September 2021 - Freeradius-Users - lists.freeradius.org

StrongSwan IKEv2 - eap-radius - Auth Failing
by Chris Myburgh 15 Sep '21

15 Sep '21

Hi Freeradius Users I am hoping you can help me. I have been battling the past couple of days getting StrongSwan (5.9.3) IKEv2 authentication by eap-radius to work. FreeRADIUS Version 3.0.23 ............ ............ ............ | (5) eap: Expiring EAP session with state 0x98fe0da799fc17eb | (5) eap: Finished EAP session with state 0x98fe0da799fc17eb | (5) eap: Previous EAP request found for state 0x98fe0da799fc17eb, released from the list | (5) eap: Peer sent packet with method EAP MSCHAPv2 (26) | (5) eap: Calling submodule eap_mschapv2 to process data | (5) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/default | (5) eap_mschapv2: authenticate { | (5) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password | (5) mschap: Creating challenge hash with username: chris | (5) mschap: Client is using MS-CHAPv2 | (5) mschap: ERROR: FAILED: No NT-Password. Cannot perform authentication | (5) mschap: ERROR: MS-CHAP2-Response is incorrect ............ ............ ............ | (5) } # Post-Auth-Type REJECT = updated | (5) Login incorrect (mschap: FAILED: No NT-Password. Cannot perform authentication): [chris/<via Auth-Type = eap>] (from client rad_clients port 8 cli 172.29.0.1[55829]) | (5) Delaying response for 1.000000 seconds | Waking up in 0.6 seconds. ================== Freeradius is using the MySQL driver (driver = "rlm_sql_mysql") and the eap module is set to use md5 as the default (default_eap_type = md5). When I do radtests directly to radius, I receive "Access-Accept" for PAP,CHAP & MSCHAP authentication types. However, radtest authentication type eap-md5 also fails stating that there is no cleartext-password in the radius logs. My users in freeradius are configured in the radcheck table with the following: ------------------------------------------------------------------------------------ id | username | attribute | op | value ================================================ 1 | chris | Cleartext-Password | := | chris12345 ------------------------------------------------------------------------------------ I've been up and down the configuration, but I cannot seem to figure it out. To me it seems that when I use the eap for authentication, it fails to lookup the radcheck table for the password. Any assistance or additional information I can provide to help the investigation? TIA __ Regards Chris Myburgh

2 5

Re: Checkrad and IPv6 NAS IP address
by Fabricio Viana 15 Sep '21

15 Sep '21

Hello! > I'll have to take a look. I'm pretty busy this week, so it might be a bit. > Alan DeKok. All right. Thanks for letting me know. I will follow the list and GitHub (v3.0.x branch). Regards Fabricio Viana

1 0

Good guest WLAN portal solution?
by Michael Schwartzkopff 15 Sep '21

15 Sep '21

Hi, perhaps this question is not completely FR related. But I'd like to ask this community anyway. What solution can you recommend for a Guest WLAN setup? We need a solution that provides a capture portal, so that the user can generate a OTP for a limited access. Also there must be a portal that the user agrees to the terms & conditions and only after agreement gets access. Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

1 0

Relase estimation for version 4?
by Michael Schwartzkopff 15 Sep '21

15 Sep '21

Hi, is there any estimation for a release date for the version 4 of FR? We would like to see the TACACS feature in the software. Then we could suggest my customer to switch from a commercial RADIUS server to FR. I assume that networkradius also will support the new features of version 4. Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

2 1

Two frreadius are connected to the same AD, and the first one is unavailable
by yanyi5496＠gmail.com 14 Sep '21

14 Sep '21

I have two freeradius on different ubuntu server, and I use freeradius to connect AD, when I configure freeradius A to connect AD, freeradius A was working, then I configure freeradius B to connect AD with same user and password, freeradius B was working, but freeradius A didn`t work, I checked their configuration, they arm same, freeradius A log is as follows: Tue Sep 14 03:02:26 2021 : Error: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: When trying to update a password, this return status indicates that the value provided as the current password is not correct. (0xc000006a)' Tue Sep 14 03:02:26 2021 : Auth: (3) Login incorrect: [sqauser/xxxxxxx] (from client 127.0.0.1 port 2 cli xxxxxxxxx) I make sure I use the correct account information, I don't know what went wrong, freeradius configuration or AD configuration. I'm really confused. Thanks Jason Chen

2 1

Retrieving Client TLS attributes for invalid/rejected requests
by Jason Healy 13 Sep '21

13 Sep '21

Hello, We're using EAP TLS and I've had no trouble pulling the TLS attributes (TLS-Client-Common-Name, etc) out of the request during normal processing. However, I'm getting several certs as revoked/expired and I'd like to get into it a little more. I could attach to debug, but I'd like to also log these failed certificates so I can chase down the users and run some reports. However, when I try to log the TLS-* attributes in Post-Auth-Type REJECT, they're empty. I'm guessing that the EAP module cleans them up on failure? I even tried to use failover to catch the invalid response as quickly as possible: eap { invalid = 1 } if (invalid) { sa_linelog_bad_cert invalid } But again all the TLS-* attributes come up blank in the linelog. I can see them in the eap_tls section, but they're gone by the time I get to linelog: (7) eap: Calling submodule eap_tls to process data (7) eap_tls: (TLS) EAP Got final fragment (827 bytes) (7) eap_tls: (TLS) EAP Done initial handshake (7) eap_tls: (TLS) Handshake state - Server SSLv3/TLS write server done (7) eap_tls: (TLS) recv TLS 1.2 Handshake, Certificate (7) eap_tls: (TLS) Creating attributes from TLS-Client-Cert-Serial certificate (7) eap_tls: (TLS) Creating attributes from server certificate (7) eap_tls: TLS-Cert-Serial := "460d875635c64859ebabee3bba64e93f" (7) eap_tls: TLS-Cert-Expiration := "390703160000Z" (7) eap_tls: TLS-Cert-Valid-Since := "190703161900Z" (7) eap_tls: TLS-Cert-Subject := "/O=Suffield Academy/CN=Suffield Academy Device Intermediate CA" (7) eap_tls: TLS-Cert-Issuer := "/O=Suffield Academy/CN=Suffield Academy Device Root CA" (7) eap_tls: TLS-Cert-Common-Name := "Suffield Academy Device Intermediate CA" (7) eap_tls: (TLS) Creating attributes from client certificate (7) eap_tls: TLS-Client-Cert-Serial := "5052ac2d40917d66343d050650939854" (7) eap_tls: TLS-Client-Cert-Expiration := "210803194948Z" (7) eap_tls: TLS-Client-Cert-Valid-Since := "210802193900Z" (7) eap_tls: TLS-Client-Cert-Subject := "/O=Suffield Academy/CN=Expired User (Fake 1234567890)" (7) eap_tls: TLS-Client-Cert-Issuer := "/O=Suffield Academy/CN=Suffield Academy Device Intermediate CA" (7) eap_tls: TLS-Client-Cert-Common-Name := "Expired User (Fake 1234567890)" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Email := "Expired User (Fake 1234567890)" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Dns := "_SA_" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Upn := "expired" (7) eap_tls: ERROR: SSL says error 10 : certificate has expired (7) eap_tls: (TLS) send TLS 1.2 Alert, fatal certificate_expired (7) eap_tls: ERROR: (TLS) Alert write:fatal:certificate expired (7) eap_tls: ERROR: (TLS) Server : Error in error (7) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (7) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (7) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation (7) eap_tls: ERROR: [eaptls process] = fail (7) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (7) eap: Sending EAP Failure (code 4) ID 229 length 4 (7) eap: Failed in EAP select (7) [eap] = invalid (7) if (invalid) { (7) if (invalid) -> TRUE (7) if (invalid) { (7) sa_linelog_bad_cert: EXPAND %{Module-Failure-Message} for %{%{TLS-Client-Cert-Common-Name}:-No-Common-Name} %{%{TLS-Client-Cert-Subject-Alt-Name-Email}:-No-Alt-RFC822} %{%{TLS-Client-Cert-Subject-Alt-Name-Dns}:-No-Alt-DNS} (7) sa_linelog_bad_cert: --> eap_tls: SSL says error 10 : certificate has expired for No-Common-Name No-Alt-RFC822 No-Alt-DNS (7) [sa_linelog_bad_cert] = ok (7) [invalid] = invalid (7) } # if (invalid) = invalid (7) } # Auth-Type eap = invalid So, any way to retrieve invalid cert data for logging? Thanks, Jason

3 4

Quoting =~ in unlang on string expansion
by Walter Schober 13 Sep '21

13 Sep '21

Hi folks! String expansion is behaving different in case just adding a string or being a result in a regex compare. (1) if (&Called-Station-ID =~ /%{reply:FeatureA}/) { (1) EXPAND %{reply:FeatureA} (1) --> \^\(3\[0-79]\|38\[0-25-9]\|4\[014-9]\|42\[123]\|29\[89]\|43\[1-6]\|43800\|43720) (1) ERROR: \^\(3\[0-79]\|38\[0-25-9]\|4\[014-9]\|42\[123]\|29\[89]\|43\[1-6]\|43800\|43720) (1) ERROR: ^ Pattern compilation failed: unmatched parentheses (1) ERROR: Failed retrieving values required to evaluate condition Sure this does not compile because it quoted "(" but not ")". In this use case some chars in the reply string are quoted: ^(|[ are quoted while ]) are not for some reasons But adding the reply value to some debug AVPair this is done without quoting: This shows the real content of the reply attr: (1) else { (1) update control { (1) Auth-Type := Reject (1) } # update control = noop (1) update reply { (1) EXPAND block=%{reply:FeatureA} (1) --> block=^(3[0-79]|38[0-25-9]|4[014-9]|42[123]|29[89]|43[1-6]|43800|43720) (1) Generic-Debug := block=^(3[0-79]|38[0-25-9]|4[014-9]|42[123]|29[89]|43[1-6]|43800|43720) I was looking through source code why this is happening, but I am lost. Any hint to source code is appreciated. I'm using version from Debian Buster Backports: 3.0.21+dfsg-1~bpo10+1 I tried a lot already: "/%{}/", /"%{}"/, %{unescape:...}, ... even if (&Called-Station-ID =~ /&reply:FeatureA/) (which results in FALSE always) Why are some character quoted here in this expansion? Where are the "safe charaters" defined for unlang compare operator? Greetings, Walter

2 2

linelog module soft failure
by Arnaud LAURIOU 10 Sep '21

10 Sep '21

Hi, On our eduroam proxy we use linelog modules in the post-auth section. Recently, one of these linelog module failed and its 'fail' return code was applied to requests in the post-auth section : Auth: (34463328) Rejected in post-auth. Is there a way to have a 'soft failure' when the return code from linelog is 'fail' ? Regards, Arnaud

2 4

Re: Checkrad and IPv6 NAS IP address
by Fabricio Viana 08 Sep '21

08 Sep '21

Hi Alan! First of all, thanks for the quick response! > Huh? The main FreeRADIUS GitHub repository is at https://github.com/FreeRADIUS/freeradius-server/ It's pointed to from http://freeradius.org. > I don't recommend looking at third-party repositories for FreeRADIUS. They are many years out of date. I had so many tabs open in my browser that I didn't even realize I wasn't in the correct repository! Sorry for this mistake. > Patch rlm_sql.c to accept IPv6 addresses. This requires code changes. I'll take a look. > Alan DeKok Unfortunately I can't help in this regard, as I don't know the C language... But thanks again for your willingness to check what can be done. I will be looking forward to it! Regards Fabricio Viana

1 0

Re: Networkradius packages for freeradius-3.0.22-1.el7.x86_64.rpm
by Clive Allen 08 Sep '21

08 Sep '21

>>This comment is demeaning, and insulting. As best I can tell, it is *intended* to be demeaning and insulting. Please don't assume you know why I wrote that comment. I absolutely did not write that comment to demean or insult anyone. Anyway, so that anyone else who may experience this issue wants to know the resolution, I will post here. At least there is a record of it then. The URL is stated as "HTTPS://packages.networkradius.com/freeradius-3.0/centos/7/" No matter what I tried I could only ever get it to list 3.0.23. So, I thought, well, may as well try http rather than https and, with using the following two commands it worked: "yum list freeradius-3.0.22*" - it listed back "freeradius-3.0.22-1.el7" "yum install freeradius-3.0.22-1.el7" radiusd -X shows no issues and the version is "3.0.22". At least that clears up the confusion, but not sure why http worked and https did not - maybe a security issue or certs. Anyway, thank you Matthew and Alan for the pointers. I will keep those in mind for future reference. A basic resolution but sometimes the basics are easily missed.

3 2