December 2019 - Freeradius-Users - lists.freeradius.org

dhcpclient fails if offer contains two option43s
by Chinnapaiyan, Nagamani 16 Dec '19

16 Dec '19

# /usr/bin/dhcpclient -i eth1 -x -f /opt/viasat/dhcp_fr_citests/dhcpclient-modem_discover.txt 10.43.18.36:6767 Sending DHCP-Discover Id 7d727167 from 0.0.0.0:6767 to 10.43.18.36:6767 length 326 ... ... dhcpclient: Failed decoding packet: fr_dhcpv4_decode_option: Insufficient data Received DHCP-Offer Id 7d727167 from 10.43.18.36:6767 to 0.0.0.0:6767 via eth1 length 770 Regards, Nagamani Chinnapaiyan

2 1

hex is not working in 4.0.x
by Chinnapaiyan, Nagamani 16 Dec '19

16 Dec '19

hex conversion of mac address used to work previously, (0) EXPAND 0x%{hex:%{DHCP-Client-Hardware-Address}} (0) EXPAND %{DHCP-Client-Hardware-Address} (0) --> 00:a0:bc:6c:7e:4e (0) EXPAND %{hex:%{DHCP-Client-Hardware-Address}} (0) (%{hex:00:a0:bc:6c:7e:4e}) (0) --> 00a0bc6c7e4e (0) --> 0x00a0bc6c7e4e Now it is broken, (0) EXPAND 0x%{hex:%{DHCP-Client-Hardware-Address}} (0) EXPAND %{DHCP-Client-Hardware-Address} (0) --> 00:a0:bc:6c:7d:3a (0) EXPAND %{hex:%{DHCP-Client-Hardware-Address}} (0) (%{hex:00:a0:bc:6c:7d:3a}) (0) --> 000000000000 (0) --> 0x000000000000 Regards, Nagamani Chinnapaiyan

3 2

cosmetic: radiusd server in -X mode, it keeps printing the listen line continuously
by Chinnapaiyan, Nagamani 16 Dec '19

16 Dec '19

'radiusd -X' on 4.0.x: #### Opening listener interfaces #### Listening on dhcpv4 address proto_dhcpv4_udp server 127.0.0.1 port 6767 on interface lo bound to virtual server dhcp Listening on dhcpv4 address proto_dhcpv4_udp server 10.43.18.36 port 6767 bound to virtual server dhcp Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests TIMER - worker max_request_time - 0 active requests Resetting worker 0 cleanup timer to +30 Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests TIMER - worker max_request_time - 0 active requests Resetting worker 0 cleanup timer to +30 Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Ready to process requests Regards, Nagamani Chinnapaiyan

2 1

Double check of sanity with PEAP setup
by Adam Taylor 15 Dec '19

15 Dec '19

Hey all, I just want to double check that I am doing something correctly as I set up our new radius servers. We currently use PEAP to auth our wireless. My question is about doing the certificates correctly on the new radius servers. We currently use a Global CA cert in the TLS section but everywhere says not to in the config files. I'm confused as to why for PEAP, as we have to have a CA signed cert for all the user devices to not throw a "could not verify cert" creating the TLS tunnel before EAP. Clients installing a cert is a non-starter....there is no way with the amount of visitors. So is a CA signed TLS cert correct for PEAP auth or am I not understanding something in the documentation? I just want to make sure I do this correctly and do not have some giant gaping security hole. Thanks, Adam Taylor

5 5

global/wildcard config for COA server?
by P. R.M. 15 Dec '19

15 Dec '19

I need to configure freeradius so that it will send COA/disconnect messages to a given NAS using a 'global COA configuration' for COA-related settings such as port #, shared secret, retransmit, etc., yet without having to hard-code the IP address of the NAS within a home_server section (in a similar way to how a client can be setup with wildcard host/network address). I tried using a wildcard IP address within a home_server configuration, but it doesn't work; I received a "Wildcard '*' addresses are not permitted for home servers" error. According to the documentation, freeradius will supposedly try to send a COA/disconnect message to the same NAS that sent the original RADIUS request. However, in practice, it doesn't work; it produces an error "Unknown destination {IP:PORT} for CoA request." since it cannot match the NAS to an existing home_server config. So, even though it auto-detects the target for the COA packet, it's not very useful in situations where you need a wildcard "open-to-any-client" setup. Ideally, it would be useful to have freeradius respond to a given client/NAS using the same 'shared secret' that was used to connect to that particular client (even if the client is configured with a wildcard IP), and/or perhaps also global configuration for the other COA settings (UDP port # and the retransmit settings). At the very least, a wildcard IP address for a COA home_server config would be very helpful. Is there already a way to set something like this up? Or, is it possible via a work-around? If not, can this be put in as a feature request? Thanks in advance, P.R.

2 1

FreeRadius LDAP group verification not working for me
by Condor 13 Dec '19

13 Dec '19

Hi all, i'm really brand new on freeradius. i'm using freeradius 3.0.4 with ldap, ldap autethication work for me fine with "o=organitation" but not with group = cn, maybe the ldap configuration is not the standart I'm following these thread: lists.freeradius.org/pipermail/freeradius-users/2016-December/085971.html For me: in /mods-available/ldap ldap { server = "x.x.x.x" base_dn = "o=organization,cn=telecom"} user { base_dn = "o=organization,cn=telecom" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"} group { base_dn = "o=organization,cn=telecom" filter = '(cn=telecom)' name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = 'memberUid' } on radius -X : Received Access-Request Id 125 from y.y.y.y:42420 to x.x.x.x:1812 length 78 User-Name = 'usertest' User-Password = '*****' NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x075a82e674d1e57b22856618bd3adc87(2) Received Access-Request packet from host y.y.y.y port 42420, id=125, length=78(2) User-Name = 'usertest'(2) User-Password = '*****'(2) NAS-IP-Address = 127.0.1.1(2) NAS-Port = 0(2) Message-Authenticator = 0x075a82e674d1e57b22856618bd3adc87(2) # Executing section authorize from file /etc/raddb/sites-enabled/default(2) authorize {(2) eap : No EAP-Message, not doing EAP(2) [eap] = nooprlm_ldap (ldap): Reserved connection (4)(2) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})(2) ldap : --> (uid=usertest)(2) ldap : EXPAND o=organitation,cn=telecom(2) ldap : --> o=organitation,cn=telecom(2) ldap : Performing search in 'o=organitation,cn=telecom' with filter '(uid=usertest)', scope 'sub'(2) ldap : Waiting for search result...(2) ERROR: ldap : Failed performing search: The specified DN wasn't found, check base_dn and identityrlm_ldap (ldap): Released connection (4)(2) [ldap] = fail(2) } # authorize = fail(2) Invalid user (ldap: Failed performing search: The specified DN wasn't found, check base_dn and identity): [usertest/******] (from client Renaju port 0)(2) Using Post-Auth-Type Reject(2) # Executing group from file /etc/raddb/sites-enabled/default(2) Post-Auth-Type REJECT {(2) attr_filter.access_reject : EXPAND %{User-Name}(2) attr_filter.access_reject : --> usertest(2) attr_filter.access_reject : Matched entry DEFAULT at line 11(2) [attr_filter.access_reject] = updated(2) } # Post-Auth-Type REJECT = updated(2) Delaying response for 1 seconds ------- # in the "default" server authorize { ... eap { ok = return updated = return } ldap group_authorization # In the "inner-tunnel" server: authorize { ... eap { ok = return } ldap group_authorization I create "policy.d/group_authorization" the file not exist # in policy.d/group_authorization: group_authorization { if (&Huntgroup-Name == "telecom") { if (&LDAP-Group[*] == "o=organization,cn=telecom") { ok } else { update reply { &Reply-Message := "Not authorized for telecom" } reject } } elsif (&Huntgroup-Name == "telecom") { reject }} Thanks!

2 1

Script
by Aurélio de Souza Ribeiro Neto 13 Dec '19

13 Dec '19

Hello All, I'm using freeradius 3.0.20 in ubuntu + MySQL, and I want to implement a solution to discconect users when I don't receive 2 Interim Update Packets for example. How can I do this? Someone can help? Aurélio

3 2

Regex match on a variable is not working if length is long
by Chinnapaiyan, Nagamani 12 Dec '19

12 Dec '19

Hi, I am using freeradius-4.0.x version. This one works, (6) if ( "%{control:Tmp-String-7}" =~ /vendor-options.*\(number 43\)\(value (([0-9a-fA-F]{2}:)*[0-9a-fA-F]{2})/ ) { (6) EXPAND %{control:Tmp-String-7} (6) --> ((ClassName Policy)(name client-policy:1,6,00:A0:BC:6C:7E:64)(v4-reply-options [vendor-encapsulated-options])(vendor-options [((ClassName Option)(number 43)(value 01:03:00:A0:BC:14:44:01:00:02:01:03:11:05:00:44:00:44:07:00:43:00:43:01:01:02:01:03:06:07:01:BD:01:BD:01:01:02:01:07:00:87:00:88:01:01:02:01:06:C0:A8:64:00:18:07:00:16:00:17:01:01:02:01:03:11:06:C0:A8:64:00:18:07:00:A1:00:A1:19:01:01:21:01:01:26:38:68:74:74:70:3A:2F:2F:31:30:2E:34:33:2E:31:39:2E:31:38:3A:39:36:37:35:2F:6C:69:76:65:2F:43:50:45:4D:61:6E:61:67:65:72:2F:43:50:45:73:2F:67:65:6E:65:72:69:63:54:52:36:39:27:02:00:05:28:02:07:D0:36:01:FF:40:01:00)(option-definition-set-name ViasatUT))])) (6) update control { But this one is not, (15) if ( "%{control:Tmp-String-7}" =~ /vendor-options.*\(number 43\)\(value (([0-9a-fA-F]{2}:)*[0-9a-fA-F]{2})/ ) { (15) EXPAND %{control:Tmp-String-7} (15) --> ((ClassName Policy)(name client-policy:1,6,00:A0:BC:6C:7D:3A)(v4-reply-options [vendor-encapsulated-options])(vendor-options [((ClassName Option)(number 43)(value 01:03:00:A0:BC:02:09:55:54:00:00:00:00:00:00:07:03:0E:55:54:32:00:00:00:00:00:03:07:03:0A:00:09:04:11:55:54:5F:33:2E:37:2E:33:2E:31:30:2E:39:2E:62:69:6E:05:04:0A:4F:FF:0F:14:44:01:00:02:01:03:11:05:00:44:00:44:07:00:43:00:43:01:01:02:01:03:06:07:01:BD:01:BD:01:01:02:01:07:00:87:00:88:01:01:02:01:06:C0:A8:64:00:18:07:00:16:00:17:01:01:02:01:03:11:06:C0:A8:64:00:18:07:00:A1:00:A1:19:01:01:26:42:68:74:74:70:3A:2F:2F:61:63:73:2E:64:65:76:2E:63:6D:74:2E:76:69:61:73:61:74:2E:69:6F:3A:39:36:37:35:2F:6C:69:76:65:2F:43:50:45:4D:61:6E:61:67:65:72:2F:43:50:45:73:2F:67:65:6E:65:72:69:63:54:52:36:39:27:02:00:05:28:02:07:D0:2A:0E:55:54:2E:35:2E:32:2E:32:2E:31:30:35:30:33:2B:04:0A:4F:FF:0F:2C:0E:55:54:2E:35:2E:32:2E:32:2E:31:30:33:39:33:33:0C:55:54:32:00:00:00:00:00:00:00:29:08:36:01:FF:3B:0E:55:54:32:00:00:00:00:00:03:07:03:0A:00:09:3C:12:55:54:32:5F:33:2E:37:2E:33:2E:31:30:2E:39:2E:62:69:6E:3D:04:0A:4F:FF:0F:3E:3C:68:74:74:70:3A:2F:2F:31:30:2E:37:39:2E:32:35:35:2E:31:36:2F:70:75:62:2F:76:77:61:5F:69:6D:61:67:65:73:2F:76:77:61:5F:55:54:2E:35:2E:32:2E:32:2E:31:30:35:30:33:2E:74:61:72:2E:67:7A:3F:3C:68:74:74:70:3A:2F:2F:31:30:2E:37:39:2E:32:35:35:2E:31:36:2F:70:75:62:2F:76:77:61:5F:69:6D:61:67:65:73:2F:76:77:61:5F:55:54:2E:35:2E:32:2E:32:2E:31:30:33:39:33:2E:74:61:72:2E:67:7A:40:01:00)(option-definition-set-name ViasatUT))])) (15) ERROR: regex failed: regex evaluation failed with code (-27): <INVALID> (15) ERROR: Condition evaluation failed because the value of an operand could not be determined (15) ... (15) } Both are same conditions with different values in them. Why second one is not working? Regards, Nagamani Chinnapaiyan

3 5

Does freeRADIUS 3 support PostgreSQL 11
by Min Wang 11 Dec '19

11 Dec '19

Does freeRADIUS 3 support PostgreSQL 11? Best regards, Min Wang Global Data Services New York Stock Exchange An Intercontinental Exchange Company (NYSE: ICE) 11 Wall St. | New York, NY 10005 Tel: +1 212.656.2441 | Mob: +1 201.936.9888 Min.Wang(a)theice.com<mailto:Min.Wang@theice.com> [ice] [Intercontinental Exchange - email.png]<https://icespace.cpex.com/servlet/JiveServlet/showImage/102-61239-14-18333/…> ________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), its subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired.

3 9

Trying not to send outer identity in the Access-Accept message
by Torres López María Isabel 11 Dec '19

11 Dec '19

Dear Sir or Madam. Currently, we are running Freeradius 3.0.11. It works correctly with our wireless controler, but when we upgrade the firmware of our wireless controlles, the users are not able to stablish sesión anymore. The problem is that the freeradius is sending two User-Name values in the Access-Accept packet (the inner and the outer identity), and the Wireless controler detects two values and drops the packet. The authentication is correct, but the Wireless controller does not stablish the user sesión. Besides, as the Freeradius sends both identities, sometimes the accountings shows the outer identity, not the inner one. ¿Is there any way to send only the inner identity in the Access-Accept packet? (6) Login OK: [pruebas.wifi(a)uah.es] (from client WLAN-1 port 0 cli B49D0B8C389F via TLS tunnel) (6) } # server inner (6) Virtual server sending reply (6) User-Name = "pruebas.wifi(a)uah.es" (6) Class = 0x414c554d4e4f53 (6) Filter-Id = "ALUMNOS" (6) eap_ttls: Got tunneled Access-Accept (6) eap: Sending EAP Success (code 3) ID 8 length 4 (6) eap: Freeing handler (6) [eap] = ok (6) } # authenticate = ok (6) Login OK: [anonymous(a)uah.es] (from client WLAN-1 port 0 cli B49D0B8C389F) (6) Sent Access-Accept Id 56 from 192.168.153.175:1812 to 172.17.47.240:37462 length 0 (6) User-Name = "anonymous(a)uah.es" (6) User-Name = "pruebas.wifi(a)uah.es" (6) Class = 0x414c554d4e4f53 (6) Filter-Id = "ALUMNOS" (6) MS-MPPE-Recv-Key = 0x567a04806953128ea5aadb908f6728a6753794d66a6ec189964c4f2e54cfb15b (6) MS-MPPE-Send-Key = 0x068df56d4605c2a4b62e8f4eee3fdb12031bdebf9eaa4201d6d08b310246d6d4 (6) EAP-Message = 0x03080004 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) Finished request Best regards. Mª Isabel Torres López Comunicaciones - Servicios Informáticos Universidad de Alcalá Correo: Isabel.torres(a)uah.es<mailto:Isabel.torres@uah.es> Telefono: 918856458

2 1