November 2024 - Freeradius-Users - lists.freeradius.org

Windows Machines not Validating Cert
by FreeRAD 06 Nov '24

06 Nov '24

I'm using EAP-TTLS. When generating the production certs I know it says in the readme file that all client machines need to have the root CA installed for it to work, but that doesn't seem to be the case in my setup. If I connect from a windows 11 machine I get a notification asking if I am happy with the certificate information for the server that I am connecting to, but I haven't got the root CA cert installed on my machine. I then just accept the notification and it allows me to connect. Even after installing it nothing really changed. Would this indicate that something is set up wrong with the RADIUS server? The debug logs confirm that a TLS handshake is complete. Many thanks!

3 10

Hashing of Debug Log Passwords
by FreeRAD 06 Nov '24

06 Nov '24

Hi All, I've hashed the passwords in my DB and made it so that the RADIUS server, a) uses the hashed passwords b) doesn't store the cleartext passwords in the 'radpostauth' table. Think I know the answer to this already but is it possible to hash/hide the passwords being seen in the debug logs (e.g. freeradius -X)? Pretty sure this is a no since the server needs to see the password at some point but thought I would ask. Thanks!

2 2

debugging SSL self-signed cert issues
by Malcolm Herbert 05 Nov '24

05 Nov '24

Hi - I've had a long-running setup with freeradius 3.0.16 which I acknowledge is likely quite ancient now, but I've barely had to touch it since I set it up about 4y ago ... I've been using self-signed certificate-based auth for our mobile label printers for some time without problems but after a CA certificate expiry extension (retaining the original CA key, pushing the notAfter date out) and creation of a new server-side certificate on my radius server, the clients will now generate a bad certificate alert whenever I try using it. I can replace the original server-side cert and things are ok again, so - something clearly is wrong with the new cert, but I haven't been able to pinpoint what. The old and new server cert have the same information, barring minor differences between their SANs and relevant dates. I've confirmed that openssl can verify both the old and new server certs against both the old and new CA certs and it seems to think everything is fine. For testing purposes, half the printers have been given the updated CA cert and the others are on the same original CA cert but this side of the equation doesn't appear to change the result - printers configured with either will start having issues if I start using the new server cert. I don't want to spam the list with long radiusd debug traces unless requested as I definitely think this is a cert issue of my own making, but I'm stumped as to how to get more information to isolate the underlying cause. Has anyone else encountered this problem before? Here's just the SSL negotiation in the working (original server cert) case: : : (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x8abbb4538a68ad3a (1) eap: Finished EAP session with state 0x8abbb4538a68ad3a (1) eap: Previous EAP request found for state 0x8abbb4538a68ad3a, released from the list (1) eap: Peer sent packet with method EAP PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Continuing EAP-TLS (1) eap_peap: Peer indicated complete TLS record size will be 296 bytes (1) eap_peap: Got complete TLS record (296 bytes) (1) eap_peap: [eaptls verify] = length included (1) eap_peap: (other): before SSL initialization (1) eap_peap: TLS_accept: before SSL initialization (1) eap_peap: TLS_accept: before SSL initialization (1) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0123] (1) eap_peap: TLS_accept: SSLv3/TLS read client hello (1) eap_peap: >>> send TLS 1.2 [length 0039] (1) eap_peap: TLS_accept: SSLv3/TLS write server hello (1) eap_peap: >>> send TLS 1.2 [length 0d2c] (1) eap_peap: TLS_accept: SSLv3/TLS write certificate (1) eap_peap: >>> send TLS 1.2 [length 01cd] (1) eap_peap: TLS_accept: SSLv3/TLS write key exchange (1) eap_peap: >>> send TLS 1.2 [length 0004] (1) eap_peap: TLS_accept: SSLv3/TLS write server done (1) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_peap: In SSL Handshake Phase (1) eap_peap: In SSL Accept mode (1) eap_peap: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 212 length 1004 (1) eap: EAP session adding &reply:State = 0x8abbb4538b6fad3a (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored : : Here is the same again in the failed (new server cert) case: : : (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x5f15dbf65b3fc265 (5) eap: Finished EAP session with state 0x5f15dbf65b3fc265 (5) eap: Previous EAP request found for state 0x5f15dbf65b3fc265, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer indicated complete TLS record size will be 7 bytes (5) eap_peap: Got complete TLS record (7 bytes) (5) eap_peap: [eaptls verify] = length included (5) eap_peap: <<< recv TLS 1.2 [length 0002] (5) eap_peap: ERROR: TLS Alert read:fatal:bad certificate (5) eap_peap: TLS_accept: Need to read more data: error (5) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate (5) eap_peap: In SSL Handshake Phase (5) eap_peap: In SSL Accept mode (5) eap_peap: SSL Application Data (5) eap_peap: ERROR: TLS failed during operation (5) eap_peap: ERROR: [eaptls process] = fail (5) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (5) eap: Sending EAP Failure (code 4) ID 42 length 4 (5) eap: Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Post-Auth-Type REJECT { : : Regards, Malcolm -- Malcolm Herbert mjch(a)mjch.net

2 2

Duplicate "object" definition
by Alex Zetaeffesse 04 Nov '24

04 Nov '24

Hi all, I apologize if I don't use the right terminology. I'm playing/testing with 3.2.6 to better understand how freeradius behaves when finding duplicate definitions. I created a copy of the filter policy, calling it policy.d/filter2 and I defined the object/policy filter_username in this way: filter_username { if (&User-Name) { reject } } Now, when in the directory policy.d I only have the file filter2, I always get the expected Access-Reject, if I just have the default file filter I get Access-Accept (the user is correctly configured in the file users). If I have both files (filter and filter 2), when I launch radiusd -X I get, the file filter is loaded first and then the file filter2 ... *including configuration file /etc/freeradius/policy.d/filter <<<*including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/accounting *including configuration file /etc/freeradius/policy.d/filter2 <<<* ... and I always get Access-Accept. How are duplicate objects treated? Is the first definition that's retained or the last? From my experiment it seems the first is retained. May you please confirm? Regards, Alex

3 3

Check LDAP if object exist with filter based on user's certificate attributest after EAP-TLS auth succeeds?
by Alexey D. Filimonov 04 Nov '24

04 Nov '24

In short, I have EAP-TLS auth, and I need to check if there is an LDAP object that has value of `TLS-Client-Cert-Subject-Alt-Name-Upn` in `krbCanonicalName` attribute and it's `createTimestamp` is less or equal than `TLS-Client-Cert-Valid-Since` value. 1. I found that `TLS-Client-Cert-Subject-Alt-Name-Upn` attribute is created only inside `authenticate { Auth-Type eap { ... }}` section. Is it correct that I have no access to certificate properties inside `authorize` section? 2. Next, I found that according to [rlm_ldap guide from networkradius](https://www.networkradius.com/doc/current/raddb/mods-availab…, ldap module can `look for user` only inside `authorize` section, but not inside `authenticate`. Is it correct I can not make a check for existence of an object in LDAP from `authenticate` section using `rlm_ldap` module, and only xlat-ing can be used? 3. I found that there are some xlat functions exposed by `rlm_ldap` module, but they are only mentioned in my `mods-available/ldap`, and not documented in `3.2.x` branch on github. I vave FreeRADIUS version from debian-stable and it is `3.2.1`. Is raddb/mods-available/ldap from master branch is useful as documentation for 3.2.1 ldap?

2 3

How to bypass some logic during EAP-TLS auth?
by Alexey D. Filimonov 03 Nov '24

03 Nov '24

Currently I have several if()s in authorize{} before eap and I think I can not move it past EAP call But during EAP authentication I see this logic gets executed 8(!) times in -X debug session. Can I wrap those if()s into some rule like "If session is new, then execute wrapped logic, else - just bypass wrapped block"? authorize { if (!(&NAS-Port-Type && &NAS-Port-Type == Wireless-802.11)) { update request { &Module-Failure-Message += 'Rejected: NAS-Port-Type is not Wireless-802.11.' } reject } rewrite_called_station_id if (!Called-Station-SSID) { update request { &Module-Failure-Message += 'Rejected: No SSID in Called-Station-Id' } reject } if ("%{client:vlan_for_%{Called-Station-SSID}}") { update session-state { Tunnel-Type := VLAN # rfc3580 Tunnel-Medium-Type := IEEE-802 #rfc2628 Tunnel-Private-Group-Id := "%{client:vlan_for_%{Called-Station-SSID}}" # string, rfc2628 } } else { update request { &Module-Failure-Message += "Rejected: No vlan_for_%{Called-Station-SSID} defined for client %{client:shortname}" } reject } if (!(&User-Name)) { update request { &Module-Failure-Message += 'Rejected: User-Name not provided.' } reject } eap_wifi { ok = return updated = return } } authenticate { eap_wifi }

3 2

dynamic client
by mohamed almeshal 03 Nov '24

03 Nov '24

dear all this config file for dynamic client work fine without any problems but my goal is to accept any connection from any nas I try to do * in ipaddr but didn't work also I try it with listen part but also not work # SQL_LISTEN_CONFIG_START listen { type = auth port = 1812 ipaddr = * proto = udp limit { max_pps = 1000 } } listen { type = acct port = 1813 ipaddr = * proto = udp limit { max_pps = 1000 } } # SQL_LISTEN_CONFIG_END client dynamic { # CLIENT_IPADDR_START ipaddr = 0.0.0.0/0 # CLIENT_IPADDR_END dynamic_clients = dynamic_clients lifetime = 1 } server dynamic_clients { authorize { if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { update control { &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" &FreeRADIUS-Client-Require-MA = no &FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" } ok } } }

1 0

Ignoring duplicate packet from client
by Mamun Ahmed 02 Nov '24

02 Nov '24

Hello, I'm using Ubuntu server 22.04 and FreeRADIUS Version 3.0.26 I'm trying to connect with Mikrotik and my mikrotik has 267 users but when users are trying to connect to freeradius the freeradius Error: (0) Ignoring duplicate packet from client SaraNet port 46328 - ID: 175 due to unfinished request in component authorize module sql. my database server is capable of handling 267 users and also freeradius server. database resource 2GB Memory and 2 CPU freeradius resource 1GB Memory and 1CPU can you guide me? how can I prevent duplicate packet from client. Is Freeradius have by default configuration to prevent duplicate packet from client or any configuration?. I need to solve this error anyway. I'm trying to solve this problem by changing some the freeradius configuration but I can't solve it. Fri Sep 6 07:03:22 2024 : Info: Loaded virtual server inner-tunnel Fri Sep 6 07:03:22 2024 : Info: Ready to process requests Fri Sep 6 07:06:44 2024 : Error: (0) Ignoring duplicate packet from client SaraNet port 46328 - ID: 175 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (1) Ignoring duplicate packet from client SaraNet port 45985 - ID: 176 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (2) Ignoring duplicate packet from client SaraNet port 54469 - ID: 177 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (3) Ignoring duplicate packet from client SaraNet port 57714 - ID: 178 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (4) Ignoring duplicate packet from client SaraNet port 37314 - ID: 179 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (5) Ignoring duplicate packet from client SaraNet port 52315 - ID: 180 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (7) Ignoring duplicate packet from client SaraNet port 38181 - ID: 182 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (6) Ignoring duplicate packet from client SaraNet port 48777 - ID: 181 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (8) Ignoring duplicate packet from client SaraNet port 49147 - ID: 183 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (9) Ignoring duplicate packet from client SaraNet port 38949 - ID: 184 due to unfinished request in component authorize module sql *Sincerly* Mamun Ahmed

3 2