February 2018 - Freeradius-Users - lists.freeradius.org

rlm_detail and empty packets
by Brian Candler 22 Feb '18

22 Feb '18

I was trying to find out why reply_log wasn't logging successful authentications [freeradius 3.0.x] It turns out there is hard-coded logic in rlm_detail.c to ignore packets which don't contain any AV pairs: if (!packet->vps) { RWDEBUG("Skipping empty packet"); return 0; } This is unfortunate because I was hoping to see e.g. Thu Feb 22 13:53:29 2018 Packet-Type = Access-Accept Timestamp = 1519307609 I can force it to work by adding a spurious Reply-Message attribute, but that seems silly. Setting "log_packet_header" doesn't make any difference, because the empty packet check is made very early on. Was there a reason for suppressing these logs? Would it be worth having a config switch for this? Regards, Brian.

2 2

FreeRadius Re-Authentication Latency
by Smith, James 21 Feb '18

21 Feb '18

Submitted as a larger email last time. The attached file is now compressed and email should be a smaller size. Hello, I'm currently experiencing a latency issue with Siemens base stations and CPEs re-authenticating to our FreeRadius server running version 3.0.4. (I understand this version is a little old and should be updated. We will look into this in the new future) Attached is my log file after running FreeRadius in debug mode. CPE9(a)siemens.com is the specific host I'd like to look at but all of our CPEs are experiencing the same issue. We use EAP-TTLS for authentication and it looks like it takes many sessions (167 from what I can tell by looking at the Access-Request ID) to actually complete the re-authentication process. The amount of sessions may vary for each CPE as they can take 2-10 minutes to actually authenticate. It starts on line 3546 and finally authenticates on line 18927. CPE (Suplicant) ----> NAS-Identifier = "BS" (Authenticator) ------> Radius Server Please let me know if you have any questions and/or if you think I have to tweak my configuration somewhere to speed this up. Thanks for the help, James Smith - This message is intended only for the addressee and may contain information that is company confidential or privileged. Any technical data in this message may be exported only in accordance with the U.S. International Traffic in Arms Regulations (22 CFR Parts 120-130) or the Export Administration Regulations (15 CFR Parts 730-774). Unauthorized use is strictly prohibited and may be unlawful. If you are not the intended recipient, or the person responsible for delivering to the intended recipient, you should not read, copy, disclose or otherwise use this message. If you have received this email in error, please delete it, and advise the sender immediately. -

2 2

[sql]ok, [sql]notfound and [sql]reject
by Anderson Gomes de Andrade 21 Feb '18

21 Feb '18

Como obter rejeição no sql, recebo apenas [slq] ok e [sql] notfound, se o usuário inserir o nome de usuário correto e a senha errada, o sql retorna ok, não foi para retornar [sql] rejeitar?

3 2

AW: Post-Auth Section not executed / RESOLVED
by NOC WVNET 20 Feb '18

20 Feb '18

>My Post-Auth Section (in sites-enabled) > >post_auth { > Post-Auth-Type REJECT { > update reply { > Cisco-AVPair !* ANY > } > attr_filter.access_reject > } > > Aaaargh => post_auth doesn't exist, should be post-auth Now everything is working fine ... post-auth { Post-Auth-Type REJECT { update reply { Cisco-AVPair !* ANY } attr_filter.access_reject }

1 0

Post-Auth Section not executed
by NOC WVNET 20 Feb '18

20 Feb '18

Hi all, I'm testing an LDAP Backend for PPPoE User Authorization. Goal is to remove the added AVPairs (during Authorization) if authentication fail. I have put the statements in the "post-auth" Section but it seems it is never executed. ------------------------------------------------------------------ RADIUS VERSION (http://packages.networkradius.com/centos/7/repo) ------------------------------------------------------------------- radiusd: FreeRADIUS Version 3.0.16, for host x86_64-redhat-linux-gnu, built on Jan 11 2018 at 16:34:57 FreeRADIUS Version 3.0.16 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT -------------------------------------- cat ../sites-available/wvnet-aaa -------------------------------------- server wvnet-aaa { listen { ipaddr = ATVIED6INFRAH4AAA port = 1812 type = auth } authorize { filter_username filter_password preprocess if ( &User-Name =~ /^(.*)(a)(.*$)/ ) { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } } auth_log ATVIED6INFRAH4LDAP chap pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } } post_auth { Post-Auth-Type REJECT { update reply { Cisco-AVPair !* ANY } attr_filter.access_reject } } listen { ipaddr = ATVIED6INFRAH4AAA port = 1813 type = acct } preacct { preprocess update request { FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}" } acct_unique acct_counters64 } accounting { redundant { ATVIED6INFRAH4MYSQL ATVIED6INFRAH3MYSQL ATVIED6INFRAH2MYSQL } attr_filter.accounting_response } } -------------------------- cat ../mods-enabled/ldap -------------------------- ldap ATVIED6INFRAH4LDAP { server = 'ldaps://ATVIED6INFRAH4LDAP.as29081.net' identity = '---------' password = '---------' valuepair_attribute = 'radiusAttribute' base_dn = 'ou=DialIn,ou=AccessService,ou=AAA,dc=as29081,dc=net' update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" #filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" filter = "(cn=%{User-Name})" scope = 'sub' access_attribute = 'dialupAccess' access_positive = yes } group { } profile { } client { base_dn = 'ou=AccessServer,ou=AAA,dc=as29081,dc=net' filter = '(objectClass=radiusClient)' scope = 'sub' attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' shortname = 'radiusClientShortname' nas_type = 'radiusClientType' virtual_server = 'radiusClientVirtualServer' require_message_authenticator = 'radiusClientRequireMa' } } read_clients = no accounting { } post-auth { } options { dereference = 'never' chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 3 net_timeout = 2 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { start_tls = no ca_path = /etc/openldap/certs certificate_file = /etc/openldap/certs/as29081_net.crt private_key_file = /etc/openldap/certs/as29081_net.key random_file = /dev/urandom require_cert = 'allow' } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 20 lifetime = 0 idle_timeout = 60 } } DEBUG-OUTPUT ------------ (1) Received Access-Request Id 58 from 10.214.30.1:38589 to 10.214.200.35:1812 length 109 (1) User-Name = "atvied6infraclust-monitor(a)edsl.wvnet.at" (1) User-Password = "secret" (1) NAS-IP-Address = 10.214.10.1 (1) NAS-Port = 1 (1) Message-Authenticator = 0x74809479c2c4eb92b4d90fa454a31de5 (1) # Executing section authorize from file /etc/raddb/sites-enabled/wvnet-aaa (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) policy filter_password { (1) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (1) EXPAND %{string:User-Password} (1) --> secret (1) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (1) } # policy filter_password = notfound (1) [preprocess] = ok (1) if ( &User-Name =~ /^(.*)(a)(.*$)/ ) { (1) if ( &User-Name =~ /^(.*)(a)(.*$)/ ) -> TRUE (1) if ( &User-Name =~ /^(.*)(a)(.*$)/ ) { (1) update request { (1) EXPAND %{1} (1) --> atvied6infraclust-monitor (1) Stripped-User-Name := atvied6infraclust-monitor (1) EXPAND %{2} (1) --> edsl.wvnet.at (1) Realm := edsl.wvnet.at (1) } # update request = noop (1) } # if ( &User-Name =~ /^(.*)(a)(.*$)/ ) = noop (1) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addres s}}/auth-detail-%Y%m%d (1) auth_log: --> /var/log/radius/radacct/10.214.30.1/auth-detail-20180219 (1) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addres s}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.214.30.1/auth-detail-20180219 (1) auth_log: EXPAND %t (1) auth_log: --> Mon Feb 19 22:59:20 2018 (1) [auth_log] = ok rlm_ldap (ATVIED6INFRAH4LDAP): Reserved connection (1) (1) ATVIED6INFRAH4LDAP: EXPAND (cn=%{User-Name}) (1) ATVIED6INFRAH4LDAP: --> (cn=atvied6infraclust-monitor(a)edsl.wvnet.at) (1) ATVIED6INFRAH4LDAP: Performing search in "ou=DialIn,ou=AccessService,ou=AAA,dc=as29081,dc=net" with filter "(cn=atvied6infraclust-monitor(a)edsl.wvnet.at)", scope "sub" (1) ATVIED6INFRAH4LDAP: Waiting for search result... (1) ATVIED6INFRAH4LDAP: User object found at DN "cn=atvied6infraclust-monitor(a)edsl.wvnet.at,ou=edsl.wvnet.at,ou=realm,ou=Dia lIn,ou=AccessService,ou=AAA,dc=as29081,dc=net" (1) ATVIED6INFRAH4LDAP: Processing user attributes (1) ATVIED6INFRAH4LDAP: control:Password-With-Header += 'secret' (1) ATVIED6INFRAH4LDAP: reply::Cisco-AVPair += 'ip:addr-pool=monitor-pool' (1) ATVIED6INFRAH4LDAP: reply::Cisco-AVPair += 'lcp:interface-config=service-policy input monitor' rlm_ldap (ATVIED6INFRAH4LDAP): Released connection (1) Need 4 more connections to reach 10 spares rlm_ldap (ATVIED6INFRAH4LDAP): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ATVIED6INFRAH4LDAP): Connecting to ldaps://ATVIED6INFRAH4LDAP.as29081.net:636 TLS certificate verification: Error, self signed certificate in certificate chain rlm_ldap (ATVIED6INFRAH4LDAP): Waiting for bind result... rlm_ldap (ATVIED6INFRAH4LDAP): Bind successful (1) [ATVIED6INFRAH4LDAP] = updated (1) [chap] = noop (1) pap: No {...} in Password-With-Header, re-writing to Cleartext-Password (1) pap: Removing &control:Password-With-Header (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /etc/raddb/sites-enabled/wvnet-aaa (1) Auth-Type PAP { (1) pap: Login attempt with password (1) pap: Comparing with "known good" Cleartext-Password (1) pap: ERROR: Cleartext password does not match "known good" password (1) pap: Passwords don't match (1) [pap] = reject (1) } # Auth-Type PAP = reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) Post-Auth-Type sub-section not found. Ignoring. (1) Login incorrect (pap: Cleartext password does not match "known good" password): [atvied6infraclust-monitor(a)edsl.wvnet.at/secret] (from client ATVIED6INFRACLUST-RADCLIENT port 1) (1) Delaying response for 2.000000 seconds Waking up in 0.6 seconds. Waking up in 1.3 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 58 from 10.214.200.35:1812 to 10.214.30.1:38589 length 110 (1) Cisco-AVPair += "ip:addr-pool=monitor-pool" (1) Cisco-AVPair += "lcp:interface-config=service-policy input monitor" Waking up in 2.9 seconds. (1) Cleaning up request packet ID 58 with timestamp +26 Ready to process requests BR Stefan

2 2

Custom, conditional, variable in linelog
by Giuseppe Civitella 19 Feb '18

19 Feb '18

Hi all, I use a few virtual servers to define users access to CISCO devices against their LDAP profile. In every virtual server I've got: post-auth { update { &reply: += &session-state: } reply_log exec if ("%{ldap:ldap://127.0.0.1/USER_DN?objectClass?one?(&(dialupAccess=yes)(o=cpe_mpls_15)(cn=%{User-Name}))}") { update reply { &Reply-Message += 'Custom message' &Cisco-AVPair += 'shell:priv-lvl=15' My-Ldap-filter := cpe_mpls_15 } } log_dyn_clients In my local dictionary I defined: ATTRIBUTE My-Ldap-filter 5000 string I'd like to assign a value to My-Ldap-filter in every if block and record the value in a log file. So i defined log_dyn_clients this way: linelog log_dyn_clients { filename = ${logdir}/linelog-client-auth-%Y%m%d.log permissions = 0600 reference = "messages.%{%{reply:Packet-Type}:-default}" messages { default = "[Unknown] unknown packet type %{Packet-Type}" Access-Accept = "[Accept] user: %{User-Name}, client_ip: %{Packet-Src-IP-Address}, virtual_server: %{Virtual-Server}, attr: %{My-Ldap-filter}" Access-Reject = "[Reject] user: %{User-Name}, client_ip: %{Packet-Src-IP-Address}, virtual_server: %{Virtual-Server}, attr: %{My-Ldap-filter}" } } Unfortunately I'm not able to get My-Ldap-filter's value in the logs: [Accept] user: gcivitella, client_ip: 10.200.20.79, virtual_server: cpe_mpls_srv, attr: [Accept] user: gcivitella, client_ip: 10.200.20.79, virtual_server: cpe_mpls_srv, attr: How could I get the logs I need? Any idea? Thanks a lot, Giuseppe

1 1

Re: Salted SHA3 Support
by Rashad Hall 16 Feb '18

16 Feb '18

Currently running FreeRADIUS Version 3.0.15 and looking for confirmation of SHA3 support as I found this page (https://freeradius.org/radius d/man/rlm_pap.html) that has SHA3 listed, but when I run man rlm_pap I have significantly fewer options. Just wanted to confirm if support for SHA3 in FreeRADIUS is available yet? My "man rlm_pap" below. rlm_pap(5) FreeRADIUS Module rlm_pap(5) NAME rlm_pap - FreeRADIUS Module DESCRIPTION The rlm_pap module authenticates RADIUS Access-Request packets that contain a User-Password attribute. The module should also be listed last in the authorize section, so that it can set the Auth-Type attribute as appropriate. When a RADIUS packet contains a clear-text password in the form of a User-Password attribute, the rlm_pap module may be used for authentication. The module requires a "known good" password, which it uses to validate the password given in the RADIUS packet. That "known good" password must be supplied by another module (e.g. rlm_files, rlm_ldap, etc.), and is usually taken from a database. CONFIGURATION The only configuration item is: normalise The default is "yes". This means that the module will try to automatically detect passwords that are hex- or base64-encoded and decode them back to their binary representation. However, some clear text passwords may be erroneously converted. Setting this to "no" prevents that conversion. USAGE The module looks for the Password-With-Header control attribute to find the "known good" password. The attribute value comprises the header followed immediately by the password data. The header is given by the following table. Header Attribute Description ------ --------- ----------- {clear} Cleartext-Password clear-text passwords {cleartext} Cleartext-Password clear-text passwords {crypt} Crypt-Password Unix-style "crypt"ed passwords {md5} MD5-Password MD5 hashed passwords {base64_md5} MD5-Password MD5 hashed passwords {smd5} SMD5-Password MD5 hashed passwords, with a salt {sha} SHA-Password SHA1 hashed passwords SHA1-Password SHA1 hashed passwords {ssha} SSHA-Password SHA1 hashed passwords, with a salt SSHA1-Password SHA1 hashed passwords, with a salt {ssh2} SHA2-Password SHA2 hashed passwords {ssh256} SHA2-Password SHA2 hashed passwords {ssh512} SHA2-Password SHA2 hashed passwords {nt} NT-Password Windows NT hashed passwords {nthash} NT-Password Windows NT hashed passwords {x-nthash} NT-Password Windows NT hashed passwords {ns-mta-md5} NS-MTA-MD5-Password Netscape MTA MD5 hashed passwords {x- orcllmv} LM-Password Windows LANMAN hashed passwords {X- orclntv} LM-Password Windows LANMAN hashed passwords *--* *Rashad Hall* Jr. Network Engineer | *Zayo Group* O: +1 858.836.0202 <(858)%20836-0202> 12270 World Trade Drive Suite #100 | San Diego, CA 92128 Mission <http://www.zayo.com/company/about-zayo/> | Network Map <http://www.zayo.com/solutions/global-network/> | LinkedIn <https://www.linkedin.com/company/zayo-group> | Twitter <https://twitter.com/zayogroup>

3 4

Digital certificate
by Tchesco 15 Feb '18

15 Feb '18

Good afternoon everyone, I'm new here, and I do not write well in English, but I need help with FreeRadius. My scenario is as follows, I'm using FreeRADIUS Version 3.0.13 on CentOS 7 to authenticate wireless equipment in my network. My wireless system has two Alcatel-Lucent OAW-4604-US controllers, and more than 50 access point. FreeRadius is up and running. Only they requested that a digital certificate be installed, where the equipment is recognized as being valid. I've already got a valid certificate for a week to test, but I can not get it up and running. Does anyone know how to do this? NOTE: For generating the valid certificate, I sent the generated "server.csr" as the README file to the "/ etc / raddb / certs /" folder. Regards, Francisco Trindade. +55 (48) 3221-2760

2 1

Multiple post-auth queries
by Gianluca Laudano 15 Feb '18

15 Feb '18

Hello, I'm running freeradius 3.0.12 on Debian Stretch amd64 + mysql 5.6 I'm trying to execute multiple queries at post-auth with a configuration like this: query= "statement 1; statement 2; statement 3" With this configuration active I often (not always) get this MySQL error: sql_time: ERROR: rlm_sql_mysql: ERROR 2014 (Commands out of sync; you can't run this command now): HY000 The error does't appear if I just execute two statements. The statements execute insert and updates Thanks in advance Gianluca

3 4

Accees requests log
by Bassem Mettichi 13 Feb '18

13 Feb '18

Hello, iam using freeradius 3.0.16 and i need to enbale log for acceess requets any one could help how to enbale logging for access requests because in this version i can't see the auth log module on mods-available. Thanks in advance

4 4