August 2020 - Freeradius-Users - lists.freeradius.org

scripting pap off to eapol_test?
by Jonathan 06 Aug '20

06 Aug '20

I'm thinking of passing received PAP username and password on a realm/proxy basis to eapol_test to transform a PAP request into a proxied EAP request for further authentication upstream towards a 3rd party radius which only accepts secured EAP-PEAP:mschapv2 requests. If this would be possible, what would be the easiest way to do this from within a proxy config? scenario: 1) hotspot pap send to freeradius 2) freeradius matching realm, transform to eap-peap:mschapv2 request and proxy to upstream 3rd party server

2 1

Exec module questions, v4
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 04 Aug '20

04 Aug '20

Hi all, Does the exec module in v4 still support "non-xlat" use, i.e. where you stipulate a program, run it, maybe collect output pairs values? If so, I have an example where the execution is a bit different from v3, and wanted to query it. Using pretty much stock setup, only just added two bits - one to update the cleartext-password for chap testing, and the other to reject the user every time, for another reason. I have an exec module "testexec" exec testexec { program='/etc/freeradius/test.sh' wait = yes input_pairs = request output_pairs = reply } And my test.sh program #!/bin/bash echo "Reply-Message := \"hello\"" exit 0 Some observations - The stdout output "pickup" didn't seem to be consistent, here I've used radtest to fire a test auth twice in a row without changing anything (let me know if you'd like to see the complete output) .. (0) pap - Setting &control:Auth-Type = pap (0) pap (updated) (0) testexec (yield) (0) EXPAND /etc/freeradius/test.sh (0) --> /etc/freeradius/test.sh (0) Running request (0) tmpl - Resuming execution (0) testexec - EXEC GOT -- Reply-Message := \"hello\" (0) testexec (ok) .. pap - Setting &control:Auth-Type = pap (1) pap (updated) (1) testexec (yield) (1) EXPAND /etc/freeradius/test.sh (1) --> /etc/freeradius/test.sh (1) Running request (1) tmpl - Resuming execution (1) testexec (ok) .. - Also, the module return code isn't the same as it used to be, i.e. where 0 was ok, 1 was reject, 2 fail, as per https://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html If I modify the program to: #!/bin/bash echo "Reply-Message := \"hello\"" exit 1 ./test.sh ; echo $? Reply-Message := "hello" 1 I still get (ok), not (reject), and some more output inconsistency, one has status code, one not, even with no modifications (except the exit code in the script) or restarting the service (3) pap - Setting &control:Auth-Type = pap (3) pap (updated) (3) testexec (yield) (3) EXPAND /etc/freeradius/test.sh (3) --> /etc/freeradius/test.sh (3) Running request (3) tmpl - Resuming execution (3) testexec (ok) pap - Setting &control:Auth-Type = pap (4) pap (updated) (4) testexec (yield) (4) EXPAND /etc/freeradius/test.sh (4) --> /etc/freeradius/test.sh (4) Running request (4) tmpl - Resuming execution (4) Program failed with status code 1 (4) testexec (ok) I'm not modifying the module behaviour with { reject=1 } etc. We used to rely on the text output, even if the exit code was non zero, and that exit code value to do some more stuff after a CoA request. I should try modifying my unlang to do some xlats instead, but thought I'd ask first - is it just me - do I not understand deliberate changes that have taken place? I've tried changing shell_escape value, using sh instead of bash, with similar results. Thanks! Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 6

Does Pam_Radius support Acct-Interim-Interval?
by Mark Antony 04 Aug '20

04 Aug '20

Hello, I have a question about Pam_Radius plugin and Freeradius. Does it only support authentication? I'm asking because while authentication seem to work, Acct-Interim-Interval seem to be completely ignored. post-auth { update reply { Acct-Interim-Interval = 10 } } For testing purposes I have set it to 10 seconds and I was expecting it to fire update-requests every 10 seconds, but this isn't happening. Thanks, Mark

2 1

eapol_test ipv6
by Dave Macias 03 Aug '20

03 Aug '20

Hello, After much googling i was able to use eapol_test with ipv6. Distro provided eapol_test tool does not support ipv6 so had to build from source. Looking at this old post, https://www.spinics.net/lists/hostap/msg06118.html i needed to add the "CONFIG_IPV6=y" to the eapol_test/config_linux file to be able to support radius server's ipv6 address. *Possible to add it to source code?* *I'm willing to PR it.* Just some extra info: Output from distro eapol_test: $ eapol_test -c eapol_test.txt -s <mysecret> -a ::1 -N <whatever> Reading configuration file 'eapol_test.txt' ... Invalid IP address '::1' eapol_test: eapol_test.c:1036: wpa_init_conf: Assertion `0' failed. Aborted Output from source build with CONFIG_IPV6=y: $ ./eapol_test_source -c eapol_test.txt -s <mysecret> -a ::1 -N <whatever> Reading configuration file 'eapol_test.txt' Line: 1 - start of a new network block ... EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit ENGINE: engine deinit MPPE keys OK: 1 mismatch: 0 SUCCESS Thank you for the support! -Dave

1 0