December 2018 - Freeradius-Users - lists.freeradius.org

Re: Freeradius crash please help
by Peter Hutchison 10 Dec '18

10 Dec '18

Ref: 8zero2 operations <8zero2ops(a)gmail.com<mailto:8zero2ops@gmail.com>> A few things to check: a) Check configuration is syntax is correct. a. Cd /etc/freeradius b. Run 'freeradius -XC' c. Warning and errors should be elimated. b) If using EAP or TLS then you will need to ensure certificates are ok and not expired. a. Cd /etc/freeradius/certs b. Openssl x509 -in server.crt -inform perm -noout -text c) Next check modules in mods-enabled. a. Make sure all these files are links to actual files in mods-available to avoid file discrepencies b. Only include the modules here you are actually using. c. Check all the files and look for any problems. d) Next check your sites, e.g. default, and check that it only loads the modules you need and in the correct section. e) Try running freeradius in debug mode 'freeradius -X' and use a tool like NTRadPing (or radtest from another linux workstation), to test authentication to radius server, you can then view the debug output to see what is going on and where it fails. f) When making changes, only make one change at time, test, and then try the next change. Peter Hutchison MCP Senior Network Systems Specialist University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

1 0

Freeradius 3 status server
by Tim Cheyne 09 Dec '18

09 Dec '18

Hi we receive status requests on our version 3 Freeradius (RedHat 7) server periodically from upstream radius proxies also in our company. Upon investigation I can see that these requests are being rejected. They come in on UDP port 1645. Looking into status it would seem that you can't receive status requests from an upstream radius proxy on the same port (1645) that you process auth requests. You would have to configure 18121 to be allowed thru the interconnecting firewalls etc and at both ends. This is the command I run from another radius (10.241.69.183) and output below it with main status config below that. 10.241.69.183 is also in the clients file and it does have a different secret but I have tried matching that too. Specifying 1645 as status port just results in conflict of ports. Am I missing the point as I just assumed it was misconfigured on my end. Thanks for your help Tim Command: echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 1, Response-Packet-Type = Access-Accept"| radclient -x 10.241.69.185:1645 status adminsecret Log output on radius (.185): (2) Received Status-Server Id 167 from 10.241.69.183:53816 to 10.241.69.185:1645 length 50 Dropping packet without response because of error: Received packet from 10.241.69.183 with invalid Message-Authenticator! (Shared secret is incorrect.) Waking up in 0.3 seconds. (2) Cleaning up request packet ID 167 with timestamp +147 Ready to process requests /etc/raddb/sites-available/status ================================== server status { listen { # ONLY Status-Server is allowed to this port. # ALL other packets are ignored. type = status ipaddr = * port = 18121 #port = 1645 } client admin { ipaddr = 127.0.0.1 secret = adminsecret } client rad020 { ipaddr = 10.241.69.183 secret = adminsecret } This email, including any attachments, is confidential. If you have received this email in error, please let me know and then delete it - do not read, use, or distribute it or its contents. This email does not designate an information system for the purposes of the Contract and Commercial Law Act 2017.

2 2

Access-Reject in Password using Cisco
by MDS Test 07 Dec '18

07 Dec '18

Hi, We are running freeradius 2.2.7 and decided it is time to move to a latest version. The person who built the existing server is no longer with us. Knowing that configuration from version 2 cannot be ported to version 3, we had learn it. So we are able to get a working version 3.13 up and able to proxy the request into an rsa server. Authenticating from a juniper network and linux host works. But when we authenticate from a cisco device it fails. Below is the snippet of the log: ... (0) Converting control list to client fields (0) ipv4addr = 10.8.4.36 (0) secret = xxxxx (0) shortname = evtlmdt-chnp11 (0) nas_type = other (0) virtual_server = default Adding client 10.8.4.36/32 with shared secret "xxxxx" (0) Received Access-Request Id 20 from 10.8.4.36:1812 to 10.8.2.16:1812 length 75 (0) User-Password = "\346)!M\367\341\233\305F\342\344\227\350\245\327\313" (0) NAS-IP-Address = 10.8.4.36 (0) NAS-Port-Type = Virtual (0) NAS-Port = 1 (0) Calling-Station-Id = "10.2.2.31" (0) User-Name = "ec2624" (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/radius/radacct/10.8.4.36/auth-detail-20181207 (0) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.8.4.36/auth-detail-20181207 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Dec 7 18:31:40 2018 (0) [auth_log] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "ec2624", looking up realm NULL (0) suffix: Found realm "NULL" (0) suffix: Adding Stripped-User-Name = "ec2624" (0) suffix: Adding Realm = "NULL" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) files: users: Matched entry DEFAULT at line 1 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> ec2624 (0) sql: SQL-User-Name set to 'ec2624' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'ec2624' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'ec2624' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='ec2624' ORDER BY priority (0) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='ec2624' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 (0) sql: User found in the group table (0) sql: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'TIER-4_RW' ORDER BY id (0) sql: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'TIER-4_RW' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: Group "TIER-4_RW": Conditional check items matched (0) sql: Group "TIER-4_RW": Merging assignment check items (0) sql: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'TIER-4_RW' ORDER BY id (0) sql: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'TIER-4_RW' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: Group "TIER-4_RW": Merging reply items rlm_sql (sql): Released connection (0) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = ok (0) Starting proxy to home server 135.37.245.6 port 1812 (0) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (0) pre-proxy { (0) pre_proxy_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d (0) pre_proxy_log: --> /var/log/radius/radacct/10.8.4.36/pre-proxy-detail-20181207 (0) pre_proxy_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d expands to /var/log/radius/radacct/10.8.4.36/pre-proxy-detail-20181207 (0) pre_proxy_log: EXPAND %t (0) pre_proxy_log: --> Fri Dec 7 18:31:40 2018 (0) [pre_proxy_log] = ok (0) } # pre-proxy = ok (0) Proxying request to home server 135.37.245.6 port 1812 timeout 30.000000 (0) Sent Access-Request Id 216 from 0.0.0.0:44743 to 135.37.245.6:1812 length 103 (0) User-Password = "\346)!M\367\341\233\305F\342\344\227\350\245\327\313" (0) NAS-IP-Address = 10.8.4.36 (0) NAS-Port-Type = Virtual (0) NAS-Port = 1 (0) Calling-Station-Id = "10.2.2.31" (0) User-Name = "ec2624" (0) Event-Timestamp = "Dec 7 2018 18:31:40 GMT" (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x3230 Waking up in 0.3 seconds. (0) Expecting proxy response no later than 29.668236 seconds from now Waking up in 29.6 seconds. (0) Marking home server 135.37.245.6 port 1812 alive (0) Clearing existing &reply: attributes (0) Received Access-Reject Id 216 from 135.37.245.6:1812 to 10.8.2.16:44743 length 24 (0) Proxy-State = 0x3230 (0) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (0) post-proxy { (0) post_proxy_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d (0) post_proxy_log: --> /var/log/radius/radacct/10.8.4.36/post-proxy-detail-20181207 (0) post_proxy_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d expands to /var/log/radius/radacct/10.8.4.36/post-proxy-detail-20181207 (0) post_proxy_log: EXPAND %t (0) post_proxy_log: --> Fri Dec 7 18:31:40 2018 (0) [post_proxy_log] = ok (0) eap: No pre-existing handler found (0) [eap] = noop (0) update proxy-reply { (0) Filter-Id !* ANY (0) Fortinet-Access-Profile !* ANY (0) Juniper-Local-User-Name !* ANY (0) Cisco-AVPair !* ANY (0) PaloAlto-Admin-Role !* ANY (0) PaloAlto-Panorama-Admin-Role !* ANY (0) F5-LTM-User-Info-1 !* ANY (0) } # update proxy-reply = noop (0) if ("%{proxy-reply:Packet-Type}" == Access-Accept) { (0) EXPAND %{proxy-reply:Packet-Type} (0) --> Access-Reject (0) if ("%{proxy-reply:Packet-Type}" == Access-Accept) -> FALSE (0) } # post-proxy = ok (0) EXPAND %{User-Name} failed authentication for %{Packet-Src-IP-Address} (0) --> ec2624 failed authentication for 10.8.4.36 (0) Login incorrect (Home Server says so): [ec2624] (from client evtlmdt-chnp11 port 1 cli 10.2.2.31) ec2624 failed authentication for 10.8.4.36 (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> ec2624 (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 20 from 10.8.2.16:1812 to 10.8.4.36:1812 length 20 Waking up in 3.9 seconds. Waking up in 5.3 seconds. I noticed that this field User-Password = "\346)!M\367\341\233\305F\342\344\227\350\245\327\313" seems to be the issue but i am not certain. I think this data is being sent to the rsa server instead of clear text. The clear text value of that password is 16752550. This is an OTP. But when we are authenticating to a linux host, the password field is clear text. In our version 2.0, we are able to authenticate to the cisco gear. I am still learning freeradius and would like if you can point me how to fix this. mds

2 1

Re: User Authorization Using 'PAM Authentication Module(pam_radius_auth.so)
by Deepak Kumar Bhagat 07 Dec '18

07 Dec '18

Hi Alan, Hi just raised the pull request for the patch, Can you please review and merge the patch to the master. Sharing the pull request for your reference - https://github.com/FreeRADIUS/pam_radius/pull/41 -Deepak Bhagat

1 0

Re: User Authorization Using 'PAM Authentication Module(pam_radius_auth.so)
by Deepak Kumar Bhagat 07 Dec '18

07 Dec '18

Thank You !! Alan for the response, It's very encouraging for me. > If you can update the patch for the current module, I can add it in. I have completed the patch and doing the initial testing with my setup, I will surely share the patch very soon !!

1 0

Implementation with AD integration on RHEL7
by M S 06 Dec '18

06 Dec '18

Hi all, Please pardon my newb-ness. I am new to RADIUS and FreeRADIUS. How would you guys advise setting up FreeRADIUS to utilize Active Directory on RHEL7? My goal is to provide centralized authentication for our network switches. The RHEL7 host system that will be hosting FreeRADIUS is setup to directly authenticate users logging into it against our AD server using sssd. I was thinking that rather than setting up a separate AD relationship between FreeRADIUS and AD, would it be possible to have FreeRADIUS utilize the OS-level relationship that is setup with AD via sssd? I am not finding much online describing this setup. Setup: Red Hat Enterprise Linux Server release 7.6 (Maipo) FreeRADIUS 3.0.13-9 (the version available in RHEL7 repos) Thanks, MS

3 2

sqlippool additional information
by Nathan Ward 06 Dec '18

06 Dec '18

Hi, I’m doing some testing of sqlippool in a fairly large scale environment, where we have lots of different IPv4 prefixes to select addresses from. We have many prefixes in each pool, and direct customers to pools based on some details. Depending on the prefix the customer gets assigned an address from we want to return different information in RADIUS - such as setting attributes to pass DHCP options like prefix length, router, DNS server, etc. In my testing, I’ve been setting these manually, but in production these can change, and I don’t want to be reconfiguring and reloading the RADIUS server each time we move things about. Customers could get addresses from any prefix, so we can’t provide these values from our user database unfortunately. sqlippool returns only a single value. As does sql xlat. Is there a good way to pull these from a DB? We’ve got both LDAP and SQL at our disposal. We’re running Postgres, so can easily do a longest prefix match to find the prefix that an address is in - but this means one query per attribute value we want, which I figure means about 4 or 5 extra queries per auth request so isn’t really ideal. Before I go down that road, I figured I’d reach out and see if anyone else has an elegant solution I haven’t considered, as it seems like it’d be a fairly common problem. -- Nathan Ward

3 4

User Authorization Using 'PAM Authentication Module(pam_radius_auth.so)
by Deepak Kumar Bhagat 06 Dec '18

06 Dec '18

Hi All, I have a requirement to authenticate and authorize users for management access to the device using Radius Protocol. I'm using Linux PAM module (pam_radius_auth.so) for Radius client support and freeRADIUS as Radius server. I have written sample PAM-enable application (check_user) to test the same. I could successfully test user authentication using my application. As part of user authorization, I'm sending 'Management-Privilege-Level (136)' RFC 5607 attribute in 'Access-Accept' and Intend to use the same at the device to give different management access to the user. Different Management-Privilege-Level (MPL) levels are mapped as below. MPL Access Level 1 Root user (read, write, exec) 2 Read only user (read) 3 Deny access (null) Is there a way to fetch/read/pass this attribute from pam_radius_auth.so to my PAM-enable application?? I checked pam_radius_auth.so source code, It seems it doesn't read any attribute from 'Access Accept' received from the server, if that is the case then how can we enable 'PAM Authentication Module' to read the authorization attributes received in the response?? Or, Can someone suggest how can we achieve user authorization using PAM Authentication module?? One relevant reference form the mail list is https://www.redhat.com/archives/pam-list/2001-March/msg00056.html, but it seems the code changes are not included in the module. Many Thanks, Deepak Bhagat.

2 1

Re: escaping close brace inside "d string is not working
by Chinnapaiyan, Nagamani 06 Dec '18

06 Dec '18

It works when we escape with %. Documentation should have had this point. if("%{redis: EXISTS {local%}:pool}" == 1) { Regards, Nagamani Chinnapaiyan

2 1

Fw: How to Enable Accounting Update using Freeradius-Client
by Hamid Hashmi 06 Dec '18

06 Dec '18

Hi I am using Freeradius-Client<https://github.com/FreeRADIUS/freeradius-client> with opensips (aaa_radius<https://opensips.org/html/docs/modules/2.4.x/aaa_radius.html>) and I need to enable accounting update, how can I do that? I have added AVP Acct-Interim-Update<https://freeradius.org/rfc/rfc2869.html#Acct-Interim-Interval> in an Access-Accept packet but still freeradius-client in not generating accounting update. Is there any other configuration or AVP required in freeradius-client to enable interim updates. Regards Hamid R. Hashmi

2 1