- Freeradius-Users - lists.freeradius.org

Relase estimation for version 4?
by Michael Schwartzkopff 15 Sep '21

15 Sep '21

Hi, is there any estimation for a release date for the version 4 of FR? We would like to see the TACACS feature in the software. Then we could suggest my customer to switch from a commercial RADIUS server to FR. I assume that networkradius also will support the new features of version 4. Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

2 1

Two frreadius are connected to the same AD, and the first one is unavailable
by yanyi5496＠gmail.com 14 Sep '21

14 Sep '21

I have two freeradius on different ubuntu server, and I use freeradius to connect AD, when I configure freeradius A to connect AD, freeradius A was working, then I configure freeradius B to connect AD with same user and password, freeradius B was working, but freeradius A didn`t work, I checked their configuration, they arm same, freeradius A log is as follows: Tue Sep 14 03:02:26 2021 : Error: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: When trying to update a password, this return status indicates that the value provided as the current password is not correct. (0xc000006a)' Tue Sep 14 03:02:26 2021 : Auth: (3) Login incorrect: [sqauser/xxxxxxx] (from client 127.0.0.1 port 2 cli xxxxxxxxx) I make sure I use the correct account information, I don't know what went wrong, freeradius configuration or AD configuration. I'm really confused. Thanks Jason Chen

2 1

Retrieving Client TLS attributes for invalid/rejected requests
by Jason Healy 13 Sep '21

13 Sep '21

Hello, We're using EAP TLS and I've had no trouble pulling the TLS attributes (TLS-Client-Common-Name, etc) out of the request during normal processing. However, I'm getting several certs as revoked/expired and I'd like to get into it a little more. I could attach to debug, but I'd like to also log these failed certificates so I can chase down the users and run some reports. However, when I try to log the TLS-* attributes in Post-Auth-Type REJECT, they're empty. I'm guessing that the EAP module cleans them up on failure? I even tried to use failover to catch the invalid response as quickly as possible: eap { invalid = 1 } if (invalid) { sa_linelog_bad_cert invalid } But again all the TLS-* attributes come up blank in the linelog. I can see them in the eap_tls section, but they're gone by the time I get to linelog: (7) eap: Calling submodule eap_tls to process data (7) eap_tls: (TLS) EAP Got final fragment (827 bytes) (7) eap_tls: (TLS) EAP Done initial handshake (7) eap_tls: (TLS) Handshake state - Server SSLv3/TLS write server done (7) eap_tls: (TLS) recv TLS 1.2 Handshake, Certificate (7) eap_tls: (TLS) Creating attributes from TLS-Client-Cert-Serial certificate (7) eap_tls: (TLS) Creating attributes from server certificate (7) eap_tls: TLS-Cert-Serial := "460d875635c64859ebabee3bba64e93f" (7) eap_tls: TLS-Cert-Expiration := "390703160000Z" (7) eap_tls: TLS-Cert-Valid-Since := "190703161900Z" (7) eap_tls: TLS-Cert-Subject := "/O=Suffield Academy/CN=Suffield Academy Device Intermediate CA" (7) eap_tls: TLS-Cert-Issuer := "/O=Suffield Academy/CN=Suffield Academy Device Root CA" (7) eap_tls: TLS-Cert-Common-Name := "Suffield Academy Device Intermediate CA" (7) eap_tls: (TLS) Creating attributes from client certificate (7) eap_tls: TLS-Client-Cert-Serial := "5052ac2d40917d66343d050650939854" (7) eap_tls: TLS-Client-Cert-Expiration := "210803194948Z" (7) eap_tls: TLS-Client-Cert-Valid-Since := "210802193900Z" (7) eap_tls: TLS-Client-Cert-Subject := "/O=Suffield Academy/CN=Expired User (Fake 1234567890)" (7) eap_tls: TLS-Client-Cert-Issuer := "/O=Suffield Academy/CN=Suffield Academy Device Intermediate CA" (7) eap_tls: TLS-Client-Cert-Common-Name := "Expired User (Fake 1234567890)" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Email := "Expired User (Fake 1234567890)" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Dns := "_SA_" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Upn := "expired" (7) eap_tls: ERROR: SSL says error 10 : certificate has expired (7) eap_tls: (TLS) send TLS 1.2 Alert, fatal certificate_expired (7) eap_tls: ERROR: (TLS) Alert write:fatal:certificate expired (7) eap_tls: ERROR: (TLS) Server : Error in error (7) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (7) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (7) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation (7) eap_tls: ERROR: [eaptls process] = fail (7) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (7) eap: Sending EAP Failure (code 4) ID 229 length 4 (7) eap: Failed in EAP select (7) [eap] = invalid (7) if (invalid) { (7) if (invalid) -> TRUE (7) if (invalid) { (7) sa_linelog_bad_cert: EXPAND %{Module-Failure-Message} for %{%{TLS-Client-Cert-Common-Name}:-No-Common-Name} %{%{TLS-Client-Cert-Subject-Alt-Name-Email}:-No-Alt-RFC822} %{%{TLS-Client-Cert-Subject-Alt-Name-Dns}:-No-Alt-DNS} (7) sa_linelog_bad_cert: --> eap_tls: SSL says error 10 : certificate has expired for No-Common-Name No-Alt-RFC822 No-Alt-DNS (7) [sa_linelog_bad_cert] = ok (7) [invalid] = invalid (7) } # if (invalid) = invalid (7) } # Auth-Type eap = invalid So, any way to retrieve invalid cert data for logging? Thanks, Jason

3 4

Quoting =~ in unlang on string expansion
by Walter Schober 13 Sep '21

13 Sep '21

Hi folks! String expansion is behaving different in case just adding a string or being a result in a regex compare. (1) if (&Called-Station-ID =~ /%{reply:FeatureA}/) { (1) EXPAND %{reply:FeatureA} (1) --> \^\(3\[0-79]\|38\[0-25-9]\|4\[014-9]\|42\[123]\|29\[89]\|43\[1-6]\|43800\|43720) (1) ERROR: \^\(3\[0-79]\|38\[0-25-9]\|4\[014-9]\|42\[123]\|29\[89]\|43\[1-6]\|43800\|43720) (1) ERROR: ^ Pattern compilation failed: unmatched parentheses (1) ERROR: Failed retrieving values required to evaluate condition Sure this does not compile because it quoted "(" but not ")". In this use case some chars in the reply string are quoted: ^(|[ are quoted while ]) are not for some reasons But adding the reply value to some debug AVPair this is done without quoting: This shows the real content of the reply attr: (1) else { (1) update control { (1) Auth-Type := Reject (1) } # update control = noop (1) update reply { (1) EXPAND block=%{reply:FeatureA} (1) --> block=^(3[0-79]|38[0-25-9]|4[014-9]|42[123]|29[89]|43[1-6]|43800|43720) (1) Generic-Debug := block=^(3[0-79]|38[0-25-9]|4[014-9]|42[123]|29[89]|43[1-6]|43800|43720) I was looking through source code why this is happening, but I am lost. Any hint to source code is appreciated. I'm using version from Debian Buster Backports: 3.0.21+dfsg-1~bpo10+1 I tried a lot already: "/%{}/", /"%{}"/, %{unescape:...}, ... even if (&Called-Station-ID =~ /&reply:FeatureA/) (which results in FALSE always) Why are some character quoted here in this expansion? Where are the "safe charaters" defined for unlang compare operator? Greetings, Walter

2 2

linelog module soft failure
by Arnaud LAURIOU 10 Sep '21

10 Sep '21

Hi, On our eduroam proxy we use linelog modules in the post-auth section. Recently, one of these linelog module failed and its 'fail' return code was applied to requests in the post-auth section : Auth: (34463328) Rejected in post-auth. Is there a way to have a 'soft failure' when the return code from linelog is 'fail' ? Regards, Arnaud

2 4

Re: Checkrad and IPv6 NAS IP address
by Fabricio Viana 08 Sep '21

08 Sep '21

Hi Alan! First of all, thanks for the quick response! > Huh? The main FreeRADIUS GitHub repository is at https://github.com/FreeRADIUS/freeradius-server/ It's pointed to from http://freeradius.org. > I don't recommend looking at third-party repositories for FreeRADIUS. They are many years out of date. I had so many tabs open in my browser that I didn't even realize I wasn't in the correct repository! Sorry for this mistake. > Patch rlm_sql.c to accept IPv6 addresses. This requires code changes. I'll take a look. > Alan DeKok Unfortunately I can't help in this regard, as I don't know the C language... But thanks again for your willingness to check what can be done. I will be looking forward to it! Regards Fabricio Viana

1 0

Re: Networkradius packages for freeradius-3.0.22-1.el7.x86_64.rpm
by Clive Allen 08 Sep '21

08 Sep '21

>>This comment is demeaning, and insulting. As best I can tell, it is *intended* to be demeaning and insulting. Please don't assume you know why I wrote that comment. I absolutely did not write that comment to demean or insult anyone. Anyway, so that anyone else who may experience this issue wants to know the resolution, I will post here. At least there is a record of it then. The URL is stated as "HTTPS://packages.networkradius.com/freeradius-3.0/centos/7/" No matter what I tried I could only ever get it to list 3.0.23. So, I thought, well, may as well try http rather than https and, with using the following two commands it worked: "yum list freeradius-3.0.22*" - it listed back "freeradius-3.0.22-1.el7" "yum install freeradius-3.0.22-1.el7" radiusd -X shows no issues and the version is "3.0.22". At least that clears up the confusion, but not sure why http worked and https did not - maybe a security issue or certs. Anyway, thank you Matthew and Alan for the pointers. I will keep those in mind for future reference. A basic resolution but sometimes the basics are easily missed.

3 2

Re: Networkradius packages for freeradius-3.0.22-1.el7.x86_64.rpm
by Clive Allen 08 Sep '21

08 Sep '21

>>You did post to the list, didn't you? You're asking us for help with our repos. The repos we provide for free. The repos you use to get paid by your customers. Again, I point to the very simple question that could have/should have required a very simple answer of: No, sorry, never seen the issue (or not respond at all)/Yes, here is how I resolved it. >>Then ask RedHat how "yum" works. And I thanked you for that response. It was not a sarcastic "Thank you" it was a genuine thank you. >>Then you misunderstood my point. My point was that it was an option for you. Which should have been pretty clear. No. I understood that is what you were stating, hence, again, my thanks. It is just a process I would like to try and avoid. But I understand there are plenty of documents out there to help with this if I choose to go that way. >>Yeah, that's the typical "I'm insulted" response. You know what the list is about. Asking leading questions means you're not solving technical problems (which IS what the list is about), but you're looking for reasons to be offended. Do you not see the irony in your response? I am never insulted by anyone. Offence/Insult - A discussion for a different group perhaps. >>Nonsense. Saying that means you either haven't read many of the messages here, or you haven't understood them. How is it nonsense? The group is available to either ask a question or it is not. Do you say to any of your students "No question is too stupid"? >>Would you be insulted if someone told you "I'm sure that any meaningless IT work you do could be done by some low-level monkey with some googling and research." As I mentioned above, I thank you for yours and Matthews response. Very much appreciated. No, I would not get insulted. Would not bother me, people can think whatever they want. >>Yes? Then don't say the same thing here. See my answer above. Let's leave it at that. I thank yourself and Matthew for your responses. As I said, it is appreciated and ways to look to move forward (Which I was hoping to avoid hence my question in the first place).

2 1

Re: Networkradius packages for freeradius-3.0.22-1.el7.x86_64.rpm
by Clive Allen 08 Sep '21

08 Sep '21

> I have created the new baseURL with > [1]https://packages.networkradius.com/freeradius-3.0/centos/7/ > and, in fact, if I go the URL sure enough, there is version 3.0.22. > However, again, when I try to list > freeradius (yum list freeradius) I only get 3.0.23 in the listing. If I > try to install via the actual version > name then I get a yum response of "it cannot be found, nothing to do". > This is really frustrating as version 3.0.22 is at the URL, as you > rightly state, but it simply will not > show in any listing. > > I also tried the yum install direct from the URL to bypass the repo > file, with no luck either. I do not > want to go down the manual route of rpm installation as I am not overly > expert with Linux as yet > and will more than likely mess it up. Any further help would be > appreciated. >>i.e. people are paying you to do FreeRADIUS work, but you want us to work for you, for free. >>Hmm... >>a) build 3.0.22 yourself. It isn't difficult. After all, all of the source is online. >>b) download 3.0.22 manually, and manually install it on the customer machines >>c) ask RedHat how yum works. >>When students ask on Stack Overflow how to do their networking assignments, the response is "do your own work". Something similar applies here. >>Alan DeKok. Hi Alan, Since where have I asked for anyone to complete any work for me? I simply asked if anyone had seen this issue before where the baseurl in the repo is correct, the URL for that baseurl shows 3.0.22 as well as many others. When I complete the command yum --showduplicates list freeradius it shows version 3.0.22 in the listing yet when I use yum list and yum install, all that appears to be available is 3.0.23. I do not require any or ask for any help with regarding to building something from scratch. If that is the process I end up having to use then so be it, and as you state, there is plenty of docs online to help with that. It is just a process I do not want to utilise when the yum repo should show 3.0.22 as an available package. I know how yum works and how to build a repo, what I have never completed before is a freeradius + dependencies build from scratch. That is a learnable process. So, the question, put in more simple terms is: "Has anyone seen this issue before and what was the way around it"? If no-one has seen this issue then that is all good too. My assumption was that this mailing group could be utilised to ask such a question. If that is not what this mailing group is about then maybe it should cease, as I am sure the answer to any question asked in this group is resolvable with some googling and research. Thanks Matthew for the help and Alan for the A) B) and C) options. References 1. https://deref-gmx.com/mail/client/8rkjL0zdpEA/dereferrer/?redirectUrl=https…

2 1

Re: Networkradius packages for freeradius-3.0.22-1.el7.x86_64.rpm
by Clive Allen 08 Sep '21

08 Sep '21

On 07/09/2021 21:51, Clive Allen wrote: > I am trying to install networkradius packages for freeradius-3.0.22 and > having no success. > > OS: RHEL7.9 ... > The problem I have is the yum install only finds 3.0.23 --- I know > 3.0.22 is available but I cannot get the repos to find this version for > a yum install. I have the source code but do not wish to proceed down > that route. Has anyone utilised the networkradius packages for > freeradius and if they have, can they point me to how to get 3.0.33 > version of freeradius please? On 07/09/2021 10:23PM, Matthew Newton Wrote: >>There is no version 3.0.33. >>All versions from 3.0.20 onwards are in the repo: [1]>>https://packages.networkradius.com/freeradius-3.0/centos/7/ >>You'll just need to use the correct yum command to tell it which version >>to install (or download and install the RPMs manually). >>But in any case, use 3.0.23-3. There's no reason to use the older >>versions with known bugs. Version 3.0.33 was a typo on my part. It should have read 3.0.22. Under normal circumstances I would simply install 3.0.23 as you suggested, however, we have customers who are utilising 3.0.22 and I need to get the labs set up exactly the same so I can start testing the new configurations they are asking for. I have created the new baseURL with https://packages.networkradius.com/freeradius-3.0/centos/7/ and, in fact, if I go the URL sure enough, there is version 3.0.22. However, again, when I try to list freeradius (yum list freeradius) I only get 3.0.23 in the listing. If I try to install via the actual version name then I get a yum response of "it cannot be found, nothing to do". This is really frustrating as version 3.0.22 is at the URL, as you rightly state, but it simply will not show in any listing. I also tried the yum install direct from the URL to bypass the repo file, with no luck either. I do not want to go down the manual route of rpm installation as I am not overly expert with Linux as yet and will more than likely mess it up. Any further help would be appreciated. References 1. https://deref-gmx.com/mail/client/8rkjL0zdpEA/dereferrer/?redirectUrl=https…

2 1