June 2017 - Freeradius-Users - lists.freeradius.org

Overriding a Crypt-Password with a Cleartext-Password in FR 3.x
by Bjørn Mork 06 Jun '17

06 Jun '17

I recently upgraded from FR 2.2.5 to FR 3.0.12 as part of an upgrade from Debian jessie to stretch. The config had to be migrated manually, which went mostly without problems. But there was one config pattern I have been unable to figure out how to handle in FR 3.x: I use the unix module to load crypt passwords for a few system users. But there are also some unix users without any Unix password, which should exist as RADIUS users. "no Unix password" means that the users have a /etc/shadow entry which cannot be matched. So I need to ignore the Crypt-Password attribute for these users. In FR 2.x I explicitly set the Auth-Type to foribly ignore the invalid Crypt-Password, like this: luser Cleartext-Password := "foo", Auth-Type := Local But FR 3.x refused to accept Auth-Type "Local". So I tried to modify the entry to luser Cleartext-Password := "foo" in the hope that the pap module would be smart enough to figure out that the Cleartext-Password should override the invalid Crypt-Password. It was not. Being unable to figure out the smart way, I just took the simple route out by doing luser User-Password == "foo", Auth-Type := Accept But this is a bit ugly and rightfully cause warnings like Tue Jun 6 15:05:03 2017 : Warning: Found User-Password == "..." Tue Jun 6 15:05:03 2017 : Warning: Are you sure you don't mean Cleartext-Password? Tue Jun 6 15:05:03 2017 : Warning: See "man rlm_pap" for more information so I'd really like to figure out a better way. Is there a smart way to override a Crypt-Password per user in FR 3.x? I guess I could generate crypted passwords from the cleartext passwords and simply override Crypt-Password in the users file. But that does not seem much nicer than the current User-Password match to me. What I really want is to be able to say "use this Cleartext-Password no matter what". Bjørn

2 2

add attribute with radsecproxy => wrong value@freeradius
by Michael Baye 06 Jun '17

06 Jun '17

Hello, - within radsecproxy.conf you can add simple rewrite rules with "addVendorAttribute <vendor>:<attribute>:<value>" with all numerical values just like with the other attribute configuration options. e.g.: rewrite miktest { addVendorAttribute 14988:27:2000 addVendorAttribute 14988:26:0 } - When I radtest with a client, I get: Received Access-Accept : Mikrotik_Wireless_VLANIDtype = 842018864 Attr-26.14988.26 = 0x30 => So, the number 2000 is transformed into 842018864 and 0 is transformed into 0x30. => My question is: Why is it transformed and how can I stop this? Looking at /usr/share/freeradius/dictionary.mikrotik: ATTRIBUTE Mikrotik_Wireless_VLANID 26 integer ATTRIBUTE Mikrotik_Wireless_VLANIDtype 27 integer If would be great if someone could give some hints Regards Michael

2 1

FR 3.0.12 exec_perl: ERROR: Failed to create pair &request:EAP-Message
by Thor Spruyt 06 Jun '17

06 Jun '17

Hi, I have a problem with FR 3.0.12 as a proxy with a perl modules in the authorize section which does not include the EAP-Message attributes from the incoming request into the outgoing proxy request. When I disable the perl module, the EAP-Message is proxied correctly and the problem only occurs with multiple EAP-Message attributes. I found this conversation from 11/2016 which seems to be related: http://freeradius.1045715.n5.nabble.com/PERL-and-EAL-TLS-Modul-gt-Failed-to… However, the conversation seems to have stopped without a solution or fix and I don't see anything in the release notes of 3.0.13 or 3.0.14 either... so I guess the issue has not been taken care of yet. Here's some debugging output: (1255) Received Access-Request Id 41 ... length 804 (1255) User-Name = "x" ... (1255) EAP-Message = 0x0276024819800000023e16030302061000020202006288d372a198ab690b34793275ed4eb9b448611f3cf207b5321e147bd85ce371e5d95b9f43572fab73517455ef1b3fe3eca0232825c5feb7e7233c3b08cd9d77205d49a157afa734730496f7a2b9b284654486313cc104e5f70fbd0ff2b5478549a5 ... (1255) session-state: No cached attributes (1255) # Executing section authorize from file server.conf (1255) authorize { (1255) [preprocess] = ok (1255) exec_perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'x' ... (1255) exec_perl: $RAD_REQUEST{'EAP-Message'} = &request:EAP-Message -> '0x0276024819800000023e16030302061000020202006288d372a198ab690b34793275ed4eb9b448611f3cf207b5321e147bd85ce371e5d95b9f43572fab73517455ef1b3fe3eca0232825c5feb7e7233c3b08cd9d77205d49a157afa734730496f7a2b9b284654486313cc104e5f70fbd0ff2b5478549a5d992778059693e3857f542e79b6bcca778b991167120b479ac90efc8508af066f6e600720b1f43130963f9f9299b91736210d6e3ad28eaed792800c9dff95c7df1eeae1a2bd5f18394c41476d38e8a348f2f0093890dd192695840f6e681ccc6cdb79b95fba1cd6a479d9ff8bc57312454d9203e9d19e4544650374e4f632bbb2cac4dfa501401862b3eb2152d7dc96b2d30a736233ba77600009a7ca4702d76ddd4f5e5afd9f00426ff88b8fb07902e7aacdfd76ec86847600c764177b435f8cdf2c4b44a6b62154c60640ff21ccac1105a8f0088a6e6582d7e70f525829b90a2961348e569fc71be3347280381c7d8b58d0c3a502042539092d31e73e0f44ffdfb01b618c4b0be79df064e3584c62e9374ddba8301e7afa9fcca4f286b8463b2b6d885088db0c1275873714904141ab79b62f5a8f363466c33c659d58f139cbaaf6db5b3aa7b6eececc1224c626b22bb529fba206d8816fa9da708cf223e3c50079e3378cfd37890b331f0092ad5ae62e218c3dde18d974ff24318bb16639702399448d62b92' ... (1255) exec_perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'x' (1255) exec_perl: ERROR: Failed to create pair &request:EAP-Message = $RAD_REQUEST{'EAP-Message'} -> '0x0276024819800000023e16030302061000020202006288d372a198ab690b34793275ed4eb9b448611f3cf207b5321e147bd85ce371e5d95b9f43572fab73517455ef1b3fe3eca0232825c5feb7e7233c3b08cd9d77205d49a157afa734730496f7a2b9b284654486313cc104e5f70fbd0ff2b5478549a5d992778059693e3857f542e79b6bcca778b991167120b479ac90efc8508af066f6e600720b1f43130963f9f9299b91736210d6e3ad28eaed792800c9dff95c7df1eeae1a2bd5f18394c41476d38e8a348f2f0093890dd192695840f6e681ccc6cdb79b95fba1cd6a479d9ff8bc57312454d9203e9d19e4544650374e4f632bbb2cac4dfa501401862b3eb2152d7dc96b2d30a736233ba77600009a7ca4702d76ddd4f5e5afd9f00426ff88b8fb07902e7aacdfd76ec86847600c764177b435f8cdf2c4b44a6b62154c60640ff21ccac1105a8f0088a6e6582d7e70f525829b90a2961348e569fc71be3347280381c7d8b58d0c3a502042539092d31e73e0f44ffdfb01b618c4b0be79df064e3584c62e9374ddba8301e7afa9fcca4f286b8463b2b6d885088db0c1275873714904141ab79b62f5a8f363466c33c659d58f139cbaaf6db5b3aa7b6eececc1224c626b22bb529fba206d8816fa9da708cf223e3c50079e3378cfd37890b331f0092ad5ae62e218c3dde18d974ff24318bb16639702399448d62b92' ... (1255) [exec_perl] = noop ... (1255) } # authorize = ok (1255) Starting proxy to home server ... port 1812 (1255) # Executing section pre-proxy from file server.conf (1255) pre-proxy { (1255) } # pre-proxy = noop (1255) Proxying request to home server ... port 1812 timeout 5.000000 (1255) Sent Access-Request Id 130 from ... length 273 ... (1255) User-Name = "x" (1255) EAP-Message = 0x ... Waking up in 0.1 seconds. Kind regards, Thor

3 8

Version 3.0.14 has been released
by Alan DeKok 05 Jun '17

05 Jun '17

I try not to do releases on a Friday, but this one may be useful. https://freeradius.org/press/index.html#3.0.14 This release fixes a crash in session resumption seen by a few people. It also fixes an issue where it was possible to convince the server to do session resumption, even if the underlying session had not finished authentication. Everyone should either upgrade, or set "enable = no" in the EAP "cache" section. Alan DeKok.

5 8

Post Auth and Logging Multiple MSCHAP modules
by Arnab Roy 05 Jun '17

05 Jun '17

Hi , I have multiple MSCHAP definitions in my setup each pointing to different ad domains and all is working well. The authenticate section is defined as such Auth-Type MS-CHAP { mschap-a { reject =2 } if(reject) { mschap-b reject=2 } } Now I am trying to check in post auth if user authenticated via mschap-a go to VLAN A(vsa) else goto VLAN B(vsa). What I cant figure out is how do I reference these in the post auth block as if I try looking for return code from the modules mschap-a ===> this always seems to return a noop ? if(ok){ } Also I need to log in linelog which mschap module authenticated the user ? Is this possible somehow... Many Thanks Arnab

3 8

WARNING: Outer and inner identities are the same. User privacy is compromised.
by Håvard Steen 04 Jun '17

04 Jun '17

I have a clean Freeradius install v. 3.0.14, and so far just made a few config modifications and generated new certificates. My test user is added to users (.../raddb/users). My task is to set up WPA enterprise. I'm testing with my iPhone, and it seems to work fine. But in the 'log' (radiusd -X output) the following message appears: (35) Virtual server inner-tunnel received request (35) EAP-Message = 0x027000061a03 (35) FreeRADIUS-Proxied-To = 127.0.0.1 (35) User-Name = "byod" (35) State = 0x9197e30a90e7f90d1e18c9ac6236626c (35) WARNING: Outer and inner identities are the same. User privacy is compromised. (35) server inner-tunnel { (35) session-state: No cached attributes (35) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (35) authorize { (35) policy filter_username { (35) This seems kind of bad, any ideas?

4 3

Compile error when configuring without "tcp" or "dhcp"
by Wussler, Doug 02 Jun '17

02 Jun '17

Just FYI, I am upgrading from 3.0.11 to 3.0.14 If I run “configure –without-tcp” and then “make”, I get: … CC src/main/tls_listen.c build/objs/src/main/process.o: In function `check_proxy': /downloads/freeradius-server-3.0.14/src/main/process.c:5324: undefined reference to `home_servers_udp' build/objs/src/main/realms.o: In function `home_server_afrom_cs': /downloads/freeradius-server-3.0.14/src/main/realms.c:770: undefined reference to `home_servers_udp' collect2: error: ld returned 1 exit status make: *** [build/bin/local/radiusd] Error 1 If I run “configure –without-dhcp” and then “make”, I get: … CC src/modules/proto_dhcp/dhcpclient.c /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/crt1.o: In function `_start': (.text+0x20): undefined reference to `main' collect2: error: ld returned 1 exit status make: *** [build/bin/local/dhcpclient] Error 1 v3.0.11 was also unable to be compiled without dhcp or tcp. I reported the issues at that time and I’m just trying to be a good soldier by reporting that they still exist. I just prefer not to compile in capabilities I don’t need but have been using 3.0.11 for well over a year and it has done very, very well for us. Doug Wussler 850.645.4201 Florida State University Information Technology Services

2 1

FreeRadius EAP-TTLS Troubleshooting
by Smith, James 01 Jun '17

01 Jun '17

FreeRADIUS Version 3.0.4 Hello, I'm new to the FreeRadius community and would like to start by saying hello. I'm working on a FreeRadius issue and am having some trouble figuring out what exactly is going on so I'm going to try to post here to see if there is a possible solution. We are utilizing FreeRadius for EAP-TTLS authentication with Siemens radios and I'm not able to get our radio to register with the base station. Certificates are installed on the radio, base station and radius server. I've included the Radius -X output to an text file and have it attached. I've looked through the debug file and I'm noticing that the radio is getting through part of the authentication then is failing when it tries to authorize the radio. The error seems like it would be easy to translate but nothing seems to be incorrect in my files regarding the client.conf so I'm having a hard time figuring out why the radio is unable to authorize. The actual error message states "No Auth type found:" rejects the user then says "Login Incorrect". Note: I changed the actual passwords using the Find/Replace function. The client that is failing is CPE4(a)siemens.com<mailto:CPE4@siemens.com> and it begins authentication as the Debug (7) in the debug log. The first reject happens in Debug (11) (I highlighted in red where the reject message begins.) Any help would be appreciated and if you have any questions at all, please let me know. Best Regards, James Smith This message is intended only for the addressee and may contain information that is company confidential or privileged. Any technical data in this message may be exported only in accordance with the U.S. International Traffic in Arms Regulations (22 CFR Parts 120-130) or the Export Administration Regulations (15 CFR Parts 730-774). Unauthorized use is strictly prohibited and may be unlawful. If you are not the intended recipient, or the person responsible for delivering to the intended recipient, you should not read, copy, disclose or otherwise use this message. If you have received this email in error, please delete it, and advise the sender immediately.

3 3

openLDAP, freeRadius and firewall integration
by M. selcuk karaca 01 Jun '17

01 Jun '17

Hi I have an architectural question and I hope I will not destroy list rules We have an openLDAP server. And we want to integrate LDAP users to our firewall. Our ultimate aim for integration is to apply FW policies according to users. curently we are applying policies according to IP addresses. Because openLDAP server does not provide us with accounting information sent to the FW, we have employed a freeRadius server. But we could not trigger freeRadius accounting packages by authenticating our users with openLDAP server. SO we have used libpam-radius-auth package and directly authenticated users from freeRadius. I want to ask whether this way is a logical one. does this have any negative effects, not recommended etc.. what should be the correct architecture for authenticating our users from openLDAP and provide Firewall integration for user based policies..? Thanks for your guidance..

4 5