September 2017 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 149, Issue 47
by Chevalier Violet 13 Sep '17

13 Sep '17

Hi Alan (Buxley), Googling a bit and not having a mac or windows machine, it is looking very tricky to set this up "manually". I have been able to download mobile config files in hex form from other universities, but it looks like it'd be a lot easier to generate this automatically. So unless you have a genius solution, I will likely borrow someone's Windows machine (the shame) and generate a profile! I guess that won't be so bad, but if you know of other resources that are easier, I'm all ears! And either way, thanks so much to you and every for the thoughts! On Tue, Sep 12, 2017 at 6:00 AM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: EAP-TLS: Strategies for getting the right certificate to > the right user (Chevalier Violet) > 2. Re: EAP-TLS: Strategies for getting the right certificate to > the right user (Alan Buxey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 12 Sep 2017 01:00:03 -0400 > From: Chevalier Violet <chevalier.violet(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: EAP-TLS: Strategies for getting the right certificate to > the right user > Message-ID: > <CANv8M1sMeczbPX9vicXi=dKUN=NDyEviQUc_t+VDxqeN+a3kkQ@mail. > gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Update: I got my iPhone working. I think the problem was that I needed to > import the client.p12 cert (helpfully mentioned not very often of course). > Anyway, it's working! > > As for how to make THAT relatively automatic... wow, I may need the website > Alan proposed. > > Best, > David > > On Tue, Sep 12, 2017 at 12:29 AM, Chevalier Violet < > chevalier.violet(a)gmail.com> wrote: > > > Hi all, > > > > Thanks for all the thoughts. It's much appreciated to know that maybe > it's > > not just n00bness that is causing me to struggle with this! > > > > I ended up making a pw protected page on my website (sigh)--but the > limits > > of that solution without internet access are pretty obvious I'd say! > > > > And never mind that using TTLS-PAP with passwords saved as SSHA-512 > > doesn't work on the iphone... !!! That's kinda insane if you ask me. But > > obviously apple didn't! > > > > Getting certs on the iPhone has been a real hassle--it'd be easier with > > mac or windows machines around because I could use iTunes, but anyway, it > > has been done through the website option! > > > > Now, I can't get EAP-TLS to work on my iPhone because I can't choose > > "mode" EAP-TLS. Instead, it continually asks me for the username & pass, > > which is precisely what I'm trying to avoid! I think there may be someway > > to signal that my wifi prefers TLS mode that I don't know about. > > > > If you have help on that point, that'd be great, and sigh&thanks! > > > > CV > > > > PS Indeed my routher is not exactly hotspot 2.0 or captive portal > > compliant! > > > > On Mon, Sep 11, 2017 at 10:22 AM, Chevalier Violet < > > chevalier.violet(a)gmail.com> wrote: > > > >> I've been googling around and kind of surprised to not be seeing a ton > of > >> resources about this. Maybe you all can help! > >> > >> EAP-TLS: Strategies for getting the right certificate to the right user. > >> It needs to be relatively automated. I do have users coming by with BYOD > >> devices, e.g. iPhones (omg they're super finicky about the freeradius > setup > >> but that's another story!), frequently when I'm not around to set them > up. > >> > >> Users are starting with no internet access. > >> > >> I was thinking maybe of the following: > >> > >> 1) Use some kind of TTLS-MSCHAPv2 thing with a standard user & password > >> for guests that would change every so often. Maybe let them use the > >> internet either i) for a few minutes at a time or ii) only to access a > page > >> on the internal network from which they could download the guest > >> certificate that would allow them to connect via EAP-TLS? 3) the certs > >> would expire after a few days. > >> > >> I have been struggling to get even my own iPhone to have the proper > cert! > >> On the bright side, my two linux machines are now working with EAP-TLS > so > >> there's hope for me! I wish I could just put the certs on a USB key but > >> that doesn't work for phones. And it's a bunch of Linux machines, no > >> Windows or Macs around. Excuse me if this is a n00b question. > >> > >> Thanks everyone! > >> > >> PS At this link: > >> > >> https://github.com/FreeRADIUS/freeradius-server/issues/2045# > >> issuecomment-324641610 > >> > >> Arr2036 mentions that the hot spot 2.0 standards set out how this could > >> work, with auto-renewing certs and the whole 9 yards. I wasn't able to > find > >> how to make that work for linux, for instance with freeradius. Thanks! > >> > > > > > > > > -- > > "Do not speak, unless it improves on silence." -- Buddha > > > > > > > -- > "Do not speak, unless it improves on silence." -- Buddha > > > ------------------------------ > > Message: 2 > Date: Tue, 12 Sep 2017 07:55:48 +0100 > From: Alan Buxey <alan.buxey(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: EAP-TLS: Strategies for getting the right certificate to > the right user > Message-ID: > <CAOVYXj8MnXE1eG9hA8zB+QBKCf8J-109Tun8Hc8waB9=XEJgrg@ > mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Getting certs onto the iPhone is fairly easy if you just use a > .mobileconfig profile deployment file , as can be created with the apple > tools, manually or with commercial tools :) > > alan > > On 12 Sep 2017 5:31 am, "Chevalier Violet" <chevalier.violet(a)gmail.com> > wrote: > > > Hi all, > > > > Thanks for all the thoughts. It's much appreciated to know that maybe > it's > > not just n00bness that is causing me to struggle with this! > > > > I ended up making a pw protected page on my website (sigh)--but the > limits > > of that solution without internet access are pretty obvious I'd say! > > > > And never mind that using TTLS-PAP with passwords saved as SSHA-512 > doesn't > > work on the iphone... !!! That's kinda insane if you ask me. But > obviously > > apple didn't! > > > > Getting certs on the iPhone has been a real hassle--it'd be easier with > mac > > or windows machines around because I could use iTunes, but anyway, it has > > been done through the website option! > > > > Now, I can't get EAP-TLS to work on my iPhone because I can't choose > "mode" > > EAP-TLS. Instead, it continually asks me for the username & pass, which > is > > precisely what I'm trying to avoid! I think there may be someway to > signal > > that my wifi prefers TLS mode that I don't know about. > > > > If you have help on that point, that'd be great, and sigh&thanks! > > > > CV > > > > PS Indeed my routher is not exactly hotspot 2.0 or captive portal > > compliant! > > > > On Mon, Sep 11, 2017 at 10:22 AM, Chevalier Violet < > > chevalier.violet(a)gmail.com> wrote: > > > > > I've been googling around and kind of surprised to not be seeing a ton > of > > > resources about this. Maybe you all can help! > > > > > > EAP-TLS: Strategies for getting the right certificate to the right > user. > > > It needs to be relatively automated. I do have users coming by with > BYOD > > > devices, e.g. iPhones (omg they're super finicky about the freeradius > > setup > > > but that's another story!), frequently when I'm not around to set them > > up. > > > > > > Users are starting with no internet access. > > > > > > I was thinking maybe of the following: > > > > > > 1) Use some kind of TTLS-MSCHAPv2 thing with a standard user & password > > > for guests that would change every so often. Maybe let them use the > > > internet either i) for a few minutes at a time or ii) only to access a > > page > > > on the internal network from which they could download the guest > > > certificate that would allow them to connect via EAP-TLS? 3) the certs > > > would expire after a few days. > > > > > > I have been struggling to get even my own iPhone to have the proper > cert! > > > On the bright side, my two linux machines are now working with EAP-TLS > so > > > there's hope for me! I wish I could just put the certs on a USB key but > > > that doesn't work for phones. And it's a bunch of Linux machines, no > > > Windows or Macs around. Excuse me if this is a n00b question. > > > > > > Thanks everyone! > > > > > > PS At this link: > > > > > > https://github.com/FreeRADIUS/freeradius-server/issues/2045# > > > issuecomment-324641610 > > > > > > Arr2036 mentions that the hot spot 2.0 standards set out how this could > > > work, with auto-renewing certs and the whole 9 yards. I wasn't able to > > find > > > how to make that work for linux, for instance with freeradius. Thanks! > > > > > > > > > > > -- > > "Do not speak, unless it improves on silence." -- Buddha > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > > list/users.html > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 149, Issue 47 > ************************************************* > -- "Do not speak, unless it improves on silence." -- Buddha

1 0

Freeradius Server seg fault when initializing python module
by Avner Elizarov 13 Sep '17

13 Sep '17

Hi, I'm trying to add the rlm_python module to the freeradius server and After following the instructions in the documentation https://wiki.freeradius.org/modules/Rlm_python The server crashes with a segmentation fault. When I run it in debug mode the follwing debug information is printed : Wed Sep 13 09:18:09 2017 : Debug: # Instantiating module "python" from file /etc/freeradius/mods-enabled/python Wed Sep 13 09:18:09 2017 : Info: Python version: 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609] *Segmentation fault (core dumped)* I ran freeradius using gdb to check the origin of the segmentation fault and this is the output: Program received signal SIGSEGV, Segmentation fault. __strchr_sse2 () at ../sysdeps/x86_64/multiarch/../strchr.S:32 32 ../sysdeps/x86_64/multiarch/../strchr.S: No such file or directory. (gdb) bt #0 __strchr_sse2 () at ../sysdeps/x86_64/multiarch/../strchr.S:32 #1 0x00007ffff53867c1 in PySys_SetPath () from /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0 #2 0x00007ffff57f9d79 in ?? () from /usr/lib/freeradius/rlm_python.so #3 0x00000000004214e4 in module_instantiate () #4 0x00000000004228b5 in modules_init () #5 0x000000000040f7dc in main () It seems that when the server tries to set the python path to that written in mods-available/python (python_path = ${modconfdir}/${.:name}) it crashes. I've tried different strings for the python path and it still crashes. When I removed the python_path line from the file and updated the PYTHONPATH environment variable it worked when running it in debug mode (freeradius -f -X -xx). However it doesn't work when I run the radius server as a service (service freeradius start). The debug output is: Sep 13 09:26:19 radius-server freeradius[6748]: Python version: 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609] Sep 13 09:26:19 radius-server freeradius[6748]: python_function_load - Module 'reorder_tlv' not found Sep 13 09:26:19 radius-server freeradius[6748]: <type 'exceptions.ImportError'> (No module named reorder_tlv) Sep 13 09:26:19 radius-server freeradius[6748]: python_function_load - Failed to import python function 'reorder_tlv.post_auth' Sep 13 09:26:19 radius-server freeradius[6748]: /etc/freeradius/mods-enabled/python[8]: Instantiation failed for module "python" Sep 13 09:26:19 radius-server systemd[1]: freeradius.service: Control process exited, code=exited status=1 Sep 13 09:26:19 radius-server sudo[6717]: pam_unix(sudo:session): session closed for user root Sep 13 09:26:19 radius-server systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. Is someone familiar with this problem? Is there a fix? Thanks in advance

2 1

rlm_rest performance / thread usage
by Бенджамин Томпсон 13 Sep '17

13 Sep '17

We make a billing system which has a JSON API which allows our customers to hook in FreeRADIUS servers to provide RADIUS and DHCP. Up to now we have always used rlm_perl along with a perl script using the JSON and HTTP perl modules to generate the JSON and get it to and from our API. Recently, I have done a few experiments using the rlm_rest module in place of rlm_perl, and I have been very impressed. It is easy to configure and it provides a simpler solution for us, in that it renders the perl script unnecessary. I would like to ask whether there is likely to be any performance difference beteween these two solutions. rlm_perl is performing well for us and as I understand it runs in a multithreaded mode whereby multple perl instances can be created by multiple server threads. I would like to ask whether the rlm_rest module is likely to offer as good as or better performance as we are currently getting with rlm_perl. Also, I would like to understand whether it is necessary to configure multiple instances of rlm_rest and put them for example in a load_balance section in order to get the best performance. Ben Thompson

3 3

Update User-Name
by Dale Lloyd 11 Sep '17

11 Sep '17

FreeRADIUS Version 3.0.4 I wish to modify the User-Name attribute in access-requests by appending the realm, but if I do that, FreeRADIUS refuses to proxy the request. I added the following to /etc/raddb/sites-enabled/default: authorize { if("%{User-Name}" !~ /@/) { update request { User-Name := "%{User-Name}(a)uni.ac.uk" Realm := "eduroam" } ... radiusd -X output: Ready to process requests Received Access-Request Id 0 from 10.10.200.254:36488 to 10.10.2.53:1812 length 148 User-Name = 'testuser' NAS-IP-Address = 6.71.67.224 Calling-Station-Id = '00-00-00-00-00-02' Called-Station-Id = '88-15-44-47-43-E0:TEST' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x0200000d01756e697431323334 Message-Authenticator = 0xca24c7b4bfe0fa73b421bc8c9c1e29a5 (0) Received Access-Request packet from host 10.10.200.254 port 36488, id=0, length=148 (0) User-Name = 'testuser' (0) NAS-IP-Address = 6.71.67.224 (0) Calling-Station-Id = '00-00-00-00-00-02' (0) Called-Station-Id = '88-15-44-47-43-E0:TEST' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = 'CONNECT 11Mbps 802.11b' (0) EAP-Message = 0x0200000d01756e697431323334 (0) Message-Authenticator = 0xca24c7b4bfe0fa73b421bc8c9c1e29a5 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) if ("%{User-Name}" !~ /@/) (0) EXPAND %{User-Name} (0) --> testuser (0) if ("%{User-Name}" !~ /@/) -> TRUE (0) if ("%{User-Name}" !~ /@/) { (0) update request { (0) EXPAND %{User-Name}(a)uni.ac.uk (0) --> testuser(a)uni.ac.uk (0) User-Name := "testuser(a)uni.ac.uk" (0) Realm := 'eduroam' (0) } # update request = noop (0) } # if ("%{User-Name}" !~ /@/) = noop (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = noop (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Request already has destination realm set. Ignoring (0) [suffix] = noop (0) eap : Peer sent code Response (2) ID 0 length 13 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Identity does not match User-Name, setting from EAP Identity (0) eap : Failed in handler (0) [eap] = invalid (0) } # authenticate = invalid (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> testuser(a)uni.ac.uk (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Identity does not match User-Name, setting from EAP Identity (0) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (0) [eap] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Suggestions greatly appreciated.

4 8

Re: Update User-Name
by Alan Buxey 11 Sep '17

11 Sep '17

No no no Please don't do this. If users have incorrect configuration (missing realm) then those users need to be corrected. If that org lets it's users get online without realm then that is not following best practice but means that those users won't work at other eduroam sites anyway So, not only do you cause confusion (but it works at my home org and place down road but nowhere else - this will then waste other sites time/effort 'we must be doing something wrong as this user can work at another site other than home' ) But you will also be causing other users problems... Those users from elsewhere than that org who also don't have realm set ... Who will, instead of being rejected as they should, will now be proxied to the completely wrong site and end up with misconfiguration or sending their details to wrong place. Just REJECT misconfigured users And check with eduroam UK policy to see if it's been updated yet that eduroam auths MUST have the realm even for local auths ... Otherwise a while can of worms gets opened up. don't create policies just because of a bad neighbor. Get them to fix the system. Contact eduroam UK if required to get channels of communication established. alan On 9 Sep 2017 7:20 pm, "Dale Lloyd" <dale.lloyd(a)gmail.com> wrote: Thank you, Alan, for taking the time to reply. > You should really use 3.0.15. Apologies, I followed the example in the FreeRADIUS Technical Guide and typed "yum install freeradius" and this is the version it installed. I will go back and install 3.0.15 manually. > No... read the debug output. The error is something else. When testing and specifying the full username on the client e.g. 'user(a)uni.ac.uk', everything works. Specifying just the short username on the client 'user' fails. Using a packet capture, I see that the request does not get forwarded as hoped. I read the output of radiusd -X and noticed the EAP error, but I don't know whether it is possible to overcome it? > If they're your users, then you should authenticate them. You don't need to edit the User-Name. You don't need to proxy. > Describe the problem you're trying to solve. We are a small entity next to a big university. The neighbouring university allows its users to connect to eduroam locally without specifying the realm in the username, but this can lead to problems because their users are often not aware that they need to use the full username if they wish to roam. We get many visitors from the university and their perception is that our wireless is broken. I want to make it easier for those visitors to connect to eduroam, because I can't explain to all visitors that they should user their full username. I need to proxy and I think that need to add the realm to the username, otherwise the eduroam NRPS won't know what to do with the request. On 9 September 2017 at 18:03, Alan DeKok <aland(a)deployingradius.com> wrote: > On Sep 9, 2017, at 10:11 AM, Dale Lloyd <dale.lloyd(a)gmail.com> wrote: >> >> FreeRADIUS Version 3.0.4 > > You should really use 3.0.15. > >> I wish to modify the User-Name attribute in access-requests by >> appending the realm, but if I do that, FreeRADIUS refuses to proxy the >> request. > > No... read the debug output. The error is something else. > >> I added the following to /etc/raddb/sites-enabled/default: >> >> authorize { >> >> if("%{User-Name}" !~ /@/) { >> update request { >> User-Name := "%{User-Name}(a)uni.ac.uk" >> Realm := "eduroam" >> } > > The better question is why do you think this is necessary? > > If they're your users, then you should authenticate them. You don't need to edit the User-Name. You don't need to proxy. > > Or, if you do proxy, you can just set Proxy-To-Realm: > > if("%{User-Name}" !~ /@/) { > update control { > Proxy-To-Realm := "my-other-server" > } > > >> radiusd -X output: >> >> (0) # Executing group from file /etc/raddb/sites-enabled/default >> (0) authenticate { >> (0) eap : Identity does not match User-Name, setting from EAP Identity >> (0) eap : Failed in handler >> (0) [eap] = invalid >> (0) } # authenticate = invalid >> (0) Failed to authenticate the user >> (0) Using Post-Auth-Type Reject > > That doesn't say "refused to proxy the request". The message is English, and should be clear. > >> Suggestions greatly appreciated. > > Describe the problem you're trying to solve. Don't ask why your proposed solution doesn't work. > > There are likely many other ways of getting the same result. > > Alan DeKok. > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

1 0

Re: not able to install FR 3.0.16+git in (pure) Debian 9
by Rui Ribeiro 11 Sep '17

11 Sep '17

> > Message: 2 > Date: Fri, 11 Aug 2017 17:55:12 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: not able to install FR 3.0.16+git in (pure) Debian 9 > Message-ID: <13B96F99-2D68-4469-9CC1-639938303881(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Aug 11, 2017, at 5:50 PM, Rui Ribeiro <ruyrybeyro(a)gmail.com> wrote: > > What is the best way to send patches? > > > > This is the one for including libjson-c3 > > For small things, that's fine. I've pushed a fix. > > Alan DeKok. > > > > Hi again Alan, After this commit, you can already compile for Debian 9, thanks. If you would not mind, I would also propose striking out the HeartBleed check from debian/rules in 3.0.x, to be able to install it on Debian 9. Otherwise, the dependencies are not satisfied, and Debian 9 refuses to install the packages. --- debian/rules.old 2017-08-16 15:19:15.015393327 +0100 +++ debian/rules 2017-08-16 15:19:27.647279581 +0100 @@ -52,13 +52,6 @@ confflags += --build $(DEB_BUILD_GNU_TYPE) --host $(DEB_HOST_GNU_TYPE) endif -# Add dependency on distribution specific version of openssl that fixes Heartbleed (CVE-2014-0160). -ifeq ($(shell dpkg-vendor --derives-from Ubuntu && echo yes),yes) - SUBSTVARS = -Vdist:Depends="libssl1.0.0 (>= 1.0.1f-1ubuntu2)" -else - SUBSTVARS = -Vdist:Depends="libssl1.0.0 (>= 1.0.1e-2+deb7u5)" -endif - # Add libsystemd-dev as a Build-Depends to debian/control if it is known to this system ifeq ($(shell apt-cache show libsystemd-dev &>/dev/null && echo yes),yes) CONTROL_BUILDDEPS += libsystemd-dev, -- Regards, -- Rui Ribeiro Senior Linux Architect and Network Administrator ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

7 21

Using freeradius, the system enters in an infinite loop
by Ricardo Ruiz 10 Sep '17

10 Sep '17

Hello out there, I am using freeradius2 in a raspberry pi3 with last version of LEDE and FreeRADIUS Version 2.2.9, and it happens something really weird, an infinite loop when a user tries to connect from a wifi hotspot. After installing freeradius, I only change 2 things: Add:ricardo Cleartext-Password := “testing”to /etc/freeradius2/users Comment out this# interface = br-lan from /etc/freeradius2/radiusd.conf I test the radius server using:root@LEDE:/etc/freeradius2# echo "User-Name = ricardo, User-Password = testing" | radclient -x 127.0.0.1 auth testing123 And it works:Sending Access-Request of id 28 to 127.0.0.1 port 1812 User-Name = "ricardo" User-Password = "testing"rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=28, length=20 However, when I setup WPA 2 Enterprise in the LEDE router (the same with freeradius server) and a user tries to connect, this infinite loop happens:https://vimeo.com/233192357 No error or warning message when running radiusd -XXXHere the log:https://gist.github.com/Ricardo1980/a5a7047fd0a03a6b10aea3b82f5e7cdf I think it is not related with certificates, because I can see this in the log:Sun Sep 10 14:07:31 2017 : Info: [peap] (other): SSL negotiation finished successfully Apart from that, I have this package installed:freeradius2-democerts And in the iPhone, it says that the expiration date is next year. Do you have any idea or suggestion? Probably it is a small detail but I cannot see it.Thanks a lot for your time.

2 4

Authentication problems with some devices: TLS version too low
by Lars Veldscholte 09 Sep '17

09 Sep '17

Hello everyone, I have problems with authenticating some clients using PEAP-MSCHAP. I've seen two (unrelated) devices having this issue so far: an Android phone and a Windows 7 PC. Other clients do not have this problem. The debug output is: (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 99 bytes (2) eap_peap: Got complete TLS record (99 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: (other): before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: <<< recv TLS 1.2 [length 005e] (2) eap_peap: >>> send TLS 1.0 Alert [length 0002], fatal protocol_version (2) eap_peap: ERROR: TLS Alert write:fatal:protocol version tls: TLS_accept: Error in error (2) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417D18C:SSL routines:tls_process_client_hello:version too low (2) eap_peap: ERROR: System call (I/O) error (-1) (2) eap_peap: ERROR: TLS receive handshake failed during operation (2) eap_peap: ERROR: [eaptls process] = fail (2) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (2) eap: Sending EAP Failure (code 4) ID 230 length 4 (2) eap: Failed in EAP select (2) [eap] = invalid (2) } # authenticate = invalid (2) Failed to authenticate the user I'm not sure if I'm interpreting this correctly, but it seems that the client is trying to talk in TLSv1.2 while FreeRADIUS doesn't support that? I don't know what started this problem. PEAP always worked in the past, until now. The only thing I can think of is that I've recently generated new certificates (old ones were expired). There has also been a FreeRADIUS update (just regular Debian updates, I'm on 3.0.15 now). Could that be related? Thanks in advance for your help, Lars

4 13

Re: not able to install FR 3.0.16+git in (pure) Debian 9
by Arran Cudbard-Bell 09 Sep '17

09 Sep '17

> > On 9 Sep 2017, at 21:30, Fajar A. Nugraha <list(a)fajar.net> wrote: > > On Sat, Sep 9, 2017 at 7:56 PM, Alan DeKok <aland(a)deployingradius.com> wrote: >> On Sep 9, 2017, at 12:11 AM, Fajar A. Nugraha <list(a)fajar.net> wrote: >>> I think the problem arise because users see the debian directory, and >>> expect to build it successfully (i.e. following >>> https://wiki.freeradius.org/building/Debian-and-Ubuntu) But that >>> fails for debian 9. >> >> I can't feel overly responsible for distributions which break application software. >> >> There's really no other way to describe this. They've added patches to Debian after 3.0.15 was released, and those patches break *all* versions of FreeRADIUS. >> >>> IMHO some possible options are: >>> (a) add some instructions (e.g. on >>> https://wiki.freeradius.org/building/Debian-and-Ubuntu) something >>> like 'if you're absolutely sure you're using patched/non-vulnerable >>> versions of openssl, then you can edit these files manually, but don't >>> complain if it's broken", and so on. And point any >>> debian-package-related queries there. OR >> >> I've pushed patches to v3.0.x which should help. I'll see if I can add notes to the wiki. I think there's some confusion here... Those were an adaptation of the fixes that I put into v4.0.x to call the new OpenSSL 1.1.0 API to set min/max TLS versions, they won't affect debian packaging, or alter which security issues FreeRADIUS flags. ...they will however allow users to override the TLS restrictions in Debian 9, which only allowed TLS 1.2 to be used, which was the subject of another thread. I'm working on a new docker build image for Debian 9, after that's done we should be able to look at the packaging issues in v3.0.x on Debian 9. As for discovering packaging issues early, yes there is a the beginnings of a Jenkins based CIT system, that publishes packages for centos7 and ubuntu to packages.networkradius.com. The main issues are that packages aren't pushed for every debian/ubuntu/centos flavour, and there's currently no notifications of when a build fails. >> We'll try to get automated builds set up... right now, we're up to a backlog of ~10-20 systems that people want. It's up, it's just sort of, half finished, and not overly useful in its current form. Not to say it couldn't be useful, it just isn't right now, seeing as it doesn't publish notifications in any form... outside of maybe the jobs triggered by pull requests. Anyway that's an internal discussion. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

Freeradius 3.X ldap-userdn
by Bhagwat, Shrikant 08 Sep '17

08 Sep '17

Getting error for LDAP-UserDN Module. Anybody has seen it ? 0) level1_and_duopush : Executing: /idm/idmt_home/srv/radius-mfa-scripts/bin/DuoFactor.pl %{config:modules.ldap.identity} %{config:modules.ldap.password} %{config:modules.ldap.server} %{config:modules.ldap.base_dn} %{check:LDAP-UserDn} %{config:modules.ldap.level-1_kdc} %{config:modules.ldap.logFILEname} %{config:modules.ldap.duo_host} %{config:modules.ldap.duo_ikey} %{config:modules.ldap.duo_skey} push 0) level1_and_duopush : EXPAND modules.ldap.identity (0) level1_and_duopush : --> modules.ldap.identity (0) level1_and_duopush : EXPAND %{config:modules.ldap.identity} (0) level1_and_duopush : --> cn=p-idm-radius,o=services (0) level1_and_duopush : EXPAND modules.ldap.password (0) level1_and_duopush : --> modules.ldap.password (0) level1_and_duopush : EXPAND %{config:modules.ldap.password} (0) level1_and_duopush : --> XXXX (0) level1_and_duopush : EXPAND modules.ldap.server (0) level1_and_duopush : --> modules.ldap.server (0) level1_and_duopush : EXPAND %{config:modules.ldap.server} (0) level1_and_duopush : --> p-idm-dir1.ent.med.umich.edu (0) level1_and_duopush : EXPAND modules.ldap.base_dn (0) level1_and_duopush : --> modules.ldap.base_dn (0) level1_and_duopush : EXPAND %{config:modules.ldap.base_dn} (0) level1_and_duopush : --> dc=umich,dc=edu (0) ERROR: level1_and_duopush : %{check:LDAP-UserDn} (0) ERROR: level1_and_duopush : ^ Unknown module (0) level1_and_duopush : EXPAND modules.ldap.level-1_kdc (0) level1_and_duopush : --> modules.ldap.level-1_kdc (0) level1_and_duopush : EXPAND %{config:modules.ldap.level-1_kdc} (0) level1_and_duopush : --> UMICH.EDU (0) level1_and_duopush : EXPAND modules.ldap.logFILEname (0) level1_and_duopush : --> modules.ldap.logFILEname (0) level1_and_duopush : EXPAND %{config:modules.ldap.logFILEname} (0) level1_and_duopush : --> /idm/idmt_home/srv/radius-mfa-scripts/log/umhspf.log (0) level1_and_duopush : EXPAND modules.ldap.duo_host ********************************************************** Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues

3 2