November 2019 - Freeradius-Users - lists.freeradius.org

ippool and Framed-IP-Address
by Volodymyr Litovka 26 Nov '19

26 Nov '19

Dear colleagues, I didn't find this info in docs, so asking here. In general, I want to use ippool to assign addresses for connections but sometimes I need to assign addresses manually from the same pool. The question is: if I will use Framed-IP-Address in "users" configuration, how this assignment cab be reflected in ippool's configuration? At the moment I see that, when using manual assignment, db files left untouched, while requesting ippool for the address changes db files - so, probably, ippool isn't aware about Framed-IP-Address in user's config and can assign it sometimes to someone else? On the other hand, there is no kind of 'exclude' option in ippool configuration and I can't exclude addresses which I don't want to be assigned automatically. Are there ways to combine automatic and manual assignments from single pool without conflicts? Thank you. -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison

2 2

Re: Conditional EAP Type Acceptance
by Mike DiBella 26 Nov '19

26 Nov '19

The vulnerability I'm trying to control is the gap where unmanaged devices are converted to managed devices between guest account password rotations. The supplicants on these devices have already made the guest account credentials part of the saved preferred network information. MDM cannot erase that, only the user can "forget" the network on the device itself. When these devices enroll in MDM, they will receive the certificate for EAP-TLS, but the device can continue to use the saved guest credentials until the password is rotated, subverting the compliance check. Rejecting PEAP authentication when the device is found in the managed device directory will encourage users of these devices to "forget" the network and use the certificate instead. ---------------------- > So I would need to break the LDAP check into two parts. First, if an object exists where the MAC attribute matches the request Calling-Station-Id , authenticate by EAP-TLS. If authenticated, accept the request if the compliance attribute is zero. > > If the MAC address is not found, authenticate using PEAP. Except you don't control which authentication method is used. The supplicant (client side) chooses that. Further, if you don't issue client certificates for guests, then they can't choose EAP-TLS. And, if you don't issue passwords for normal users, they can't choose PEAP. Well, they can, but they can't authenticate because they don't have a password. So what you really need to do is for EAP-TLS, check that the MAC attribute matches the Calling-Station-Id. And that's about it. Which is what you already have.

2 1

Radiusd hangs on redis cluster failover (sometimes)
by Milan Nikolic 26 Nov '19

26 Nov '19

Hello, I have an issue with FreeRADIUS 4.0.x and Redis cluster. When I shut down one of the nodes (all have freeradius and use redis cluster), redis recovers and cluster state is OK but it seems freeradius doesn't refresh cluster topology, and when I send a packet to one of the working nodes it is trying to send command to node that is down and then just hangs and doesn't return response. I cannot stop radiusd after that (i.e. ctrl+c doesn't work) and it must be killed. The last line in log is this, and nothing is printed after that: Debug : (7) rediswho - [16] >>> Sending command(s) to 192.168.1.8:7004 (fr_redis_cluster_state_init) Btw. I changed the message in cluster.c just to confirm which function is called (there are two same Sending command(s) msg in that file), it is this line https://github.com/FreeRADIUS/freeradius-server/blob/master/src/lib/redis/c… . So 192.168.1.8 is the node that I shut down to test high availability, and I send packet after redis is recovered. This doesn't happen when I shut down the other node, I can see in log how radius refreshes cluster topology and everything just continues to work. Before every test, I always make sure cluster state is ok and master/slaves are in balance on all nodes. Attached is a log file I get with `radiusd -X` on the node that fails and hangs after it tries to contact node that is down. Thanks, Milan

2 9

i cant get any information for server have pppoe client
by تعلم البرمجة 26 Nov '19

26 Nov '19

1-mikrotik(name m1) pppoe-server + radius server (server) 2-mikroitk(name m2) have pppoe client i can`t get any information about m2 with radius server i want any attribute can tell me gateway for m2 or any information

1 0

Freeradius daemon terminates with a SIGTERM
by Prajosh Augustine 26 Nov '19

26 Nov '19

Hi, We are running freeradius 3.0.19 on RedHat 7.6 and trying to run as a daemon via 'systemctl start freeradiusd.service'. But executable starts and it is killed immediately. We have the following entries in the log /var/log/freeradius/radius.log. Does anyone know why is it getting a signal to terminate? Any help is appreciated. Upon checking the process with 'strace' output, it shows that it is terminated with a SIGTERM signal. Tue Nov 26 15:33:49 2019 : Info: Debugger not attached Tue Nov 26 15:33:49 2019 : Info: systemd watchdog interval is 30.00 secs Tue Nov 26 15:33:49 2019 : Info: rlm_ldap: libldap vendor: OpenLDAP, version: 20444 Tue Nov 26 15:33:49 2019 : Info: Loaded virtual server <default> Tue Nov 26 15:33:49 2019 : Warning: Ignoring "sql" (see raddb/mods-available/README.rst) Tue Nov 26 15:33:49 2019 : Info: Loaded virtual server default Tue Nov 26 15:33:49 2019 : Info: Loaded virtual server status Tue Nov 26 15:33:49 2019 : Info: Ready to process requests Tue Nov 26 15:33:49 2019 : Info: Signalled to terminate Tue Nov 26 15:33:49 2019 : Info: Exiting normally But when the executable is run manually, it runs ok (even though with warning regarding NSS/OpenSSL libraries) and accepts all authentication requests. We renamed the binary as freeradiusd from radiusd as per our naming convention. As per http://lists.freeradius.org/pipermail/freeradius-users/2018-May/091636.html, the warnings are due to Redhat switching the library to NSS from OpenSSL in 7.6. Could the SIGTERM that we receive be because of the warning messages below? [root(a)xxxpoc01.st1 system]# /usr/sbin/freeradiusd TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. The contents of the service file (/etc/systemd/system/freeradiusd.service) is below: [Unit] Description=FreeRADIUS multi-protocol policy server After=network-online.target Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com /doc/ [Service] Type=notify WatchdogSec=60 NotifyAccess=all PIDFile=/var/run/freeradiusd/freeradius.pid EnvironmentFile=-/etc/sysconfig/radiusd Environment=HOSTNAME=%H MemoryLimit=2G ExecStartPre=/usr/sbin/freeradiusd $FREERADIUS_OPTIONS -Cx -lstdout ExecStartPre=/usr/bin/chown radiusd:radiusd /var/run/freeradiusd ExecStart=-/usr/sbin/freeradiusd $FREERADIUS_OPTIONS Restart=on-failure RestartSec=10 [Install] WantedBy=multi-user.target Thanks, Prajosh

2 2

Version 3.0.20 has been released
by Matthew Newton 25 Nov '19

25 Nov '19

Version 3.0.20 has now been released. Full release notes are on the web site: https://freeradius.org/release_notes/?br=3.0.x&re=3.0.20 As the aim for version 3 is stability, this is mainly a bugfix release, though there have been a few minor features added, too. Some highlights: New modules (experimental, please test): - Python3 support with rlm_python3. - MongoDB support in rlm_sql_mongo. Security updates: - More EAP-PWD security fixes. Please upgrade if you use this. - Tighten security when running with systemd - Disable TLS 1.0 and 1.1 in the default configuration (strongly recommended to do this in all installations). Dockerfiles and packaging updates to add support for: - Debian 10 - RHEL/CentOS8 As well as many other fixes and improvements, including the usual documentation and dictionaries. Download from all the usual places: https://freeradius.org/releases/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_20 Docker images are building and will upload to Dockerhub shortly. Packages will be available on https://packages.networkradius.com/ within a day or so. -- Matthew

6 14

Conditional EAP Type Acceptance
by Mike DiBella 25 Nov '19

25 Nov '19

I have FR set up to authenticate based EAP-TLS certificate and authorize based on finding an object in LDAP where Calling-Station-Id from the supplicant is equal to an attribute containing the WLAN MAC address, and an additional compliance attribute is equal to zero. This allows me to only accept requests from managed devices that are policy compliant. Now I need to add a way to accept requests from guest devices. So I would need to break the LDAP check into two parts. First, if an object exists where the MAC attribute matches the request Calling-Station-Id , authenticate by EAP-TLS. If authenticated, accept the request if the compliance attribute is zero. If the MAC address is not found, authenticate using PEAP. Accept on credential match. I only need a few guest accounts, so I'd load them in a simple store. Which backend would be most suited for the PEAP accounts? I'd want to be able to rotate the guest account passwords periodically without much fuss.

2 1

A little help on freeradius with ldap
by Marco Miglietta 25 Nov '19

25 Nov '19

A little help on freeradius with ldap I configured freeradius 2.2.5 on debian 8.7 for authentication with LDAP following this usefull post and all works fine... http://mageconfig.blogspot.com/2014/11/configure-radius-with-ldap-for-netwo… Freeradius pass the authentication's task to LDAP. How can I make that only the users present in mysql radius database are checked on LDAP ? I'm not much experienced whit linux ed freeradius. Sorry ! Thank you. Marco.

2 2

Home server failure messages
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 24 Nov '19

24 Nov '19

Hi all, Freeradius 3.0.20-1. Is there a way I can pick up (and report) failures for connections to home servers? I can't think of a way, but normally I'd check the Module-Failure-Message attribute; is there anything similar I can use for proxying as that isn't set here (not a module I guess!) Sorry if it's really obvious and documented somewhere, but I can't see anything that would get set, having checked proxy.conf, tls, pre-proxy, post-proxy bits. I can't use status-server just to check before clients connect, because of using Radsec (it's the future?!), so some requests are returned as rejects. It's good to know when/how often this sort of stuff happens given that some of the servers are external, nothing to do with us (Govroam). Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

3 6

RADIUS Extensions for IP Port Configuration and Reporting
by Ali Arslan 23 Nov '19

23 Nov '19

Hello all, An ISP company uses NAT not to assign a distinct real IP to each user because of insufficient number of real IP. And such ISP companies need NAT IPDR (Internet Protocol Detail Record) report with following format: User_Name | Private_IP | Private_IP_Port_Range_Start | Private_ IP_Port_Range_End |Real_IP | Real_IP_Port_Range_Start | Real_IP_Port_Range_End|Session_Star_Date | Session_EndUpdate_Date | Upload_Byte | Download_Bype | Session_Dsiconnect_Message | Session_State | Session_PVC | Service_Number | Session_Code Here it is needed to get/set IP source transport ports allocated to a user but could not find attributes of such kind in freeRadius. In searching for that info i found RFC 8045 https://tools.ietf.org/html/rfc8045 which defines attributes IP-Port-Limit-Info, IP-Port-Range, IP-Port-Forwarding-Map. Does freeRadius current version (3.0) has support for RFC 8045 ? Are there any way to get the transport port allocated to a user when accounting session starts and write this info in radacct in a custom column so that we can use that port in IPDR reporting? Thanks.

2 2