September 2018 - Freeradius-Users - lists.freeradius.org

Issue redundant block - Freeradius 3.0.16.
by Andrea Mucci 27 Sep '18

27 Sep '18

Hi All, I configured a redundant block for two instances of the sql module as described in the radius.conf file. redundant redundant_sql_default { sql_primary_default sql_secondary_default handled } sql_primary_default and sql_secondary_default are two instances of the sql module. It works if I call it as a module in the authorize stream but does not accept it in an expansion. update control { Tmp-String-1 := "%{redundant_sql_default: SELECT VENDOR_ID||'~'||VALUE||'~'||VPDN_VENDOR_CODING_ID FROM NAS a, NAS_TAG b, VPDN_LAC l WHERE A.ID = B.NAS_ID (+) AND B.NAS_TAG_NAME_ID (+) = 1 AND A.ID = L.NAS_ID (+) AND A.IP_ADDR_TXT = '%{NAS-IP-Address}'}" } The service start gives this error. Sep 27 16:17:26 freeradiusmi radiusd[8798]: /etc/raddb/policy.d/windtre-nas-policy[12]: Failed parsing expanded string: Sep 27 16:17:26 freeradiusmi radiusd[8798]: /etc/raddb/policy.d/windtre-nas-policy[12]: %{redundant_sql_default: SELECT VENDOR_ID||'~'||VALUE||'~'||VPDN_VENDOR_CODING_I Sep 27 16:17:26 freeradiusmi radiusd[8798]: /etc/raddb/policy.d/windtre-nas-policy[12]: ^ Unknown module Sep 27 16:17:26 freeradiusmi systemd[1]: radiusd.service: control process exited, code=exited status=1 Sep 27 16:17:26 freeradiusmi systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. -- Subject: Unit radiusd.service has failed What am I doing wrong? Best Regards Andrea

2 1

auth = yes logs too much, auth = no too little
by Hans-Christian Esperer 27 Sep '18

27 Sep '18

Hi All, I would like to log failed login attempts, so I can see the username that was tried. Is there a simple way to do this? Setting auth=yes in radiusd.conf also logs all successful attempts. So basically, I'd like to see lines like this one: Mon Sep 24 13:24:16 2018 : Auth: (34876) Login incorrect (mschap: FAILED: No NT/LM-Password. Cannot perform authentication): [username/<via Auth-Type = eap>] (from client unifi port 0 via TLS tunnel) but not Mon Sep 24 13:15:03 2018 : Auth: (34866) Login OK: [username] (from client unifi port 123456789 cli 00-00-11-22-33-44) Any suggestions on how to achieve this or something similar would be much appreciated. Not directly related, but somewhat: When auth=no is set, and a login fails (be it due to a wrong username, or wrong passphrase), I get the following in the log: Mon Sep 24 13:24:16 2018 : Info: (34877) eap_peap: This means you need to read the PREVIOUS messages in the debug output Mon Sep 24 13:24:16 2018 : Info: (34877) eap_peap: to find out the reason why the user was rejected Mon Sep 24 13:24:16 2018 : Info: (34877) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Mon Sep 24 13:24:16 2018 : Info: (34877) eap_peap: what went wrong, and how to fix the problem And that's all! There are *no previous* messages. There four lines are all that I get. I assume this means that something on my side is misconfigured, like an "if all else fails, reject" kind of statement? Thanks for the help! Cheers HC

3 9

dynamic_clients // Required attribute "FreeRADIUS-Client-Secret" is missing
by Osvaldo T Crispim Filho 27 Sep '18

27 Sep '18

Why is not he finding the "secret"? ============================== Freeradius 3.0.18 Debian 9 amd64 ============================== Table nas: id | nasname | shortname | type | ports | secret | server | community ----+-------------+-----------+-------+-------+--------+--------+----------- 1 | 172.20.0.20 | ap-20 | other | | 123123 | | 2 | 172.20.0.21 | ap-21 | other | | 123123 | | (2 rows) ========================= fradius1:~$ psql -h localhost -d radius -U radius -W -c "select secret from nas where nasname = '172.20.0.21';" Password for user radius: secret -------- 123123 (1 row) ========================== freeradius -X: Ready to process requests (0) server dynamic_clients { (0) # Executing section authorize from file /etc/freeradius/sites-enabled/dynamic-clients (0) authorize { (0) if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { (0) EXPAND %{User-Name} (0) --> (0) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (3) (0) Executing select query: SELECT nasname FROM nas WHERE nasname = '172.20.0.21' (0) SQL query returned no results rlm_sql (sql): Released connection (3) Need 2 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (8), 1 of 24 pending slots used (0) EXPAND %{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'} (0) --> (0) if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") -> FALSE (0) [ok] = ok (0) } # authorize = ok (0) } # server dynamic_clients (0) Converting control list to client fields *(0) ERROR: Cannot add client 172.20.0.21 <http://172.20.0.21>: Required attribute "FreeRADIUS-Client-Secret" is missing* Ignoring request to auth address * port 1812 bound to server default from unknown client 172.20.0.21 port 45122 proto udp Ready to process requests -- - Osvaldo T Crispim Filho -

2 2

EAP-TLS cert validation with intermediate cert
by Zetan Drableg 26 Sep '18

26 Sep '18

In /etc/raddb/mods-enabled/eap client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" Wpa_supplicant is sending a client certificate that is the client + intermediate certificate concatenated. However freeradius only gets the client certificate in TLS-Client-Cert-Filename and openssl fails validation. I checked this by changing the client = verify command to copy the certificate to /var/tmp so I could look at it. I can verify the cert using openssl verify -CAfile ca.pem -untrusted intermediate.pem client.pem but the intermediate is not available to the radius server, or from the received cert chain from the client. I think freeradius should be receiving client+intermediate certs from wpa_client, but it's not. Is there another Filename variable containing the intermediate? Why is freeradius truncating the cert to only the client and removing the intermediate? freeradius 3.0.13

2 1

Detect MSCHAPv2 inner-tunnel state
by Gary Gwin 26 Sep '18

26 Sep '18

The attached radius.log shows successful EAP-PEAP/MSCHAPv2 authentication using a Windows 10 client and Meraki access point with FreeRADIUS 3.0.17. An inner-tunnel Python script uses an API to get the NT hash and sets the NT-Password within authorize. The standard authenticate MS-CHAP module then handles. During the chatty inner-tunnel MSCHAPv2 negotiation, the get NT hash API is invoked twice in requests 7 and 8, which works, but with unnecessary script and API load. I can eliminate the second invocation in step 8 by checking the request EAP-Message for length. That feels fragile. There must be a better way to detect state to determine we're in request 8. Any recommendations? Thanks, Gary

2 2

EAP-PWD with wrong password
by Anja Ruckdaeschel 26 Sep '18

26 Sep '18

Hi there, Is there a way to determine that a user tried to log in with a "wrong password" with eap-pwd? Setup is as recommended by comments in config with an inner-tunnel. EAP-PWD against edir with a correct password works fine and it produces a log line on Access-Accept in the radius-Logfile. But EAP-PWD with the user using a wrong password, does nothing. In debug it just looks like an unfinished eap-request with eap returning handled instead of ok for the last packet. Problem is, that we cannot see "normal" entry in radius.log and trigger some other actions on a reject. Thank you very much Kind regards Anja

3 6

Linelog to same file as default log
by Anja Ruckdaeschel 26 Sep '18

26 Sep '18

Hi there! One question: Is it safe to log to the same file with linelog which is the default log in radiusd.conf? As far as I can see, this works in my tests, but I don't wan't to have "bad surpises" when taking this to production with hundreds of log events. Thank you very much Anja

2 2

Diameter client module in FreeRADIUS ?
by Chaigneau, Nicolas 25 Sep '18

25 Sep '18

Hello, I may have to implement a Diameter client module within FreeRADIUS. I would like to be able to query a Diameter server when handling some RADIUS requests. Basically, it would be similar to the FreeRADIUS rlm_rest module... but using Diameter instead of REST. Has anyone had to do something like that ? For now my idea is to scavenge stuff from freeDiameter and embed them in a custom module. All advices are welcome. :) Regards, Nicolas. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 1

Is this a job for FreeRadius?
by Bret Schuhmacher 25 Sep '18

25 Sep '18

Hi all, First post... just seeing if I'm on the right track. I have my router locked down to prevent my kids from bringing unauthorized devices into the house... I change the router passwords daily and have it locked down by MAC address. However, once I give them the daily password they have full internet access to do homework. Unfortunately, once they have the password they seem to be watching youtube and other things instead of doing homework. Can I use FreeRadius to limit their access to the Internet to exclude a list of blacklisted sites until they prove their homework is done and I flip some bits to make policy changes **PER USER** and allow one child access to youtube without allowing the other child access? I feel like I can, but all I'm looking for here is a "yes you can do that" and I'll keep trying to figure it out - I just want to see if I'm on the right track. Thanks, Bret -- Bret Schuhmacher | Sr. Solutions Architect | 865.257.9856 | bits.and.bytes.software(a)gmail.com

7 7

freeradius with cloud authentication
by mohamad buvaydanı 25 Sep '18

25 Sep '18

I am using freeradius server locally on ubuntu machine , and my system working fine . I want to allow my system to run from cloud to start sell it , but I don’t know how to make my freeradius working on cloud . clients don’t have public ip address , I searched alote in the internet and found many cloud Radius server , they using NAS-ID attribute , but I don’t know how freeradius and NAS can makeing connection and authentication through NAS-ID . When I running my system locally I insert NAS information into nas table, like nas ip and secret ,but that because NAS and freeradius server running at same network so they can connect together , so how can I do that ? Thank you

1 0