February 2019 - Freeradius-Users - lists.freeradius.org

Trouble Getting Mac-Auth to Work
by Seth Turner 07 Feb '19

07 Feb '19

I'm new to FreeRadius, but have managed to get LDAP authentication working properly. Now I am trying to add in mac-auth as well for certain devices, but all devices are being rejected when they connect to the SSID regardless if the MAC is in the file. Based on what I am seeing, the calling-station-Id is being rewritten to the proper format, which matches what I have in the mac file, but RADIUS still rejects the connection. Can somebody help direct me as to what the issue may be? *NOTE: The end goal is actually to block certain MAC's from connecting to an SSID, which is why the file is called blocked_macs instead of authorized_mac like the documentation. I'm just trying to follow the guide for mac_auth atm before I try using it to restrict by MAC.* This is what I have under the Authorize section of default.conf. * preprocess* * # If cleaning up the Calling-Station-Id...* * rewrite_calling_station_id* * # Now check against the blocked_macs file* * blocked_macs* * if (!ok) {* * # No match was found, so reject* * reject* * }* * else {* * # The MAC address was found, so update Auth-Type* * # to accept this auth.* * update control {* * Auth-Type := Accept* * }* * }* This is what I get while running radiusd -X. Hopefully that is the proper logging needed for troubleshooting. *(0) [preprocess] = ok* *(0) policy rewrite_calling_station_id {* *(0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {* *(0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE* *(0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {* *(0) update request {* *(0) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}* *(0) --> 60-D8-19-D4-F0-83* *(0) &Calling-Station-Id := 60-D8-19-D4-F0-83* *(0) } # update request = noop* *(0) [updated] = updated* *(0) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated* *(0) ... skipping else: Preceding "if" was taken* *(0) } # policy rewrite_calling_station_id = updated* *(0) blocked_macs: EXPAND %{Calling-Station-ID}* *(0) blocked_macs: --> 60-D8-19-D4-F0-83* *(0) [blocked_macs] = noop* *(0) if (!ok) {* *(0) if (!ok) -> TRUE* *(0) if (!ok) {* *(0) [reject] = reject* *(0) } # if (!ok) = reject* *(0) } # authorize = reject* *(0) Using Post-Auth-Type Reject* -- *Seth Turner*Gasconade County R-2 School District Network Manager OHS Hunting and Fishing Club Sponsor Phone (573)-437-2172

2 2

Proxy-tester nagios check for Freeradius
by Fekete Tamás 06 Feb '19

06 Feb '19

Hello! I would like to make a proxy-tester Nagios check for Freeradius and would like to ask some help for debugging as I experience some problem with using eapol_test. The design is that a user wants to authenticate at realm "A" with credentials stored at realm "B". The infrastructure already set up for proxying based on the realm names and the Access-Requests are do forwarded. I tried this proxy scenario with radtest. And with radtest it works. However, I have some questions regarding this developer work. Maybe you can help me. The first is: is it true, that radtest doesn't encrypt it's messages so proxy requests will contain the password in a recoverable manner? - Tamas Fekete

2 2

Improve IO wait
by Sajad Tahernejad 06 Feb '19

06 Feb '19

Hi all, I'm installed freeradius on vps with this details 2 Core CPU - 4G RAM - HDD 100G 10k I see iowaot always +25% I see disk IO is +3MB/s with mysql I have about 200 users online. How can improve performance for iowait. Thanks. Regards

2 3

Meaning of zero queue size in a Freeradius prod environment
by Fekete Tamás 05 Feb '19

05 Feb '19

Hello! I would like to develop a Nagios check for Freeradius which periodically checks the queue. My idea it to use radclient with statistics type 16 (or similar) and grep out the useful informations. I queried our prod server which handles about 3000-5000 requests in a minute and got a result that the queue is zero: [root@radius1 sites-enabled]# echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 16, Response-Packet-Type = Access-Accept" | radclient -x localhost:18121 status <somethingpass> Sent Status-Server Id 230 from 0.0.0.0:37413 to 127.0.0.1:18121 length 50 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = Internal Response-Packet-Type = Access-Accept Received Access-Accept Id 230 from 127.0.0.1:18121 to 0.0.0.0:0 length 128 FreeRADIUS-Stats-Start-Time = "Feb 4 2019 08:33:06 CET" FreeRADIUS-Stats-HUP-Time = "Feb 4 2019 08:33:06 CET" FreeRADIUS-Queue-Len-Internal = 0 FreeRADIUS-Queue-Len-Proxy = 0 FreeRADIUS-Queue-Len-Auth = 0 FreeRADIUS-Queue-Len-Acct = 0 FreeRADIUS-Queue-Len-Detail = 0 FreeRADIUS-Queue-PPS-In = 0 FreeRADIUS-Queue-PPS-Out = 0 I am asking just for the sure understanding. Does Freeradius show me zero values regardless of the load because the operation of the program is so quick and all the requests are handled less than a second so it is hard to catch a queue value different than 0? - Tamas Fekete

2 2

New member of FreeRADIUS
by Alan DeKok 04 Feb '19

04 Feb '19

This is a short message announcing that we (Network RADIUS) have hired Jorge Pereira as a full-time person working on FreeRADIUS. He has contributed to FreeRADIUS in the past, and we're looking forward to more contributions from him in the future. He will largely be working on updating the documentation for version 4. And also miscellaneous bug fixes, features, etc. as needed. Alan DeKok.

1 0

How to Authorize group from AD
by Maicon Luis 04 Feb '19

04 Feb '19

Hello people, I’m newcomer here as well as on freeradius. I have a environment with Radius integrated with Active directory so I can login on Cisco’s Switches with AD account. All it’s working but I should like give privilege 15 for users that login. I have done the follow lines on “user” file user1 Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = Yes When user1 do login on cisco switch he need type “enable” more local password for enable instead your password from Active Directory I should like when user “user1” login on Cisco Switch and type enable he earn privileges 15 directly without any password or your password from AD instead local enable password. What I have to do for reach this ? I’m using freeradius 3.0 Thanks.

4 3

Re: Problem with MSCHAP when migrating from freeradius2 to freeradius3
by koehne 04 Feb '19

04 Feb '19

Hi Alan, thanks for your quick response. > Which should be clear. The server is unable to get the Cleartext-Password from LDAP. As such, it can't do MS-CHAP. >> Do you mean, I shall get back the password from LDAP in Cleartext form?? Our eDir sends it in a hashed form. It works so with freeradius2 for years. > Read what you've done to the "inner-tunnel" virtual server, >> I´ve gone through this module several times in the last weeks and have no further idea ... and ask yourself: "Where is Cleartext-Password supposed to be coming from?" >> this is exactly what I´m asking myself ... with no clear answer and idea what to change. Sorry, I´m no Server-, Freeradius- or Linux-Expert. Normally I´m working with Network-Devices, but now trying to migrate a very old freeradius installation, because there´s no other person in our office able to do this. Thanks for your patience. Regards Ronald

1 0

Problem with MSCHAP when migrating from freeradius2 to freeradius3
by koehne 04 Feb '19

04 Feb '19

Hello, I´ve now spent so much time on troubleshooting, testing and searching for hints in the internet, I hope someone here from this mailing-list can support me. We are using freeradius to authenticate CLI-Access to Network-Devices, VPN-Access and WLAN-Access. As User-Database we are using Novell eDirectory via LDAP. I want to migrate from freeradius2 to freeradius3 on a new server. I´ve allready succeeded with migrating Network-CLI- and VPN-Access, however WLAN-Access is not working. These are the significant messages from the DEBUG saying "*mschap: No Cleartext-Password configured*". ... Executing group from file /etc/raddb/sites-enabled/inner-tunnel Fri Feb 1 10:18:31 2019 : Debug: (8) eap_mschapv2: authenticate { Fri Feb 1 10:18:31 2019 : Debug: (8) eap_mschapv2: modsingle[authenticate]: calling mschap (rlm_mschap) *Fri Feb 1 10:18:31 2019 : WARNING: (8) mschap: No Cleartext-Password configured. Cannot create NT-Password Fri Feb 1 10:18:31 2019 : WARNING: (8) mschap: No Cleartext-Password configured. Cannot create LM-Password* Fri Feb 1 10:18:31 2019 : Debug: (8) mschap: Creating challenge hash with username: koehne Fri Feb 1 10:18:31 2019 : Debug: (8) mschap: Client is using MS-CHAPv2 Fri Feb 1 10:18:31 2019 : ERROR: (8) mschap: FAILED: No NT/LM-Password. Cannot perform authentication ... Enclosed is a full debug. I´ve compared "old" and "new" configuration of the relevant modules several times and adapted the necessary changes in the configuration from freeradius2 to freeradius3. Here are the configs of the virtual-server and the ldap module: server mdwwlan { listen { .... } } authorize { filter_username preprocess auth_log detail suffix files -ldap eap { ok = return } Autz-Type LDAP { mdwacc_wlan mschap update { &MS-CHAP-User-Name := "%{mschap:User-Name}" } } } authenticate { Auth-Type MSCHAP { mschap } eap } } ldap mdwacc_wlan { server = "ldap.mdw.ac.at" port = 636 identity = "cn=ldap_radius,o=MDWds" password = frtz56uit33 basedn = "o=MDWds" access_attr = "mdwaccAllowwlan" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" update { control:NT-Password := 'mdwaccPwwlan' } edir_autz = yes user { basedn = "o=MDWds" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' access_attr = 'mdwaccAllowwlan' } group { basedn = "o=MDWds" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' membership_attribute = 'radiusGroupName' } options { timeout = 4 srv_timelimit = 3 net_timeout = 1 } tls { start_tls = no } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} uses = 0 lifetime = 0 } } And the "users" File: DEFAULT Huntgroup-Name == WISM, Autz-Type := LDAP Fall-Through = yes Do you have any hints for me, what could be missing or wrong in my configuration of version 3? Thank You!! Best Regards Ronald

2 1

FR3 odd log indentation
by Diggins Mike 02 Feb '19

02 Feb '19

Just started logging wireless authentications to my FR3 server today and noticed a couple changes from FR2. Two questions, what does the value in the brackets () represent and what's with the odd indentation on the Login OK lines. This is the way it appears in my syslog. Feb 1 09:22:41 frsrv3 radiusd[14322]: (10) Login OK: [nettest] (from client IPSentry port 0) Feb 1 09:25:59 frsrv3 radiusd[14322]: (42) Login OK: [user1] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:25:59 frsrv3 radiusd[14322]: (43) Login OK: [user1] (from client WLC-TEST port 13 cli 94-65-2d-6c-94-82) Feb 1 09:26:19 frsrv3 radiusd[14322]: (57) Login OK: [user2] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:19 frsrv3 radiusd[14322]: (58) Login OK: [user2] (from client WLC-TEST port 13 cli 58-e6-ba-45-66-c7) Feb 1 09:26:21 frsrv3 radiusd[14322]: (72) Login OK: [user3] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:21 frsrv3 radiusd[14322]: (73) Login OK: [user3] (from client WLC-TEST port 13 cli b8-d7-af-05-d3-5d) Feb 1 09:26:24 frsrv3 radiusd[14322]: (87) Login OK: [user4] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:24 frsrv3 radiusd[14322]: (88) Login OK: [user4] (from client WLC-TEST port 13 cli 58-e6-ba-45-66-c7) Feb 1 09:26:34 frsrv3 radiusd[14322]: (102) Login OK: [user4] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:34 frsrv3 radiusd[14322]: (103) Login OK: [user4] (from client WLC-TEST port 13 cli 58-e6-ba-45-66-c7) Feb 1 09:27:23 frsrv3 radiusd[14322]: (117) Login OK: [user5] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:27:23 frsrv3 radiusd[14322]: (118) Login OK: [user5] (from client WLC-TEST port 13 cli a4-5e-60-d5-01-d5) Feb 1 09:27:42 frsrv3 radiusd[14322]: (132) Login OK: [user6] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:27:42 frsrv3 radiusd[14322]: (133) Login OK: [user6] (from client WLC-TEST port 13 cli 20-2d-07-03-01-34) -Mike

3 3

Historic connection error
by Leonardo Piña 01 Feb '19

01 Feb '19

I have migrated from FreeRadius 2 to FreeRadius 3, and I found the novelty that when carrying the production DB of version 2 does not work correctly in version 3, the amount in FreeRadius 3 stops saving the connection information

2 1