March 2018 - Freeradius-Users - lists.freeradius.org

Secondary Authentication on FreeRadius
by Christian Becerra 16 Mar '18

16 Mar '18

We have a Juniper SSL VPN device that we want to authenticate to AD via the Free Radius. If the Username and password is good - Want to have another check against our Scheduling software that manages the users Time of Allowed VPN. It is front ended by an API via HTTP If the scheduling software says the time is good - We want to send a message back to the Juniper - that access is allowed. If anyone is interested in taking on this project, please respond to me with either an hourly rate of project cost. Let me know Thanks Chris

2 1

is there a way to identify the very first ACCESS-REQUEST
by Michael Hocke 16 Mar '18

16 Mar '18

Hi there, I want to improve our logging and want to keep track of authentication attempts that do not complete. I was thinking of logging the very first ACCESS-REQUEST and then later on the result. Is there a good way to identify the very first ACCESS-REQUEST from the client with unlang? Maybe by checking the contents of the session-state list or some such? Any ideas? Thanks! - Michael

4 6

Additional Step for Authentication
by Christian Becerra 16 Mar '18

16 Mar '18

Good Morning We have FreeRadius authenticating users via AD. We want to perform an additional step of Authorization based on "Time Allowed to Login" We have an API that will already check if the User is allowed in based on their login time. What documentation can I look at to create the script? Basically if FreeRadius checks AD and thats good....then to make the additional check against our API and then to respond to the NAS that logging in is allowed. Let me know and I will start to research. Thanks

2 1

Strongswan integration, Access-Request contains no credentials?
by Phil Frost 16 Mar '18

16 Mar '18

I'm attempting to configure an IKEv2 VPN which uses strongswan's eap-radius plugin to delegate authentication to freeradius. I've configured freeradius to authenticate against Active Directory by executing ntlm_auth, and I'm hoping to use mschapv2 authentication. I'm able to successfully authenticate with radtest: radtest -x -t mschap phil.frost redacted 127.0.0.1 0 redacted Sending Access-Request of id 193 to 127.0.0.1 port 1812 User-Name = "phil.frost" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = redacted MS-CHAP-Response = redacted rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=193, length=84 MS-CHAP-MPPE-Keys = redacted MS-MPPE-Encryption-Policy = redacted MS-MPPE-Encryption-Types = redacted I'm also able to connect to the VPN if I use the eap-mschapv2 strongswan plugin in lieu of eap-radius and configure a plaintext password in strongswan's user database. So it would appear the issue is the integration between the two. Should strongswan be including the credentials? Or should freeradius be doing something to indicate the VPN client should present them? I've learned many ways things could work, but a hint at how they *should* work in this case would very much help me narrow what's otherwise been a fruitless search through a combinatorial explosion of RFCs and protocol options. This seems to be the most salient part of the freeradius output. The unabbridged debug output is attached. rad_recv: Access-Request packet from host 127.0.0.1 port 60479, id=236, length=137 User-Name = "phil.frost" NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 5 NAS-Port-Id = "ikev2-vpn" NAS-IP-Address = 10.6.0.81 Called-Station-Id = "10.6.0.81[4500]" Calling-Station-Id = "73.161.191.57[4500]" NAS-Identifier = "strongSwan" Message-Authenticator = redacted # Executing section authorize from file /etc/freeradius/sites-enabled/postmates +group authorize { ++[preprocess] = ok ++[mschap] = noop +} # group authorize = ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user.

2 1

Statistics about sql connections
by Andrea Gabellini 14 Mar '18

14 Mar '18

Hello, is it possible to get statistics about configured sql connections? At least how many threads are used? Thanks, Andrea -- ---------------------------------------------------------------- Missing your cat? Try looking under my tires. ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini(a)telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm

3 3

Stripped-User-Domain case insensitive
by wouldsmina 13 Mar '18

13 Mar '18

Hi, I'am testing Freeradius with this guide <https://wiki.freeradius.org/guide/eduroam>, but when I put a capital letter in my domain name (example: anonymous(a)mydomain.COm) the requests are proxied. I think I need to add something here (into site-enabled/default) : ... if (Stripped-User-Domain != "${operator_name}") { ... I tested : ... if ("%{tolower:Stripped-User-Domain}" != "${operator_name}") { ... but it doesn't work (all requests are proxied). what wrong? thanks.

2 2

off topic - eapol_test alternative
by Matt Zagrabelny 12 Mar '18

12 Mar '18

Greetings FR-users, We don't have access to the shared secrets of a RADIUS server performing EAP, but we'd like to download the RADIUS server SSL certs. Is anyone aware of a GNU/Linux utility similar to eapol_test to do this? I'm not sure if NetworkManager can do it - I've searched the internet a bit. Is there a proprietary solution that anyone is aware of? Thanks for any pointers! -m

4 10

How to configure freeradius server to authenticate VSA attribute
by Jibin Han 12 Mar '18

12 Mar '18

Hi, I am using freeradius v2.1.12 on Ubuntu 16.04, I need to configure it so that it will authenticate the incoming RADIUS messages based on their Vendor Specific Attributes. I looked over freeradius.org, it is not clear how to do that, hence ask people in this group. Here are the details - 1. We have an in-house developed RADIUS client software which creates a RADIUS access request message and sends to freeradius server. 2. The configuration of freeradius server is ready: when the client message has the right user/password, we can receive accept message; otherwise reject message. The authentication is PAP. 3. Now we insert VSA attribute: the code is 26, the vendor id is our vendor's ID and the custom name and value. 4. Our goal is, make freeradius server authenticate not only user/password, but also this VSA - when an invalid name/value are put into VSA, freeradius sends reject message. I check out dictionary, but that seems just some name mapping, I do not think it authenticate attributes. Could you point me the direction how this could be done and preferably with some examples? I can upgrade to freeradius v3 if it is required. Thanks a lot!

4 6

Freeradius - radacct session issue
by Pierre Delamotte 12 Mar '18

12 Mar '18

Hi Issue: I am picking a lot of entries in radacct that seem to have been updated days after session has been closed (recording of the timestamp of an accounting stop reception). Such an entry is looking like: select * from radacct where radacctid = 7299616\G *************************** 1. row *************************** radacctid: 7299616 acctsessionid: f0766fb97a76.0400.dhcp acctuniqueid: 9c83f2fc9f88007e5ebaf552233b6817 username: xxxxxx groupname: realm: xxxxxxxx nasipaddress: 10.100.2.10 nasidentifier: bgate1030 nasportid: slot=3D3D0=3D3B nasporttype: Wireless-802.11 acctstarttime: 2018-02-22 16:50:02 acctupdatetime: 2018-03-06 01:30:51 acctstoptime: 2018-02-25 18:55:30 acctinterval: 900 acctsessiontime: 6301 acctauthentic: connectinfo_start: connectinfo_stop: acctinputoctets: 359928391 acctoutputoctets: 6626058 calledstationid: A6-74-2A-B0-D2-4C:xxxxxxxx callingstationid: F0-76-6F-B9-7A-76 acctterminatecause: NAS-Reboot servicetype: framedprotocol: framedipaddress: 10.16.59.137 acctstartdelay: NULL acctstopdelay: NULL xascendsessionsvrkey: NULL 1 row in set (0.01 sec) select * from radacct where radacctid = 4605678\G *************************** 1. row *************************** radacctid: 4605678 acctsessionid: 2400ba1bcd17.0400.dhcp acctuniqueid: 3590303eebf7e0a3dbdca9116f37a6a2 username: xxxxxx groupname: realm: xxxxxxxxxxxx nasipaddress: 10.100.2.10 nasidentifier: bgate1030 nasportid: slot=3D3D0=3D3B nasporttype: Wireless-802.11 acctstarttime: 2018-01-18 09:11:03 acctupdatetime: 2018-03-09 16:10:37 acctstoptime: 2018-01-18 06:17:36 acctinterval: 10681 acctsessiontime: 942 acctauthentic: connectinfo_start: connectinfo_stop: acctinputoctets: 1716210 acctoutputoctets: 601621 calledstationid: A6-74-2A-AD-F0-F3:xxxxxxx callingstationid: 24-00-BA-1B-CD-17 acctterminatecause: NAS-Request servicetype: framedprotocol: framedipaddress: 10.16.22.228 acctstartdelay: NULL acctstopdelay: NULL xascendsessionsvrkey: NULL 1 row in set (0.00 sec) select * from radacct where radacctid = 5016371\G *************************** 1. row *************************** radacctid: 5016371 acctsessionid: a04c5b6485b1.0400.dhcp acctuniqueid: f28f3633c6d406e3d68d9bf75f1f3d71 username: xxxxxxxxxx groupname: realm: xxxxxxxxx nasipaddress: 10.100.2.10 nasidentifier: bgate1030 nasportid: slot=3D3D0=3D3B nasporttype: Wireless-802.11 acctstarttime: 2018-01-15 10:44:44 acctupdatetime: 2018-03-01 12:02:54 acctstoptime: 2018-01-15 12:06:12 acctinterval: 900 acctsessiontime: 1826 acctauthentic: connectinfo_start: connectinfo_stop: acctinputoctets: 120903 acctoutputoctets: 63363 calledstationid: B6-74-2A-AD-EF-A5:xxxxxxxxxx callingstationid: A0-4C-5B-64-85-B1 acctterminatecause: NAS-Request servicetype: framedprotocol: framedipaddress: 10.16.21.160 acctstartdelay: NULL acctstopdelay: NULL xascendsessionsvrkey: NULL 1 row in set (0.01 sec) Context: Freeradius (Version 3.0.13 see below) is deployed with a front-end called Radiusdesk. Service is provided thru WiFi APs centrally managed (Capwap) by and Access Controller (AC) acting as Freeradius client. This AC is regularly performing unattended reboots, hence most likely the replication of Accounting Session Id. The Accounting SQL management is performed via the standard Freeradius sql module. We picked up the issue when we identified some discrepancies in collecting user usage stats. Any idea why Freeradius would overwrite an entry that has been "closed"? and how we could work around that (beside ditching the AC or systematically moving the "closed" entries to another table upon reception of Acct_Stop)? radiusd: FreeRADIUS Version 3.0.13 (git #d5a382e), for host x86_64-pc-linux-gnu, built on Mar 24 2017 at 19:26:35 FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT PLM -- Disclaimer and Confidentiality Warning - This message is intended for the addressee only. If you are not the intended recipient of this message, you are notified that any distribution, use of or copying of this communication is strictly prohibited. If you have received the communication in error, please notify the sender immediately. The views and opinions expressed in this message are those of the individual sender of this message and do not necessarily represent the views and opinions of Brightwave Technologies Consequently, Brightwave Technologies does not accept responsibility for such views and opinions and this message should not be read as representing the views and opinions of Brightwave Technologies without subsequent written confirmation. Each page attached hereto must also be read in conjunction with this disclaimer.

2 3

FreeRADIUS packages by NetworkRADIUS
by Stefan Paetow 12 Mar '18

12 Mar '18

Hi guys, Just as a by the way, the LDAP module for FreeRADIUS as packaged by NR sarl has a dependency for openldap-ltb. This is not available in the CentOS or RedHat repos. You may want to document that (and where to find it). :-) Stefan Paetow Consultant, Trust and Identity t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

1 0