June 2020 - Freeradius-Users - lists.freeradius.org

FreeRadius, Eduroam, and me...
by Tim Young 22 Jun '20

22 Jun '20

This is using FreeRADIUS Version 3.0.16 I find myself in the middle of an odd situation. I am not directly part of any of this, but I have root permissions and everyone involved is asking me to fix what they have deployed. :( The site that I have permissions for has recently deployed a free-radius server to use as an eduroam endpoint, authenticating off their Active Directory. They managed to get it to work such that they can properly authenticate using "radtest -t mschap ..." The consultant setting that up smiled smugly at that success and then left. But the access from outside, using the same credentials, fails. A consultant working at the far end is telling my friends that it is broken, and in asking that consultant if they can give us info from any of their working sites, we find out that none of their client sites are working with this configuration. So, I do not know if it is my fault, or theirs... Oh Joy. Running "freeradius -xX" and looking at the failure and the success, and I can see a dramatic difference: The working connection: Sat Jun 20 14:10:22 2020 : Info: Ready to process requests Sat Jun 20 14:10:25 2020 : Debug: (1) Received Access-Request Id 180 from 127.0.0.1:59459 to 127.0.0.1:1812 length 166 Sat Jun 20 14:10:25 2020 : Debug: (1) User-Name = "user(a)domain.name" Sat Jun 20 14:10:25 2020 : Debug: (1) NAS-IP-Address = 10.1.2.11 Sat Jun 20 14:10:25 2020 : Debug: (1) NAS-Port = 1812 Sat Jun 20 14:10:25 2020 : Debug: (1) Message-Authenticator = 0xc89e50f3f488393d2b4738522be27bcc Sat Jun 20 14:10:25 2020 : Debug: (1) MS-CHAP-Challenge = 0x8860d7d61af05416 Sat Jun 20 14:10:25 2020 : Debug: (1) MS-CHAP-Response = 0x000SOMEBIGLONGNUMBER Sat Jun 20 14:10:25 2020 : Debug: (1) session-state: No State attribute Sat Jun 20 14:10:25 2020 : Debug: (1) # Executing section authorize from The failed connection: Sat Jun 20 12:26:22 2020 : Info: Ready to process requests Sat Jun 20 12:27:05 2020 : Debug: (2) Received Access-Request Id 11 from [outsideIP]:37127 to 10.1.2.11:1812 length 91 Sat Jun 20 12:27:05 2020 : Debug: (2) User-Name = "user(a)domain.name" Sat Jun 20 12:27:05 2020 : Debug: (2) User-Password = "ActualTextPassword" Sat Jun 20 12:27:05 2020 : Debug: (2) NAS-IP-Address = [secondIP] Sat Jun 20 12:27:05 2020 : Debug: (2) Proxy-State = 0x313632 Sat Jun 20 12:27:05 2020 : Debug: (2) session-state: No State attribute Sat Jun 20 12:27:05 2020 : Debug: (2) # Executing section authorize from file /etc/freeradius/3.0/sitesenabled/eduroam We are authenticating off of an internal MS Domain Controller, so we need mschap configured, and on the failed connection we are getting: Sat Jun 20 12:27:05 2020 : Debug: (2) modsingle[authorize]: calling mschap (rlm_mschap) Sat Jun 20 12:27:05 2020 : Debug: (2) modsingle[authorize]: returned from mschap (rlm_mschap) Sat Jun 20 12:27:05 2020 : Debug: (2) [mschap] = noop And eventually: Sat Jun 20 12:27:05 2020 : ERROR: (2) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject Sat Jun 20 12:27:05 2020 : Debug: (2) Failed to authenticate the user Sat Jun 20 12:27:05 2020 : Debug: (2) Using Post-Auth-Type Reject Not knowing what I am stepping into, I am a bit unsure where to begin. In checking with the people involved, the incoming request may be correct, or it may have issues. The local configuration may have issues, or it may be correct... Any clues as to how I should begin to figure out which are has the problem, and then any pointers for how to fix it? What do you need from your end to be able to ask good questions? - Tim

4 11

Authenticate locally then proxy
by Júlíus Þór Bess Ríkharðsson 22 Jun '20

22 Jun '20

Hi, I'm wondering if I can authenticate users locally and then proxy the request. I'm hoping to authenticate the user on both servers, and if both can, then reply with Access-Accept. I've been searching around and It seems like it's only possible in version 4 because of the way versions up to 3 do proxying. Am I wrong? I'm hoping that it's possible somehow using unlang in version 3. The reason for doing this is I want to continue authenticating users locally (AD as users db) and then proxy the request for MFA/2FA push notifications. Kær kveðja / best regards Júlíus Þór Ríkarðsson Kær kveðja / Best regards Júlíus Þór Bess Ríkharðsson Sérfræðingur / Networking Expert Net- og samskiptalausnir / Network and telecommunication julius.bess(a)origo.is / www.origo.is Tel.: +354 516 1000 Fyrirvari / Disclaimersig1

2 1

Change between FreeRadius 2.2.5 to 3.0.17 in Filter ?
by Olivier CALVANO 22 Jun '20

22 Jun '20

Hi i test for update my old FreeRadius 2.2.5 to 3.0.17 included int CentOS 8. On filter, i have a error that i don't have in 2.2.5: (6) if ((Tunnel-Server-Endpoint:0[0] != '192.168.1.96') && (User-Name =~ /\\.internal-lan\\.ftth/) && ("%{Packet-Src-IP-Address}" == "192.168.90.58")) { (6) ERROR: Failed retrieving values required to evaluate condition (6) elsif ((Tunnel-Server-Endpoint:0[0] != '192.168.1.96') && (User-Name =~ /\\.internal-lan\\.ftth/) && ("%{Packet-Src-IP-Address}" == "192.168.90.59")) { (6) ERROR: Failed retrieving values required to evaluate condition (6) elsif ((Tunnel-Server-Endpoint:0[0] != '192.168.1.96') && (User-Name =~ /\\.internal-lan\\.ftth/) && ("%{Packet-Src-IP-Address}" == "192.168.90.74")) { (6) ERROR: Failed retrieving values required to evaluate condition (6) elsif ((Tunnel-Server-Endpoint:0[0] != '192.168.1.96') && (User-Name =~ /\\.internal-lan\\.ftth/) && ("%{Packet-Src-IP-Address}" == "192.168.90.208")) { (6) ERROR: Failed retrieving values required to evaluate condition Exemple of my config entry: if ((Tunnel-Server-Endpoint:0[0] != '192.168.1.96') && (User-Name =~ /\\.internal-lan\\.ftth/) && ("%{Packet-Src-IP-Address}" == "192.168.90.58")) { update reply { tunnel-Server-Endpoint:0 := '192.168.1.96' tunnel-Client-Auth-Id:0 := "POP-192.168.1.96" tunnel-Server-Auth-Id:0 := "POP-192.168.1.96" Tunnel-Type := "L2TP" Tunnel-Medium-Type := "IPv4" Class := "FTTH-PRO-DL1000m500k-UL300m500k" Tunnel-Preference !* ANY Framed-MTU !* ANY Cisco-AVPair !* ANY MS-Primary-DNS-Server !* ANY MS-Secondary-DNS-Server !* ANY Framed-IP-Address !* ANY Framed-IP-Netmask !* ANY Service-Type !* ANY Framed-Protocol !* ANY } } they are a synthaxe change in FreeRadius 3.x ? thanks Olivier

1 0

I would like to ldap bind with username instead of DN
by Wessel Louwris 21 Jun '20

21 Jun '20

Hi, I would like to bind with the given username and skip the ldapsearch, so I implemented DEFAULT Ldap-UserDN := "%{User-Name}” in my authorize file (as described on https://wiki.freeradius.org/modules/Rlm_ldap <https://wiki.freeradius.org/modules/Rlm_ldap>). Unfortunately this seems to be not enough because it’s still binding with the DN: (6) ldap: Login attempt by "user(a)company.nl " (6) ldap: Using user DN from request "uid= user,ou=Users,dc=example,dc=com” # this is a wrong DN returned by ldapsearch (6) ldap: Waiting for bind result... (6) ldap: ERROR: Bind credentials incorrect: Invalid credentials The reason I want to bind with the given username instead of the DN is that we use Google Secure LDAP with multiple domains. The LDAP search returns the wrong DN for users with another domain then our main domain. For users in my main domain everything works fine. For example an ldapsearch for user(a)company.nl <mailto:user@company.nl> on the Google LDAP returns: dn: uid=user,ou=Users,dc=example,dc=com which results in a failed LDAP bind. where it should return dn: uid=user,dc=company,dc=nl which would succeed. I noticed that I can also do a succesful LDAP bind with username: ldapsearch -W -H googleldapserver -D user(a)company.nl -s sub -b “dc=example,dc=com” So binding on username would be a solution for me. Does anybody now how I can force binding the DEFAULT Ldap-UserDN := "%{User-Name}” and skip the ldapsearch? Thanks for any help. Kind regards, Wessel

5 10

RADACCT TABLE
by Aurélio de Souza Ribeiro Neto 21 Jun '20

21 Jun '20

Hello All, If I clean old registers from radacct table I will have problems to allocate the same Ip to user in allocate find? Another question: It´s necessary to use rapostauth table If I have another way to control the connections? Thanks Aurelio

2 1

Re: Converting from GNU radius for a computone Client and an OpenVPN client using port 1645
by Alan DeKok 19 Jun '20

19 Jun '20

On Jun 19, 2020, at 2:44 PM, Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem <root(a)doctor.nl2k.ab.ca> wrote: > This is using FreeBSD . This is getting annoying. You are not following the documentation. You are arguing with every attempt by me to help you. Good luck getting this done. You clearly don't need (or want) my help. Alan DeKok.

1 0

Converting from GNU radius for a computone Client and an OpenVPN client using port 1645
by The Doctor 19 Jun '20

19 Jun '20

Currently I wish to convert from GNU radius to Free Radius. I have a computione intelliserver on 192.168.5.4 using Shread "Secret" to access to unix passwd file on 192.168.5.1 . my gnu clients file has server as wraparound and non-server like Routers and terminal servers using Secret My clients.conf as server local ns1 foobar 1645 1646 source_ip ns1 timeout 3 retry 1 A config file with option {} logging{} auth {} acct {} rewrite [] All defined Hints file DEFAULT Rewrite-Function = restore_nas_ip Fall-Through = Yes Naslist with localhosy and 192.168.5.4 defined nastypes typically defined realms files domain ns1:1645 domain ns2:1812 users DEFAULT Auth-Type = System, Simultaneous-Use =1 Service-Type = Framed-User, Framed-Protocol = PPP, Session-Timeout = 1day . What is needed to convert this to Freeradius 3? Openvpn radius plugin will assume to be not adjusted. -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising! nk.ca started 1 June 1995 . https://www.empire.kred/ROOTNK?t=94a1f39b Holding the church as Christ's head is not the act of a redeemed soul. -unknown

2 7

Multiple Password Auth
by Miguel Barrera 18 Jun '20

18 Jun '20

Hi, We have a captive portal integrated with freeradius for auth and accounting, and I have a question, how can I handle multiple password (PAP ClearText Password) with a single User?, for auth, we use the sql module so the passwords are stored on a mysql database. There are some scenarios where we need to store two or three password for the same user, here is the log for one of these password and the radcheck table registers of this user. Ready to process requests (8) Received Access-Request Id 4 from 186.154.58.197:41224 to 172.31.51.38:1812 length 345 (8) User-Name = "a450460f6823" (8) User-Password = "a450460f6823" (8) Service-Type = Call-Check (8) NAS-IP-Address = 192.168.0.10 (8) NAS-Identifier = "data-col-wifi" (8) Called-Station-Id = "dc085609e6d0:data-col-wifi1" (8) NAS-Port-Type = Wireless-802.11 (8) NAS-Port = 4 (8) NAS-Port-Id = "wifi-5G" (8) Calling-Station-Id = "a450460f6823" (8) Acct-Session-Id = "192.168.0.10_18/06/2020_11:49:11_a450460f6823" (8) Acct-Multi-Session-Id = "192.168.0.10_18/06/2020_11:49:11_a450460f6823" (8) Framed-MTU = 1400 (8) Xylan-Port-Desc = "data-col-wifi" (8) Xylan-Device-Name = "AP-Datawifi" (8) Xylan-Device-Location = "2c:fa:a2:99:d2:10" (8) Attr-26.800.154 = 0x41502d4441544157494649 (8) Message-Authenticator = 0xc6c8ec4fc33b39e6f65e27b3f4a13605 (8) # Executing section authorize from file /etc/freeradius/sites-enabled/default (8) authorize { (8) [chap] = noop (8) sql: EXPAND %{User-Name} (8) sql: --> a450460f6823 (8) sql: SQL-User-Name set to 'a450460f6823' rlm_sql (sql): Reserved connection (6) (8) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (8) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'a450460f6823' ORDER BY id (8) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'a450460f6823' ORDER BY id (8) sql: User found in radcheck table (8) sql: WARNING: check items do not match. rlm_sql (sql): Reserved connection (9) rlm_sql (sql): Released connection (9) Need 3 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (12), 1 of 24 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on dbdatawifi.cluster-cvxa7jznn96c.us-east-1.rds.amazonaws.com via TCP/IP, server version 5.7.12, protocol version 10 (8) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (8) sql: --> SELECT groupname FROM radusergroup WHERE username = 'a450460f6823' ORDER BY priority (8) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'a450460f6823' ORDER BY priority (8) sql: User found in the group table (8) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (8) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'google@monetizacion' ORDER BY id (8) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'google@monetizacion' ORDER BY id (8) sql: Group "google@monetizacion": Conditional check items matched (8) sql: Group "google@monetizacion": Merging assignment check items (8) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (8) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'google@monetizacion' ORDER BY id (8) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'google@monetizacion' ORDER BY id (8) sql: Group "google@monetizacion": Merging reply items (8) sql: Ruckus-Location = "https://www.google.com/" (8) sql: Session-Timeout = 600 (8) sql: WISPr-Bandwidth-Max-Down = 3500000 (8) sql: WISPr-Bandwidth-Max-Up = 3500000 (8) sql: Maximum-Data-Rate-Downstream = 3500000 (8) sql: Maximum-Data-Rate-Upstream = 3500000 rlm_sql (sql): Released connection (6) (8) [sql] = ok (8) [files] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = ok (8) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/freeradius/sites-enabled/default (8) REJECT { ... } # empty sub-section is ignored (8) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [a450460f6823/a450460f6823] (from client private-network-1 port 4 cli a450460f6823) (8) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. [image: image.png] Hope to hear from you soon, thank you very much. Gracias, quedo atento.

2 1

User Authentication problem
by juliana sales porto 18 Jun '20

18 Jun '20

Hi everyone, I have a issue with hotspot authetication. I configured the aruba IAP to connect to my radius, the user connects and authenticates, but there is no entry of user data in the radacct table Somebody can help me, please? Att, Juliana Porto

3 2

Best/fastest method to query external radius OTP
by Dominique Wille 18 Jun '20

18 Jun '20

Hello dear users. Could you help ? We have a freeradius 3.0.x configuration working - Authorization with LDAP - Authentication with LDAP, backup to files Now trying to get validation from OTP provider Needs to send a radius request with User-Name="myusername", User-Password="push" (this one is always "push", not the original pwd). The "push" words triggers a push notification on mobile that needs to be answered, and then OTP provider radius answers with accept or reject. I have tried radclient (working in console mode) with exec module, but having some issues to move it to rlm_exec module (piping data I think). So far reached exec myotp { input_pairs = request wait = yes timeout = 30 program = "/bin/echo \"User-Name=$USER_NAME,User-Password=push\" | /bin/radclient -r 1 -t 20 xx.xx.xx.xx:1812 auth mysecret" } Of course still missing the testing of what the command returns. But this does not work. Seems piping is not working and I can not push two commands there. An idea where is the issue ? Is there a better or fastest way ? thanks nash35

3 2