February 2018 - Freeradius-Users - lists.freeradius.org

API capabilities
by Tunc Gunergun 01 Feb '18

01 Feb '18

Hi Guys, Hope you are well. I never installed/used free radius before however I'm tasked to assess its Rest API capabilities and see whether following 802.1.x use case is workable. - Controller asks FreeRadius to block a specific IP address via API; - FreeRadius finds who owns that IP from authenticated user list; - FreeRadius sends Radius CoA to 802.1x authenticator (Switch) a. to reset user session (reject user authentication at next attempt or put user into default vlan) b. to reset user session and put user into a quarantine vlan X - Controller ask FreeRadius to unblock (release) a specific IP address via API. a. same as above but in reverse order b. same as above but in reverse order. Many thanks for your support in advance. Cheers Matt

3 2

BYOD and base on MAC
by Luc Paulin 01 Feb '18

01 Feb '18

Hi, I know that we can do a BYOD wireless setup with freeradius base on if the client setup was setup with certificate(EAP-TLS) or not by checking the EAP-Type field. But I was wondering would it be possible to do it base on MAC adresse. The idea here is that we would like to move user to the appropriate vlan base on his device mac. If MAC address is within that list, device is granted to the corp vlan, else it'll default to the BYOD vlan. In the post-auth section I did add some lines in order to try do the check base on mac addresse ======== # We rewrite calling_station_id in order to do mac checkup rewrite_calling_station_id # Check against the authorized_macs file authorized_macs if (!ok) { update reply { Tunnel-Type := 13 Tunnel-Medium-Type := 6 Tunnel-Private-Group-Id := 155 } } else { update reply { Tunnel-Type := 13 Tunnel-Medium-Type := 6 Tunnel-Private-Group-Id := 157 } } ======== However look like the authorized_macs always return noop. Am I doing something wrong or something not supported? Thanx !! -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

3 11

Problem authentication Windows 10
by Arnaud Forster 01 Feb '18

01 Feb '18

Hello, Since a few weeks now, several users using Windows 10 cannot authenticate anymore. It seems that an update from Windows 10 (Update 1703) could be the source of this problem. Does anyone has informations about that or a way to solve this possible issue ? Thanks to all for your help Arnaud

3 3

Can't use winbind in 3.0.16
by Jonathan Gazeley 01 Feb '18

01 Feb '18

I have just started upgraded from 3.0.15 to 3.0.16 (the latter being installed directly from http://packages.networkradius.com/centos/7/repo/) I now cannot start up the daemon and in debug mode it fails : radiusd -X ... # Instantiating module "eduroammschap" from file /etc/raddb/mods-enabled/eduroammschap /etc/raddb/mods-enabled/eduroammschap[10]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/eduroammschap[10]: Instantiation failed for module "eduroammschap" My eduroammschap module is configured to use a winbind handle rather than a call to ntlm_auth, as recommend by Matthew Newton a while ago. [jg4461@radius-dev ~]$ cat /etc/raddb/mods-enabled/eduroammschap | grep -v '#' mschap eduroammschap { winbind_username = "%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}}" winbind_domain = "%{eduroammschap:NT-Domain}" pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } passchange { } allow_retry = no retry_msg = "Verify username and re-enter your password" } I've been building the RPM myself from the official tarball + spec file up until now, but is the official RPM built differently? Thanks, Jonathan

5 8

freeRadius leaking memory
by Nicolas Reich 01 Feb '18

01 Feb '18

Hi, I'm running some tests on the freeRadius server I'm working on (which uses only EAP-TLS) to see what sort of load it can handle, and to tune the configuration accordingly. Doing this, I've noticed that the memory used by the radiusd process continually increases, until the system is out of memory, a clear sign of memory leaking. So I kept experimenting and I got quite sure there is some memory leaking. So I tried with Valgrind, and here's what I got after 1 minute (approximately 75 access requests): LEAK SUMMARY: definitely lost: 46,978 bytes in 327 blocks indirectly lost: 893,915 bytes in 5,922 blocks possibly lost: 2,228,808 bytes in 4,792 blocks still reachable: 1,599,763 bytes in 32,997 blocks suppressed: 0 bytes in 0 blocks Reachable blocks (those to which a pointer was found) are not shown. To see them, rerun with: --leak-check=full --show-leak-kinds=all Those are the biggest for "definitely lost": 214,180 (7,676 direct, 206,504 indirect) bytes in 76 blocks are definitely lost in loss record 1,696 of 1,700 at 0x4C2DB9D: malloc (vg_replace_malloc.c:299) by 0x5B9697F: _talloc_array (in /usr/lib64/libtalloc.so.2.1.9) by 0x50814BF: talloc_bstrndup (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x509121F: value_data_from_str (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x5082207: fr_pair_value_from_str (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x50826A7: fr_pair_make (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x148961: cbtls_verify (in /usr/sbin/radiusd) by 0x561AE84: ??? (in /usr/lib64/libcrypto.so.1.0.2m) by 0x561CE5F: X509_verify_cert (in /usr/lib64/libcrypto.so.1.0.2m) by 0x5964137: ssl_verify_cert_chain (in /usr/lib64/libssl.so.1.0.2m) by 0x593AF78: ssl3_get_client_certificate (in /usr/lib64/libssl.so.1.0.2m) by 0x593C7D7: ssl3_accept (in /usr/lib64/libssl.so.1.0.2m) 509,668 (26,928 direct, 482,740 indirect) bytes in 153 blocks are definitely lost in loss record 1,698 of 1,700 at 0x4C2DB9D: malloc (vg_replace_malloc.c:299) by 0x5B95DFA: _talloc_zero (in /usr/lib64/libtalloc.so.2.1.9) by 0x5081901: ??? (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x5081A12: fr_pair_afrom_da (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x5082598: fr_pair_make (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x148961: cbtls_verify (in /usr/sbin/radiusd) by 0x561AE84: ??? (in /usr/lib64/libcrypto.so.1.0.2m) by 0x561CE5F: X509_verify_cert (in /usr/lib64/libcrypto.so.1.0.2m) by 0x5964137: ssl_verify_cert_chain (in /usr/lib64/libssl.so.1.0.2m) by 0x593AF78: ssl3_get_client_certificate (in /usr/lib64/libssl.so.1.0.2m) by 0x593C7D7: ssl3_accept (in /usr/lib64/libssl.so.1.0.2m) by 0x5948801: ssl3_read_bytes (in /usr/lib64/libssl.so.1.0.2m) And those for "possibly lost": 567,552 bytes in 32 blocks are possibly lost in loss record 1,700 of 1,700 at 0x4C2DB9D: malloc (vg_replace_malloc.c:299) by 0x55277E7: CRYPTO_malloc (in /usr/lib64/libcrypto.so.1.0.2m) by 0x5949CD2: ssl3_setup_read_buffer (in /usr/lib64/libssl.so.1.0.2m) by 0x5949E28: ssl3_setup_buffers (in /usr/lib64/libssl.so.1.0.2m) by 0x594B484: ssl23_get_client_hello (in /usr/lib64/libssl.so.1.0.2m) by 0x594BC5B: ssl23_accept (in /usr/lib64/libssl.so.1.0.2m) by 0x594CDC1: ssl23_read (in /usr/lib64/libssl.so.1.0.2m) by 0x14BE29: tls_handshake_recv (in /usr/sbin/radiusd) by 0x52B115E: eaptls_process (in /usr/lib64/freeradius/libfreeradius-eap.so) by 0xBBCCD0D: ??? (in /usr/lib64/freeradius/rlm_eap_tls.so) by 0xAFAB571: ??? (in /usr/lib64/freeradius/rlm_eap.so) by 0xAFABA99: eap_method_select (in /usr/lib64/freeradius/rlm_eap.so) 559,872 bytes in 32 blocks are possibly lost in loss record 1,699 of 1,700 at 0x4C2DB9D: malloc (vg_replace_malloc.c:299) by 0x55277E7: CRYPTO_malloc (in /usr/lib64/libcrypto.so.1.0.2m) by 0x5949DCC: ssl3_setup_write_buffer (in /usr/lib64/libssl.so.1.0.2m) by 0x5949E37: ssl3_setup_buffers (in /usr/lib64/libssl.so.1.0.2m) by 0x594B484: ssl23_get_client_hello (in /usr/lib64/libssl.so.1.0.2m) by 0x594BC5B: ssl23_accept (in /usr/lib64/libssl.so.1.0.2m) by 0x594CDC1: ssl23_read (in /usr/lib64/libssl.so.1.0.2m) by 0x14BE29: tls_handshake_recv (in /usr/sbin/radiusd) by 0x52B115E: eaptls_process (in /usr/lib64/freeradius/libfreeradius-eap.so) by 0xBBCCD0D: ??? (in /usr/lib64/freeradius/rlm_eap_tls.so) by 0xAFAB571: ??? (in /usr/lib64/freeradius/rlm_eap.so) by 0xAFABA99: eap_method_select (in /usr/lib64/freeradius/rlm_eap.so) I am unsure on how to proceed next though. Any advice? Could it be a misconfiguration? Could it be a problem in OpenSSL? I have freeRadius 3.0.15 and OpenSSL 1.0.2m on Fedora 25. Thanks in advance, and regards, Nicolas

2 1

Huntgroup-Name
by Carsten Schulze 01 Feb '18

01 Feb '18

Hi, I use the huntgroup text file for my NAS myshare NAS-IP-Address == 192.168.102.43 and now I would like to do a check in sites-enabled/default post-auth { (0) if ("%{Huntgroup-Name}" == "myshare") { (0) ERROR: Failed retrieving values required to evaluate condition (0) else { How could I access/or is there a variable with the name of the huntgroup? There are only examples using sql :(. Thanks + Regards Carsten

3 5

minor bug on Redhat/Centos init/starup script
by Stefano Mason 01 Feb '18

01 Feb '18

Dear Alan, I just cloned the https://github.com/FreeRADIUS/freeradius-server.git and cd freeradius-server git checkout -b v3.0.x origin/v3.0.x cd redhat [smason@betty redhat]$ grep RuntimeDirectory radiusd.service RuntimeDirectory=/var/run/radiusd RuntimeDirectoryMode=0775 [smason@betty redhat]$ Please substitute RuntimeDirectory=/var/run/radiusd with RuntimeDirectory=radiusd because, this parameter RuntimeDirectory should be filled with relative path, as from "man" reported (man systemd.exec): RuntimeDirectory= Takes a list of directory names. If set, one or more directories by the specified names will be created below /run (for system services) or below $XDG_RUNTIME_DIR (for user services) when the unit is started, and removed when the unit is stopped. The directories will have the access mode specified in RuntimeDirectoryMode=, and will be owned by the user and group specified in User= and Group=. Use this to manage one or more runtime directories of the unit and bind their lifetime to the daemon runtime. The specified directory names must be relative, and may not include a "/", i.e. must refer to simple directories to create or remove. This is particularly useful for unprivileged daemons that cannot create runtime directories in /run due to lack of privileges, and to make sure the runtime directory is cleaned up automatically after use. For runtime directories that require more complex or different configuration or lifetime guarantees, please consider using tmpfiles.d(5). To replicate the bug is necessary to reboot the system, because the /var/run will be empty during the first phases of a booting system. The /var/run/radiusd will be created only in case the content of RuntimeDirectory variable will be radiusd. Best regards. Stefano

2 1

Freeradius OpenLDAP + SSL
by Tsirkas Georgios 01 Feb '18

01 Feb '18

Hello, I am trying to connect Freeradius Server + OpenLDAP with SSL. Connecting as LDAP client with Jxplorer, i use a certificate. Where i can define this certificate in freeradius in order to connect with LDAP ? Thank you!

2 1

Acctstoptime same as acctstarttime
by Yahn do Amaral Almeida Pinheiro 01 Feb '18

01 Feb '18

Hello, I'm using FreeRadius 2.1.12 and I gotta a database problem with the user connection registry. Can you help me? When the connection is registered, the acctstoptime field is filled with the same content from the acctstarttime field, the user doesn't loose connection but radius fills the field like it lost at the same time it started. However, when the user actually looses connection, the field gets updated to the right actual time. As of now, I can't update my FreeRadius since it's the one being used for the clients and it can't stop at any time then. Thank you in advance.

2 2

Debian 9 - Samba 4.5.12 - Freeradius 3.02 ntlm_auth not working
by Kasandra Padisha 01 Feb '18

01 Feb '18

Hi I have tried everything possible. I have read every publication available and I am about to give up !!! I could not make it work: Radius using ntlm_auth to autenthicate. Details ..: a bit long . apologies :-) --------------------------------- SAMBA --------------------------------- I have samba 4.5.12 working OK ------------------- smb.conf # Global parameters [global] netbios name = GALAPA realm = MINUT.EDU.CO workgroup = MINUT-EXT dns forwarder = 192.168.32.1 server role = active directory domain controller # Autenticaion sin dominio winbind use default domain = no [netlogon] path = /var/lib/samba/sysvol/minut.edu.co/scripts read only = No [sysvol] path = /var/lib/samba/sysvol read only = No ------------------- All tests of samba working OK ------------------- #>> smbclient -L localhost -U% Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian] Sharename Type Comment --------- ---- ------- netlogon Disk sysvol Disk IPC$ IPC IPC Service (Samba 4.5.12-Debian) Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian Server Comment --------- ------- Workgroup Master --------- ------- WORKGROUP GALAPA ------------------- #>> root@galapa:/etc/freeradius/3.0# smbclient //localhost/netlogon -Uskina%'Nio4LasOo' -c 'ls' Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian] . D 0 Tue Jan 30 11:11:29 2018 .. D 0 Tue Jan 30 11:11:48 2018 65799648 blocks of size 1024. 61762632 blocks available #>> ntlm_auth --request-nt-key --domain=MINUT-EXT --username=skina --password='Nio4LasOo' NT_STATUS_OK: Success (0x0) #>> wbinfo --ntlmv2 -a 'skina'%'Nio4LasOo' plaintext password authentication succeeded challenge/response password authentication succeeded # wbinfo -a 'skina'%'Nio4LasOo' plaintext password authentication succeeded challenge/response password authentication failed wbcAuthenticateUserEx(MINUT-EXT\skina): error code was NT_STATUS_WRONG_PASSWORD (0xc000006a) error message was: Wrong Password Could not authenticate user skina with challenge/response ------------------- **** This last message is my only clue. --------------------------------- FREERADIUS --------------------------------- I have installed y configured freeradius following every manual .. First .. the basic configuration .. and working OK http://wiki.freeradius.org/guide/Basic-configuration-HOWTO ------------------- #>> radtest bob hello localhost 0 testing123 Sent Access-Request Id 70 from 0.0.0.0:37544 to 127.0.0.1:1812 length 73 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "hello" Received Access-Accept Id 70 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 Reply-Message = "Hello, bob" ------------------- Second .. configure OK freeradius with ntlm_auth and PAP http://wiki.freeradius.org/guide/NTLM%20Auth%20with%20PAP%20HOWTO ------------------- #>> radtest 'skina' 'Nio4LasOo' localhost 0 testing123 Sent Access-Request Id 14 from 0.0.0.0:34004 to 127.0.0.1:1812 length 75 User-Name = "skina" User-Password = "Nio4Las2Oo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "Nio4LasOo" Received Access-Accept Id 14 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 ------------------- Third .. tryied to configure freeradius ntlm_auth and MSCHAP http://deployingradius.com/documents/configuration/active_directory.html I have already set all the permissions to user freerad to winbindd_private directory so that not the issue. It does not matter what I do .. I always get the same error .. ------------------- #>> radtest -t mschap 'skina' 'Nio4LasOo' localhost 0 testing123 Sent Access-Request Id 158 from 0.0.0.0:33353 to 127.0.0.1:1812 length 131 User-Name = "skina" MS-CHAP-Password = "Nio4LasOo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "Nio4LasOo" MS-CHAP-Challenge = 0x59e2a1e585ad94e6 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000001eacb1bfed243034f718b74d89b6b11b84af50869ab40b06 Received Access-Reject Id 158 from 127.0.0.1:1812 to 0.0.0.0:0 length 61 MS-CHAP-Error = "\000E=691 R=1 C=c3f65e6f825239e4 V=2" (0) -: Expected Access-Accept got Access-Reject ------------------- And the output of "freeradius -X" ------------------- (2) Received Access-Request Id 57 from 127.0.0.1:34102 to 127.0.0.1:1812 length 131 (2) User-Name = "skina" (2) NAS-IP-Address = 127.0.1.1 (2) NAS-Port = 0 (2) Message-Authenticator = 0xe88750a3ffc2bc75b90b872caf81f7e5 (2) MS-CHAP-Challenge = 0x1fa8d5c8e307ea3f (2) MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000074102cb712031d37dcb5bda4745b7e918794c4168fa1e5f5 (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy ntlm_auth.authorize { (2) if (!control:Auth-Type && User-Password) { (2) if (!control:Auth-Type && User-Password) -> FALSE (2) } # policy ntlm_auth.authorize = notfound (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (2) [mschap] = ok (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "skina", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: No EAP-Message, not doing EAP (2) [eap] = noop (2) [files] = noop (2) [sql] = notfound (2) [expiration] = noop (2) [logintime] = noop (2) } # authorize = ok (2) Found Auth-Type = mschap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) mschap: Client is using MS-CHAPv1 with NT-Password (2) mschap: Executing: /usr/bin/ntlm_auth --allow-mschapv2 --ntlmv2 --request-nt-key --username=%{mschap:User-Name:-None} --domain=MINUT-EXT --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}: (2) mschap: EXPAND --username=%{mschap:User-Name:-None} (2) mschap: --> --username=skina (2) mschap: mschap1: 1f (2) mschap: EXPAND --challenge=%{mschap:Challenge:-00} (2) mschap: --> --challenge=1fa8d5c8e307ea3f (2) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00} (2) mschap: --> --nt-response=74102cb712031d37dcb5bda4745b7e918794c4168fa1e5f5 (2) mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' (2) mschap: External script failed (2) mschap: ERROR: External script says: Logon failure (0xc000006d) (2) mschap: ERROR: MS-CHAP2-Response is incorrect (2) [mschap] = reject (2) } # authenticate = reject (2) Failed to authenticate the user (2) Using Post-Auth-Type Reject (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Post-Auth-Type REJECT { (2) [sql] = ok (2) attr_filter.access_reject: EXPAND %{User-Name} (2) attr_filter.access_reject: --> skina (2) attr_filter.access_reject: Matched entry DEFAULT at line 11 (2) [attr_filter.access_reject] = updated (2) [eap] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) } # Post-Auth-Type REJECT = updated (2) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.7 seconds. (2) Sending delayed response (2) Sent Access-Reject Id 57 from 127.0.0.1:1812 to 127.0.0.1:34102 length 61 (2) MS-CHAP-Error = "\000E=691 R=1 C=be58a2cfd7660c37 V=2" Waking up in 3.9 seconds. (2) Cleaning up request packet ID 57 with timestamp +161 Ready to process requests ------------------- This is the same error when I used wbinfo without --ntlmv2 ... ( might be a clue) In mods_enabled/mschap I have tried many parameters in ntlm_auth command .. including hardcoding a known user .. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=MINUT-EXT --username=skina --password='Nio4LasOo'" It returned NT OK . .. but when I added the other to parameters .. i came back to the same error. --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ----------- I was wondering if it is a kind of incompatibility concerning the version of MSCHAP or NTLM .. I appreciate any help you can give me. I have four days trying every option, reading every post, .. without success. Kasandra

4 4