } } THIS WORKS: accounting { ... # detail ... if (noop) { ok } } THIS DOESN'T WORKS: accounting { ... # detail ... # if (noop) { # ok # } } All have an explanation for me at the end ! Thanks for the help ! -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: lunes, 17 de abril de 2017 19:02 Para: FreeRadius users mailing list Asunto: Re: Acct-Status-Type = 7 On Apr 17, 2017, at 12:41 PM, Oscar Jofre <oscar(a)jofre.com> wrote: > I wish no need to try for hours, but even I'm a developer I don't have the deep knowledge about radius and even linux environment ... can't know about everything...\ The idea is simple: follow the instructions on this list. When I say to post the debug log, I mean for you to post all of it. All of the documentation makes this clear. When you post part of the debug log, you are making it difficult for us to help you. > I wish you to point me to the correct instructions, I've read many pages about radius debugging, I've tried, trust me, to figure out by myself ... but still with no understand where is the difference. Then post the debug log and let *us* help. It's not hard. > I really appreciate you help ! > > The packets should be exactly the same (no username in both requests and different result). I'm sure I missing something ... It doesn't need a User-Name attribute. The NAS is rebooting. There's no "user". > If you need any more detail please let me know and I will the all to give necessary informations. That was enough. The short answer is to go to the file raddb/sites-enabled/default. In the "accounting" section after the "sql" module, add: if (noop) { ok } There should already be code like that in the file, but commented out. > I don’t understand about: It's in the FAQ, "man" pages, web pages, and pretty much daily on this list When I say to post the debug log. It's mentioned EVERYWHERE in the documentation, and daily on this list. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Acct-Status-Type = 7
by Oscar Jofre 17 Apr '17

17 Apr '17

Hi Alan and thanks, About last answer i will check it but the accounting on should response anything ? Thanks. -------- Mensaje original -------- De: Alan DeKok <aland(a)deployingradius.com> Fecha: 14/4/17 1:41 (GMT+01:00) Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Asunto: Re: Acct-Status-Type = 7 On Apr 13, 2017, at 5:56 PM, Oscar Jofre <oscar(a)jofre.com> wrote: > When I reboot a mikrotik with hotspot + radius activated, after reboot the > router sends Acct-Status-Type = 7. Which is "Accounting On". It's best to use names instead of numbers. They're more informative. > What I understand is that with this Acct-Status-Type = 7 the mikrotik tells > radius that router has rebooted and then radius close all connections with > NAS-Reboot. Yes. > What happens in my case is that freeradius is not responding the > Acct-Status-Type = 7 and then mikrotik thinks that and accumulate timeoute > from raiuds. Well, run the server in debugging mode to see what it's doing. As suggested in the FAQ, web pages, "man" pages, and daily on this list. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 9

Matching in VSA
by Noah 14 Apr '17

14 Apr '17

Hi there freeradius list, I need to be able to match a client request with a specific key. I generally do this by matching IPs in the clients.conf file. Is there any way to match to a Vendor specific attribute? For instance if the request comes in from a specific vendor-id in the request I could match based on that and a specific radius secret key is used for the radius authentication session. Cheers, Noah

3 10

Acct-Status-Type = 7
by Oscar Jofre 13 Apr '17

13 Apr '17

Hi, When I reboot a mikrotik with hotspot + radius activated, after reboot the router sends Acct-Status-Type = 7. What I understand is that with this Acct-Status-Type = 7 the mikrotik tells radius that router has rebooted and then radius close all connections with NAS-Reboot. What happens in my case is that freeradius is not responding the Acct-Status-Type = 7 and then mikrotik thinks that and accumulate timeoute from raiuds. Mikroitk keeps trying Acct-Status-Type = 7 and accumulates tiemouts. When the first users connects, then mikrotik sends Access-Request and after Access-Accept starts accounting. But then after that mikrotik sends another and LAST Acct-Status-Type = 7 that makes this firs connection to close with NAS-Reboot. After that everything goes ok but I have a user connected with NAS-Reboot on Radius. I did send this behavior to mikrotik. My question is if it is correct that mikrotik is not reciving response from Acct-Status-Type = 7 or maybe I have some misconfiguration on freeradius. I'm using FreeRADIUS Version 3.0.10 Thanks !

2 1

question about default site file
by Bill Schoolfield 13 Apr '17

13 Apr '17

I'm writing a little tool that our clients will execute to configure their freeradius instance (given a stock - nothing changed yet setup). Basically it parses the various setup files and makes substitutions, changes, etc. The idea here is the client won't (shouldn't) edit the files manually. Anyway I noticed that the files ship with sql module directives with a prefixed dash. Ie. -sql What's the meaning of this? Couldn't find it documented anywhere. Another comment method? Something else? Bill

3 3

freeradius, mysql and encrypted columns
by petr.linke＠seznam.cz 13 Apr '17

13 Apr '17

Hi, I have very simple question: Is it possible to use encrypted columns in freeradius? I wish to hide 'sensitive' data (cleartext-password in radcheck table, secret in nas table ...) from simple raw reading block device, where the mysql tables are stored. One way is to use LUKS (but here is performance storage impact), second way is encrypting on database level. And where is the problem: If in freeradius is used nas table and nas query from default, all works perfectly. But if I use encrypted columns - for example modified nas query like: nas_query = "SELECT id, nasname, shortname, type, DES_DECRYPT(secret), server FROM ${nas_table}", freeradius stops resolving clients from nas table. In column secret in nas table is des_encrypted value given by des_encrypt('some_secret',1), mysql is started with one key slot in key-file as a key for encryption. example: cleartext column secret in the nas table, nas_query is set to: "SELECT id, nasname, shortname, type, secret, server FROM ${nas_table}" result executing the nas query: SELECT id, nasname, shortname, type, secret, server FROM nas; +----+-------------------+-------------+-------+--------+--------+ | id | nasname | shortname | type | secret | server | +----+-------------------+-------------+-------+--------+--------+ | 6 | 10.255.246.120/32 | client test | other | test | NULL | +----+-------------------+-------------+-------+--------+--------+ - all works works fine - result from radtest: radtest user password 10.255.246.120 1 test Sending Access-Request of id 113 to 10.255.246.120 port 1812 User-Name = "user" User-Password = "password" NAS-IP-Address = 10.255.246.120 NAS-Port = 1 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 10.255.246.120 port 1812, id=113, length=37 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "123" But when I put into column secret des_encrypted value, and modify the nas query to: "SELECT id, nasname, shortname, type, DES_DECRYPT(secret), server FROM ${nas_table}", freeradius stops resolving correctly the clients from nas table, and in freeradius log appears: Ignoring request to authentication address 10.255.246.120 port 1812 from unknown client 10.255.246.120 port 56837 but the result from modified nas query with encrypted column secret is the same as query result with cleartext secret: SELECT id, nasname, shortname, type, DES_DECRYPT(secret), server FROM nas; +----+-------------------+-------------+-------+---------------------+--------+ | id | nasname | shortname | type | DES_DECRYPT(secret) | server | +----+-------------------+-------------+-------+---------------------+--------+ | 6 | 10.255.246.120/32 | client test | other | test | NULL | +----+-------------------+-------------+-------+---------------------+--------+ The same situation is with encrypted column Value in radcheck or radgroupcheck table. It looks that when some columns are encrypted and in the query is used DES_DECRYPT() function, freeradius has problem to fill the value from encypted columns into internal variables. For example in debug from freeradius is (encrypted column Value in radcheck table): [pap] Using clear text password "" - it looks that freeradius do not take DES_DECRYPT(Value) from radcheck table. Thank you for answer, Petr Linke

2 3

Install Freeradius in Centos7 with Perl support
by Fabian Borot 13 Apr '17

13 Apr '17

Hi I installed freeradius-server-3.0.13 on centos7 from http://networkradius.com/doc/FreeRADIUS%20Technical%20Guide.pdf THE FREERADIUS TECHNICAL GUIDE HAPTER NTRODUCTION WHAT ... networkradius.com Copyright (C) 2014 Network RADIUS SARL 1 of 58 THE FREERADIUS TECHNICAL GUIDE CHAPTER 1 - INTRODUCTION WHAT IS FREERADIUS? Chapter 1 - Introduction I proceedd with the regular, configure, make, make install steps but I saw a lot of warnings about messing dependencies and as I was noticing them I added them to a yum install list, see below yum install net-snmp net-snmp-utils libtalloc-devel unixODBC-devel unixODBC openssl openssl-devel perl-ExtUtils-CBuilder perl-ExtUtils-MakeMaker wireshark mysql-devel libmemcached libmemcached-devel libpcap-devel perl-devel python-devel freeradius-perl freeradius-python freeradius-unixODBC -y but I still cant get the perl module as shown below when doing the config part === configuring in src/modules/rlm_perl (/usr/src/freeradius-server-3.0.13/src/modules/rlm_perl) checking whether perl executable path has been provided... no checking for perl... /bin/perl Can't locate ExtUtils/Embed.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .). BEGIN failed--compilation aborted. Can't locate ExtUtils/Embed.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .). BEGIN failed--compilation aborted. checking for perl.h... no checking for perl.h in /usr/local/include/... no checking for perl.h in /opt/include/... no configure: WARNING: silently not building rlm_perl. configure: WARNING: FAILURE: rlm_perl requires: EXTERN.h EXTERN.h libperl.so libperl.so. please advise... thank you fborot

3 6