October 2018 - Freeradius-Users - lists.freeradius.org

"Dummy" radiusd Python module ;-)
by Stefan Paetow 18 Oct '18

18 Oct '18

Hi, Question... there isn't per chance a dummy radiusd Python module out there that can be used to mock up FR structures accessible through Python, is there? :-) Reason I ask is because as much as FR can be built on a macOS environment, the person in question doesn't need/want a full FreeRADIUS environment on their system to develop some Python modules... :-) With Regards Stefan Paetow Consultant, Trust and Identity t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

3 3

EAP-TLS failure
by Stephen 18 Oct '18

18 Oct '18

Hi all- trying to understand a particular failure/error. I've been using dd-wrt, freeradius and strongswan together for almost a year (mostly) without issue. Freeradius provides my eap-tls functionality passed either through the wifi router (dd-wrt) or VPN (strongswan). Recently my macbook was upgraded to MacOS Mojave and I appear to no longer auth to wireless with the same cert. The cert still works for strongswan auth. Below are my logs for either scenario: [dd-wrt client auth failure] (993) eap: Expiring EAP session with state 0xaa3880f3ad308d40 (993) eap: Finished EAP session with state 0xaa3880f3ad308d40 (993) eap: Previous EAP request found for state 0xaa3880f3ad308d40, released from the list (993) eap: Peer sent packet with method EAP TLS (13) (993) eap: Calling submodule eap_tls to process data (993) eap_tls: Continuing EAP-TLS (993) eap_tls: Peer indicated complete TLS record size will be 7 bytes (993) eap_tls: Got complete TLS record (7 bytes) (993) eap_tls: [eaptls verify] = length included (993) eap_tls: <<< recv TLS 1.2 [length 0002] (993) eap_tls: ERROR: TLS_accept: Failed in SSLv3 read client certificate A (993) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:140350E5:SSL routines:ACCEPT_SR_CERT:ssl handshake failure (993) eap_tls: ERROR: System call (I/O) error (-1) (993) eap_tls: ERROR: TLS receive handshake failed during operation (993) eap_tls: ERROR: [eaptls process] = fail (993) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (993) eap: Sending EAP Failure (code 4) ID 8 length 4 (993) eap: Failed in EAP select --- [strongswan client auth success] (2171) eap: Expiring EAP session with state 0x92fe72999ff07f67 (2171) eap: Finished EAP session with state 0x92fe72999ff07f67 (2171) eap: Previous EAP request found for state 0x92fe72999ff07f67, released from the list (2171) eap: Peer sent packet with method EAP TLS (13) (2171) eap: Calling submodule eap_tls to process data (2171) eap_tls: Continuing EAP-TLS (2171) eap_tls: Got final TLS record fragment (272 bytes) (2171) eap_tls: [eaptls verify] = ok (2171) eap_tls: Done initial handshake (2171) eap_tls: <<< recv TLS 1.2 [length 1458] (2171) eap_tls: TLS - Creating attributes from certificate OIDs (2171) eap_tls: TLS-Cert-Serial := "<omitted>" (2171) eap_tls: TLS-Cert-Expiration := "<omitted>" (2171) eap_tls: TLS-Cert-Subject := "/C=ZL/ST=Null/L=Nowhere/O=Nulllabs/OU=Root CA/CN=server.mgmt/emailAddress=poseidon(a)services.mgmt" (2171) eap_tls: TLS-Cert-Issuer := "/C=ZL/ST=Null/L=Nowhere/O=Nulllabs/OU=Root CA/CN=server.mgmt/emailAddress=poseidon(a)services.mgmt" (2171) eap_tls: TLS-Cert-Common-Name := "server.mgmt" (2171) eap_tls: TLS - Creating attributes from certificate OIDs (2171) eap_tls: TLS-Client-Cert-Serial := "<omitted>" (2171) eap_tls: TLS-Client-Cert-Expiration := "<omitted>" (2171) eap_tls: TLS-Client-Cert-Subject := "/C=ZL/ST=Zero/L=Nowhere/O=Nulllabs/O=Endpoint/OU=Nulllabs-Endpoints/CN=mbp.home/emailAddress=poseidon(a)services.mgmt" (2171) eap_tls: TLS-Client-Cert-Issuer := "/C=ZL/ST=Null/L=Nowhere/O=Nulllabs/OU=Root CA/CN=server.mgmt/emailAddress=poseidon(a)services.mgmt" (2171) eap_tls: TLS-Client-Cert-Common-Name := "mbp.home" (2171) eap_tls: TLS-Client-Cert-X509v3-Authority-Key-Identifier += "<omitted>" (2171) eap_tls: TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, IPSec User, IPSec End System, E-mail Protection, Code Signing" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.7" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.5" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.4" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.3" (2171) eap_tls: TLS_accept: SSLv3 read client certificate A What I should be seeing is the following: [dd-wrt client success] (1015) eap: Expiring EAP session with state 0xbd2980f9b0278d8b (1015) eap: Finished EAP session with state 0xbd2980f9b0278d8b (1015) eap: Previous EAP request found for state 0xbd2980f9b0278d8b, released from the list (1015) eap: Peer sent packet with method EAP TLS (13) (1015) eap: Calling submodule eap_tls to process data (1015) eap_tls: Continuing EAP-TLS (1015) eap_tls: Peer ACKed our handshake fragment. handshake is finished (1015) eap_tls: [eaptls verify] = success (1015) eap_tls: [eaptls process] = success (1015) eap: Sending EAP Success (code 3) ID 14 length 4 (1015) eap: Freeing handler This was shown by another dd-wrt client on the same setup (High Sierra). Anyone else seeing similar issues with MacOS Mojave? Am I missing an extended key usage parameter or am I doing something else wrong? Thanks in advance.

3 4

Compiling with OpenSSL 1.1.1
by Doug Wussler 18 Oct '18

18 Oct '18

Compiling FreeRADIUS v 3.0.15 with OpenSSL 1.1.1 works just fine. Just thought you might like to know the debug info reports an UNKNOWN TLS VERSION: (2) fsu-eap: Peer sent packet with method EAP PEAP (25) (2) fsu-eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 151 bytes (2) eap_peap: Got complete TLS record (151 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: (other): before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0092] (2) eap_peap: TLS_accept: SSLv3/TLS read client hello (2) eap_peap: >>> send TLS 1.2 [length 005d] (2) eap_peap: TLS_accept: SSLv3/TLS write server hello (2) eap_peap: >>> send TLS 1.2 [length 088b] (2) eap_peap: TLS_accept: SSLv3/TLS write certificate (2) eap_peap: >>> send TLS 1.2 [length 0095] (2) eap_peap: TLS_accept: SSLv3/TLS write key exchange (2) eap_peap: >>> send TLS 1.2 [length 0004] (2) eap_peap: TLS_accept: SSLv3/TLS write server done (2) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (2) eap_peap: In SSL Handshake Phase (2) eap_peap: In SSL Accept mode (2) eap_peap: [eaptls process] = handled Doug Wussler Florida State University

2 1

Debug log for just one user
by Enrico Polesel 17 Oct '18

17 Oct '18

Hi, I would like to have debug logs (like `freeradius -X`) only for one user (that I may identify with the mac address), using a dedicated SSID with a dedicated radius server is not an option since he has problems only with a particular SSID. I found in the wiki (https://wiki.freeradius.org/config/Logging) that I may increase debug level with unlang using > update control { > Tmp-String-0 = "%{debug:1}" > } I have two questions about that: 1. which levels are available? Which one is more verbose and which one is less verbose? 2. which level is equivalent (or similar) to the output of `freeradius -X`? I use freeradius 3.0.17 compiled from git. Thank you for your time and your great job on freeradius. Enrico Polesel

2 2

FreeRadius tools to gather statistics
by work vlpl 17 Oct '18

17 Oct '18

Hi, >From documentation/wiki I found two tools to gather statistics from FreeRadius - radsniff and status server. First show statistic for radius protocol packets. Second can show counters for Access-Accept/Access-Reject response - this is exactly what I need. But I have a little concern about it. If radius server will stop working, counters will be reseted. And if for example I query status server every 10 seconds, then statistics at least for last 10 seconds may be lost - it is not big deal but it is not desirable. Are there any tools to gather statistics from FreeRadius? Excluding log processing. Maybe there is exists mechanism to save status server counter between FreeRadius server restarts? For example like iptables-save/iptables-restore can do. And default configuration for status servers contains the next warning "Due to internal limitations, the statistics might not be exactly up to date. Do not expect all of the numbers to add up perfectly." Does it means that statistic counters always are approximate values? Or if FreeRadius will idle for some time the counters values will be updated to actual values? -- Vladimir

2 2

Parsing failed expanded string
by Saurabh Lahoti 17 Oct '18

17 Oct '18

Dear, While running server in debug mode getting below error: <internal>[0]: Failed parsing expanded string: <internal>[0]: %A/%{Client-IP-Address}/detail <internal>[0]: ^ Invalid variable expansion Could you please guide which file is causing this error..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Mob: +32.499.82.37.88* *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

2 1

IPv6 PPPoE Radius Accounting
by Maile Halatuituia 16 Oct '18

16 Oct '18

Hi I have Cisco ASR 1001 with IPv6 PPPoE Enabled. I need to collect CDR for my pppoe session. Appreciate any information. Thanks Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

3 3

Simple question for migration to Freeradius
by Olaf s 15 Oct '18

15 Oct '18

After many years we want to migrate from Steel-belted Radius to Freeradius. Current Freeradius setup (and working) Centos 7.5 MSSQL (due to application requirements) Default sql schema as provided with Freeradius. The only requirement we have is that we need to lookup the username in a table somewhere in our own mssql db (not the freeradius db) If the username is in the table: send accept. (not even using password) >From debug i can see this: (0) sql: EXPAND %{User-Name} (0) sql: --> 32490013984 (0) sql: SQL-User-Name set to '32490013984' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '32490013984' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '32490013984' ORDER BY id (0) sql: User found in radcheck table how can i adjust the select query and change it to fit my own sql schema. I could not find it in main/mssql/queries.conf Is it possible? Thanks!

3 4

Proxy requests on multiple backend Radius servers based on LDAP Group Membership
by Mathieu CLAIR 15 Oct '18

15 Oct '18

Hey there, I'm trying to route Radius requests on 2 backend Radius servers based on LDAP group membership. The purpose is to send Radius requests on the 1st server when the user is a member of an LDAP group (example CN=MyGroup,CN=Users,DC=foo,DC=bar) and to send all other requests on the 2nd Radius server. I'm wondering if it's possible and what is the best way to do it. I started to think about the folowing process : - declare an LDAP filter like (&(objectClass=user)(sAMAccountName=%{User-Name})(memberof=CN=MyGroup,CN=Use rs,DC=foo,DC=bar)) - use the filter (match not null ?) in the site configuration Something that sounds like bellow : my_ldap_filter = (&(objectClass=user)(sAMAccountName=%{User-Name})(memberof=CN=MyGroup,CN=Use rs,DC=foo,DC=bar)) authorize { if (%{my_ldap_filter} != "") { update control { Proxy-To-Realm := 'Radius1' } } else { update control { Proxy-To-Realm := 'Radius2' } } } I'm not sure about the syntax of this. Of course, I faced several errors "Entry is not a reference to a module" when I start manually the freeradius server. Do I need to use the LDAP module ? Thank you for your answer BR, Mathieu

2 2

Radius Attribute
by Maile Halatuituia 15 Oct '18

15 Oct '18

I have this on my radius packet send from my Cisco ASR 1001 with IPv6 enable to my Radius Accounting Server. *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 35 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 29 "connect-progress=LAN Ses Up" *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 31 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 25 "nas-tx-speed=1000000000" *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 31 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 25 "nas-rx-speed=1000000000" *Oct 14 22:14:43.752: RADIUS: Acct-Session-Time [46] 6 79768 *Oct 14 22:14:43.752: RADIUS: Acct-Input-Octets [42] 6 1063443 *Oct 14 22:14:43.752: RADIUS: Acct-Output-Octets [43] 6 1480018 *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 37 *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 35 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 29 "connect-progress=LAN Ses Up" *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 31 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 25 "nas-tx-speed=1000000000" *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 31 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 25 "nas-rx-speed=1000000000" *Oct 14 22:14:43.752: RADIUS: Acct-Session-Time [46] 6 79768 *Oct 14 22:14:43.752: RADIUS: Acct-Input-Octets [42] 6 1063443 *Oct 14 22:14:43.752: RADIUS: Acct-Output-Octets [43] 6 1480018 *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 37 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 31 "acct-input-octets-ipv6=444093" *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 38 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 32 "acct-output-octets-ipv6=871971" *Oct 14 22:14:43.752: RADIUS: Acct-Input-Packets [47] 6 21676 *Oct 14 22:14:43.752: RADIUS: Acct-Output-Packets [48] 6 24477 *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 36 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 30 "acct-input-packets-ipv6=8250" *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 37 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 31 "acct-output-packets-ipv6=8719" *Oct 14 22:14:43.752: RADIUS: Acct-Authentic [45] 6 RADIUS [1] *Oct 14 22:14:43.752: RADIUS: Acct-Status-Type [40] 6 Watchdog [3] *Oct 14 22:14:43.752: RADIUS: NAS-Port-Type [61] 6 Ethernet [15] *Oct 14 22:14:43.752: RADIUS: NAS-Port [5] 6 111 *Oct 14 22:14:43.752: RADIUS: NAS-Port-Id [87] 11 "0/0/0/111" *Oct 14 22:14:43.752: RADIUS: Connect-Info [77] 15 "ACCESS-STATIC" *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 41 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 35 "client-mac-address=ae6e.0e44.ea8b" *Oct 14 22:14:43.752: RADIUS: Service-Type [6] 6 Framed [2] *Oct 14 22:14:43.752: RADIUS: NAS-IP-Address [4] 6 10.254.36.190 *Oct 14 22:14:43.752: RADIUS: home-hl-prefix [151] 10 "65738A12" *Oct 14 22:14:43.752: RADIUS: Event-Timestamp [55] 6 1539508483 *Oct 14 22:14:43.752: RADIUS: Acct-Input-Packets [47] 6 21676 *Oct 14 22:14:43.752: RADIUS: Acct-Output-Packets [48] 6 24477 *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 36 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 30 "acct-input-packets-ipv6=8250" *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 37 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 31 "acct-output-packets-ipv6=8719" *Oct 14 22:14:43.752: RADIUS: Acct-Authentic [45] 6 RADIUS [1] *Oct 14 22:14:43.752: RADIUS: Acct-Status-Type [40] 6 Watchdog [3] *Oct 14 22:14:43.752: RADIUS: NAS-Port-Type [61] 6 Ethernet [15] *Oct 14 22:14:43.752: RADIUS: NAS-Port [5] 6 111 *Oct 14 22:14:43.752: RADIUS: NAS-Port-Id [87] 11 "0/0/0/111" *Oct 14 22:14:43.752: RADIUS: Connect-Info [77] 15 "VRF" *Oct 14 22:14:43.752: RADIUS: Vendor, Cisco [26] 41 *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 35 "client-mac-address" *Oct 14 22:14:43.752: RADIUS: Service-Type [6] 6 Framed [2] *Oct 14 22:14:43.752: RADIUS: NAS-IP-Address [4] 6 IP *Oct 14 22:14:43.752: RADIUS: home-hl-prefix [151] 10 "65738A12" *Oct 14 22:14:43.752: RADIUS: Event-Timestamp [55] 6 1539508483 Note the ipv6 octect counter is normal but my issue comes when i try to add the ipv6 counter to my radius databases to process and it says it is unknown attribute *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 31 "acct-input-octets-ipv6=444093" *Oct 14 22:14:43.752: RADIUS: Cisco AVpair [1] 32 "acct-output-octets-ipv6=871971" ? Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

3 7