September 2019 - Freeradius-Users - lists.freeradius.org

eap type for Windows client authentication without certificate
by Tal Nur 13 Sep '19

13 Sep '19

Hi All, I think I'm asking simple question.I installed FR 3.0.19 for eduroam and I used configuration files from eduroam.org.I noticed that my Windows clients must install CA certificate to successfully log in.My question is what type our EAP I should to use to allow them be authenticated without certificate?Is it possible to use both types of authentication at the same time? Here is my eap file: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = QwerAsdf1992! private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } mschapv2 { } }

2 2

Freeradius, building from sources using unixodbc-dev not libiodbc2-dev package.
by CpServiceSPb . 12 Sep '19

12 Sep '19

I plan to install Asterisk and Freeradius at teh same Ubuntu server, that is to build from sources. But there is dependency conflict. Asterisk needs unixodbc-dev for correctly working with DBs, as Freeradius requires libiodbc2-dev. And it conflicts each other. Is it possible to make Freeradius with unixodbc-dev without functionality lacking ? Or it is not and is libiodbc2-dev only required ?

2 1

How to send a challenge request via PEAP-GTC
by ngoetz24＠gmail.com 11 Sep '19

11 Sep '19

Is it possible to send a challenge response to a user asking them to enter a OPT (One Time Password) token using PEAP with GTC? I have followed the documentation example and got this working with PAP, but our security team will not allow us to use PAP due to security concerns with the week encryption used by PAP. I also tried to do this via EAP-TTLS, but when I posted the issue I was having, I was informed that EAP-TTLS has a fixed packet flow, and that I should use EAP-GTS in the inner tunnel. I am trying to do this now, but I am obviously doing something wrong. I am trying to follow the documentation, but I could not find any examples of sending a challenge via PEAP with GTC. Is this even possible, or is PAP the only way to send a challenge request to the user? The problem I seem to be having is that when I use "challenge" in the authenticate section of the inner-tunnel configuration it seems to break the tunnel. When I do this I get the following error message in the debug: eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed. My guess is that I am trying to do the challenge from the wrong location in the configuration, but I am not sure where the proper place is. My inner-tunnel is configured as follows: server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { filter_username chap mschap suffix update control { &Proxy-To-Realm := LOCAL } eap { ok = return } files pap } authenticate { Auth-Type PAP { pap } Auth-Type MSCHAP { mschap } mschap Auth-Type ntlm_auth { ntlm_auth if (ok) { update reply { # Create a random State attribute: State := "%{randstr:aaaaaaaaaaaaaaaa}" Reply-Message := "Please enter OTP" } # Return Access-Challenge: challenge } } eap } session { radutmp } post-auth { if (0) { update reply { User-Name !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY } update { &outer.session-state: += &reply: } } Post-Auth-Type REJECT { -sql attr_filter.access_reject update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } pre-proxy { } post-proxy { eap } } Here is a copy of the section of the debug where it seems to break: (18) eap_peap: Continuing EAP-TLS (18) eap_peap: Peer indicated complete TLS record size will be 42 bytes (18) eap_peap: Got complete TLS record (42 bytes) (18) eap_peap: [eaptls verify] = length included (18) eap_peap: [eaptls process] = ok (18) eap_peap: Session established. Decoding tunneled attributes (18) eap_peap: PEAP state phase2 (18) eap_peap: EAP method GTC (6) (18) eap_peap: Got tunneled request (18) eap_peap: EAP-Message = 0x020800110643306b3343306b3331323334 (18) eap_peap: Setting User-Name to test-user (18) eap_peap: Sending tunneled request to inner-tunnel (18) eap_peap: EAP-Message = 0x020800110643306b3343306b3331323334 (18) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (18) eap_peap: User-Name = " test-user " (18) eap_peap: State = 0x48f270f749fa76fc54bf6bce0580ffa4 (18) eap_peap: Framed-MTU = 1200 (18) eap_peap: Service-Type = Framed-User (18) eap_peap: NAS-Identifier = "Test" (18) eap_peap: NAS-IP-Address = 151.143.16.5 (18) eap_peap: Event-Timestamp = "Sep 11 2019 10:09:42 PDT" (18) Virtual server inner-tunnel received request (18) EAP-Message = 0x020800110643306b3343306b3331323334 (18) FreeRADIUS-Proxied-To = 127.0.0.1 (18) User-Name = " test-user " (18) State = 0x48f270f749fa76fc54bf6bce0580ffa4 (18) Framed-MTU = 1200 (18) Service-Type = Framed-User (18) NAS-Identifier = "Test" (18) NAS-IP-Address = 151.143.16.5 (18) Event-Timestamp = "Sep 11 2019 10:09:42 PDT" (18) server inner-tunnel { (18) session-state: No cached attributes (18) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (18) authorize { (18) policy filter_username { (18) if (&User-Name) { (18) if (&User-Name) -> TRUE (18) if (&User-Name) { (18) if (&User-Name =~ / /) { (18) if (&User-Name =~ / /) -> FALSE (18) if (&User-Name =~ /@[^@]*@/ ) { (18) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (18) if (&User-Name =~ /\.\./ ) { (18) if (&User-Name =~ /\.\./ ) -> FALSE (18) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (18) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (18) if (&User-Name =~ /\.$/) { (18) if (&User-Name =~ /\.$/) -> FALSE (18) if (&User-Name =~ /(a)\./) { (18) if (&User-Name =~ /(a)\./) -> FALSE (18) } # if (&User-Name) = notfound (18) } # policy filter_username = notfound (18) [chap] = noop (18) [mschap] = noop (18) suffix: Checking for suffix after "@" (18) suffix: No '@' in User-Name = " test-user ", looking up realm NULL (18) suffix: No such realm "NULL" (18) [suffix] = noop (18) update control { (18) &Proxy-To-Realm := LOCAL (18) } # update control = noop (18) eap: Peer sent EAP Response (code 2) ID 8 length 17 (18) eap: No EAP Start, assuming it's an on-going EAP conversation (18) [eap] = updated (18) [files] = noop (18) [pap] = noop (18) } # authorize = updated (18) Found Auth-Type = eap (18) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (18) authenticate { (18) eap: Expiring EAP session with state 0x48f270f749fa76fc (18) eap: Finished EAP session with state 0x48f270f749fa76fc (18) eap: Previous EAP request found for state 0x48f270f749fa76fc, released from the list (18) eap: Peer sent packet with method EAP GTC (6) (18) eap: Calling submodule eap_gtc to process data (18) eap_gtc: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (18) eap_gtc: Auth-Type ntlm_auth { (18) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=EDD_LOCAL --username=%{mschap:User-Name} --password=%{User-Password}: (18) ntlm_auth: EXPAND --username=%{mschap:User-Name} (18) ntlm_auth: --> --username= test-user (18) ntlm_auth: EXPAND --password=%{User-Password} (18) ntlm_auth: --> --password=Test-Password (18) ntlm_auth: Program returned code (0) and output 'NT_STATUS_OK: The operation completed successfully. (0x0)' (18) ntlm_auth: Program executed successfully (18) [ntlm_auth] = ok (18) if (ok) { (18) if (ok) -> TRUE (18) if (ok) { (18) update reply { (18) EXPAND %{randstr:aaaaaaaaaaaaaaaa} (18) --> 96SQAtQhOkKcI9Gb (18) State := 0x39365351417451684f6b4b6349394762 (18) Reply-Message := "Please enter OTP" (18) } # update reply = noop (18) policy challenge { (18) update control { (18) &Response-Packet-Type = Access-Challenge (18) } # update control = noop (18) [handled] = handled (18) } # policy challenge = handled (18) } # if (ok) = handled (18) } # Auth-Type ntlm_auth = handled (18) eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed (18) eap: Sending EAP Failure (code 4) ID 8 length 4 (18) eap: Failed in EAP select (18) [eap] = invalid (18) } # authenticate = invalid (18) Failed to authenticate the user (18) Using Post-Auth-Type Reject (18) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (18) Post-Auth-Type REJECT { (18) attr_filter.access_reject: EXPAND %{User-Name} (18) attr_filter.access_reject: --> test-user (18) attr_filter.access_reject: Matched entry DEFAULT at line 11 (18) [attr_filter.access_reject] = updated (18) update outer.session-state { (18) &Module-Failure-Message := &request:Module-Failure-Message -> 'eap: Failed continuing EAP GTC (6) session. EAP sub-module failed' (18) } # update outer.session-state = noop (18) } # Post-Auth-Type REJECT = updated (18) } # server inner-tunnel (18) Virtual server sending reply (18) Reply-Message := "Please enter OTP" (18) EAP-Message = 0x04080004 (18) Message-Authenticator = 0x00000000000000000000000000000000 (18) eap_peap: Got tunneled reply code 3 (18) eap_peap: Reply-Message := "Please enter OTP" (18) eap_peap: EAP-Message = 0x04080004 (18) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (18) eap_peap: Got tunneled reply RADIUS code 3 (18) eap_peap: Reply-Message := "Please enter OTP" (18) eap_peap: EAP-Message = 0x04080004 (18) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (18) eap_peap: Tunneled authentication was rejected (18) eap_peap: FAILURE (18) eap: Sending EAP Request (code 1) ID 9 length 46 (18) eap: EAP session adding &reply:State = 0xaa5507c9a25c1ecd (18) [eap] = handled (18) } # authenticate = handled (18) Using Post-Auth-Type Challenge (18) Post-Auth-Type sub-section not found. Ignoring. (18) # Executing group from file /etc/raddb/sites-enabled/default (18) session-state: Saving cached attributes (18) Module-Failure-Message := "eap: Failed continuing EAP GTC (6) session. EAP sub-module failed" (18) Sent Access-Challenge Id 8 from 151.143.230.42:1812 to 151.143.16.5:48021 length 0 (18) EAP-Message = 0x0109002e19001703030023c75c4bff687aa6d3f1bdb96e186b084df07da99dd0cc0c16b678 094cb04ef7d6fee216 (18) Message-Authenticator = 0x00000000000000000000000000000000 (18) State = 0xaa5507c9a25c1ecdfce0263177f07a1c (18) Finished request

2 5

Log file format
by John Horne 11 Sep '19

11 Sep '19

Hello, I can see in our 'radius.log' file entries such as: ====== Wed Sep 11 17:33:27 2019 : Auth: (1746809) Login OK: [snipped] Wed Sep 11 17:33:28 2019 : Auth: (1746811) Login incorrect (Home Server says so): [snipped] ====== My question is what are the numbers 1746809 and 1746811? They are too small to be an epoch time, and as a number of seconds don't correspond to the server uptime. Thanks, John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

2 1

Cache errors(?) - single device
by Marcin Marszałkowski 11 Sep '19

11 Sep '19

Hi, I have freeradius 3.0.20 with tls cache enabled (fast reauthentication) running in docker container , sql backend. Everything has been working fine until recently new device (laptop) was added to network. Laptop connects properly to specified network but when roaming it gets answer Access-Accept without any AVP, thus it is assigned to native, trunk network. Since it applies only to one device (MacBook Pro) and debug doesn’t throw any errors I don’t know where to start troubleshooting. I’d removed content of tlscache folder, toggled off/on cache and it didn’t help. Any suggestion? Martin

3 14

Accounting Requests originating from FreeRADIUS
by mufid ay 11 Sep '19

11 Sep '19

Hi there, We have a few Wireless Access Points that support RADIUS authentication only. They won't send out any accounting requests. And we are using FreeRADIUS to proxy authentication requests. I was wondering if we can get FreeRADIUS to send out accounting requests on behalf of Access Points. This will need to be after Access Accept message is received. Is that possible? Is there any configuration examples? thanks.

2 1

Is it possible to automate a Disconnect-Request based on exceeded Monthly-Usage?
by Houman 10 Sep '19

10 Sep '19

Hello, I have setup the FreeRadius like the following to prevent a user from logging in after his monthly usage has been exceeded. echo 'ATTRIBUTE Monthly-Usage 3001 integer64' >> /etc/freeradius/3.0/dictionary sed -i '/authorize {/a\ update request {\ Monthly-Usage = "%{sql:SELECT COALESCE((SUM(`acctoutputoctets`)), 0) FROM radacct WHERE `username`='"'"'%{User-Name}'"'"' AND Month(acctupdatetime)=(Month(NOW())) AND Year(acctupdatetime)=Year(NOW())}"\ }\ ' /etc/freeradius/3.0/sites-enabled/default INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('houman','Monthly-Usage','<',10000); While this works fine, the user won't be disconnected after the monthly-usage has been exceeded. Instead only if the user disconnects voluntarily and tries to reconnect again would he be prevented. So I'm trying to find a way to disconnect the user the moment his limit has been reached. After some research I have come across Dynamic Authorization extension and have enabled it like this: *dae {* * enable = yes * * listen = 0.0.0.0 * * port = 3799 * * secret = secret123 * *}* Now I can disconnect myself from the command line, like this: *echo User-Name=houman | radclient -x 127.0.0.1:3799 <http://127.0.0.1:3799> disconnect ''secret123''* That's very nice. So I could run a Python script via a crontab job to check every minute to see which users have exceeded their monthly-usage and disconnect them. But I was wondering if there is a way to automate the disconnect directly via free radius so that I don't have to run the crontab job. Is there a way that I'm overlooking? Many Thanks, Houman

3 2

Problem with LDAP queries
by edson luiz 09 Sep '19

09 Sep '19

I currently have a freeradius + LDAP server, I'm having a big problem, authentication works inconsistently, even for valid users with correct credentials, there are times when the user authenticates and at times not, the error is displayed: (11) ldap: ERROR: Bind with uid = test, or = wifi, dc = test, dc = org to ldap: //X.X.X.X failed: Other (e.g., implementation specific) error (11) ldap: ERROR: Server said: Failure authenticating with password. The curious thing is that the problem only occurs in the authentication phase, I captured and analyzed the traffic of queries and strangely the information goes incorrect, it uses information from another user (one of the last connections), mixing everything, I think this is the problem, but I don't know what is causing it. * information like server DN and IP has been modified

3 3

Users vs Groups attribute
by Marcin Marszałkowski 08 Sep '19

08 Sep '19

Hi, I have set a few attributes in Groups and as far as I have seen, attribute defined there overrides (same) attribute if is defined in user’s profile. Is there any way to make it working the other way around - user’s attribute would override group’s attribute? Regards Martin

2 2

Python Module Threading Issue
by Kwak Wookjong 07 Sep '19

07 Sep '19

Hi Alan, I recently upgraded FreeRadius server 3.0.16 to 3.0.19 and observed a performance issue on handling multiple thread. I have done some research on this forum and found below discussion for Python Module Threading Issue about a year ago. http://freeradius.1045715.n5.nabble.com/Python-Module-Threading-Issue-td575…<http://freeradius.1045715.n5.nabble.com/Python-Module-Threading-Issue-td575…> As a result of the discussion, it made one of the configuration value changed in rlm_python/rlm_pyton.c (line #1180) for 3.0.18 release. https://github.com/FreeRADIUS/freeradius-server/commit/9a9e7852e52cab5323df…<https://github.com/FreeRADIUS/freeradius-server/commit/9a9e7852e52cab5323df…> module_t rlm_python = { .magic = RLM_MODULE_INIT, .name = "python", - .type = RLM_TYPE_THREAD_SAFE, + .type = RLM_TYPE_THREAD_UNSAFE, and it looked like the change was made in case for using multiple python modules but the thing is, in my case, within a single python module the multiple requests were treated as a single threaded. I have confirmed such behavior with a simple test with using python module and example code provided in /etc/raddb/mods-config/python/example.py by putting few seconds of delay for authenticate. def authenticate(p): print "*** authenticate ***" time.sleep(5) return radiusd.RLM_MODULE_OK Also confirmed, by putting back RLM_TYPE_THREAD_SAFE, multiple requests were handled by multi-threaded and the performance issue was resolved. If it were needed to update RLM_TYPE_THREAD_UNSAFE for using multiple python module, Can you, at least, make it configurable so that it can be set depending on the usage and situation? Let me know, Thanks! Best Regards, wj ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 1