June 2018 - Freeradius-Users - lists.freeradius.org

Windows 10 breaks Samba/LDAP/freeradius machine credentials configuration
by Anthony Stuckey 26 Jun '18

26 Jun '18

I find it hard to believe that I'm the first person to come across this issue, but I have been unable to find anyone else with these exact questions or documentation that discusses this issue. It's easy to find a Microsoft document that discusses a problem that I don't have, it's very hard to find any document which discusses the problem I do have. https://support.microsoft.com/en-us/help/3121002/windows-10-devices-can-t-c… We use a Samba domain controller with an LDAP backend to provide account services for our organization. We have a Cisco wireless lan controller which uses freeradius to authenticate with Windows Machine Credentials. Windows 10 sends different User-Names before and after it is joined to the domain, and that causes wireless authentication to fail. Previous versions of Windows do not have this behavior, and wireless authentication works perfectly. Specifically, the User-Name attribute changes from User-Name = "host/i26171" to User-Name = "host/i26171.DOMAIN". The Samba server creates an ldap entry with the password attributes under the non-domain name, which is then not found when the credentials are presented with the domain attached. dn: uid=I26171$,ou=Machines,ou=SambaSAM,dc=domain,dc=edu uid: I26171$ uid: host/i26171 sambaSID: S-1-5-21-4128435402-3538960026-4000809499-15117 displayName: i26171$ objectClass: sambaSamAccount objectClass: account objectClass: radiusprofile sambaAcctFlags: [W ] cn: i26171 radiusFilterId: true radiusTunnelMediumType: IEEE-802 radiusTunnelType: vlan radiusTunnelPrivateGroupId: 630 sambaNTPassword: <<secret>> sambaPwdLastSet: 1526590492 Wed May 23 10:51:04 2018 : Info: [ldap] performing user authorization for host/i26171.DOMAIN Wed May 23 10:51:04 2018 : Info: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Wed May 23 10:51:04 2018 : Info: [ldap] ... expanding second conditional Wed May 23 10:51:04 2018 : Info: [ldap] expand: %{User-Name} -> host/i26171.DOMAIN Wed May 23 10:51:04 2018 : Info: [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=host/i26171.DOMAIN) Wed May 23 10:51:04 2018 : Info: [ldap] expand: ou=sambasam,dc=domain,dc=edu -> ou=sambasam,dc=domain,dc=edu Wed May 23 10:51:04 2018 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed May 23 10:51:04 2018 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed May 23 10:51:04 2018 : Debug: [ldap] performing search in ou=sambasam,dc=domain,dc=edu, with filter (uid=host/i26171.DOMAIN) Wed May 23 10:51:04 2018 : Debug: [ldap] object not found Wed May 23 10:51:04 2018 : Info: [ldap] search failed Wed May 23 10:51:04 2018 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed May 23 10:51:04 2018 : Info: ++[ldap] = notfound Has anyone else encountered this issue, and what did you do to fix it? The obvious solution is to rewrite the User-Name attribute in the freeradius configuration, but this is seriously frowned upon by the freeradius developers, for reasons which are not usually made explicit other than vague comments that it might allow a security hole. Attempts to actually do this all seem to end in various error messages and pain. Is there any known setting for Windows 10 that will cause it to act in the backwards-compatible way? Is there any documentation of why Microsoft made this change? Is this a known issue which is fixed in freeradius3/RHEL7 somehow? [root@radiusdebug /]# cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.9 (Santiago) [root@radiusdebug /]# rpm -qa | egrep -i freeradius freeradius-2.2.6-7.el6_9.x86_64 freeradius-utils-2.2.6-7.el6_9.x86_64 freeradius-ldap-2.2.6-7.el6_9.x86_64

2 1

right tutorial
by Javier Escalante 26 Jun '18

26 Jun '18

Hello, Could somebody tell us which tutorial /wiki can we follow in order to properly configure freeradius 3.0.16? Thanks in advance BR Javier Escalante Business Development Manager <mailto:Javier.escalante@bwireless.eu> Javier.escalante(a)bwireless.eu <tel:00%2034%20626%2078%2056%2075> 00 34 626 785 675 <tel:00%2034%2093%20172%2006%2074> 00 34 93 141 56 36 <tel:00%2041%2078%20689%2085%2069> 00 41 78 689 85 69 Skype: fruiz002 Do you know our IoT solutions? Have a look here: <http://www.bsmart.global/> www.bsmart.global <http://www.bwireless.eu/> http://www.bwireless.eu Le informamos que, de conformidad con la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, se informa que todos los datos personales que nos ha facilitado serán incorporados y tratados en los ficheros de BW & TAKACS TELECOM, S.L. para las finalidades de su e-mail. Puede ejercer sus derechos de acceso, rectificación, cancelación y oposición mediante una comunicación a BW & TAKACS TELECOM, S.L. con domicilio en <https://maps.google.com/?q=Camil+Oliveras,+26,+08032+Barcelona+(Espa%C3%B1a &entry=gmail&source=g> Camil Oliveras, 26, 08032 Barcelona (España), o bien mediante una comunicación a la dirección de correo electrónico <mailto:info@bwireless.eu> info(a)bwireless.eu. En ambos casos, deberá acompañar una copia de su documento nacional de identidad o documento válido que lo identifique.

11 40

tutorials
by Javier Escalante 26 Jun '18

26 Jun '18

Hello, I followed this wiki, https://wiki.freeradius.org/guide/SQL-HOWTO-for-freeradius-3.x-on-Debian-Ub… In theory, following completely, and having the files exactly as the wiki indicates, it should work, right? The error is still : (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query I don't get why it is not working, and why there is not more information in Internet (2 week with it already...). Since I have no clue where to look anymore? Can anybody give me a sensible and if possible understandable clue? Thanks BR Javier Escalante Business Development Manager Javier.escalante(a)bwireless.eu 00 34 626 785 675 00 34 93 141 56 36 00 41 78 689 85 69 Skype: fruiz002 Do you know our IoT solutions? Have a look here: www.bsmart.global http://www.bwireless.eu Le informamos que, de conformidad con la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, se informa que todos los datos personales que nos ha facilitado serán incorporados y tratados en los ficheros de B’W & TAKACS TELECOM, S.L. para las finalidades de su e-mail. Puede ejercer sus derechos de acceso, rectificación, cancelación y oposición mediante una comunicación a B’W & TAKACS TELECOM, S.L. con domicilio en Camil Oliveras, 26, 08032 Barcelona (España), o bien mediante una comunicación a la dirección de correo electrónico info(a)bwireless.eu. En ambos casos, deberá acompañar una copia de su documento nacional de identidad o documento válido que lo identifique.

2 1

Radperf
by Bassem Mettichi 26 Jun '18

26 Jun '18

hello, iam trying to make performnce tests for my freeradius server using Radperf tool but i don't know the command to send accounting and access request together at the same time, for example sending 1 accounting request than one access request, any help please? Thanks Bassem

1 0

errors
by Pedro Loupa 25 Jun '18

25 Jun '18

Hello, Following this wiki: https://wiki.freeradius.org/guide/SQL%20HOWTO#before-you-start I see that sql.conf does not exist, I edited* /etc/freeradius/3.0/mods-available/sql. Is that correct?* The line database = "mysql" does not exist either, could somebody tell me where is it? Thank you very much in advance Regards

4 5

update of freeradius 2.x to 3.015
by Pedro Loupa 25 Jun '18

25 Jun '18

Hello, I had an old version of freeradius working perfectly with sql and after updating to ubuntu 17. I get the following errors on trying to authenticate wit radtest. (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject I created a test user in radcheck for testing and I followed this tutorial; https://wiki.freeradius.org/guide/SQL%20HOWTO But I don't know how to go on, Could anybody give me a hint? Thanks in advance Best

1 0

best performance alternative using multiple virtual server to bound IP/port
by Philemon Jaomalaza 25 Jun '18

25 Jun '18

Hello Dear, I need to decide a structure of my deplyement, what the best practice and give best performance and memory usage if I want to have a separate service per client : - define multiple virtual servers with one global "listen" section IP/port for all virtual server. - define multiple virtual servers and each server has its listen section IP/port difffrent - define single virtual servers and use if ....elsif....else to select the proper sql module. One Nas will use one virtual and server It can have more than 50 NAS and arround 20 to 50 simultanews connexion by NAS. Philemon Jaomalaza

2 2

Large Deployment advice. 10000 users
by Uchenna Nebedum 25 Jun '18

25 Jun '18

Good Day all, If i wanted to use freeRADIUS to manage about 100 NAS each with about 1000 users, could i use a single server for all the NAS, if yes, what spec of server. And would MySQL still be the best database to use considering performance or would Redis be better. And what would be the best configurations. Please i need advice. Thanks a lot for any help.

2 2

Apache client certificat To freeradiis
by vince technical address 25 Jun '18

25 Jun '18

Hi, Is it possible to send client certificate to à freeradius server by apache. I would like to manage authentication by radius only. No way to do something like 802.1x with radius and apache and navigator ? Tanks. Vince

2 3

User-Password
by Javier Escalante 25 Jun '18

25 Jun '18

Hello, Could it be correct? http://freeradius.1045715.n5.nabble.com/ISSUE-Authentication-will-fail-unle… If so? Where should I change it? Thanks BR Javier Escalante Business Development Manager Javier.escalante(a)bwireless.eu 00 34 626 785 675 00 34 93 141 56 36 00 41 78 689 85 69 Skype: fruiz002 Do you know our IoT solutions? Have a look here: www.bsmart.global http://www.bwireless.eu Le informamos que, de conformidad con la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, se informa que todos los datos personales que nos ha facilitado serán incorporados y tratados en los ficheros de B’W & TAKACS TELECOM, S.L. para las finalidades de su e-mail. Puede ejercer sus derechos de acceso, rectificación, cancelación y oposición mediante una comunicación a B’W & TAKACS TELECOM, S.L. con domicilio en Camil Oliveras, 26, 08032 Barcelona (España), o bien mediante una comunicación a la dirección de correo electrónico info(a)bwireless.eu. En ambos casos, deberá acompañar una copia de su documento nacional de identidad o documento válido que lo identifique. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+javier.escalante=bwireless.eu@lists.freeradius.org] On Behalf Of Javier Escalante Sent: domingo, 24 de junio de 2018 15:57 To: 'FreeRadius users mailing list' Subject: RE: right tutorial Hello, Sorry guys, based on the answers of Alan, I might be stupid...I'll explain another time and I hope this time I get some help: 1. I installed a fresh server (I have my all server already configured and working since 4 years) 2. I installed freeradius 3.0.16 and mysql. No errors during installation 3. I tested with user and password in file, and it worked perfectly 4. I tested by putting the user test with password test in radcheck and the authentication failed as it is shown further down. 5. I have searched in all kind of forums and obviously also in www.freeradius.org. No solution yet. 6. The sql seems to be working despite the include line is not uncommented in radiusd.conf. Can somebody confirm? Can anybody give me a clue of how to solve this problem? Request: radtest test test localhost 10 1107 Freeradius debug output: Ready to process requests (0) Received Access-Request Id 195 from 127.0.0.1:37474 to 127.0.0.1:1812 length 74 (0) User-Name = "test" (0) User-Password = "test" (0) NAS-IP-Address = 5.135.246.127 (0) NAS-Port = 10 (0) Message-Authenticator = 0x05270c450007175556849d0b38cc7a27 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/de fault (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "test", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> test (0) sql: SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE us ername = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE us ername = 'test' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User- Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE userna me = 'test' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (0) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth -Type (0) pap: WARNING: Authentication will fail unless a "known good" password is ava ilable (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND %{User-Name} (0) sql: --> test (0) sql: SQL-User-Name set to 'test' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet- Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test', 'Access-Reject', '2018-06-24 13:55:21') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authda te) VALUES ( 'test', 'test', 'Access-Reject', '2018-06-24 13:55:21') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (1) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 195 from 127.0.0.1:1812 to 127.0.0.1:37474 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 195 with timestamp +2 Ready to process requests Thanks in advance BR Javier Escalante Business Development Manager Javier.escalante(a)bwireless.eu 00 34 626 785 675 00 34 93 141 56 36 00 41 78 689 85 69 Skype: fruiz002 Do you know our IoT solutions? Have a look here: www.bsmart.global http://www.bwireless.eu Le informamos que, de conformidad con la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, se informa que todos los datos personales que nos ha facilitado serán incorporados y tratados en los ficheros de B’W & TAKACS TELECOM, S.L. para las finalidades de su e-mail. Puede ejercer sus derechos de acceso, rectificación, cancelación y oposición mediante una comunicación a B’W & TAKACS TELECOM, S.L. con domicilio en Camil Oliveras, 26, 08032 Barcelona (España), o bien mediante una comunicación a la dirección de correo electrónico info(a)bwireless.eu. En ambos casos, deberá acompañar una copia de su documento nacional de identidad o documento válido que lo identifique. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+javier.escalante=bwireless.eu@lists.freeradius.org] On Behalf Of Alan Buxey Sent: viernes, 22 de junio de 2018 20:06 To: FreeRadius users mailing list Subject: Re: right tutorial hi, Could somebody tell us which tutorial /wiki can we follow in order to > properly configure freeradius 3.0.16? > properly configure? you need to define what it is you are trying to do. based on other replies there is history here that I havent seen (or deleted amongst deluge of other posts) one persons requirement/use-case rarely matches with another. take FreeRADIUS 3.0.16 - either built form source or via package. then follow the guides (or read the docs in the config files themselves) as required. DONT hack a load of the config around , start with basics (as per docs) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 10