March 2021 - Freeradius-Users - lists.freeradius.org

Fwd: Question regarding the direction of eap_tls: <<< recv and eap_tls: >>> send
by Eric Nguyen 17 Mar '21

17 Mar '21

Hi, I'd like to ask a question regarding the direction of the exchanges in the radius log (radiusd -X). I used eapol_test as a client/authenticator against FreeRADIUS 3.0.21. - If I set the following parameters in the FreeRADIUS eap file, espol_test will results in a failure. In this case, "eap_tls: <<< recv TLS 1.3" looks like an exchange from FreeRADIUS to eapol_test (SERVER -> CLIENT): tls_min_version = "1.3" tls_max_version = "1.3" The FREERADIUS log shows: (2) eap_tls: <<< recv TLS 1.3 [length 00b9] (2) eap_tls: >>> send TLS 1.2 [length 0002] (2) eap_tls: ERROR: TLS Alert write:fatal:protocol version - If I set the following parameters in the FreeRADIUS eap file, espol_test will results in a success. In this case, "eap_tls: <<< recv TLS 1.2" looks like an exchange from eapol_test to FreeRADIUS (CLIENT TO SERVER): tls_min_version = "1.2" tls_max_version = "1.3" (6) eap_tls: <<< recv TLS 1.2 [length 08de] (6) eap_tls: TLS - Creating attributes from certificate OIDs Could you please clarify the meaning of these "eap_tls: <<< recv" log messages? Thanks, Eric ------------------------------------------------------------------------------------------------------------------------------------------- FULL LOG tls_min_version = "1.3" tls_max_version = "1.3" (2) eap: Calling submodule eap_tls to process data (2) eap_tls: Continuing EAP-TLS (2) eap_tls: [eaptls verify] = ok (2) eap_tls: Done initial handshake (2) eap_tls: (other): before SSL initialization (2) eap_tls: TLS_accept: before SSL initialization (2) eap_tls: TLS_accept: before SSL initialization (2) eap_tls: <<< recv TLS 1.3 [length 00b9] (2) eap_tls: >>> send TLS 1.2 [length 0002] (2) eap_tls: ERROR: TLS Alert write:fatal:protocol version tls: TLS_accept: Error in error (2) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (2) eap_tls: ERROR: System call (I/O) error (-1) (2) eap_tls: ERROR: TLS receive handshake failed during operation (2) eap_tls: ERROR: [eaptls process] = fail (2) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (2) eap: Sending EAP Failure (code 4) ID 54 length 4 (2) eap: Failed in EAP select (2) [eap] = invalid (2) } # authenticate = invalid ------------------------------------------------------------------------------------------------------------------------------------------- tls_min_version = "1.2" tls_max_version = "1.3" (6) eap: Calling submodule eap_tls to process data (6) eap_tls: Continuing EAP-TLS (6) eap_tls: Got final TLS record fragment (1272 bytes) (6) eap_tls: [eaptls verify] = ok (6) eap_tls: Done initial handshake (6) eap_tls: TLS_accept: SSLv3/TLS write server done (6) eap_tls: <<< recv TLS 1.2 [length 08de] (6) eap_tls: TLS - Creating attributes from certificate OIDs (6) eap_tls: TLS-Cert-Serial := "315fa3c827cb5c44e13222c88ff80369d1a176f1" (6) eap_tls: TLS-Cert-Expiration := "210113170058Z" (6) eap_tls: TLS-Cert-Valid-Since := "201114170058Z" (6) eap_tls: TLS-Cert-Subject := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Cert-Issuer := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Cert-Common-Name := "Example Certificate Authority" (6) eap_tls: TLS - Creating attributes from certificate OIDs (6) eap_tls: TLS-Client-Cert-Serial := "02" (6) eap_tls: TLS-Client-Cert-Expiration := "210113170058Z" (6) eap_tls: TLS-Client-Cert-Valid-Since := "201114170058Z" (6) eap_tls: TLS-Client-Cert-Subject := "/C=FR/ST=Radius/O=Example Inc./CN=user@example.org/emailAddress=user@example.org" (6) eap_tls: TLS-Client-Cert-Issuer := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress= admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Client-Cert-Common-Name := "user(a)example.org" (6) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" (6) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (6) eap_tls: TLS_accept: SSLv3/TLS read client certificate (6) eap_tls: <<< recv TLS 1.2 [length 0046] (6) eap_tls: TLS_accept: SSLv3/TLS read client key exchange (6) eap_tls: <<< recv TLS 1.2 [length 0108] (6) eap_tls: TLS_accept: SSLv3/TLS read certificate verify (6) eap_tls: TLS_accept: SSLv3/TLS read change cipher spec (6) eap_tls: <<< recv TLS 1.2 [length 0010] (6) eap_tls: TLS_accept: SSLv3/TLS read finished (6) eap_tls: >>> send TLS 1.2 [length 0001] (6) eap_tls: TLS_accept: SSLv3/TLS write change cipher spec (6) eap_tls: >>> send TLS 1.2 [length 0010] (6) eap_tls: TLS_accept: SSLv3/TLS write finished (6) eap_tls: (other): SSL negotiation finished successfully (6) eap_tls: TLS - Connection Established (6) eap_tls: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) eap_tls: TLS-Session-Version = "TLS 1.2" (6) eap_tls: TLS - got 51 bytes of data (6) eap_tls: [eaptls process] = handled

3 3

Working with data used at authentication time during accounting
by Marki 16 Mar '21

16 Mar '21

Hello, During authentication/authorization Radius queries our backend for validity of the user (exec modules), which return several response attributes to Radius and in consequence to the NAS. Now, if possible, I would like to re-use some of that information at accounting stage. The thing is that I'm proxying the NAS' accounting packets to another firewall for SSO access, which also requires that information. The NAS doesn't remember the custom attributes from authentication response and doesn't include them in the accounting request. Probably, it doesn't have or need to. Still, I have to add them back in somehow . Of course I could just ask the backend again, to obtain the same information, but maybe it's possible without that. Less scripts, you know. Maybe there's no magic here which I'll gladly accept. :) I thought that since the server seems to know during challenge-response at authentication time which session is which, there may be a way here too. Don't hang me if that's not the case and these things are unrelated. I see that the NAS transmits an audit-session-id which is identical in both the authentication and accounting packets. Maybe I could leverage that. But still both worlds (authentication/accounting) would somehow need to share some data. Thanks, Marki

2 2

Need support for radclient tool
by tejeswi 16 Mar '21

16 Mar '21

Hi Team, Greetings for the day..!! We started using radclient tool for simulating radius traffic. We need your support in resolving our queries. Query 1: We are trying to send request with id as 31 using id '-i' argument in radclient command. Command used: radclient -c 1 -i 31 -n 1 -p 1 -r 1 -t 1 -sx 192.167.3.31:4444 auth testing123 -f input -d /usr/share/freeradius Output of command: Sent Access-Request Id 124 from 192.167.3.6:2001 to 192.167.3.31:4444 length 89 (0) No reply from server for ID 124 socket 3 Packet summary: Accepted : 0 Rejected : 0 Lost : 1 Passed filter : 0 Failed filter : 0 Issue is though we are specifying id number from command line, it is not considering the id and it picks some random number and sends the request. We need to simulate the id of the request. please help us out in resolving this issue Issue 2: We are trying to simulate both A & B traffic and C is the router for both MME and HSS. [image: image.png] We were able to simulate traffic from A to C(A1) and C is forwarding the request to B(A2). Now B has to send response to C(A3). Can you support us in simulating response from C. Please note that response should be sent with the corresponding request id only. Free radius version used: 3.0.13 Utils version used: freeradius-utils-3.0.13-15.el7.x86_64 Attached is the radiusd output. -- ------------------------ Regards Tejeswi K +91-8880007462 -----------------------

3 5

EAP protocol on Free RADIUS
by السعيد محمد صالح عبدالكريم 16 Mar '21

16 Mar '21

Hello and good morning, I am interested in a RADIUS Server, when I upload the product to my device and connect to it can I view EAP protocol data for scientific research purposes. But if not, please direct me or advise me. My goal in studying the EAP packet is to know the response time for a number of different passwords to develop a product, as I am a master's researcher in information and network security from Qassim University in Saudi Arabia.

2 1

EAP-AKA
by Bassem Mettichi 15 Mar '21

15 Mar '21

Hello, Please could you tell me if Freeradius 3.0.21 supports EAP-AKA or not? if yes, if there is any guide or example of configuration and use? Best Regards Bassem

2 4

run multiple sql queries
by Imdad Hasan 15 Mar '21

15 Mar '21

Hii all, Can i run multiple sql queries at a time in freeradius sql module.? specifically for accounting. for manage accounting data in different different tables. Thanks

3 3

How to install a specific version of freeradius via apt?
by Mark Antony 14 Mar '21

14 Mar '21

Based on Freeradius website, it is possible to echo "deb https://packages.networkradius.com/releases/debian-buster buster main" >> /etc/apt/sources.list sudo apt-key adv --keyserver keys.gnupg.net --recv-key 0x41382202 apt update But it doesn't allow me to install the older version 3.0.20: apt install --only-upgrade freeradius=3.0.20 Is there a way to achieve that? Many Thanks, Mark

3 5

Freeradius can't connect to MySQL 8.0 from Debian Buster
by Mark Antony 14 Mar '21

14 Mar '21

Hello, I have FreeRADIUS Version 3.0.17 is installed that comes by default with Debian 10. When Freeradius is trying to connect to a remote MySQL 8.0 server, I get this error: rlm_sql_mysql: libmysql version: 10.3.27 mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "rad_db" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect to MySQL server myuser@18.133.xxx.xxx:rad_db rlm_sql_mysql: MySQL error: Plugin caching_sha2_password could not be loaded: /usr/lib/x86_64-linux-gnu/mariadb19/plugin/caching_sha2_password.so: cannot open shared object file: No such file or directory rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) rlm_sql (sql): Removing connection pool /etc/freeradius/3.0/mods-enabled/sql[20]: Instantiation failed for module "sql" Debian buster doesn't come with MySQL 8.0. So I have installed it manually: MYSQL_8_file="mysql-apt-config_0.8.16-1_all.deb" apt install gnupg -y wget -c https://dev.mysql.com/get/${MYSQL_8_file} dpkg -i ${MYSQL_8_file} apt update apt install mysql-client libmysqlclient-dev The error message indicated that FreeRadius is looking for mariadb plugins. I checked and there is no caching_sha2_password.so in the path /usr/lib/x86_64-linux-gnu/mariadb19/plugin/. Any suggestions, please?

2 3

Config when only using EAP-TLS (OPEN)
by Weisteen Per 12 Mar '21

12 Mar '21

Hi, I'm setting up a server only to be used for authentication of cameras using EAP-TLS. May I remove pap, mschap, dhcp and ntlm_auth links from mods-enabled/ ? ./PerW Sensitivity: Internal

2 1

User file _matching
by Hassan, Hazem (Nokia - EG/Cairo) 11 Mar '21

11 Mar '21

Hi , I want to make a different matching-criteria : Working Scenario : 98:86:5d:90:c2:82 Cleartext-Password := "pass" Alc-Subsc-Prof-Str = "three_services_1G", Alc-SLA-Prof-Str = "Internet_1G", Alc-Subsc-ID-Str = "sub-3", Framed-IP-Address = 100.0.0.6, Framed-IP-Netmask = 255.255.255.0, 2 2021/03/11 11:16:29.479 UTC MINOR: DEBUG #2001 management RADIUS "RADIUS: Transmit Access-Request(1) 80.194.79.79:1812 id 251 len 289 vrid 4095 pol bng-aaa-pol USER NAME [1] 17 98:86:5d:90:c2:82 3 2021/03/11 11:16:29.480 UTC MINOR: DEBUG #2001 management RADIUS "RADIUS: Receive Access-Accept(2) id 251 len 193 from 80.194.79.79:1812 vrid 4095 pol bng-aaa-pol VSA [26] 19 Nokia(6527) SUBSC PROF STR [12] 17 three_services_1G VSA [26] 13 Nokia(6527) SLA PROF STR [13] 11 Internet_1G VSA [26] 7 Nokia(6527) SUBSC ID STR [11] 5 sub-3 FRAMED IP ADDRESS [8] 4 100.0.0.6 FRAMED IP NETMASK [9] 4 255.255.255.0 FRAMED ROUTE [22] 22 192.168.6.0/24 0.0.0.0 VSA [26] 6 Nokia(6527) Non-Working Scenario : trying to send the access-request with different format "option-82 circuit-id" 2 2021/03/11 13:18:39.936 UTC MINOR: DEBUG #2001 management RADIUS "RADIUS: Transmit Access-Request(1) 80.194.79.79:1812 id 245 len 302 vrid 4095 pol bng-aaa-pol USER NAME [1] 30 OLT51 eth 1/1/03/01/8/14/1/100 PASSWORD [2] 16 W3EtVOTVYeWJ7NruhPh2ek NAS IP ADDRESS [4] 4 10.113.139.50 VSA [26] 52 DSL(3561) AGENT CIRCUIT ID [1] 30 OLT51 eth 1/1/03/01/8/14/1/100 AGENT REMOTE ID [2] 18 ONU 8 Testing DHCP 3 2021/03/11 13:18:40.938 UTC MINOR: DEBUG #2001 management RADIUS "RADIUS: Receive Access-Reject(3) id 245 len 20 from 80.194.79.79:1812 vrid 4095 pol bng-aaa-pol Output from debug mode: (2) Received Access-Request Id 161 from 10.113.139.50:64509 to 80.194.79.79:1812 length 302 (2) User-Name = "OLT51 eth 1/1/03/01/8/14/1/100" (2) User-Password = "Nokia" (2) NAS-IP-Address = 10.113.139.50 (2) ADSL-Agent-Circuit-Id = 0x4f4c5435312065746820312f312f30332f30312f382f31342f312f313030 (2) ADSL-Agent-Remote-Id = 0x4f4e5520382054657374696e672044484350 (2) NAS-Port-Type = Ethernet (2) NAS-Port-Id = "lag-2:11" (2) NAS-Identifier = "BNG-SR1" (2) Alc-Client-Hardware-Addr = "98:86:5d:90:c2:82" (2) Alc-ToServer-Dhcp-Options = 0x3501013d070198865d90c282370b0103060c0f1c2b364278795234011e4f4c5435312065746820312f312f30332f30312f382f31342f312f31303002124f4e5520382054657374696e672044484350ff (2) Acct-Session-Id = "785EB0000360B7604A1C96" (2) Alc-SAP-Session-Index = 1 (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> TRUE (2) if (&User-Name =~ / /) { (2) update request { (2) &Module-Failure-Message += 'Rejected: User-Name contains whitespace' (2) } # update request = noop (2) [reject] = reject (2) } # if (&User-Name =~ / /) = reject (2) } # if (&User-Name) = reject (2) } # policy filter_username = reject (2) } # authorize = reject (2) Using Post-Auth-Type Reject (2) # Executing group from file /etc/raddb/sites-enabled/default (2) Post-Auth-Type REJECT { (2) attr_filter.access_reject: EXPAND %{User-Name} (2) attr_filter.access_reject: --> OLT51 eth 1/1/03/01/8/14/1/100 (2) attr_filter.access_reject: Matched entry DEFAULT at line 11 (2) [attr_filter.access_reject] = updated (2) [eap] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) } # Post-Auth-Type REJECT = updated (2) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (2) Sending delayed response (2) Sent Access-Reject Id 161 from 80.194.79.79:1812 to 10.113.139.50:64509 length 20 Waking up in 1.9 seconds. Thanks, Hazem

3 3