November 2020 - Freeradius-Users - lists.freeradius.org

FR 3.0.21 authenticating to OpenDirectory on macOS Catalina
by Jason Holloway 23 Nov '20

23 Nov '20

Hello, FR compiled from source, configured according to Apple Support KB and tested authenticating successfully via PAP. However, MSCHAPv2 authentication failing. (3) Received Access-Request Id 27 from XXX to YYY length 134 (3) Service-Type = Framed-User (3) Framed-Protocol = PPP (3) User-Name = "jasonh" (3) MS-CHAP-Challenge = 0x16595e62295ac4e32812a88453133fe1 (3) MS-CHAP2-Response = 0x00326393cddb212a637ff9cac34ccfa379be00000000000000007f39e4bc2b1a7ac69 523633cf0c147f5e3783267bc11a92e (3) NAS-IP-Address = XXX (3) NAS-Port = 0 (3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet- Src-IPv6-Address}}/auth-detail-%Y%m%d (3) auth_log: --> /usr/local/var/log/radius/radacct/192.168.90.254/auth-detail-20201120 (3) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet- Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/XXX/auth-detail-20201120 (3) auth_log: EXPAND %t (3) auth_log: --> Fri Nov 20 16:56:00 2020 (3) [auth_log] = ok (3) [chap] = noop (3) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (3) [mschap] = ok (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "jasonh", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: No EAP-Message, not doing EAP (3) [eap] = noop (3) files: users: Matched entry DEFAULT at line 167 (3) [files] = ok (3) opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. (3) opendirectory: The host XXX does not have an access group. (3) opendirectory: no access control groups, all users allowed (3) [opendirectory] = ok (3) sql: EXPAND %{User-Name} (3) sql: --> jasonh (3) sql: SQL-User-Name set to 'jasonh' rlm_sql (sql): Closing connection (9): Hit idle_timeout, was idle for 62 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_sqlite: Socket destructor called, closing socket rlm_sql (sql): Closing connection (10): Hit idle_timeout, was idle for 62 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_sqlite: Socket destructor called, closing socket rlm_sql (sql): Closing connection (8): Hit idle_timeout, was idle for 62 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_sqlite: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (11), 1 of 32 pending slots used rlm_sql_sqlite: Opening SQLite database "/var/db/radius/freeradius.db" rlm_sql (sql): Reserved connection (11) (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'jasonh' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'jasonh' ORDER BY id (3) sql: WARNING: User not found in radcheck table. rlm_sql (sql): 1 of 1 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (12), 1 of 31 pending slots used rlm_sql_sqlite: Opening SQLite database "/var/db/radius/freeradius.db" rlm_sql (sql): Reserved connection (12) rlm_sql (sql): Released connection (12) Need 1 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (13), 1 of 30 pending slots used rlm_sql_sqlite: Opening SQLite database "/var/db/radius/freeradius.db" (3) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (3) sql: --> SELECT groupname FROM radusergroup WHERE username = 'jasonh' ORDER BY priority (3) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'jasonh' ORDER BY priority (3) sql: User not found in any groups rlm_sql (sql): Released connection (11) (3) [sql] = notfound (3) [expiration] = noop (3) [logintime] = noop Not doing PAP as Auth-Type is already set. (3) [pap] = noop (3) } # authorize = ok (3) Found Auth-Type = mschap (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (3) authenticate { (3) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (3) mschap: No NT-Password configured. Trying OpenDirectory Authentication (3) mschap: OD username_string = jasonh, OD shortUserName= (length = 0) (3) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError (3) [mschap] = reject (3) } # authenticate = reject (3) Failed to authenticate the user (3) Using Post-Auth-Type Reject (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (3) Post-Auth-Type REJECT { (3) sql: EXPAND .query (3) sql: --> .query (3) sql: Using query template 'query' rlm_sql (sql): Reserved connection (11) (3) sql: EXPAND %{User-Name} (3) sql: --> jasonh (3) sql: SQL-User-Name set to 'jasonh' (3) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M') (3) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'jasonh', '', 'Access-Reject', '2020-11-20 16:56:00.652402') (3) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'jasonh', '', 'Access-Reject', '2020-11-20 16:56:00.652402') (3) sql: SQL query returned: success (3) sql: 1 record(s) updated rlm_sql (sql): Released connection (11) (3) [sql] = ok (3) attr_filter.access_reject: EXPAND %{User-Name} (3) attr_filter.access_reject: --> jasonh (3) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) [attr_filter.access_reject] = updated (3) [eap] = noop (3) policy remove_reply_message_if_eap { (3) if (&reply:EAP-Message && &reply:Reply-Message) { (3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) else { (3) [noop] = noop (3) } # else = noop (3) } # policy remove_reply_message_if_eap = noop (3) } # Post-Auth-Type REJECT = updated (3) Login incorrect (mschap: rlm_mschap: authentication failed - status = eUndefinedError): [jasonh] (from client ZZZ port 0) (3) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Sending delayed response (3) Sent Access-Reject Id 27 from YYY:1812 to XXX:56975 length 20 Waking up in 3.9 seconds. (3) Cleaning up request packet ID 27 with timestamp +304 Ready to process requests The relevant part I think is this one: (3) authenticate { (3) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (3) mschap: No NT-Password configured. Trying OpenDirectory Authentication (3) mschap: OD username_string = jasonh, OD shortUserName= (length = 0) (3) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError (3) [mschap] = reject As radtest client only support mschap v1, this skips the OpenDirectory (OD) authentication so doesn’t provide any further insights. I see there have been previous issues logged by others with the same error message, but no confirmation that these were ever fixed. Help? Thanks, Jason H

2 2

accounting to multiple servers
by Nicolás Ciuffolotti 20 Nov '20

20 Nov '20

Hi Thank you in advance for your help. I am trying to create 2 servers with freeradius. I have 5 NAS and I configure the 2 radius in each one but different order, example: NAS 1 ---> radius A; radius B NAS 2 ---> radius B; radius A ... I have the problem with accounting, START and STOP in any radius server. What is the best configuration so that the files details of both servers contain the same? Is there a how to do the configuration? Thanks for the answers

2 10

adding specific user in freeradius
by lingctam 20 Nov '20

20 Nov '20

Hi all, Is there a way I could use the "sites-enabled" virtual servers to allow a specific user (by user name or IP) to pass AAA? Thanks in advance.

1 0

Copy User-Name from inner-tunnel to default only once
by Sven Hartge 19 Nov '20

19 Nov '20

Hi! I am sorry for the strange subject but I can't find a shorter description that still makes some sense. First: I got this working already in the way I need it but I want to solicit a maybe more elegant or better solution I may have not seen. Second: This is for 3.0.21. Third: This needs a bit of explanation up front before I come to my question, please bear with me. What am I doing: I have the usual default/inner-tunnel setup needed for Wifi+EAP in Eduroam and this all works fine, no problems here. And I use the "update { &reply: += &session-state: }" method to copy specific attributes from the inner-tunnel into the outer one, most important those to steer the VLAN assignment. This also works nice. Now here is the wrinkle: To aid the internal accounting I also need to provide the internal APs and Controllers with the inner-User-Name but not in requests leaving via the federation servers to Eduroam. Until recently I had a setup like this: # inner-tunnel vhost post-auth { [...] update reply { Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY User-Name !* ANY } # If internal Wifi system, readd User-Name if ("%{client:thmtype}" =~ /^aruba-wlan-/) { update reply { &User-Name := &User-Name } } [...] } # /inner-tunnel vhost "thmtype" is an additional key I add via client.conf for internal systems needing this. This also works fine. But this creates reply packages with _two_ User-Name attributes in Access-Accept, because the "copy from session state" adds the internal Username to the reply. But this worked for our Aruba IAPs with Virtual Controller, our Wifi guys saw the real username in their logs and in the accounting database. Now we upgraded to Aruba Mobility Controller and they choke on the duplicate User-Name attribute in the Access-Accept, the device never gets fully authenticated though the controller clearly receives the Access-Accept. To avoid that problem, I now also changed the default VHost to this: # default vhost post-auth { [...] # Overwrite User-Name in Reply with inner-tunnel # and remove from session-state to avoid duplication if ("%{client:thmtype}" =~ /^aruba-wlan-/) { update { &reply:User-Name := &session-state:User-Name &session-state:User-Name !* ANY } } # Add rest of inner-tunnel attributes to reply update { &reply: += &session-state: } [...] } # /default vhost This works fine, but after all those many words, the question: Is there a more elegant or simpler way to achieve this I didn't see? Grüße, Sven.

3 4

Problem with MySQL and Accouting-On record
by Ángel L. Mateo 19 Nov '20

19 Nov '20

Hi, I have a radius server (freeradius 3.0.19) to authenticate a VPN server (among other services). I have virtual server to listen from this device. In this server I have the config: accouting { ... sql_log_um ... } where "sql_log_um" es a detail config to a file, like this: detail sql_log_um { filename = ${radacctdir}/eduroam/eduroam_sql escape_filenames = no permissions = 0600 header = "%t" locking = false suppress { User-Password } } Then I have enabled the buffered-sql listening to the previous file and with: accouting { sql } to write accouting packets to a mysql database. My problem is that whenever I reboot this VPN server, it sends an Accouting-On request which is written to this file like: Fri Nov 6 13:44:04 2020 Acct-Status-Type = Accounting-On NAS-Identifier = "MikroTik-CCR-VPN-1-Test" Acct-Delay-Time = 0 NAS-IP-Address = 192.168.1.100 X-Atica-Service = "vpn" X-Atica-Service-Filter = "vpn" Timestamp = 1604666644 and then the buffered-sql runs a query like: UPDATE radacct SET acctstoptime = FROM_UNIXTIME(1604663265), acctsessiontime = '1604663265' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = 'NAS-Reboot' WHERE acctstoptime IS NULL AND nasipaddress = '155.54.213.6' AND acctstarttime <= FROM_UNIXTIME(1604663265) the problem I have is that is queried is run but the record is not deleted from the detail file neither is marked with the Donestamp mark, so buffered-sql runs it again and again, without passing to next records. My first hypothesis has been that this query lasts too match (this is a very large database), so I have changed the query (just to try) to something like: UPDATE radacct SET acctstoptime = FROM_UNIXTIME(1604663265), acctsessiontime = '1604663265' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = 'NAS-Reboot' WHERE 1 = 0 just to try and check that the problem is not this, but I'm getting the same result. Any help? Thanks. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

3 16

Freeradius Unlang Update ?
by Olivier CALVANO 19 Nov '20

19 Nov '20

Hello I have a quick question for simplicity: Currently I use: update reply { tunnel-Server-Endpoint: 0: = '172.16.1.1' tunnel-Client-Auth-Id: 0: = "LAC-172.16.1.1" tunnel-Server-Auth-Id: 0: = "LNS-172.16.1.1" Tunnel-Type: = "L2TP" Tunnel-Medium-Type: = "IPv4" Class: = "FTTH-TLM" Tunnel-Preference !* "" Framed-MTU !* "" Cisco-AVPair !* "" MS-Primary-DNS-Server !* "" MS-Secondary-DNS-Server !* "" Framed-IP-Address !* "" Framed-IP-Netmask !* "" Service-Type !* "" Framed-Protocol !* "" Port-Limit !* "" } I mostly need to send ONLY the first 5 attributes. do i have the option to delete all attributes in one command then put the 5 attributes i need? exemple: update reply { * !* "" tunnel-Server-Endpoint: 0: = '172.16.1.1' tunnel-Client-Auth-Id: 0: = "LAC-172.16.1.1" tunnel-Server-Auth-Id: 0: = "LNS-172.16.1.1" Tunnel-Type: = "L2TP" Tunnel-Medium-Type: = "IPv4" Class: = "FTTH-TLM" } thank you for your suggestion regards

3 2

Freeradius rlm_perl with Custom Perl
by Onur GURSOY 19 Nov '20

19 Nov '20

Hello everyone, currently, i can build freeradius rlm_perl successfully. But rlm_perl.se depends on libperl.so.5.26 => /usr/lib/x86_64-linux-gnu/libperl.so.5.26 but i want to use <foopath>/perl/lib/5.26.3/x86_64-linux-thread-multi/CORE/libperl.so How is this possible? This is problem for deployment point of view. Because I have custom perl which i build from source. and i want to use this instead of any other already installed perl which is in deployment machine. Many thanks With best regards -- Onur GÜRSOY R&D Engineer in Embedded Systems Master Student at Gebze Institute Of Technology Department Of Electronic Engineering GSM : 0(545) 764 7653 e-mail: onurgursoygyte(a)gmail.com

3 5

About Perl Flags in Rlm_Perl Config
by Onur GURSOY 18 Nov '20

18 Nov '20

Hello Everyone, rlm_perl is wonderful extension. including perl interpreter is good idea. but i have some trouble about perl flags in the perl module configuration. When i pass this to config it's ok. *perl_flags = "-T -I/opt/sinecins/rsc/scripts/radius"* But whe i pass this to config, perl has syntax error. *perl_flags = "-T -I<foopath>/scripts/radius -I<dummypath>/scripts/radius" * How can i pass *two include path* to perl module ? Many thanks, With best regards -- Onur GÜRSOY R&D Engineer in Embedded Systems Master Student at Gebze Institute Of Technology Department Of Electronic Engineering GSM : 0(545) 764 7653 e-mail: onurgursoygyte(a)gmail.com

3 2

LDAP authentication for Unifi wireless APs
by Erwin Rutgers 17 Nov '20

17 Nov '20

Hello freeradius community, To start off, this is my first post to the community so if there is anything I am doing wrong despite readying the help pages, please point this out to me and it will never happen again. Then to the plan and the problems: We are using Unifi Access points and like to switch to WPA-Enterprise authentication against our internal ldap. The ldap server is a freeipa server which contains the username and password for all of our users. After installation of freeradius, I entered a cleartext-password user in /etc/raddb/users and added the Aps as clients. In the Unifi controller, I configured a new RADIUS profile pointing to the freeradius server and added this to a test network. Wireless EAP authentication was successful. After that, I went on and configured the ldap module with the filters and ldap settings that apply for our freeipa server. That worked too then with a radtest command and I got a an Accept-Accept result with the credentials from a testuser in the ldap server. I already removed the Clear-text password user from the /etc/raddb/users file. From here on, I'm not quite sure on how to get both methods to connect properly. To get the ldap to work in the above test, I mainly wanted to prove that the freeradius ldap module was able to authenticate against our ldap at all. To get this to work I uncommented the following section in /etc/raddb/sites-available: Auth-Type LDAP { ldap } Your guides specifically stated that this should be avoided and when I ran a wireless connection test, the radiusd -X output gave a pretty clear message stating that setting Auth-Type will not work. So then, I disabled this section and ran another test. See the attached file: failed_attempt2.txt. Then I restored the /etc/raddb/mods-config/files/authorize file to it's original state and added "ldap" to the /etc/raddb/sites-available/default file instead of the Auth-Type LDAP part. I ran another test and added the debug information in file freeradius_debug2. Initially I chose for the ldap module instead of the ntlm_auth method because the ldap module allowed for better directory filtering to my liking. I did try to setup a samba ntlm connection to the freeipa server though, but the guides did not seem to work for freeipa. I hope this is enough information for anyone to work with. I'm looking forward to your insights. Thanks in advance and thank you for your time! Kind regards, Erwin

2 1

Create new accounting attributes
by Juan Diego 16 Nov '20

16 Nov '20

Hello everyone, I am new to working with FreeRADIUS and would appreciate your help. I would need to design new accounting attributes in a local environment, using either radclient or radeapclient as the client. As I have seen in the official documentation at https://networkradius.com/doc/current/concepts/dictionary/purpose.html, it is indicated that it is not necessary to modify the source code to add new attributes. I am confused with this, how would the client/NAS add the new accounting attributes to the radius package? Then, I understand that it is necessary to have a dictionary where the new accounting attributes appear so that the server can decode them. Please, if you know of any guide to implement new accounting attributes or what files need to be modified, I would greatly appreciate it. Thanks in advance and regards, John

3 3