April 2018 - Freeradius-Users - lists.freeradius.org

Failed to connect Freeradius to OpenLDAP
by Tsirkas Georgios 25 Apr '18

25 Apr '18

Hello, I am trying to use ldap module. But failed to connect.... With SSL // /Wed Apr 25 13:47:07 2018 : Info: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used// //Wed Apr 25 13:47:07 2018 : Debug: rlm_ldap (ldap): Connecting to ldap://ldap-server:636// //Wed Apr 25 13:47:07 2018 : Debug: rlm_ldap (ldap): New libldap handle 0x55de89593c20// //TLS: can't connect: (unknown error code).// //Wed Apr 25 13:47:08 2018 : Error: rlm_ldap (ldap): Bind with cn=admin,dc=mydomain,dc=gr to ldap://ldap-server:636 failed: Can't contact LDAP server// //Wed Apr 25 13:47:08 2018 : Debug: rlm_ldap: Closing libldap handle 0x55de89593c20// //Wed Apr 25 13:47:08 2018 : Error: rlm_ldap (ldap): Opening connection failed (0)// //Wed Apr 25 13:47:08 2018 : Debug: rlm_ldap (ldap): Removing connection pool// //Wed Apr 25 13:47:08 2018 : Error: /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap"/ Without SSL Wed Apr 25 13:51:52 2018 : Info: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): Connecting to ldap://ldap-server:389 Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): New libldap handle 0x55f00a1e4c20 Wed Apr 25 13:51:52 2018 : Error: rlm_ldap (ldap): Bind with cn=admin,dc=mydomain,dc=gr to ldap://ldap-server:389 failed: Can't contact LDAP server Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap: Closing libldap handle 0x55f00a1e4c20 Wed Apr 25 13:51:52 2018 : Error: rlm_ldap (ldap): Opening connection failed (0) Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): Removing connection pool Wed Apr 25 13:51:52 2018 : Error: /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" Any ideas? I am using Freeradius 3.0.12 with Debian....

2 1

radius.log into filebeat
by Alex Sharaz 25 Apr '18

25 Apr '18

What might be the best way to get . the contents of radius.log into filebeat? I'm already generating a suitable detail log file that the filebeat client processes to push radius acct/auth info into our logstash service ? Rgds alex p.s. 3.0.17

3 2

Freeradius 3 and empty password from authorization
by chose 24 Apr '18

24 Apr '18

Good morning, I couldn't authorize over my radius, when I run it with debug, I see that user password is empty: (23) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=domain.tld --username=%{Stripped-User-Name} --password=%{User-Password}: (23) ntlm_auth: EXPAND --username=%{Stripped-User-Name} (23) ntlm_auth: --> --username=user (23) ntlm_auth: EXPAND --password=%{User-Password} (23) ntlm_auth: --> --password= (23) ntlm_auth: ERROR: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)' (23) [ntlm_auth] = reject (23) } # if (&User-Name =~ /(a)domain.tld/ || &User-Name =~ /(a)domain.tld/) = reject (23) } # authorize = reject (23) Invalid user (ntlm_auth: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)'): [user] (from client controler2 port 13 cli 86-e8-4f-43-5c-9b) (23) Using Post-Auth-Type Reject User is not empty. When I try to authorize ntlm_auth from bash, all is OK (NT_STATUS_OK: Success (0x0)) What did I missed ? Thanks and best regards J.Karliak -- Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a DomainKeys/DKIM (s ADSP) a implementaci DMARC. Pokud mate problemy s dorucenim emailu, zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji. My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP) policy and implementation of the DMARC. If you've problem with sending emails to me, start using email origin methods mentioned above. Thank you.

4 5

RE: Multiple Radius Group Name
by Angel Elena 23 Apr '18

23 Apr '18

Ok, thanks -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ www.linkedin.com/in/angel-elena-medina -------------------------------- Zarafa Webapp. -----Mensaje original----- De: Alan DeKok <aland(a)deployingradius.com> Enviado: Lun 23-04-2018 19:01 Asunto: Re: Multiple Radius Group Name Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>; > On Apr 23, 2018, at 12:20 PM, Angel Elena <craem(a)craem.net> wrote: > > > > I have a freeradius 2.2.5 in a debian 8 box with an OpenLdap database. > > You should really upgrade to 2.2.10 at least. It takes about 10 minutes. > > > A simple query: > > > > angel.elena@bulma:/etc/freeradius$ radtest angel.elena password > localhost:1812 0 testing123 > > We don't need to see the output of radclient. > > http://wiki.freeradius.org/list-help > > > Mikrotik group is a mapped attribute in a ldap.attrmap file and works fine: > > > > replyItem Mikrotik-Group radiusGroupName\ > > See the comments at the top of that file. If the comments aren't there, > someone probably deleted them. > > Or, install 2.2.10, and look at the comments at the top of ldap.attrmap in > the source file. > > > Is possible specify two radiusGroupName in a simple reply or any idea to set > this setup ? > > Yes. It's documented in that file. You need to set the operator to "+=" > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

PAM missing in FreeRadius 3 w/ Debian 9
by servernemesis＠tutanota.com 23 Apr '18

23 Apr '18

Hello, I just installed FreeRadius 3.0.12 on Stretch in order to provide a Google Authenticator gateway (https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and… <https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and…>), but I'm unable to start the FreeRadius service, here is the debug log : Mon Apr 23 14:23:59 2018 : Debug: # Loading session {...} Mon Apr 23 14:23:59 2018 : Debug: radutmp Mon Apr 23 14:23:59 2018 : Debug: # Loading post-proxy {...} Mon Apr 23 14:23:59 2018 : Debug: eap Mon Apr 23 14:23:59 2018 : Debug: # Loading post-auth {...} Mon Apr 23 14:23:59 2018 : Debug: } # server inner-tunnel Mon Apr 23 14:23:59 2018 : Debug: server default { # from file /etc/freeradius/3.0/sites-enabled/default Mon Apr 23 14:23:59 2018 : Debug: # Loading authenticate {...} Mon Apr 23 14:23:59 2018 : Debug: mschap Mon Apr 23 14:23:59 2018 : Debug: digest Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[489]: Failed to find "pam" as a module or policy. Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[489]: Please verify that the configuration exists in /etc/freeradius/3.0$ Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[452]: Errors parsing authenticate section. Of course there is no "/etc/freeradius/3.0/mods-enabled/pam" Someone had the same problem with Ubuntu 17.10 and FreeRadius 3 before reverting to an older version (https://enterpriseadmins.org/blog/virtualization/build-your-own-two-factor-… <https://enterpriseadmins.org/blog/virtualization/build-your-own-two-factor-…>) Regards

4 7

Multiple Radius Group Name
by Angel Elena 23 Apr '18

23 Apr '18

Hi group. I have a freeradius 2.2.5 in a debian 8 box with an OpenLdap database. A simple query: angel.elena@bulma:/etc/freeradius$ radtest angel.elena password localhost:1812 0 testing123 Sending Access-Request of id 100 to 127.0.0.1 port 1812 User-Name = "angel.elena" User-Password = "password" NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=100, length=47 Mikrotik-Group = "AAA_ADMIN" Mikrotik group is a mapped attribute in a ldap.attrmap file and works fine: replyItem Mikrotik-Group radiusGroupName for a new setup and to not modify all devices, we need specify two radiusGroupName / Mikrotik-Group in every query, ex: Mikrotik-Group = "AAA_ADMIN" Mikrotik-Group = "AAA_CORES" Is possible specify two radiusGroupName in a simple reply or any idea to set this setup ? Thanks. -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ www.linkedin.com/in/angel-elena-medina -------------------------------- Zarafa Webapp.

2 1

More efficient programming of the unlang language
by Marijn van Gool 23 Apr '18

23 Apr '18

Hello freeradius users, I have searched the freeradius unlang documentation, but couldn’t find a way to make the following piece of unlang code more effective: if ("%{sql:SELECT username FROM radcheck WHERE username LIKE '%{string:&ADSL-Agent-Remote-Id}@%%' LIMIT 1}" != "") { update request { User-Name := "%{sql:SELECT username FROM radcheck WHERE username LIKE '%{string:&ADSL-Agent-Remote-Id}@%%' LIMIT 1}" } } Basically what I’m trying to do is to check if the query in question returns the username and to use this username in a self created variable later on. Something like this: username-var = SELECT query; if (username-var != “”) { update-request { User-Name := username-var } } How would I achieve this? What is the syntax that can be used here? Thanks! Met vriendelijke groet \ With kind regards, Marijn van Gool NOC Network Engineer noc(a)comsave.com <mailto:noc@comave.com> +31 88 999 5555 marijn.vangool(a)comsave.com <mailto:marijn.vangool@comsave.com> www.comsave.nl <http://www.comsave.nl/>

2 2

is this even possible ?
by m.nageh 23 Apr '18

23 Apr '18

https://www.youtube.com/watch?v=HoihKhQWZ7k&feature=youtu.be if it's possible what are the steps to do this with your tool to make a pentesting video just for Educational purpose .and test it on my own ...... so how can i edit the algorithm to make it use EAP-TTLS/PAP... sorry i am not using the freeradius-server much ... i am kinda new to it😔 😕😕😔

1 0

freeradius filter ldap groups
by Juliano 23 Apr '18

23 Apr '18

Dears, I'm having trouble setting an authentication rule on freeradius. To better contextualize my environment, I would like to explain that I have only one freeradius server, one ldap server and two wireless networks (WEB-USERS and WEB-ADMIN). It is also important to remember that each wifi network is associated with a vlan, it´s 500 and 501 and your sub network 10.20.128.0/21 and 10.20.8.0/23, respectively I need is that users of the users-wifi group only connect to the WEB-USERS network and users of the other group, called admin-wifi, can only connect to the WEB-ADMIN network. I read that in the [...] / sites-enabled / default / file there is a section called post-auth, in which I can do this filter. However I don´t haved succeed with this filters. I would like your help in this situation. Best Regards, Juliano Aléssio da Silva

2 1

eduroam howto help with the wrong password scenario
by Francesco Malvezzi 21 Apr '18

21 Apr '18

first of all, how I wished the eduroam howto (http://wiki.freeradius.org/guide/eduroam) was online when I first had to configure freeradius. Lucky those who can start from it: it used to be harder. Still, I have a problem. Following the howto with the files setup, I can handle the happy path result (user with correct password). Everything works. If I modify the ~/eapol_test/peap-mschapv2.conf file with: password="iamthewrongpassword" the request fails after a while, like the server would give the client a second try: eapol logs: [...] EAP-MSCHAPV2: password changing protocol version 3 EAP-MSCHAPV2: failure message: 'Authentication rejected' (retry allowed, error 691) EAPOL: EAP parameter needed [...] and it takes 30 secs to issue the "FAILURE" line. ./sbin/radiusd -X [...] (14) eap_mschapv2: authenticate { (14) mschap: Found Cleartext-Password, hashing to create NT-Password (14) mschap: Found Cleartext-Password, hashing to create LM-Password (14) mschap: Creating challenge hash with username: a_user(a)example.org (14) mschap: Client is using MS-CHAPv2 (14) mschap: ERROR: MS-CHAP2-Response is incorrect (14) [mschap] = reject (14) } # authenticate = reject (14) MSCHAP-Error: ?E=691 R=1 C=3277c9a2969ff694b1e423f83f99ecd4 V=3 M=Authentication rejected (14) Found new challenge from MS-CHAP-Error: err=691 retry=1 challenge=3277c9a2969ff694b1e423f83f99ecd4 (14) ERROR: MSCHAP Failure (14) inner-eap: Sending EAP Request (code 1) ID 9 length 83 (14) inner-eap: EAP session adding &reply:State = 0x30262b3d312f3188 (14) [inner-eap] = handled (14) } # authenticate = handled (14) } # server eduroam-inner (14) Virtual server sending reply (14) EAP-Message = 0x010900531a0408004e453d36393120523d3120433d333237376339613239363966663639346231653432336638336639396563643420563d33204d3d41757468656e7469636174696f6e2072656a6563746564 (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x30262b3d312f318871613eb63a4734ad (14) eap_peap: Got tunneled reply code 11 (14) eap_peap: EAP-Message = 0x010900531a0408004e453d36393120523d3120433d333237376339613239363966663639346231653432336638336639396563643420563d33204d3d41757468656e7469636174696f6e2072656a6563746564 (14) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (14) eap_peap: State = 0x30262b3d312f318871613eb63a4734ad (14) eap_peap: Got tunneled reply RADIUS code 11 (14) eap_peap: EAP-Message = 0x010900531a0408004e453d36393120523d3120433d333237376339613239363966663639346231653432336638336639396563643420563d33204d3d41757468656e7469636174696f6e2072656a6563746564 (14) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (14) eap_peap: State = 0x30262b3d312f318871613eb63a4734ad (14) eap_peap: Got tunneled Access-Challenge (14) eap: Sending EAP Request (code 1) ID 9 length 114 (14) eap: EAP session adding &reply:State = 0x8dc44f9585cd5612 (14) [eap] = handled (14) } # authenticate = handled (14) Using Post-Auth-Type Challenge (14) Post-Auth-Type sub-section not found. Ignoring. (14) # Executing group from file /opt/freeradius/etc/raddb/sites-enabled/default (14) session-state: Saving cached attributes (14) Stripped-User-Name := "a_user" (14) Sent Access-Challenge Id 8 from 127.0.0.1:1812 to 127.0.0.1:46152 length 0 (14) EAP-Message = 0x01090072190017030300674cef3f0c59b8f592198c61cd5c9a8810373267c99f6db7b6e410e43143fec0b5f4fb860d8b544e0b844edd43b9b26b119dfa7f1f7d3053bfab5b22f77511dad11e5369876d20211362ed1e949b67950fa465d6aec569ae4beae10d613101854ea2cbc3276df6df (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x8dc44f9585cd56126b4642e6eb93d427 (14) Finished request [...] Why am I missing the: linelog_send_reject from my logs? If I choose pap (~/eapol_test/eap-ttls.conf), I can see the failure log line (when password is wrong). And the client takes only one sec to tell me there is a failure. What did I do wrong? Freeradius is 3.0.17 on Debian GNU/Linux 9 (stretch), thank you, Francesco

4 3