- Freeradius-Users - lists.freeradius.org

Proxy response_window issue
by JS SV 14 Jun '22

14 Jun '22

Hi, I'm having a behavior that I don't fully understand when using proxy timers. I am using radclient to do the tests and I find that if radclient sends, for example, 3 retransmissions (timeout) the timers do not add up. I have the following configuration for home_server: response_window = 20 zombie_period = 40 check_interval = 30 num_answers_to_alive = 3 fail no response no response ------>|-------------------------------->|---------------------------------->|-------------------- req. response_window zombie_period (dead) 20s 40s The part that doesn't work for me is the response_window, if only one request is sent with radclient it goes well, the problem comes if more are sent, I add the debug: (0) Mon Jun 13 13:02:59 2022: Debug: Received Access-Request Id 205 from 127.0.0.1:60690 to 127.0.0.1:1812 length 236 (0) Mon Jun 13 13:02:59 2022: Debug: User-Name = "000a0b0c0d0f" ... (0) Mon Jun 13 13:02:59 2022: Debug: NAS-IP-Address = 10.10.36.50 (0) Mon Jun 13 13:02:59 2022: Debug: # Executing section authorize from file /etc/raddb/sites-enabled/default (0) Mon Jun 13 13:02:59 2022: Debug: authorize { ... (0) Mon Jun 13 13:02:59 2022: Debug: } # authorize = updated (0) Mon Jun 13 13:02:59 2022: Debug: Starting proxy to home server 10.10.39.211 port 1812 (0) Mon Jun 13 13:02:59 2022: Debug: server default { (0) Mon Jun 13 13:02:59 2022: Debug: } (0) Mon Jun 13 13:02:59 2022: Debug: Sent Access-Request Id 145 from 0.0.0.0:42987 to 10.10.39.211:1812 length 237 (0) Mon Jun 13 13:02:59 2022: Debug: User-Name = "000a0b0c0d0f" ... (0) Mon Jun 13 13:02:59 2022: Debug: Proxy-State = 0x323035 (0) Mon Jun 13 13:02:59 2022: Debug: Expecting proxy response no later than 19.673084 seconds from now (0) Mon Jun 13 13:03:04 2022: Debug: Sending duplicate proxied request to home server 10.10.39.211 port 1812 - ID: 145 (0) Mon Jun 13 13:03:04 2022: Debug: Sent Access-Request Id 145 from 0.0.0.0:42987 to 10.10.39.211:1812 length 237 (0) Mon Jun 13 13:03:04 2022: Debug: User-Name = "000a0b0c0d0f" ... (0) Mon Jun 13 13:03:04 2022: Debug: Event-Timestamp = "Jun 13 2022 13:02:59 CEST" (0) Mon Jun 13 13:03:04 2022: Debug: Proxy-State = 0x323035 (0) Mon Jun 13 13:03:09 2022: Debug: Sending duplicate proxied request to home server 10.10.39.211 port 1812 - ID: 145 (0) Mon Jun 13 13:03:09 2022: Debug: Sent Access-Request Id 145 from 0.0.0.0:42987 to 10.10.39.211:1812 length 237 (0) Mon Jun 13 13:03:09 2022: Debug: User-Name = "000a0b0c0d0f" ... (0) Mon Jun 13 13:03:09 2022: Debug: Event-Timestamp = "Jun 13 2022 13:02:59 CEST" (0) Mon Jun 13 13:03:09 2022: Debug: Proxy-State = 0x323035 (0) Mon Jun 13 13:03:19 2022: Debug: Expecting proxy response no later than 9.993284 seconds from now (0) Mon Jun 13 13:03:29 2022: Debug: No proxy response, giving up on request and marking it done (0) Mon Jun 13 13:03:29 2022: ERROR: Failing proxied request for user "000a0b0c0d0f", due to lack of any response from home server 10.10.39.211 port 1812 (0) Mon Jun 13 13:03:29 2022: Debug: Clearing existing &reply: attributes (0) Mon Jun 13 13:03:29 2022: Debug: Found Post-Proxy-Type Fail-Authentication (0) Mon Jun 13 13:03:29 2022: Debug: server default { (0) Mon Jun 13 13:03:29 2022: Debug: # Executing group from file /etc/raddb/sites-enabled/default (0) Mon Jun 13 13:03:29 2022: Debug: Post-Proxy-Type Fail-Authentication { (0) Mon Jun 13 13:03:29 2022: Debug: policy accept { (0) Mon Jun 13 13:03:29 2022: Debug: update control { (0) Mon Jun 13 13:03:29 2022: Debug: } # update control = noop (0) Mon Jun 13 13:03:29 2022: Debug: [handled] = handled (0) Mon Jun 13 13:03:29 2022: Debug: } # policy accept = handled (0) Mon Jun 13 13:03:29 2022: Debug: } # Post-Proxy-Type Fail-Authentication = handled (0) Mon Jun 13 13:03:29 2022: Debug: } (0) Mon Jun 13 13:03:29 2022: Debug: # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) Mon Jun 13 13:03:29 2022: Debug: Sent Access-Accept Id 205 from 127.0.0.1:1812 to 127.0.0.1:60690 length 0 (0) Mon Jun 13 13:03:29 2022: Debug: Finished request (0) Mon Jun 13 13:03:34 2022: Debug: Cleaning up request packet ID 205 with timestamp +7 I can see in the first request that the timer starts at 20s (13:02:59) but when I receive the third request, the timer has 10s left (13:03:19) when it should have finished, right? What are these extra 10s due to? Thanks!

2 5

Certificate import
by 网络时代 14 Jun '22

14 Jun '22

Hello, System version: Centos linux release 7.9.2009 Radius version: Freeradius-server-3.0.21 source code compilation and installation Routing: MikroTik v 6.48.6 As shown in the image below, the certificate with the red box is created by Freeradius and imported into MikroTik, with the "MikroTik" flag, created for the router itself. As can be seen from the comparison in the figure, the certificate created by Freeradius and imported into MikroTik is relative to the certificate created by the router itself, and there are no relevant parameters in the red box. 1. Is it normal that there is no "Key Usage" in the ca certificate? If not, how to modify ca.cnf? 2. Is it normal that the CA item in the status of the server certificate is empty? In addition, how to modify server.cnf and add the DNS parameter in "Subject Alt. Name"? Best regards

1 0

User name case insensitivity - revisited
by Luveh Keraph 13 Jun '22

13 Jun '22

I thought I had grasped what is involved in making FreeRADIUS 3.0.* to process user names in a case-insensitive way, but I am not so sure now. Here is what I have done: First, I added the following line in my /etc/raddb/mods-enabled/files: key = "%{%{Stripped-User-Name}:-%{tolower:%{User-Name}}}" I launched my FreeRADIUS server after ths. I have the following entry in my /etc/raddb/users file: ijk_user1 User-Password != "IJKpassword1" ijk_user1 Cleartext-Password := "IJKpassword1" With this, when I try to ssh as IJK_User1 (notice the mixed case) into a system that turns over authentication to my FreeRADIUS server, I get the following debugging information at this server: Sat Jun 11 11:02:25 2022 : Debug: (0) files: EXPAND %{%{Stripped-User-Name}:-%{tolower:%{User-Name}}} Sat Jun 11 11:02:25 2022 : Debug: (0) files: --> ijk_user1 Sat Jun 11 11:02:25 2022 : Debug: (0) files: users: Matched entry ijk_user1 at line 447 Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) Sat Jun 11 11:02:25 2022 : Debug: (0) [files] = ok Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) Sat Jun 11 11:02:25 2022 : Debug: (0) [expiration] = noop Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) Sat Jun 11 11:02:25 2022 : Debug: (0) [logintime] = noop Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) Sat Jun 11 11:02:25 2022 : Debug: (0) [pap] = updated Sat Jun 11 11:02:25 2022 : Debug: (0) } # authorize = updated Sat Jun 11 11:02:25 2022 : Debug: (0) Found Auth-Type = PAP Sat Jun 11 11:02:25 2022 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Sat Jun 11 11:02:25 2022 : Debug: (0) Auth-Type PAP { Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authenticate]: calling pap (rlm_pap) Sat Jun 11 11:02:25 2022 : Debug: (0) pap: Login attempt with password "IJKpassword1" (12) Sat Jun 11 11:02:25 2022 : Debug: (0) pap: Comparing with "known good" Cleartext-Password "IJKpassword1" (12) Sat Jun 11 11:02:25 2022 : Debug: (0) pap: User authenticated successfully Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authenticate]: returned from pap (rlm_pap) Sat Jun 11 11:02:25 2022 : Debug: (0) [pap] = ok Sat Jun 11 11:02:25 2022 : Debug: (0) } # Auth-Type PAP = ok Sat Jun 11 11:02:25 2022 : Debug: (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default Sat Jun 11 11:02:25 2022 : Debug: (0) post-auth { Sat Jun 11 11:02:25 2022 : Debug: (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { Sat Jun 11 11:02:25 2022 : Debug: (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE Sat Jun 11 11:02:25 2022 : Debug: (0) update { Sat Jun 11 11:02:25 2022 : Debug: (0) No attributes updated for RHS &session-state: Sat Jun 11 11:02:25 2022 : Debug: (0) } # update = noop Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec) Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec) Sat Jun 11 11:02:25 2022 : Debug: (0) [exec] = noop Sat Jun 11 11:02:25 2022 : Debug: (0) policy remove_reply_message_if_eap { Sat Jun 11 11:02:25 2022 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) { Sat Jun 11 11:02:25 2022 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Sat Jun 11 11:02:25 2022 : Debug: (0) else { Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[post-auth]: calling noop (rlm_always) Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[post-auth]: returned from noop (rlm_always) Sat Jun 11 11:02:25 2022 : Debug: (0) [noop] = noop Sat Jun 11 11:02:25 2022 : Debug: (0) } # else = noop Sat Jun 11 11:02:25 2022 : Debug: (0) } # policy remove_reply_message_if_eap = noop Sat Jun 11 11:02:25 2022 : Debug: (0) } # post-auth = noop Sat Jun 11 11:02:25 2022 : Debug: (0) Sent Access-Accept Id 64 from 192.168.0.55. 23:1812 to 192.168.0.66:60600 length 0 Which is fine: the user name gets converted from IJK_User1 to ijk_user1 and the authentication with password IJKpassword1 succeeds, as expected. I then changed the relevant entry in my /etc/raddb/users file as follows: IJK_User1 User-Password != "IJKpassword1" IJK_User1 Cleartext-Password := "IJKpassword1" After restarting the FreeRADIUS server I attempted the same log in as before. This is what I got in my traces: Sat Jun 11 11:48:54 2022 : Debug: (0) files: EXPAND %{%{Stripped-User-Name}:-%{tolower:%{User-Name}}} Sat Jun 11 11:48:54 2022 : Debug: (0) files: --> ijk_user1 Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) Sat Jun 11 11:48:54 2022 : Debug: (0) [files] = noop Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) Sat Jun 11 11:48:54 2022 : Debug: (0) [expiration] = noop Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) Sat Jun 11 11:48:54 2022 : Debug: (0) [logintime] = noop Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) Sat Jun 11 11:48:54 2022 : WARNING: (0) pap: No "known good" password found for the user. Not setting Auth-Type Sat Jun 11 11:48:54 2022 : WARNING: (0) pap: Authentication will fail unless a "known good" password is available Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) Sat Jun 11 11:48:54 2022 : Debug: (0) [pap] = noop Sat Jun 11 11:48:54 2022 : Debug: (0) } # authorize = ok Sat Jun 11 11:48:54 2022 : ERROR: (0) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject Sat Jun 11 11:48:54 2022 : Debug: (0) Failed to authenticate the user Sat Jun 11 11:48:54 2022 : Debug: (0) Using Post-Auth-Type Reject If I understand things correctly, the key = ... line that I added to the files file does indeed recast the incoming user name to lowercase. However, the FreeRADIUS server still compares incoming user names against those in the users file in a case sensitive way. This is fine, but not quite what I was looking for. Is it possible to get FreeRADIUS to compare user names (and user names alone - not passwords) in a real case-insensitive way against those in the /etc/raddb/users file?

4 6

MySQL Stored Procedure
by Aurélio de Souza Ribeiro Neto 11 Jun '22

11 Jun '22

Hello All, I'm using Freeradius 3.0.25-2 on Linux Ubunt and MySQL 5.7 and Mikrotik NAS Sometimes, if I have a energy fault on equipment, I have to many simultaneous authentication packets from same user. When it happens, the same user can use 2 ou more IPs from my Pool simultaneous. Is there a way to write a MySQL Stored Procedure to clean this faults? Someone can help-me with this? Thanks Aurélio

2 1

Releasing 3.0.26 and 3.2.0 soon
by Alan DeKok 11 Jun '22

11 Jun '22

We're going to release 3.0.26 and 3.2.0 in the near future. After months of work, they're finally ready for release. The delays were due to two issues. One was the release of OpenSSL3. It behaves differently than previous versions of OpenSSL, and it took a while to track down exactly what was going on. Thanks to Alex Clouter for patches. The second delay was due to Windows 11 inter-operability. We've been working closely with the Windows team to ensure that their software works with ours, and vice-versa. The use of TLS 1.3 complicates things, as TLS 1.3 is substantially different from earlier versions of TLS. Thanks again to Alex Clouter for testing and patches. We will be releasing 3.2.0 as the "new feature" branch of the v3 series. 3.2 will be 100% configuration compatible with 3.0, but will have new features which are not available in the main 3.0 release. We will be continuing to maintain 3.0 for the forseeable future. However, it will be "feature frozen". The only patches going into 3.0 will be bug fixes. This helps to ensure stability and low cost of maintenance. Matthew Newton is the v3 release manager, and can comment more if needed. Alan DeKok.

5 7

Python module for FreeRADIUS
by Klara Mall 09 Jun '22

09 Jun '22

Hi, does anybody know why there is no Debian package for the FreeRADIUS Python module in the networkradius.com Debian repository[0]? We use the Debian packages from networkradius.com and not from Debian itself to have the recent version running. But now we need the Python module and wonder why there's no Debian package there. Moreover the package in Debian itself depends on the version (= not >=) of the freeradius package, so it can't be installed with the newer recent freeradius package version. Does anybody has any hints on this? Best regards Klara [0] https://networkradius.com/packages/ -- Karlsruher Institut für Technologie (KIT) Steinbuch Centre for Computing (SCC) Klara Mall Abteilungsleiter Netze und Telekommunikation (NET) Zirkel 2, Geb. 20.21, R. 001.1 76131 Karlsruhe Telefon: +49 721 608-48946 E-Mail: klara.mall(a)kit.edu Web: http://www.scc.kit.edu Sitz der Körperschaft: Kaiserstraße 12, 76131 Karlsruhe KIT – Die Forschungsuniversität in der Helmholtz-Gemeinschaft

2 3

MySQL Stored Procedure
by Aurélio de Souza Ribeiro Neto 09 Jun '22

09 Jun '22

1 0

Help - MySQL Stored Procedure
by Aurélio de Souza Ribeiro Neto 09 Jun '22

09 Jun '22

2 1

Support for blank password in EAP/PEAP
by sachin shetty 09 Jun '22

09 Jun '22

Hello, I'm using freeradius for VPN and WIFI clients implementing a passwordless solution where users are only required to enter the username, and I want to authenticate users using MFA. I achieved the same using the VPN client as it uses PAP, and it succeeded. Whereas wrt to Wifi client where it uses EAP/PEAP; I'm observing the communication ends at Access-Challenge sent from radius server. i.e., the wifi client doesn't acknowledge the Challenge and ends up with a Login error. I took the TCP dump and verified Access-Challenge attributes in working and non-working scenarios, and I see the number of attributes sent is the same (although not sure of the value) I even tried to set NT:Password to empty String md5 value ( 0x31D6CFE0D16AE931B73C59D7E0C089C0), still vain attempt. Since the password is not received in the auth request and Challenge doesn't have the same information, does the wifi client ends the communication as soon as it receives Challenge? NOTE: The server certificate was imported and trusted before trying this operation and still when a blank password is sent in the Radius auth request, the handshake between client and server stops when the last Challenge is sent from the radius server. Is this a valid scenario with what I'm trying to wrt the EAP/PEAP protocol? Thanks, Sachin

2 1

RHEL 8, FreeRADIUS. LDAP, and Active Directory
by White, Daniel E. (GSFC-770.0)[AEGIS] 06 Jun '22

06 Jun '22

I am closer, but not quite there. I got "radtest -x <user> <clear text password> localhost 0 testing123" to work. I do not want passwords spewing over the network in cleartext, but I cannot get "radtest -x -t mschap <user> <clear text password> localhost 0 testing123" working. I get this is the server output: (0) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (0) mschap: Client is using MS-CHAPv1 with NT-Password (0) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (0) mschap: ERROR: MS-CHAP2-Response is incorrect I tried looking for a way to force mschapv2 but could find nothing. I tried using "{nthash}..." for the password after finding smbencrypt, but no joy. How do I either pass in an NT Password or get FR to encrypt the Cleartext-Password given ?

2 1