August 2023 - Freeradius-Users - lists.freeradius.org

radtest No "known good" password
by thenderson＠system.de 10 Aug '23

10 Aug '23

Have done much Googling/Binging, cant find a similar situation. Debian 11. Installed with apt-get install freeradius freeradius-mysql freeradius-utils. Added to /etc/freeradius/mods-config/files/authorize: testing Cleartext-Password := password During that process I had to create the folder /etc/freeradius/mods-config/files, it was not already present. Naturally due to this, the authorize file is empty other than the one line I added. Then I: radtest testing password 127.0.0.1 0 testing123 Outputs are: On Terminal A: Sent Access-Request Id 29 from 0.0.0.0:53848 to 127.0.0.1:1812 length 77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "password" Received Access-Reject Id 29 from 127.0.0.1:1812 to 127.0.0.1:53848 length 20 (0) -: Expected Access-Accept got Access-Reject Debug from Terminal B: (8) Received Access-Request Id 29 from 127.0.0.1:53848 to 127.0.0.1:1812 length 77 (8) User-Name = "testing" (8) User-Password = "password" (8) NAS-IP-Address = 127.0.1.1 (8) NAS-Port = 0 (8) Message-Authenticator = 0xbf1bb85fcdf0c1a4fbc4c65ff5c466b0 (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "testing", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: No EAP-Message, not doing EAP (8) [eap] = noop (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = ok (8) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> testing (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 29 from 127.0.0.1:1812 to 127.0.0.1:53848 length 20 Waking up in 3.9 seconds. (8) Cleaning up request packet ID 29 with timestamp +2957 Random thought: is the MySQL package making FreeRadius expect a different configuration method? I thought it was required to install but Im not using any MySQL as far as I know, Im doing a very basic setup, authorizing some Cisco vIOS routers/switches. Im probably missing something fairly obvious. Please help? -- Tristan Henderson Network Support Engineer <mailto:thenderson@system.de> thenderson(a)system.de system.de System & Project GmbH Knesebeckstr. 96, 10623 Berlin <http://www.system.de/> www.system.de T +49 30 2902315 350 F +49 30 2902315 440 Amtsgericht Berlin-Charlottenburg: HRB 53740 Geschäftsführer: Peter Schulte, Wilhelm Boeddinghaus Think before you print!

4 7

Certificate chain untrusted
by Maciej Kowalka 10 Aug '23

10 Aug '23

Hi, I've got configures freeradius 3.2 with eap tls, and working certificates, users can be authorized to network but I get warnings every time : Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /C=PL/ST=MyState/O=MyOrg/CN=Intermediate CA (TLS) untrusted certificate with depth [0] subject name /C=PL/ST=MyState/O=MyOrg/CN=client Is there solution to this or so I have to ignore it, and live with it? Maciej

5 23

crl cache refresh
by Peter Lee 08 Aug '23

08 Aug '23

Hi, A couple of questions regarding the crl cache auto refresh settings with fr release 3.2.2 check_crl = yes ca_path = ${cadir} ca_path_reload_interval = 86400 1. Does the reloading interval timer reset each time freeradius restart? 2. Is there a way to set an initial crl start time so that reloading at each interval can happen at expected time regardless when freeradius starts/restart? To make sure the crl update and fr reloading are in-sync. 3. Can ca_path_reload_interval interval be dynamically updated without restarting freeradius? Thanks.

2 1

Fwd: RADSEC / TLS errors but not sure why
by James Wood 08 Aug '23

08 Aug '23

Hi All, I'm currently testing out RADSEC/TLS on the latest version, 3.2.3, with openssl 3.0 on Ubuntu 22.04. The key, certificate and CA are correct and have been validated to match before using in the Freeradius config. When I start the daemon there are no errors indicating the key/cert don't match so I assume all is well. However, when a client connects over RADSEC/TLS (port 2083), Freeradius displays an SSL error. I've also tried the openssl s_client command and the same error is thrown. openssl s_client -showcerts -connect radius.hostname:2083 The key/cert is secp384r1 based. mods-enabled/eap: --------------------------- tls-config tls-common { private_key_password = whatever private_key_file = ${certdir}/my_key.key certificate_file = ${certdir}/my_key.crt ca_file = ${certdir}/my_key.ca dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "secp384r1" } --------------------------- sites-enabled/tls: --------------------------- listen { ipaddr = * port = 2083 type = auth+acct proto = tcp virtual_server = default clients = radsec limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } tls { private_key_password = whatever private_key_file = ${certdir}/my_key.key certificate_file = ${certdir}/my_key.key ca_file = ${certdir}/my_key.key dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no require_client_cert = no } } clients radsec { client all { ipaddr = 0.0.0.0/0 proto = tls secret = radsec } } home_server tls { ipaddr = 127.0.0.1 port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { private_key_password = whatever private_key_file = ${certdir}/purple.key certificate_file = ${certdir}/purple.crt ca_file = ${certdir}/purple.ca dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" } } home_server_pool tls { type = fail-over home_server = tls } realm tls { auth_pool = tls } --------------------------- radius debug: [snip] Listening on auth+acct proto tcp address * port 2083 (TLS) bound to server default Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 40253 Ready to process requests ... new connection request on TCP socket Listening on auth+acct from client (1.2.3.4, 38639) -> (*, 2083, virtual-server=default) Waking up in 0.9 seconds. (0) (TLS) Initiating new session (0) (TLS) Handshake state - before/accept initialization (0) (TLS) Handshake state - Server before/accept initialization (0) (TLS) recv TLS 1.2 Handshake, ClientHello (0) (TLS) send TLS 1.2 Alert, fatal handshake_failure (0) ERROR: (TLS) Alert write:fatal:handshake failure (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 38639 If I query a public radsec radius server on port 2083 using the openssl s_client command it returns the certificate list correctly etc. Is it a problem with my key/cert, openssl, or the client? Thanks

3 17

Restricting access for some devices to some groups
by Jarosław Kłopotek 07 Aug '23

07 Aug '23

Hi, I would like to restrict access to some devices (using ipaddresses). How do You assign group privileges with freeradius? (I tried to find some docs but without good results) I try: In SQL database: 1. I added table "nasgrouprestrictions" (id, nasname, groupname), Example DB results: (1, 10.100.0.1, superadm) (2, 10.100.0.1, users) (3, 10.100.0.2, superadm) (4, 10.100.0.3, users) 2. I created group "superadm" and assigned users in table radusergroup, login1, login2 are in "users" group login3 is in "superadm" and "users" group How to allow: login3 to login into all 10.100.0.{1,2,3} hosts and login1, login2 to login into only 10.100.0.{1,3} hosts ? But where to put SQL query? -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

3 4

Freeradius+AD - Login with EmployeeID
by Rodrigo Abrantes Antunes 07 Aug '23

07 Aug '23

Hello, I have a freeradius server authenticating users with active directory, the users login with the samaccountname. This is the ldap filter: (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}}) Now I need to enable the users to login with the employeeID. This is the ldap filter I tried: (employeeID=%{mschap_default:User-Name:-%{User-Name}})" The filter works in ldapsearch but not in freeradius. # Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group authorize { Mon Aug 7 10:23:44 2023 : Debug: [ad_all] performing user authorization for 1638828 Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: (employeeID=%{mschap_default:User-Name:-%{User-Name}}) -> (employeeID=1638828) Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: DC=xx,DC=xx,DC=xx,DC=xx -> DC=xx,DC=xx,DC=xx,DC=xx Mon Aug 7 10:23:44 2023 : Debug: ++[ad_all] = fail Mon Aug 7 10:23:44 2023 : Debug: +} # group authorize = fail Mon Aug 7 10:23:44 2023 : Debug: Using Post-Auth-Type REJECT Mon Aug 7 10:23:44 2023 : Debug: # Executing group from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group REJECT { Mon Aug 7 10:23:44 2023 : Debug: [attr_filter.access_reject] expand: %{User-Name} -> 1638828 Mon Aug 7 10:23:44 2023 : Debug: ++[attr_filter.access_reject] = updated Mon Aug 7 10:23:44 2023 : Debug: +} # group REJECT = updated Why freeradius can't filter with the employeeID attribute? Thanks.

2 5

Linelog and get rid of No Failure Reason
by TS 03 Aug '23

03 Aug '23

Hello, I am trying to consolidate logs and have only one log file with all needed data in it. This setup with Freeradius 3.2.3 with OpenLDAP 2.5.15. We are using EAP + MSCHAPv2, LDAP contains an attribute with NT Password. I am trying to get rid of "No Failure Reason" value of "reply:Reply-Message" variable in cases where: 1. user not found in LDAP 2. user's password is incorrect 3. user has Phase1 (EAP/TLS/...) or Phase2 (MSCHAPv2/GTC/...) misconfigured. I have pretty default configuration with small changes. I know I should modify Reply-Message but in which file and within which section(s)? Snippet from my custom linelog: reference = "inner_auth_log.%{%{reply:Packet-Type}:-format}" inner_auth_log { Access-Accept = "%d.%m.%Y@%H:%G|RESULT=OK |USER=%{User-Name}|WIFI_AP_IP=%{NAS-IP-Address}|CLIENT_MAC_ADDR=%{%{Calling-Station-Id}:-Unknown Caller Id}" Access-Reject = "%d.%m.%Y@%H:%G|RESULT=ERR|USER=%{User-Name}|WIFI_AP_IP=%{NAS-IP-Address}|CLIENT_MAC_ADDR=%{%{Calling-Station-Id}:-Unknown Caller Id}|MSG=%{%{reply:Reply-Message}:-No Failure Reason}" }

2 1

Samba radius authentication
by Jarosław Kłopotek 02 Aug '23

02 Aug '23

Hi, Is it possible to login in into samba share by using freeradius and get propper group assignment? I try switch as much authorize mechanizm as I could to freeradius. Tried to find native mechanizm in samba documentation but no info there :( -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

2 5

status-server
by Anatoliy 02 Aug '23

02 Aug '23

Hi team , when I am try to query status server for specific client I receive global stats and stats for specific client Is this expected behavior for FR , or it should return only stats for client ? For example # echo "Message-Authenticator = 0x00,FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-Number = 3" | radclient -x localhost:18121 status adminsecret Sent Status-Server Id 112 from 0.0.0.0:d5a0 to 127.0.0.1:18121 length 62 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = 35 FreeRADIUS-Stats-Client-Number = 3 Received Access-Accept Id 112 from 127.0.0.1:46c9 to 127.0.0.1:54688 length 476 FreeRADIUS-Total-Access-Requests = 430666 <<<<<<<<<< global stats for FR FreeRADIUS-Total-Access-Accepts = 679 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 679 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Auth-Conflicts = 0 FreeRADIUS-Total-Accounting-Requests = 1518800 FreeRADIUS-Total-Accounting-Responses = 1518800 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Acct-Conflicts = 0 FreeRADIUS-Stats-Client-Number = 3 FreeRADIUS-Stats-Client-IP-Address = 100.64.0.2 <<<<<<<< after this line , stats for this client. FreeRADIUS-Total-Access-Requests = 0 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 2404 FreeRADIUS-Total-Accounting-Responses = 2404 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0

2 2

Freeradius 2FA
by Jarosław Kłopotek 02 Aug '23

02 Aug '23

Hi guys, go a question - Is it possible to use freeradius with some 2FA somehow? Most perfect scenario would be: - try to log in on remote hosts, - remote server communicates with freeradius, - radius gives a question to some phone 2FA app, - then we get click "ALLOW" on the mobile 2FA app, - tadam we are logged in, -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

3 7