January 2020 - Freeradius-Users - lists.freeradius.org

Access-Accept but condition isn't correct
by Marcin Romanowski 26 Jan '20

26 Jan '20

Hello, I'd like to check mac condition with ISG cisco. in users file: 192.168.10.100 Cleartext-Password := "cisco", *Calling-Station-Id := "00:50:79:66:68:01"* Cisco-Service-info = "QU;200000;D;600000", Cisco-Avpair += 'subscriber:accounting-list=BRAS', Cisco-Avpair += 'subscriber:keepalive=interval 10', Cisco-Avpair += 'subscriber:idle-timeout-direction=inbound' debug: (0) Received Access-Request Id 60 from 1.1.1.3:1645 to 1.1.1.2:1812 length 135 (0) User-Name = "192.168.10.100" (0) User-Password = "cisco" (0) Framed-IP-Address = 192.168.10.100 (0) *Calling-Station-Id = "00:50:79:66:68:00"* (0) NAS-Port-Type = Virtual (0) NAS-Port = 0 (0) NAS-Port-Id = "0/0/0/0" (0) Service-Type = Outbound-User (0) NAS-IP-Address = 1.1.1.3 (0) Acct-Session-Id = "00000FDE" (0) NAS-Identifier = "ASR_1" (0) Event-Timestamp = "Jan 26 2020 18:54:55 UTC" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "192.168.10.100", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry 192.168.10.100 at line 37 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 60 from 1.1.1.2:1812 to 1.1.1.3:1645 length 0 (0) Cisco-Service-Info = "QU;200000;D;600000" (0) Cisco-AVPair = "subscriber:accounting-list=BRAS" (0) Cisco-AVPair = "subscriber:keepalive=interval 10" (0) Cisco-AVPair = "subscriber:idle-timeout-direction=inbound" (0) Finished request Calling-Station-Id is different than in config but i get Access-Accept. Where I'm doing wrong? Best Regards Marcin

1 1

How to deal with switches not sending User-Password attribute for MAC-based authentication
by Martin Gignac 25 Jan '20

25 Jan '20

Hi, I'm setting up wired 802.1x authentication for Juniper and Ubiquiti switches. Each device supports supplicant-based authentication and can fall back to MAC-based authentication. When using the Juniper, if it falls back to MAC-based authentication it sends an Access-Request with User-Name and User-Password attributes that both contain the MAC address of the device connecting to the switch, such as "e6e849A201e8". However, when the Ubiquiti falls back to MAC-based auth the Access-Request it sends only contains the User-Name attribute. Since my sites-enabled/default file contains: if (User-Password) { update control { Auth-Type := rest } } in the authorize section, REST authentication is completely skipped. I then tried adding: if (&NAS-Port-Type == "Ethernet" && !User-Password) { update control { User-Password = &User-Name Auth-Type := rest } } right on top of the previous section, but then I get this: (1) if (&NAS-Port-Type == "Ethernet" && !User-Password) { (1) if (&NAS-Port-Type == "Ethernet" && !User-Password) -> TRUE (1) if (&NAS-Port-Type == "Ethernet" && !User-Password) { (1) update control { (1) User-Password = &User-Name -> 'E6E849A201E8' (1) Auth-Type := rest (1) } # update control = noop (1) } # if (&NAS-Port-Type == "Ethernet" && !User-Password) = noop (1) if (User-Password) { (1) if (User-Password) -> FALSE (1) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (1) pap: WARNING: !!! Ignoring control:User-Password. Update your !!! (1) pap: WARNING: !!! configuration so that the "known good" clear text !!! (1) pap: WARNING: !!! password is in Cleartext-Password and NOT in !!! (1) pap: WARNING: !!! User-Password. !!! (1) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = rest (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) authenticate { (1) rest: ERROR: You set 'Auth-Type = REST' for a request that does not contain a User-Password attribute! (1) [rest] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject So I changed it to this: if (&NAS-Port-Type == "Ethernet" && !User-Password) { update control { Cleartext-Password = &User-Name Auth-Type := rest } } (2) if (&NAS-Port-Type == "Ethernet" && !User-Password) { (2) if (&NAS-Port-Type == "Ethernet" && !User-Password) -> TRUE (2) if (&NAS-Port-Type == "Ethernet" && !User-Password) { (2) update control { (2) Cleartext-Password = &User-Name -> 'E6E849A201E8' (2) Auth-Type := rest (2) } # update control = noop (2) } # if (&NAS-Port-Type == "Ethernet" && !User-Password) = noop (2) if (User-Password) { (2) if (User-Password) -> FALSE (2) pap: WARNING: Auth-Type already set. Not setting to PAP (2) [pap] = noop (2) } # authorize = updated (2) Found Auth-Type = rest (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (2) authenticate { (2) rest: ERROR: You set 'Auth-Type = REST' for a request that does not contain a User-Password attribute! (2) [rest] = invalid (2) } # authenticate = invalid (2) Failed to authenticate the user (2) Using Post-Auth-Type Reject Am I approaching the problem in a wrong way? What would be the best way to deal with the lack of the User-Password attribute? Thanks, -Martin

3 9

Ignoring request to authentication address
by Júlíus Þór Bess Ríkharðsson 23 Jan '20

23 Jan '20

Hi, I have been running FreeRADIUS 2 for quite a while and decided to upgrade to a later version, it went from 2.1.12 to 2.2.6, after the upgrade I get an error like the client isn't defined but it surely is and it's read from the "nas" table in SQL. Ignoring request to authentication address * port 1812 from unknown client 10.10.10.100 port 56010 rlm_sql (sql): Read entry nasname=10.10.10.100,shortname=CISCOWL01,secret=xxxxxxxxx rlm_sql (sql): Adding client 10.10.10.100 (CISCOWL01, server=wifi-vserver) to clients list radmin> show client list 10.10.10.100 Do you know of any changes that were made between these versions might have caused this? Kærkveðja / best regards Júlíus Þór

2 1

Ignoring request to auth address *
by James Ngo 23 Jan '20

23 Jan '20

Hello everyone, I am newbie with Freeradius so hopefully, you could extend your patience with my question I setup FreeRadius server on Ubuntu 18.04. Update and everything went OK. Setup the client and user all OK But when I try to connect to the network from my iPhone, it keep saying password is incorrect. In the sudo freeradius -X, the status keeps saying ----Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.x.xxx port xxxxx ---- I have allowed the ufw as sudo ufw allow 1812/tcp sudo ufw allow 1813/tcp sudo ufw allow 1812/udp sudo ufw allow 1813/udp My user setup format is as in the "users" file username Cleartext := "password123" My Client is the Access point, as in the "client.conf" file Client AP { ipaddr = 192.168.x.xxx secret = test111 } Any idea what I am missing in here?

3 5

Simple use of Huntgroup
by Condor 23 Jan '20

23 Jan '20

Hi there, i running FreeRadius 3.0.4, now i trying to discriminate some access for specific user by groups (huntgroup) For example: /etc/raddb/huntgroups grp001 NAS-IP-Address == x.x.x.x grp002 NAS-IP-Address == y.y.y.y /etc/raddb/users test002 Crypt-Password := "$1$lw0fSZNF$yggOS9C8fjoPpDZSRv6g4." Huntgroup-Name == grp002 Reply-Message = "Hello Test002", test001 Crypt-Password := "$1$Z71rzgee$Z62hAIPIJbcaMDyHtUtKN/" Huntgroup-Name == grp001 Reply-Message = "Hello Test001", So, must to permit test001 only access to grp001 and test002 to grp002 Not working and with "radius -X" and see nothing about huntgroup. I missing enable something? I only see documentation about Huntgroup and SQL Thanks

2 1

ssha passwords openldap problem
by Сергей Черевко 23 Jan '20

23 Jan '20

Hi, i have VPN mikrotik server → freeradius → openldap I have plaintext passwords for users in ldap. And all it’s okay. I encrypted users passwords in SSHA and my VPN don’t working Logs from freeradius (5) ldap: Performing search in "ou=people,dc=fusioncore,dc=local" with filter "(uid=scherevko)", scope "sub" (5) ldap: Waiting for search result... (5) ldap: User object found at DN "uid=scherevko,ou=people,dc=fusioncore,dc=local" (5) ldap: Processing user attributes (5) ldap: control:Password-With-Header += '{SSHA}y11iufAi/kWir/t/5npxER+fpUYSroNSr0VM4Q==' rlm_ldap (ldap): Released connection (11) (5) [ldap] = updated (5) [expiration] = noop (5) [logintime] = noop (5) pap: Converted: &control:Password-With-Header -> &control:SSHA1-Password (5) pap: Removing &control:Password-With-Header (5) pap: Normalizing SSHA1-Password from base64 encoding, 40 bytes -> 28 bytes (5) pap: WARNING: Auth-Type already set. Not setting to PAP (5) [pap] = noop (5) } # authorize = updated (5) Found Auth-Type = mschap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (5) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (5) mschap: Creating challenge hash with username: scherevko (5) mschap: Client is using MS-CHAPv2 (5) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (5) mschap: ERROR: MS-CHAP2-Response is incorrect (5) [mschap] = reject (5) } # authenticate = reject (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> scherevko (5) attr_filter.access_reject: Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) [eap] = noop (5) policy remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) { (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else { (5) [noop] = noop (5) } # else = noop (5) } # policy remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (5) (5) Discarding duplicate request from client mikrotik_router port 56532 - ID: 31 due to delayed response Waking up in 0.6 seconds. (5) (5) Discarding duplicate request from client mikrotik_router port 56532 - ID: 31 due to delayed response Waking up in 0.3 seconds. (5) Sending delayed response (5) Sent Access-Reject Id 31 from 10.10.2.176:1812 to 10.10.2.1:56532 length 103 (5) MS-CHAP-Error = "\001E=691 R=1 C=359def4fd6e2f6ec8965898ccce170c8 V=3 M=Authentication rejected" Waking up in 3.9 seconds. (5) Cleaning up request packet ID 31 with timestamp +1893 Ready to process requests

2 1

Freeradius with LDAPS + mschap
by Andrew Nicols 23 Jan '20

23 Jan '20

Hello all, I have been trying to create a freeradius configuration to support authentication for a VPN connection. The VPN is provided by Ubiquiti's Unifi product (though I don't believe that makes any difference). Our LDAP server is providing a variety of auths already, and we do have it configured with Freeradius already. It will currently work with pap, and with our 802.1X wireless network. The VPN typically requires mschap, or mschapv2 and this is where I'm currently stuck. The authenticate section of the inner-tunnel configuration is: authenticate { Auth-Type PAP { ldap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap ldap eap } And the authenticate section: authorize { filter_username chap mschap suffix update control { &Proxy-To-Realm := LOCAL } eap { ok = return } ldap expiration logintime pap if (User-Password) { update control { Auth-Type := ldap } } } And here is a sample log from a failed connection: (27) Received Access-Request Id 122 from 172.17.0.1:40240 to 172.17.0.3:1812 length 135 (27) Service-Type = Framed-User (27) Framed-Protocol = PPP (27) User-Name = "andrewn" (27) MS-CHAP-Challenge = 0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (27) MS-CHAP2-Response = 0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (27) NAS-IP-Address = 127.0.1.1 (27) NAS-Port = 0 (27) # Executing section authorize from file /etc/freeradius/sites-enabled/default (27) authorize { (27) policy filter_username { (27) if (&User-Name) { (27) if (&User-Name) -> TRUE (27) if (&User-Name) { (27) if (&User-Name =~ / /) { (27) if (&User-Name =~ / /) -> FALSE (27) if (&User-Name =~ /@[^@]*@/ ) { (27) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (27) if (&User-Name =~ /\.\./ ) { (27) if (&User-Name =~ /\.\./ ) -> FALSE (27) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (27) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (27) if (&User-Name =~ /\.$/) { (27) if (&User-Name =~ /\.$/) -> FALSE (27) if (&User-Name =~ /(a)\./) { (27) if (&User-Name =~ /(a)\./) -> FALSE (27) } # if (&User-Name) = notfound (27) } # policy filter_username = notfound (27) [preprocess] = ok (27) [chap] = noop (27) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (27) [mschap] = ok (27) [digest] = noop (27) suffix: Checking for suffix after "@" (27) suffix: No '@' in User-Name = "andrewn", looking up realm NULL (27) suffix: No such realm "NULL" (27) [suffix] = noop (27) eap: No EAP-Message, not doing EAP (27) [eap] = noop (27) files: users: Matched entry DEFAULT at line 181 (27) [files] = ok rlm_ldap (ldap): Closing connection (14): Hit idle_timeout, was idle for 72 seconds rlm_ldap (ldap): Reserved connection (13) (27) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (27) ldap: --> (uid=andrewn) (27) ldap: Performing search in "dc=moodle,dc=com" with filter "(uid=andrewn)", scope "sub" (27) ldap: Waiting for search result... (27) ldap: User object found at DN "uid=andrewn,ou=people,dc=moodle,dc=com" (27) ldap: Processing user attributes (27) ldap: control:Cleartext-Password := '{SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' rlm_ldap (ldap): Released connection (13) Need 6 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (17), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldaps://auth.in.moodle.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (27) [ldap] = updated (27) [expiration] = noop (27) [logintime] = noop (27) pap: WARNING: Auth-Type already set. Not setting to PAP (27) [pap] = noop (27) if (User-Password) { (27) if (User-Password) -> FALSE (27) } # authorize = updated (27) Found Auth-Type = mschap (27) # Executing group from file /etc/freeradius/sites-enabled/default (27) authenticate { (27) mschap: Found Cleartext-Password, hashing to create NT-Password (27) mschap: Found Cleartext-Password, hashing to create LM-Password (27) mschap: Creating challenge hash with username: andrewn (27) mschap: Client is using MS-CHAPv2 (27) mschap: ERROR: MS-CHAP2-Response is incorrect (27) [mschap] = reject (27) } # authenticate = reject (27) Failed to authenticate the user (27) Using Post-Auth-Type Reject (27) # Executing group from file /etc/freeradius/sites-enabled/default (27) Post-Auth-Type REJECT { (27) attr_filter.access_reject: EXPAND %{User-Name} (27) attr_filter.access_reject: --> andrewn (27) attr_filter.access_reject: Matched entry DEFAULT at line 11 (27) [attr_filter.access_reject] = updated (27) [eap] = noop (27) policy remove_reply_message_if_eap { (27) if (&reply:EAP-Message && &reply:Reply-Message) { (27) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (27) else { (27) [noop] = noop (27) } # else = noop (27) } # policy remove_reply_message_if_eap = noop (27) } # Post-Auth-Type REJECT = updated (27) Delaying response for 1.000000 seconds Waking up in 0.9 seconds. (27) Sending delayed response (27) Sent Access-Reject Id 122 from 172.17.0.3:1812 to 172.17.0.1:40240 length 103 (27) MS-CHAP-Error = "\272E=691 R=1 C=c6a8eea80730f4b2f359e698eba21ae4 V=3 M=Authentication rejected" Waking up in 3.9 seconds. (27) Cleaning up request packet ID 122 with timestamp +804 Ready to process requests I have tried to read the various documentation, but I may well be missing something so I apologise if that is the case. Is the password in our LDAP server in an incompatible format, or have I got an error in my configuration above? Thanks in advance, Andrew Nicols

2 1

AD authorization with LDAP module? Mix with other methods necessary?
by uj2.hahn＠posteo.de 22 Jan '20

22 Jan '20

Hi, I have another general question. I have a running freeradius instance on Ubuntu for authorization against Windows AD, based on ntlm_auth. But to get more group depended post-auth capabilities I thought I can switch to LDAP module. I tested that in a test installation with OpenLDAP (instead of AD) and it worked fine. But now I was going to rollout this method to AD and failed to check the good password. Of course I'm aware that OpenLDAP and AD handles passwords differently so the surprise was not too big. So my questions are: - can I mix ntlm_auth for authorization and LDAP to do some group depended post-auth actions? - is that needed at all and there are ways to run LDAP only (in that case I probably did something wrong so far)? Thanks Uwe

3 3

Using LDAPS with Freeradius
by Byron Jeffery 22 Jan '20

22 Jan '20

Hi Everyone I am attempting to setup LDAPS on our Freeradius server on Ubuntu that is querying an Active Directory server for users group memberships, and hoping for a few guidelines on the correct setup procedure. So far I have exported the self signed PEM SSL cert form the AD server and imported it into /etc/freeradius/certs. In /etc/freeradius/mods-enabled/ldap, I also specified the Port = 636 and under the TLS section, pointed the ca_file = ${certdir}/ to the certificate, enabled ca_path = ${certdir} and set require_cert = 'allow'. The radius authentication's are working but would like to confirm if this is the best way to go about enabling LDAPS. - Kind Regards - Byron Jeffery - Assisting ICT Manager

3 4

Re: Issue with building eapol_test for EAP-AKA testing with FreeRadius Server on MacOS Mojave
by Arindam Gupta (arindamg) 22 Jan '20

22 Jan '20

Hi Arran, Few quick questions : In your AKA test configuration under https://github.com/FreeRADIUS/freeradius-server/tree/master/src/tests/eapol… identity="010026000000000" password="465b5ce8b199b49faa5f0a2ee238a6bc:cd63cb71954a9f4e48a5994e37a02baf:000000000002" Is identity refer to an mobile IMSI number? How password is being generated, is it encrypted with certain algo? Regards Arindam On 22/01/20, 4:04 AM, "Arran Cudbard-Bell" <a.cudbardb(a)networkradius.com> wrote: > On 21 Jan 2020, at 12:46, Arindam Gupta (arindamg) via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > Thank you /K, let me try, in case you have additional references w.r.t. sending EAP-AKA authentication requests using eapol_test please share Shhh, don't let anyone know, but I secretly hid eapol_test build configurations for three platforms, and eapol_test configurations for all the EAP methods FreeRADIUS supports, in the public repository!!! Sneaky hiding them in plain site I know, almost ensures no one will ever find them! --- The build configuration is here: https://github.com/FreeRADIUS/freeradius-server/blob/master/scripts/travis/… and the test configurations are here: https://github.com/FreeRADIUS/freeradius-server/tree/master/src/tests/eapol… -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1