September 2024 - Freeradius-Users - lists.freeradius.org

Users randomly rejected when no connection with remote domain controllers
by Rodrigo Abrantes Antunes 06 Sep '24

06 Sep '24

Hi all, My institution has multiple AD domain controllers, one for each campus, all of them respond for the same domain and connect to each other through internet using a vpn. One of the servers is located in my campus and freeradius authenticates directly against this server. When the vpn is up, everything works as it should but when the vpn is down, users sometimes can't authenticate. This seems to be random, users authenticate normally then suddenly can't and suddenly can again. When they are rejected I see this in debug: ... (2535) mschap: --> --username=gloriasantos (2535) mschap: Creating challenge hash with username: gloriasantos (2535) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (2535) mschap: --> --challenge=2aa82edbd744104d (2535) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (2535) mschap: --> --nt-response=7c9a6934a7363630b270dddeb82ad6f347a54a1ff9fc768c Child PID 64739 is taking too much time: forcing failure and killing child. (2535) mschap: ERROR: Failed to read from child output (2535) mschap: External script failed (2535) mschap: ERROR: External script says: (2535) mschap: ERROR: MS-CHAP2-Response is incorrect (2535) eap_mschapv2: [mschap] = reject ... And at this moment, if I try the command "ntlm_auth --username=user --password=pass" it takes more time than it should and then succeds. The pid 64739 is ntlm_auth I think. Everything in freeradius, samba, and dns configuration points to the local active directory domain controller, but it seems that when vpn is down something is still trying to contact the remote domain controllers (which are unavailable). Any ideas of what might be happening? Feel free to ask for needed configuration. Freeradius 3.2.1 Samba 4.17.9-Debian

3 6

Huawei dictionary updates
by nabble＠felix.world 06 Sep '24

06 Sep '24

Hi there, We had issues with some Huawei switches where the VP-Tuples could not be populated to the python module. Turns out, that the dictionary file of Huawei is outdated or at least, the switches we have use a different definition. From https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/share/dictionar… The link https://support.huawei.com/enterprise/en/doc/EDOC1100055480/6a2e56b2/descri… can not be reached anymore. The current documentation for our switches regarding the radius attributes is: https://support.huawei.com/enterprise/en/doc/EDOC1000178178/35071f9a/radius… Also the definition from this guy matches also the one which I have: https://github.com/FreeRADIUS/freeradius-server/pull/5016 Attribute missmatiching examples: FreeRADIUS: - 253 = Huawei-Web-URL (string) - 153 = Huawei-User-Mac (string) - 154 = Huawei-DNS-Server-IPv6-address (ipv6address) Huawei: - 253 = Huawei-Framed-IPv6-Address (ipaddr) - 153 = Huawei-Access-Type (integer) - 154 = Missing?? I’ve not gone through every attribute from the Huawei. Before I open a PR on GitHub I wanted to ask if there is a general process in those dictionary files. Because there will be several devices out there which have the old definition from Huawei. Therefore just changing the dictionary file sound a bit dangerous but FreeRADIUS has also no chance to apply dictionary files based on the version of the switches. So is there a process (I couldn't think of one) instead of just updating the dictionary files? BR, Lineconnect

2 3

Freeradius EAP-TLS and LDAP
by Lennart Johansson 05 Sep '24

05 Sep '24

Hello, my fist question here, so bare with me The solution is perhaps simple, but I cant seem to figure it out I want to setup vpn authentication for users using Freeradius as Radius backend in vpn server User certificates are created using a Edirectory server that also is CA and ldap server What do I have to do to configure Freeradius role in this, if I search for solutions online, most is related to AD and MS NPS. My understanding is that EAP-TLS requires that the vpn server pass the certificate request to Freeradius and Freeradius is verifying the certificate and reply with a accept or deny. But what is needed for Freeradius to verify the certificate, is it only that the CA certificate to verify that the certificate is issued by that CA or is it possible for Freeradius to pick the subject or SAN like email address and to a lookup in LDAP to get specific group or attribute back and based on that respond with accept or deny? Or how to you do it? /Lennart Med vänlig hälsning/Kind regards Lennart Johansson Telefon: +4610 5516810 Mobil: +4670 2334116 B-IQ Business in Quaternion AB Kivra: 556949-6648 106 31 Stockholm Sverige/Sweden

2 1

Freeradius realms and/or user issue
by Nick Ryce 05 Sep '24

05 Sep '24

I'm currently running freeradius (on v2.1.22, don't shoot me) with sql backend. I need to accept *(a)randombroadband.co.uk<mailto:*@randombroadband.co.uk> and send an Access Accept. I have defined the realm in proxy.conf as below: realm randombroadband.co.uk { authhost = LOCAL nostrip } in my users file I have the following: DEFAULT User-Name =~ "@randombroadband.co.uk" Auth-Type := Accept In the logs we have the following rad_recv: Access-Request packet from host a.b.c.d port 61384, id=49, length=183 User-Name = moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> User-Password = "moo" Service-Type = Framed-User Framed-Protocol = PPP Chargeable-User-Identity = "" Acct-Session-Id = "9277500" ERX-Dhcp-Mac-Addr = "abcd.0000.0001" NAS-Identifier = "LNS1" NAS-Port = 4095 NAS-Port-Id = "-0/0/0.0" NAS-Port-Type = Ethernet ERX-Pppoe-Description = "pppoe ab:cd:00:00:00:01" NAS-IP-Address = a.b.c.d # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "randombroadband.co.uk" for User-Name = moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> [suffix] Found realm "randombroadband.co.uk" [suffix] Adding Realm = "randombroadband.co.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] expand: %{User-Name} -> moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> [files] users: Matched entry DEFAULT at line 165 [files] expand: %{User-Name} -> moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> ++[files] returns ok [sql] expand: %{User-Name} -> moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> [sql] sql_set_user escaped user --> 'moo(a)randombroadband.co.uk' rlm_sql (sql): Reserving sql socket id: 48 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'moo(a)randombroadband.co.uk' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'moo(a)randombroadband.co.uk' ORDER BY priority rlm_sql (sql): Released sql socket id: 48 [sql] User moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. So it finds the realm and the user in the user file then seems to ignore the accept and decides to lookup the SQL table. Is there any way to get it to stop that once it gets to the accept from the users file? Thanks

2 1

Can I change permissions under /var/log/radius ?
by White, Daniel E. (GSFC-764.0)[AEGIS] 05 Sep '24

05 Sep '24

I need to allow our network engineers to see the logs without giving them sudo access to the entire server. I can tinker a bit in /etc/logrotate.d/radius, but that will not guarantee the directory permissions under /var/log/radius/radacct ? A side question: There was a comment in /etc/logrotate.d/radius about setting "detailfile" in radius.conf, but then /etc/raddb/README.rst says it was deprecated. Is there any way to change the name of the files and directories under /var/log/radius/radacct ?

2 1

Reopening old defect
by BuzzSaw Code 05 Sep '24

05 Sep '24

Apologies in advance if this is irregular but was hoping we could get an old defect on github reopened: https://github.com/FreeRADIUS/freeradius-server/issues/4327 I've added more information and finally had the cycles to verify the issue. I know this is issue necromancy since years have passed, but I'd like to help get this fixed.

2 1

Users rejected when no connection with remote domain controllers
by Rodrigo Abrantes Antunes 03 Sep '24

03 Sep '24

Hi all, My institution has multiple AD domain controllers, one for each campus, all of them respond for the same domain and connect to each other through internet using a vpn. One of the servers is located in my campus and freeradius authenticates directly against this server. When the vpn is up, everything works as it should but when the vpn is down, users sometimes can't authenticate. This seems to be random, users authenticate normally then suddenly can't and suddenly can again. When they are rejected I see this in debug: ... (2535) mschap: --> --username=gloriasantos (2535) mschap: Creating challenge hash with username: gloriasantos (2535) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (2535) mschap: --> --challenge=2aa82edbd744104d (2535) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (2535) mschap: --> --nt-response=7c9a6934a7363630b270dddeb82ad6f347a54a1ff9fc768c Child PID 64739 is taking too much time: forcing failure and killing child. (2535) mschap: ERROR: Failed to read from child output (2535) mschap: External script failed (2535) mschap: ERROR: External script says: (2535) mschap: ERROR: MS-CHAP2-Response is incorrect (2535) eap_mschapv2: [mschap] = reject ... And at this moment, if I try the command "ntlm_auth --username=user --password=pass" it takes more time than it should and then succeds. The pid 64739 is ntlm_auth I think. Everything in freeradius, samba, and dns configuration points to the local active directory domain controller, but it seems that when vpn is down something is still trying to contact the remote domain controllers (which are unavailable). Any ideas of what might be happening? Feel free to ask for needed configuration. Freeradius 3.2.1 Samba 4.17.9-Debian

1 0