July 2018 - Freeradius-Users - lists.freeradius.org

Re: Problem with HP devices & radius configuration
by Saurabh Lahoti 27 Jul '18

27 Jul '18

Dear, Many thanks for your kind help. Added the attribute to HP dictionary & issue resolved. Sincere apologies from my side for the wrong terminology. Thanks & Kind Regards, Saurabh LAHOTI.

1 0

Problem with HP devices & radius configuration
by Saurabh Lahoti 26 Jul '18

26 Jul '18

Dear, While configuring users to allow access to HP devices in users.conf with parameter HP-VC-Groups = "vcadmingroup"; it throws error as '/usr/app/radius-new/prod-oob-internal/etc/raddb/mods-config/files/authorize[139]: Parse error (reply) for entry DEFAULT: Unknown attribute "HP-VC-Groups" Could you please help here with correct configuration guidelines..? Thanks & Kind Regards, Saurabh LAHOTI

3 2

Question about LDAP authentication
by Petit, Benoit 25 Jul '18

25 Jul '18

Hi, I have a quick question about LDAP authentication. The radius authentication is working but when I check the logs in debug mode I get a warning concerning LDAP. I'm wondering if this warning is important and how I can get ride of it. I put the ldap auth in the /raddb/sites-available/default file but the following warning keeps coming back, even tough the user's attributes are passed: radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Jul 11 2017 at 04:40:14 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. [ldap] performing user authorization for ba0xxxx [ldap] expand: (cn=%{User-Name}) -> (cn=ba0xxxxx(a)ssl-admin.bell) [ldap] expand: dc=connexim,dc=com -> dc=connexim,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.234.4.16:389, authentication 0 [ldap] bind as cn=Manager,dc=connexim,dc=com/xxxxxxxx to 10.x.x.x:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=connexim,dc=com, with filter (cn=ba0xxxx(a)ssl-admin.bell) [ldap] looking for check items in directory... [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.227.x.x [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.226.x.x [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.226.x.x [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.227.x.x [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.227.x.x [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.227.x.x [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.227.x.x [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.226.x.x [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.226.x.x [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.226.x.x [ldap] looking for reply items in directory... [ldap] radiusClass -> Class = 0x61646d696e WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok The logs then continue and I receive an Accept-Accept for the session. Is this warning relevant and how can I get rid of it? Thanks, Benoit Petit Analyste Technique | Technical Analyst Sécurité et Intelligence Digitale TI | IT Security and Digital Intelligence 1 Carrefour Alexandre-Graham-Bell - Aile E - 3e étage - Verdun - QC - H3E 3B3 514-391-9247 L'utilisation de ce message et régie par notre politique de courriel. www.bell.ca/PolitiqueConfidentialiteCourriel The use of this message is restricted by our mail policies. www.bell.ca/EmailConfidentialityWarning Vacances : 24 août au 17 septembre

3 4

Can we get success response in other servers ?
by Mallikarjuna Peddappanavara Karibasappa 24 Jul '18

24 Jul '18

Hi All, After successful authentication of user in freeradius server, can we get this below success response in other servers like nginx or apache ? I've configured the freeradius server in nginx and it is working fine. (19) Sent Access-Accept Id 2 from 127.0.0.1:1812 to 127.0.0.1:59820 length 0 (19) Service-Type = Callback-Login-User (19) Login-IP-Host = 127.127.127.98 (19) Callback-Number = "999999" (19) Login-Service = Telnet (19) Login-TCP-Port = Telnet Thank you, Best Regards,*Mallikarjuna PK*Email: mallikarjuna.peddappanavara(a)igrid-td.com Mobile: +91-9535744695

3 6

FreeRADIUS and radiusCheckItem
by Gianluca Gerunda 24 Jul '18

24 Jul '18

Hi all, first of all sorry if the question has been already treated, but I haven't found nothing about it. So, I successfully configured a FreeRADIUS 3 with an OpenLDAP 2.4 as backend and, luckily, all works fine: I can authenticate users from their clients, with some specific return-attribute and all that configuration is stored on Ldap. Now I'd like to check user's check-attributes list, storing them also on Ldap with the others user attributes: I tried to play with radiusCheckItem attribute, but surely I'm losing some piece around.... Can someone help me? An example configuration or a good link are enough. Thanks for your time, Gianluca -- /*GERUNDA Gianluca* System Engineer Xech s.r.l. Via Ajraghi, 30 20156 Milano (Italy) Mob.: +39 347 8318200 E-mail: ggerunda(a)xech.it / *IMPORTANTE*: il contenuto di questa e-mail e degli eventuali allegati, è strettamente confidenziale e destinato alla/e persona/e a cui è indirizzato. Se avete ricevuto per errore questa e-mail, Vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail, potr´ essere perseguito ai sensi di legge. *IMPORTANT*: The contents of this email, and any attachments, are CONFIDENTIAL and intended only for the person(s) to whom they are addressed. If you have received the email in error please notify the sender immediately and delete it from your computer system. Do not copy or distribute it or disclose its contents to any person. Any improper use of the contents of this email will be prosecuted by law.

2 1

Radius with Google Authenticator/LDAP
by Daniel Lumb 24 Jul '18

24 Jul '18

Hi all, First time using FreeRadius so apologies if these aren’t great questions but I’ve done a fair amount of internet trawling and haven’t found anything that addresses my issue. So, I’m looking to configure FreeRadius as an authentication source for a Cisco VPN with 2FA. I’d like to use Google authenticator for the second factor. There are plenty of guides on integrating Google authenticator with FreeRadius, which appear to point FreeRadius to use PAM and then add the Google authenticator config to the Radius PAM stack. In all of these examples, the OTP code must be entered on the end of the user password in the same input field, which is fine. The issue is that all of these examples use local linux users in the PAM stack, like this: #@include common-auth #@include common-account #@include common-password #@include common-session auth requisite pam_google_authenticator.so forward_pass auth required pam_unix.so use_first_pass I currently have Radius setup to authenticate against LDAP (Through the FreeRadius config itself, nothing to do with PAM) - is there a way that I can use the LDAP account as a the second part of this 2FA rather than a local account? It seems that it will have to involve PAM because as part of the google authenticator setup you have to tell FreeRadius to use PAM in the authorize/authenticate config. Any advice? Is it just a case of picking a different source for the OTP that is better integrated with FreeRadius? Thanks, Dan

2 1

Configuring Freeradius to keep a local copy of accounting records and send a copy to a remote server
by Frank Godek 24 Jul '18

24 Jul '18

Hi Everyone, I've used Radius for many, many years but have not had to worry about the accounting records until now. I have a client that is going to provide authentication for a remote partner organization. They will be billing them based on both having their clients connect and also, to some extent, on how much data the partner's clients use. The remote partner needs to get accounting records in order for them to make payment. At the same time, my client wants copies of the records so they can verify that they are getting paid correctly. I setup a new FreeRadius server for this purpose so I'm running 3.0.17 on Ubuntu 16.04. In the wireless APs that are providing service, I can easily set two accounting servers but, as has been the case since I started using Radius, the secondary server is a fallback for the primary not a location where duplicate entries are sent. I have tried setting up a realm that points to the remote partner and to use the copy-acct-to-home-server module. That worked great as far as sending the records to the remote partner but I could see that what it was doing was renaming the details file, transferring the contents of that file to the remote server, and then deleting the renamed details file. Of course, that left me without details on the local server. So, what's the best and/or easiest way for me to keep a copy locally? Do I need to define a virtual server and setup a home-server-pool with the remote server? I looked at that but it seemed that the home-server-pools were either setup for either load balancing or failover. I don't want either. I want a copy of every record to stay local AND be sent to the remote server. Thank you in advance for your help. I've been reading through the docs and also online examples but haven't found much that was very clear on this setup. Frank Godek

3 2

raddebug
by Bassem Mettichi 23 Jul '18

23 Jul '18

Hello, i would like to konw if the use of raddebug and radmin on a production environnement is safe or no? is the use of radmin can make security problems for the server? Thanks Mettichi Bassem

2 1

Problem with ntlm_auth between freeradius 3.0 and Samba 4 AD
by Benjamin DUPALUT 23 Jul '18

23 Jul '18

Hello, First of all, sorry for my english if there is some mistakes. I'm trying to set up an authentication between a freeradius 3.0 server and a Samba 4 AD using ntlm_auth. I apply the configuration from deployingradius.com/documents/configuration/active_directory.html but i got an error when testing with the "radtest -t mschap user passwd 127.0.0.1 0 testing123" command. Here is the issue of the freeradius -X debug : (11) Received Access-Request Id 115 from 127.0.0.1:60705 to 127.0.0.1:1812 length 143 (11) User-Name = "dupalutb(a)esiee.fr" (11) NAS-IP-Address = 127.0.1.1 (11) NAS-Port = 0 (11) Message-Authenticator = 0xe7c32a18a131310841e6f149e528647b (11) MS-CHAP-Challenge = 0x9aa1c8732f3e45a9 (11) MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000c93d69617f9ccbf98d1b673b2d75a401034e14ac56100964 (11) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/eduroam (11) authorize { (11) if (!(User-Name =~ /@/)){ (11) if (!(User-Name =~ /@/)) -> FALSE (11) if (User-Name =~ /@$/){ (11) if (User-Name =~ /@$/) -> FALSE (11) if (User-Name =~ /@.+?@/){ (11) if (User-Name =~ /@.+?@/) -> FALSE (11) if (User-Name =~ /@.+?[^[:alnum:]\\.-]/){ (11) if (User-Name =~ /@.+?[^[:alnum:]\\.-]/) -> FALSE (11) if (User-Name =~ /(a)[\\.-]/){ (11) if (User-Name =~ /(a)[\\.-]/) -> FALSE (11) if (User-Name =~ /@.+?[\\.-]$/){ (11) if (User-Name =~ /@.+?[\\.-]$/) -> FALSE (11) if (User-Name =~ /(a)[^\\.]+$/){ (11) if (User-Name =~ /(a)[^\\.]+$/) -> FALSE (11) if (User-Name =~ /@.+?\\.\\./){ (11) if (User-Name =~ /@.+?\\.\\./) -> FALSE (11) if (User-Name =~ /(a)myabc\\.com$/i){ (11) if (User-Name =~ /(a)myabc\\.com$/i) -> FALSE (11) if (User-Name =~ /@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i){ (11) if (User-Name =~ /@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i) -> FALSE (11) if (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i){ (11) if (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE (11) if (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i){ (11) if (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE (11) if (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i){ (11) if (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE (11) if (User-Name =~ /(a)\\.?ac\\.uk$/i){ (11) if (User-Name =~ /(a)\\.?ac\\.uk$/i) -> FALSE (11) if (User-Name =~ /@.+?\\.ax\\.uk$/i){ (11) if (User-Name =~ /@.+?\\.ax\\.uk$/i) -> FALSE (11) [preprocess] = ok (11) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (11) auth_log: --> /var/log/freeradius/radacct/ 127.0.0.1/auth-detail-20180703 (11) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20180703 (11) auth_log: EXPAND %t (11) auth_log: --> Tue Jul 3 17:36:31 2018 (11) [auth_log] = ok (11) policy operator-name.authorize { (11) if ("%{client:Operator-Name}") { (11) EXPAND %{client:Operator-Name} (11) --> (11) if ("%{client:Operator-Name}") -> FALSE (11) } # policy operator-name.authorize = ok (11) policy cui.authorize { (11) if ("%{client:add_cui}" == 'yes') { (11) EXPAND %{client:add_cui} (11) --> (11) if ("%{client:add_cui}" == 'yes') -> FALSE (11) } # policy cui.authorize = ok (11) [chap] = noop (11) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (11) [mschap] = ok (11) [digest] = noop (11) suffix: Checking for suffix after "@" (11) suffix: Looking up realm "esiee.fr" for User-Name = "dupalutb(a)esiee.fr" (11) suffix: Found realm "esiee.fr" (11) suffix: Adding Stripped-User-Name = "dupalutb" (11) suffix: Adding Realm = "esiee.fr" (11) suffix: Authentication realm is LOCAL (11) [suffix] = ok (11) eap: No EAP-Message, not doing EAP (11) [eap] = noop (11) files: users: Matched entry DEFAULT at line 1 (11) [files] = ok (11) [expiration] = noop (11) [logintime] = noop (11) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (11) pap: WARNING: Authentication will fail unless a "known good" password is available (11) [pap] = noop (11) } # authorize = ok (11) Found Auth-Type = mschap (11) # Executing group from file /etc/freeradius/3.0/sites-enabled/eduroam (11) authenticate { (11) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (11) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (11) mschap: Client is using MS-CHAPv1 with NT-Password (11) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (11) mschap: ERROR: MS-CHAP2-Response is incorrect (11) [mschap] = reject (11) } # authenticate = reject (11) Failed to authenticate the user (11) Using Post-Auth-Type Reject (11) # Executing group from file /etc/freeradius/3.0/sites-enabled/eduroam (11) Post-Auth-Type REJECT { (11) attr_filter.access_reject: EXPAND %{User-Name} (11) attr_filter.access_reject: --> dupalutb(a)esiee.fr (11) attr_filter.access_reject: Matched entry DEFAULT at line 11 (11) [attr_filter.access_reject] = updated (11) [eap] = noop (11) policy remove_reply_message_if_eap { (11) if (&reply:EAP-Message && &reply:Reply-Message) { (11) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (11) else { (11) [noop] = noop (11) } # else = noop (11) } # policy remove_reply_message_if_eap = noop (11) } # Post-Auth-Type REJECT = updated (11) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (11) Sending delayed response (11) Sent Access-Reject Id 115 from 127.0.0.1:1812 to 127.0.0.1:60705 length 61 (11) MS-CHAP-Error = "\000E=691 R=1 C=32c072eb4937c259 V=2" Waking up in 3.9 seconds. (11) Cleaning up request packet ID 115 with timestamp +545 It seems that radius try to use mschap authentication method instead of ntlm_auth. Where did i make a mistake ? Thanks in advance for your suggestions. Regards , *Benjamin Dupalut* Administrateur système et réseau Service des Moyens Informatiques Généraux (SMIG) ESIEE Paris 2 bd Blaise Pascal - 93162 Noisy-le-Grand Cedex T : +33 1 45 92 66 17 benjamin.dupalut(a)esiee.fr www.esiee.fr / www.cci-paris-idf.fr

4 10

LDAP and AD authentication on the same FreeRadius server
by Denis CLAVIER 23 Jul '18

23 Jul '18

Hi, I am trying to set up a FreeRadius server for a VPN connection used by users stored in an LDAP or in an AD. I succeeded to authenticate on LDAP and on AD separately with the two following radtest commands : LDAP : radtest dclavier "password" localhost 0 testing123 AD : radtest -t mschap dclavier "Password1234*" localhost 0 testing123 However, I would like to configure the FreeRadius server to authenticate users on LDAP or AD, based on the realm. For example, user dclavier(a)ldap.com should use ldap authentication, and dclavier(a)ad.com should use mschap authentication (or ntlm_auth) without specifying which method to use. So, I would like FreeRadius to choose the right Auth-Type according to the realm. At least, I would like FreeRadius to try the second auth-type if the first failed. I looked at the proxy.conf file to perform what I want, but I can't find how to specify the auth type for each realm. So I would like to know if it is possible to perform authentication for users from LDAP and users from AD with only one FreeRadius server. If yes, I would be happy if you can suggest how to do it. Regards, Denis CLAVIER

2 2