- Freeradius-Users - lists.freeradius.org

How to catch Ldap-Group fail state
by Sergey Nikitin 08 Jun '21

08 Jun '21

Hi! Could you help me please: is there a way to catch Ldap-Group failed state? I have the following construct for ldap group check in the post-auth section: if Ldap-Group == "test-group" { update reply { cisco-avpair :="shell:priv-lvl=15" } } else { reject } Problem is when ldap server becomes unreachable from radius server, radius client receive reject and I would like not to send reply in such case. Is there a way to implement something like this: if Ldap-Group == "test-group" { update reply { cisco-avpair :="shell:priv-lvl=15" } } elsif (fail) { do_not_respond } else { reject } where (fail) is the state of Ldap-Group check. Thank you. -- Best Regards. Sergey

2 1

Re: Re: ntlm_auth not being invoked
by Shaun donovan 07 Jun '21

07 Jun '21

Sorry Alan. Here is the full log: (0) Received Access-Request Id 124 from 127.0.0.1:45676 to 127.0.0.1:1812 length 74 (0) User-Name = "piet" (0) User-Password = "P0mp!es" (0) NAS-IP-Address = 192.168.7.203 (0) NAS-Port = 0 (0) Message-Authenticator = 0xb574f29bb2356cb5b1aa5f3b5625ae39 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "piet", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> piet (0) sql: SQL-User-Name set to 'piet' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'piet' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'piet' ORDER BY id (0) sql: WARNING: User not found in radcheck table. rlm_sql (sql): Reserved connection (2) rlm_sql (sql): Released connection (2) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.3.28-MariaDB, protocol version 10 (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'piet' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'piet' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (3) (0) sql: EXPAND %{User-Name} (0) sql: --> piet (0) sql: SQL-User-Name set to 'piet' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'piet', 'P0mp=3D21es', 'Access-Reject', '2021-06-07 07:13:41') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'piet', 'P0mp=3D21es', 'Access-Reject', '2021-06-07 07:13:41') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (3) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> piet (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 124 from 127.0.0.1:1812 to 127.0.0.1:45676 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 124 with timestamp +38 Ready to process requests > Message: 2 > Date: Fri, 4 Jun 2021 08:53:39 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: ntlm_auth not being invoked > Message-ID: <FADA674B-6BA4-4C28-AAFA-33DCD569C193(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Jun 4, 2021, at 8:02 AM, Shaun donovan via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: >> I have configured FreeRADIUS Version 3.0.20 on a CentOS Linux release 8.3.2011 machine with daloRadius. I have then followed the instructions at http://deployingradius.com/documents/configuration/active_directory.html to allow FreeRADIUS to authenticate against an Active Directory. >> >> Everything works up to the point that I must remove the "testing entry" in raddb/mods-config/files/authorize, namely the "DEFAULT Auth-Type = ntlm_auth" and uncomment the "ntlm_auth =" line in raddb/modules/mschap. Once I do this and test using radtest, I get: >> >> (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type >> (0) pap: WARNING: Authentication will fail unless a "known good" password is available >> (0) [pap] = noop >> (0) } # authorize = ok >> (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject >> >> from Radius -X. > There's a lot more output available. Post ALL of it. > >> I can see that it is trying to do PAP authentication, but does not "Fall Through" to try ntlm_auth. I have tried to google this extensively, but cannot find where I should configure FreeRADIUS to first try PAP and the try ntlm_auth. >> >> Any help appreciated. > Follow the instructions here: http://wiki.freeradius.org/list-help > > Alan DeKok.

1 1

EAP-TLS
by Henrik Schack 06 Jun '21

06 Jun '21

Hi Is it possible to configure Freeradius to require only a valid TLS client cert created by own CA, in order to get an ACCEPT ? /Henrik

3 8

Naming collision on CN in CA certificates (EAP-TLS)
by Ash Wilson 05 Jun '21

05 Jun '21

Hi there, Before I open a bug report in Github, I'm hoping that someone else has seen this issue and can advise on a work-around. What I'm trying to do: Use multiple CA certificates for authentication of EAP-TLS supplicants. The CNs in these CA certificates may be identical. What I'm expecting: FreeRADIUS (via SSL library) should use the authorityKeyID in the supplicant's certificate to locate the CA certificate (matching against the subjectKeyID) to validate the supplicant's presented certificate. What I'm observing: FreeRADIUS fails to authenticate client certificates if multiple CA certificates exist with the same CN. The CN appears to be the key which FreeRADIUS uses to locate the CA certificate. More about the test scenario: Attempted with two CA certificates as separate certs in cert_dir. Also tried with both CA certificates in the same file. As long as the CNs are different, authentication happens as desired, with no issues. If the CNs collide, auth fails. When I use OpenSSL to verify the client certs against the CA certs, OpenSSL authenticates the certs correctly even if the names collide. FreeRADIUS appears to be sharing the responsibility of validating the supplicant's certificate with the SSL library, and treating it differently than openSSL does when used independently. -- *Ash Wilson* | Technical Director *e:* ash.wilson(a)valimail.com This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified of any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system.

2 1

Identify request in post-auth section
by Arnaud LAURIOU 04 Jun '21

04 Jun '21

Hi, On our eduroam proxy server, we use a virtual server to reject requests with an unknown realm in our federation : authorize { update request { &Module-Failure-Message += 'Rejected: Realm unknown in .fr' } reject } We would also like to identify these requests in the 'Post-Auth-Type REJECT' of the default virtual server. How can we do this ? Trying to match %{proxy-reply:Module-Failure-Message} doesn't seem to work. Thank's. -- Direction des Services Applicatifs RENATER - Rennes https://www.renater.fr/

2 2

Disable accounting logging
by Patrick Oberli 04 Jun '21

04 Jun '21

Hello all I'm currently trying to disable accounting logging on a Freeradius 3.0 installation, which I exclusively use as an eduroam radius proxy (https://wiki.geant.org/display/H2eduroam/freeradius-sp) On my old 2.x installation I did not get any accounting logging, but I don't know why it is generated now in 3.0. My configuration of the sites-enabled/eduroam is exactly as shown at that site. The accounting section looks like this: accounting { } The accounting log is now filling my disk (it's also not compressed, unlike the radius.log file). I don't need the accounting logs as there should be no accounting at all. The only other link in sites-enabled is the default file. I did uncomment the word "detail" in the accounting section there and restarted the service, but it continued to log accounting information. Thanks Patrick Oberli

2 3

Changing format for $RAD_REQUEST{'Event-Timestamp'} in Perl module
by Юрий Иванов 04 Jun '21

04 Jun '21

Hi, I need to change $RAD_REQUEST{'Event-Timestamp'} format before inserting to database. Looks like $RAD_REQUEST{'date:Event-Timestamp'}, $RAD_REQUEST{'integer:Event-Timestamp'} are not working. Is there any method to use date module or standard keywords in perl code or I should do it manually.

3 4

ntlm_auth not being invoked
by Shaun donovan 04 Jun '21

04 Jun '21

Hi All. I have configured FreeRADIUS Version 3.0.20 on a CentOS Linux release 8.3.2011 machine with daloRadius. I have then followed the instructions at http://deployingradius.com/documents/configuration/active_directory.html to allow FreeRADIUS to authenticate against an Active Directory. Everything works up to the point that I must remove the "testing entry" in raddb/mods-config/files/authorize, namely the "DEFAULT Auth-Type = ntlm_auth" and uncomment the "ntlm_auth =" line in raddb/modules/mschap. Once I do this and test using radtest, I get: (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject from Radius -X. I can see that it is trying to do PAP authentication, but does not "Fall Through" to try ntlm_auth. I have tried to google this extensively, but cannot find where I should configure FreeRADIUS to first try PAP and the try ntlm_auth. Any help appreciated. Kind Regards. Shaun

2 1

Problems with Samba
by Klemen forneci 04 Jun '21

04 Jun '21

Hello. I hope someone can shine a light on my problem with Freeradius 3 and mschap (running on centos7 with samba/winbind) So long story short, I notice that every ~5 minutes there is a problem with NTLM_AUTH. Even with testing with radtest -t mscahp at the same time, I get: (10) Auth-Type MS-CHAP { (10) if (Realm == "um.si") { (10) if (Realm == "um.si") -> TRUE (10) if (Realm == "um.si") { (10) mschap_thor: Client is using MS-CHAPv1 with NT-Password (10) mschap_thor: Executing: /usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-THOR} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (10) mschap_thor: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (10) mschap_thor: --> --username=****** (10) mschap_thor: ERROR: No NT-Domain was found in the User-Name (10) mschap_thor: EXPAND --domain=%{%{mschap:NT-Domain}:-THOR} (10) mschap_thor: --> --domain=THOR (10) mschap_thor: mschap1: 31 (10) mschap_thor: EXPAND --challenge=%{%{mschap:Challenge}:-00} (10) mschap_thor: --> --challenge=316c3b72847b74c7 (10) mschap_thor: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (10) mschap_thor: --> --nt-response=273c482ad6ee3eeb8c21239368764a42d66c1b6ca8f0e98e Child PID 5238 is taking too much time: forcing failure and killing child. (10) mschap_thor: ERROR: Failed to read from child output (10) mschap_thor: External script failed (10) mschap_thor: ERROR: External script says: (10) mschap_thor: ERROR: MS-CHAP2-Response is incorrect I know this may not be a radius issue, beause of the fact that in-between the system works as expected and the line: Child PID 5238 is taking too much time: forcing failure and killing child, but I have my hopes up someone can point me in the right direction. On the backend there is a Windows AD, multiple DC (tried setting only 1 in samba, same issue), the server is domain joined. I have multiple servers with the same issue (in the same environment) What allso puzzles me, are the logs: Server 1: Fri May 28 14:35:27 2021 : ERROR: (59476) mschap_thor: ERROR: Failed to read from child output Fri May 28 14:35:31 2021 : ERROR: (59508) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:35:35 2021 : ERROR: (59534) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:03 2021 : ERROR: (60960) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:08 2021 : ERROR: (60993) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:12 2021 : ERROR: (61017) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:14 2021 : ERROR: (61030) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:15 2021 : ERROR: (61040) mschap_loki: ERROR: Failed to read from child output Server 2: Fri May 28 14:38:29 2021 : ERROR: (4) mschap_thor: ERROR: Failed to read from child output Fri May 28 14:38:44 2021 : ERROR: (5) mschap_thor: ERROR: Failed to read from child output It's like a blinker. One works, the other doesnt. Thank you for any tips. Klemen

4 4

Lockout
by Victor, Eben, Vodacom South Africa (External) 04 Jun '21

04 Jun '21

Hi All, I’m hoping someone could assist me. Is it possible to deny/lockout users with the calling-stattion-id? I’m trying to lockout users connecting to my wifi with x connections a week from x called-stattion-id. Regards C2 General This e-mail is classified C2 - Vodacom Restricted - Information to be used inside Vodacom but it may be shared with authorised partners.

2 1