- Freeradius-Users - lists.freeradius.org

Best Script
by mohamed almeshal 17 Sep '21

17 Sep '21

dear savers, which lanaguge is the best for writing the external script for implement in freeradius , bash , php . thanks alot

2 1

Problem when trying to store NAS-Port-ID into radpostauth table
by Antônio Modesto 17 Sep '21

17 Sep '21

Hi, I added a column to the radpostauth table to store the NAS-Port-ID, but I am noticing a strange behaviour for a specific type of NAS. Using tcpdump, I can see that the NAS-Port-Id attributes arrives in the following format: NAS-Port-Id Attribute (87), length: 38, Value: slot=0;subslot=2;port=1;vlanid=1110; But when I check what is being stored in the radpostauth table and in the radacct table, I get something like this: slot=3D3D0=3D3Bsubslot=3D3D2=3D3Bport=3D3D0=3D3Bvlanid=3D3D1001=3D3B I am using the following expression in my queries.conf to get the value of this attribute from the request: NULLIF('%{%{NAS-Port-ID}:-%{NAS-Port}}', '') It seems like unlang is encoding the value somehow. Do you guys have any suggestion?

3 10

eap_tls: Failed to read from child output
by Burn Zero 16 Sep '21

16 Sep '21

Hi, Our laptops are using Certificate authentication (EAP-TLS) to connect to the wifi network. Sometimes, I get the following errors in FreeRADIUS servers: Fri Sep 10 10:59:58 2021 : Auth: (185911) Login incorrect (eap_tls: Failed to read from child output): [machinename] (from client WIFI-WLC port 49315 cli Fri Sep 10 10:59:59 2021 : Auth: (185947) Login incorrect (eap_tls: Failed to read from child output): [machinename] (from client WIFI-WLC port 49315 cli Fri Sep 10 10:59:59 2021 : Auth: (185951) Login incorrect (eap_tls: Failed to read from child output): [machinename] (from client WIFI-WLC port 49315 cli Fri Sep 10 10:59:59 2021 : Auth: (185949) Login incorrect (eap_tls: Failed to read from child output): [machinename] (from client WIFI-WLC port 49315 cli Fri Sep 10 10:59:59 2021 : Auth: (185986) Login incorrect (eap_tls: Failed to read from child output): [machinename] (from client WIFI-WLC port 49315 cli It is very random and also we are not able to reproduce the issue. I have searched on the internet and freeradius mailing list archives and I don't see such issues discussed before. Could you please help on how to move forward? Thank you.

2 1

StrongSwan IKEv2 - eap-radius - Auth Failing
by Chris Myburgh 15 Sep '21

15 Sep '21

Hi Freeradius Users I am hoping you can help me. I have been battling the past couple of days getting StrongSwan (5.9.3) IKEv2 authentication by eap-radius to work. FreeRADIUS Version 3.0.23 ............ ............ ............ | (5) eap: Expiring EAP session with state 0x98fe0da799fc17eb | (5) eap: Finished EAP session with state 0x98fe0da799fc17eb | (5) eap: Previous EAP request found for state 0x98fe0da799fc17eb, released from the list | (5) eap: Peer sent packet with method EAP MSCHAPv2 (26) | (5) eap: Calling submodule eap_mschapv2 to process data | (5) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/default | (5) eap_mschapv2: authenticate { | (5) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password | (5) mschap: Creating challenge hash with username: chris | (5) mschap: Client is using MS-CHAPv2 | (5) mschap: ERROR: FAILED: No NT-Password. Cannot perform authentication | (5) mschap: ERROR: MS-CHAP2-Response is incorrect ............ ............ ............ | (5) } # Post-Auth-Type REJECT = updated | (5) Login incorrect (mschap: FAILED: No NT-Password. Cannot perform authentication): [chris/<via Auth-Type = eap>] (from client rad_clients port 8 cli 172.29.0.1[55829]) | (5) Delaying response for 1.000000 seconds | Waking up in 0.6 seconds. ================== Freeradius is using the MySQL driver (driver = "rlm_sql_mysql") and the eap module is set to use md5 as the default (default_eap_type = md5). When I do radtests directly to radius, I receive "Access-Accept" for PAP,CHAP & MSCHAP authentication types. However, radtest authentication type eap-md5 also fails stating that there is no cleartext-password in the radius logs. My users in freeradius are configured in the radcheck table with the following: ------------------------------------------------------------------------------------ id | username | attribute | op | value ================================================ 1 | chris | Cleartext-Password | := | chris12345 ------------------------------------------------------------------------------------ I've been up and down the configuration, but I cannot seem to figure it out. To me it seems that when I use the eap for authentication, it fails to lookup the radcheck table for the password. Any assistance or additional information I can provide to help the investigation? TIA __ Regards Chris Myburgh

2 5

Re: Checkrad and IPv6 NAS IP address
by Fabricio Viana 15 Sep '21

15 Sep '21

Hello! > I'll have to take a look. I'm pretty busy this week, so it might be a bit. > Alan DeKok. All right. Thanks for letting me know. I will follow the list and GitHub (v3.0.x branch). Regards Fabricio Viana

1 0

Good guest WLAN portal solution?
by Michael Schwartzkopff 15 Sep '21

15 Sep '21

Hi, perhaps this question is not completely FR related. But I'd like to ask this community anyway. What solution can you recommend for a Guest WLAN setup? We need a solution that provides a capture portal, so that the user can generate a OTP for a limited access. Also there must be a portal that the user agrees to the terms & conditions and only after agreement gets access. Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

1 0

Relase estimation for version 4?
by Michael Schwartzkopff 15 Sep '21

15 Sep '21

Hi, is there any estimation for a release date for the version 4 of FR? We would like to see the TACACS feature in the software. Then we could suggest my customer to switch from a commercial RADIUS server to FR. I assume that networkradius also will support the new features of version 4. Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

2 1

Two frreadius are connected to the same AD, and the first one is unavailable
by yanyi5496＠gmail.com 14 Sep '21

14 Sep '21

I have two freeradius on different ubuntu server, and I use freeradius to connect AD, when I configure freeradius A to connect AD, freeradius A was working, then I configure freeradius B to connect AD with same user and password, freeradius B was working, but freeradius A didn`t work, I checked their configuration, they arm same, freeradius A log is as follows: Tue Sep 14 03:02:26 2021 : Error: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: When trying to update a password, this return status indicates that the value provided as the current password is not correct. (0xc000006a)' Tue Sep 14 03:02:26 2021 : Auth: (3) Login incorrect: [sqauser/xxxxxxx] (from client 127.0.0.1 port 2 cli xxxxxxxxx) I make sure I use the correct account information, I don't know what went wrong, freeradius configuration or AD configuration. I'm really confused. Thanks Jason Chen

2 1

Retrieving Client TLS attributes for invalid/rejected requests
by Jason Healy 13 Sep '21

13 Sep '21

Hello, We're using EAP TLS and I've had no trouble pulling the TLS attributes (TLS-Client-Common-Name, etc) out of the request during normal processing. However, I'm getting several certs as revoked/expired and I'd like to get into it a little more. I could attach to debug, but I'd like to also log these failed certificates so I can chase down the users and run some reports. However, when I try to log the TLS-* attributes in Post-Auth-Type REJECT, they're empty. I'm guessing that the EAP module cleans them up on failure? I even tried to use failover to catch the invalid response as quickly as possible: eap { invalid = 1 } if (invalid) { sa_linelog_bad_cert invalid } But again all the TLS-* attributes come up blank in the linelog. I can see them in the eap_tls section, but they're gone by the time I get to linelog: (7) eap: Calling submodule eap_tls to process data (7) eap_tls: (TLS) EAP Got final fragment (827 bytes) (7) eap_tls: (TLS) EAP Done initial handshake (7) eap_tls: (TLS) Handshake state - Server SSLv3/TLS write server done (7) eap_tls: (TLS) recv TLS 1.2 Handshake, Certificate (7) eap_tls: (TLS) Creating attributes from TLS-Client-Cert-Serial certificate (7) eap_tls: (TLS) Creating attributes from server certificate (7) eap_tls: TLS-Cert-Serial := "460d875635c64859ebabee3bba64e93f" (7) eap_tls: TLS-Cert-Expiration := "390703160000Z" (7) eap_tls: TLS-Cert-Valid-Since := "190703161900Z" (7) eap_tls: TLS-Cert-Subject := "/O=Suffield Academy/CN=Suffield Academy Device Intermediate CA" (7) eap_tls: TLS-Cert-Issuer := "/O=Suffield Academy/CN=Suffield Academy Device Root CA" (7) eap_tls: TLS-Cert-Common-Name := "Suffield Academy Device Intermediate CA" (7) eap_tls: (TLS) Creating attributes from client certificate (7) eap_tls: TLS-Client-Cert-Serial := "5052ac2d40917d66343d050650939854" (7) eap_tls: TLS-Client-Cert-Expiration := "210803194948Z" (7) eap_tls: TLS-Client-Cert-Valid-Since := "210802193900Z" (7) eap_tls: TLS-Client-Cert-Subject := "/O=Suffield Academy/CN=Expired User (Fake 1234567890)" (7) eap_tls: TLS-Client-Cert-Issuer := "/O=Suffield Academy/CN=Suffield Academy Device Intermediate CA" (7) eap_tls: TLS-Client-Cert-Common-Name := "Expired User (Fake 1234567890)" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Email := "Expired User (Fake 1234567890)" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Dns := "_SA_" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Upn := "expired" (7) eap_tls: ERROR: SSL says error 10 : certificate has expired (7) eap_tls: (TLS) send TLS 1.2 Alert, fatal certificate_expired (7) eap_tls: ERROR: (TLS) Alert write:fatal:certificate expired (7) eap_tls: ERROR: (TLS) Server : Error in error (7) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (7) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (7) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation (7) eap_tls: ERROR: [eaptls process] = fail (7) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (7) eap: Sending EAP Failure (code 4) ID 229 length 4 (7) eap: Failed in EAP select (7) [eap] = invalid (7) if (invalid) { (7) if (invalid) -> TRUE (7) if (invalid) { (7) sa_linelog_bad_cert: EXPAND %{Module-Failure-Message} for %{%{TLS-Client-Cert-Common-Name}:-No-Common-Name} %{%{TLS-Client-Cert-Subject-Alt-Name-Email}:-No-Alt-RFC822} %{%{TLS-Client-Cert-Subject-Alt-Name-Dns}:-No-Alt-DNS} (7) sa_linelog_bad_cert: --> eap_tls: SSL says error 10 : certificate has expired for No-Common-Name No-Alt-RFC822 No-Alt-DNS (7) [sa_linelog_bad_cert] = ok (7) [invalid] = invalid (7) } # if (invalid) = invalid (7) } # Auth-Type eap = invalid So, any way to retrieve invalid cert data for logging? Thanks, Jason

3 4

Quoting =~ in unlang on string expansion
by Walter Schober 13 Sep '21

13 Sep '21

Hi folks! String expansion is behaving different in case just adding a string or being a result in a regex compare. (1) if (&Called-Station-ID =~ /%{reply:FeatureA}/) { (1) EXPAND %{reply:FeatureA} (1) --> \^\(3\[0-79]\|38\[0-25-9]\|4\[014-9]\|42\[123]\|29\[89]\|43\[1-6]\|43800\|43720) (1) ERROR: \^\(3\[0-79]\|38\[0-25-9]\|4\[014-9]\|42\[123]\|29\[89]\|43\[1-6]\|43800\|43720) (1) ERROR: ^ Pattern compilation failed: unmatched parentheses (1) ERROR: Failed retrieving values required to evaluate condition Sure this does not compile because it quoted "(" but not ")". In this use case some chars in the reply string are quoted: ^(|[ are quoted while ]) are not for some reasons But adding the reply value to some debug AVPair this is done without quoting: This shows the real content of the reply attr: (1) else { (1) update control { (1) Auth-Type := Reject (1) } # update control = noop (1) update reply { (1) EXPAND block=%{reply:FeatureA} (1) --> block=^(3[0-79]|38[0-25-9]|4[014-9]|42[123]|29[89]|43[1-6]|43800|43720) (1) Generic-Debug := block=^(3[0-79]|38[0-25-9]|4[014-9]|42[123]|29[89]|43[1-6]|43800|43720) I was looking through source code why this is happening, but I am lost. Any hint to source code is appreciated. I'm using version from Debian Buster Backports: 3.0.21+dfsg-1~bpo10+1 I tried a lot already: "/%{}/", /"%{}"/, %{unescape:...}, ... even if (&Called-Station-ID =~ /&reply:FeatureA/) (which results in FALSE always) Why are some character quoted here in this expansion? Where are the "safe charaters" defined for unlang compare operator? Greetings, Walter

2 2