June 2017 - Freeradius-Users - lists.freeradius.org

is there a way to identify the very first ACCESS-REQUEST
by Michael Hocke 16 Mar '18

16 Mar '18

Hi there, I want to improve our logging and want to keep track of authentication attempts that do not complete. I was thinking of logging the very first ACCESS-REQUEST and then later on the result. Is there a good way to identify the very first ACCESS-REQUEST from the client with unlang? Maybe by checking the contents of the session-state list or some such? Any ideas? Thanks! - Michael

4 6

Terminate EAP-TTLS then proxy
by adrian.p.smith＠bt.com 22 Sep '17

22 Sep '17

I would like to be able to proxy the Auth request after terminating the EAP-TTLS. FreeRadius sees the realm prefix on the User-Name and wants to proxy first. Is this possible or even sensible please? Regards, Adrian

6 20

Crashes FreeRadius 3.0.11 using rlm_rest/libcurl + rlm_cache_rbtree
by RANJALAHY RASOLOFOMANANA, Bija 01 Sep '17

01 Sep '17

Hi all, We are frequently facing a crash of our freeradius server on live production environment (8 times in 2 months). The crash can't be reproduced on our test environment so we need help. Sometimes, we have a core dump (case 1- the server crashes), sometimes, we don't (case 2- the server freezes). Unfortunately, the core dumps don't provide useful informations: Here are examples of the core dumps : core 1: #0 0x00000034b680f5db in ?? () #1 0x00007fa718d066c6 in ?? () #2 0x0000000000000000 in ?? () core 2: #0 0x00000034b680f5db in ?? () #1 0x00007f169f94e6c6 in ?? () #2 0x0000000000000000 in ?? () Freeradius version : 3.0.11 Context : our server sends REST request to a http server to retrieve data which are then stored in a cache during 1 hour. The problem started when we added this feature. Leads : 1- The server logs all http requests that are sent. Somehow, the line log is truncated when the problem appears. Maybe, it is just a coincidence but we are suspecting this part. We use the rlm_rest module + libcurl to make our requests. Have you encountered a problem using those module/library ? We tried to upgrade libcurl from 7.50.3 to 7.54.0 but this doesn't fix the problem. 2- In the case 2 (the server freezes), we've got the following message in our log files: Mon Jun 26 22:00:31 2017 : Error: (10180900) Ignoring duplicate packet from client xxx port 21665 - ID: 164 due to unfinished request in component authorize module <our cache module> Our cache module is based on the rlm_cache_rbtree module: cache <cache name> { driver = "rlm_cache_rbtree" Have you encountered a problem using rlm_cache_rbtree module ? Thanks for your help. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

5 11

Freeradius Proxy - Framed IP Address Accounting attribute
by Byron Jeffery 01 Sep '17

01 Sep '17

Hi All We are trailing a wifi system that does not send through the Framed IP Address attribute to our accounting server after the clients have successfully authenticated (EAP-PEAP-MSCHAP authentication) against a FreeRadius server hosted at another site within our WAN. I am of the mindset of setting up a Freeradius proxy server locally onsite with the purpose of sending back an accounting start with the Framed IP Address attribute to the accounting server but am unsure if this is even possible as I am unsure if the freeradius server would be able to determine the clients IP address as only the clients MAC address is passed to the radius server during authentication. I was unable to find any documentation that would support this, and would hope that someone could point me in the right direction. - Regards - Byron

5 21

Discarding conflicting packet due to recent request
by khouzam yaghi 20 Jul '17

20 Jul '17

i am receiving this error from time to time in the radius log Error: Discarding conflicting packet from client PPPOE1 port 33184 - ID: 1 due to recent request i searched online and found very old posts about this error, what does it mean? is it something related to the database slow? or broken NAS? my NAS is a Linux server running accel-ppp as a pppoe-server. is this something related to the NAS itself or to my configuration with freeradius? also what does this error means? Regards.

2 1

Windows mobile unable to authenticate [FreeRadius+Active directory]
by Burn Zero 07 Jul '17

07 Jul '17

Hi, FreeRadius version 3.0.13 We are using FreeRadius+Active directory setup in our environment to authenticate users for the WIFI. The clients are authenticated using server side cert + their Active directory credentials. This is working properly except windows phone users. Users who own windows phone are unable to authenticate via Freeradius. Below is the debug error log when they try to connect WIFI. (5829) Mon Jun 5 07:53:43 2017: Debug: eap: Calling submodule eap_peap to process data (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: Continuing EAP-TLS (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: [eaptls verify] = ok (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: Done initial handshake (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: [eaptls process] = ok (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: Session established. Decoding tunneled attributes (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: PEAP state send tlv success (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: Received EAP-TLV response (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: Client rejected our response. The password is probably incorrect (5829) Mon Jun 5 07:53:43 2017: ERROR: eap_peap: We sent a success, but the client did not agree (5829) Mon Jun 5 07:53:43 2017: ERROR: eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed (5829) Mon Jun 5 07:53:43 2017: Debug: eap: Sending EAP Failure (code 4) ID 11 length 4 (5829) Mon Jun 5 07:53:43 2017: Debug: eap: Failed in EAP select Does any one of you know what the problem is? Thank in advance for the help.

3 8

Change username for MSCHAPv2
by Gabriele Verzeletti 03 Jul '17

03 Jul '17

Hello, I have a freeradius 3.0.10-1.1 running on openSUSE leap. I need to authenticate users for WiFi access WPA2 Enterprise, using PEAP and MSCHAPv2 against Active directory. User account are identified by userPrinciplaName, but ntlm_auth is not able to authenticate using this attribute, it looks into samAccountName. With an external script I'm able to performa a query on active directory and retrieve the samAccountName, but if I update the attribute User-Name using authorize { update request { User-Name := `/path/to/my/script '%{User-Name}'` } .. .. .. I have an error in the log (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap: Identity does not match User-Name, setting from EAP Identity (0) eap: Failed in handler (0) [eap] = invalid (0) } # authenticate = invalid Is there any way to perform this account translation before send request to EAP ? Thanks to all Gab

3 7

getting access-reject not sure why
by Andrew Meyer 30 Jun '17

30 Jun '17

So I decided to blow away my FreeRADIUS v3 setup to authenticate from my cisco devices. I am doing this for documentation purposes. I am currently running CentOS 7.3. Here is what I have in my users file: test1 Cleartext-Password := "hello" Service-Type = Administrative-User, Auth-Type := Accept, Reply-Message := "Hello, %{User-Name}", Cisco-AVPair = "shell:roles=network-admin", Cisco-AVPair = "shell:priv-lvl=15" Here is my clients config: clients network-equipment { ipaddr = 10.150.1.0/24 secret = Infotech5! nas_type = cisco shortname = network-equipment } clients linux-servers { ipaddr = 10.150.10.0/24 secret = Infotech5! proto = * nas_type = other shortname = linux-servers } Everything else is default. Here is the debug output log: Ready to process requests Waking up in 0.3 seconds. (1) Received Access-Request packet from host 10.150.1.213 port 1645, id=11, length=98 (1) User-Name = 'test1' (1) Reply-Message = 'Password: ' (1) User-Password = '\305ɥ\273\306\335\026\257l{\033)z\017\343o' (1) NAS-Port = 1 (1) NAS-Port-Type = Virtual (1) Calling-Station-Id = '10.150.1.250' (1) NAS-IP-Address = 10.150.1.213 (1) NAS-Identifier = 'ASMCAP1' (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) # Executing group from file /etc/raddb/sites-enabled/default (1) pap : Login attempt with password (1) ERROR: pap : Cleartext password does not match "known good" password (1) pap : Passwords don't match (1) # Executing group from file /etc/raddb/sites-enabled/default Waking up in 0.6 seconds. (1) Sending Access-Reject packet to host 10.150.1.213 port 1645, id=11, length=0 (1) Reply-Message = 'Hello, test1' Waking up in 3.9 seconds. Ready to process requests Waking up in 0.3 seconds. (2) Received Access-Request packet from host 10.150.1.213 port 1645, id=11, length=98 (2) User-Name = 'test1' (2) Reply-Message = 'Password: ' (2) User-Password = '\305ɥ\273\306\335\026\257l{\033)z\017\343o' (2) NAS-Port = 1 (2) NAS-Port-Type = Virtual (2) Calling-Station-Id = '10.150.1.250' (2) NAS-IP-Address = 10.150.1.213 (2) NAS-Identifier = 'ASMCAP1' (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) # Executing group from file /etc/raddb/sites-enabled/default (2) pap : Login attempt with password (2) ERROR: pap : Cleartext password does not match "known good" password (2) pap : Passwords don't match (2) # Executing group from file /etc/raddb/sites-enabled/default Waking up in 0.6 seconds. (2) Sending Access-Reject packet to host 10.150.1.213 port 1645, id=11, length=0 (2) Reply-Message = 'Hello, test1' Waking up in 3.9 seconds. I don't understand why i'm getting a denied packet.

4 12

Linux PAM Authentication failed: Non-Local users
by Anand Neeli 30 Jun '17

30 Jun '17

Hello, I'm sure my query might have already been discussed. But couldnt search the mailing list. Can anyone please show pointers or answer this? I'm trying to perform Radius based authentication of any guest user using Linux PAM module 1.0 As radius client, pam_radius-1.3.17 plugin is used and freeradius server is used as Radius Server. I have performed the Radius client and server configurations according to the guidelines. I added the radius entry in /etc/pam.d/sshd: #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug While i am trying of perform authentication of users, following are the outcomes depending upon user (trying to login) is locally configured or not. Users are trying to log-in via ssh. Both Users A and B are configured in Radius Server 1. If user A (locally configured in Linux M/C) tries to login, then Linux PAM gets the user/password information and send it to radius server. Radius Server authenticates the user/password in its database and sends successful acknowledgement to linux m/c. User is allowed to login. 2. If user B (not configured in Linux M/C) login, then Authentication is being rejected by Radius Server. Radius Server logs are showing that password in either malformed/incorrect ********************************************************************************************************************************************************************************************************************* Radius Server Logs: rad_recv: Access-Request packet from host 127.0.0.1:27138, id=117, length=91 User-Name = "abcd" User-Password = "\010\n\INCORRECT" NAS-IP-Address = 172.21.142.4 NAS-Identifier = "linux" NAS-Port = 26113 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "172.21.142.140" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "abcd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [abcd/\010\n\INCORRECT] (from client localhost port 26113 cli 172.21.142.140) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! ********************************************************************************************************************************************************************************************************************* SSHD Logs: May 27 13:14:07 localho sshd[26113]: debug1: PAM: initializing for "abcd" May 27 13:14:07 localho sshd[26113]: debug1: PAM: setting PAM_RHOST to "172.21.142.140" May 27 13:14:07 localho sshd[26113]: debug1: PAM: setting PAM_TTY to "ssh" May 27 13:14:09 localho sshd[26113]: pam_radius_auth: Got user name abcd May 27 13:14:09 localho sshd[26113]: pam_radius_auth: Sending RADIUS request code 1 May 27 13:14:09 localho sshd[26113]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -1768845152. May 27 13:14:10 localho sshd[26113]: pam_radius_auth: RADIUS server 127.0.0.1 failed to respond May 27 13:14:10 localho sshd[26113]: pam_radius_auth: All RADIUS servers failed to respond. May 27 13:14:10 localho sshd[26113]: pam_radius_auth: authentication failed May 27 13:14:10 localho sshd(pam_unix)[26113]: check pass; user unknown May 27 13:14:10 localho sshd(pam_unix)[26113]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.21.142.140 May 27 13:14:13 localho sshd[26113]: debug1: PAM: password authentication failed for an illegal user: Authentication failure May 27 13:14:13 localho sshd[26113]: Failed password for invalid user abcd from ::ffff:172.21.142.140 port 36124 ssh2 ********************************************************************************************************************************************************************************************************************* After reading through couple of forums, i got the hint this is the way PAM works. Linux PAM has restriction to have user-id configured locally on Linux M/C for successful Radius Authentication But if we have the case of thousands of guest users, then it is not possible to add every user in machine itself. I am willing to know: 1. Is this is the way how PAM works. Is this limitation is present in PAM 2. I am using Linux PAM 1.0. Is there any patch/fix available in higher version of PAM? 3. Is there any way to overcome this issue by using some other libpam-radius-auth plugin. Though i do not think it is Radius client plugin issue. It will be really helpful if you can help/suggest me in this regards. Regards, Anand Neeli

2 5

LDAPS problem while migrating from 2 to 3
by Olivier 30 Jun '17

30 Jun '17

Hi, I have a working environment based on FreeRadius 2.2 and OpenLDAP 2.4. It binds to the LDAP server on ldaps://ldap.cs.ait.ac.th/ I am trying to upgrade to FreeRadius (3.0.14) and if I can bind to ldap://..., I cannot bind to ldaps://... Thu Jun 29 13:12:38 2017 : Debug: # Instantiating module "ldap_firewall" from file /usr/local/etc/raddb/mods-enabled/ldap Thu Jun 29 13:12:38 2017 : Info: rlm_ldap: libldap vendor: OpenLDAP, version: 20441 Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Couldn't find configuration for accounting, will return NOOP for calls from this section Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Couldn't find configuration for post-auth, will return NOOP for calls from this section Thu Jun 29 13:12:38 2017 : Debug: LDAP server string: ldaps://ldap.cs.ait.ac.th:636 Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Using local pool section Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): No pool reference found for config item "ldap_firewall.pool" Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Initialising connection pool ... Thu Jun 29 13:12:38 2017 : Info: rlm_ldap (ldap_firewall): Opening additional connection (0), 1 of 32 pending slots used Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Connecting to ldaps://ldap.cs.ait.ac.th:636 Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): New libldap handle 0x28e5c1e0 Thu Jun 29 13:12:38 2017 : Error: rlm_ldap (ldap_firewall): Bind with (anonymous) to ldaps://ldap.cs.ait.ac.th:636 failed: Can't contact LDAP server Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap: Closing libldap handle 0x28e5c1e0 Thu Jun 29 13:12:38 2017 : Error: rlm_ldap (ldap_firewall): Opening connection failed (0) Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Removing connection pool Thu Jun 29 13:12:38 2017 : Error: /usr/local/etc/raddb/mods-enabled/ldap[1]: Instantiation failed for module "ldap_firewall" What could I be missing? I found a reference about OpenLDAP being compiled with NSS, but being on FreeBSD, I am pretty sure that both OpenLDAP and FreeRadius us openssl. TIA, Olivier --

3 4