- Freeradius-Users - lists.freeradius.org

v4: Can't see TLS certificate fields from `send Access-Accept` section anymore
by Nick Bogdanov 17 Feb '21

17 Feb '21

I am using EAP-TLS authentication and trying to read the %{session-state.TLS-Client-Cert-Subject} attribute in order to set the reply.Tunnel-Private-Group-Id field. In v3 I could just add this to my post-auth section: if (TLS-Client-Cert-Subject =~ /\/OU=VLAN 1\//) { update reply { &Tunnel-Private-Group-Id = "1" } } In v4 I can see the cert fields in the `recv Access-Request` section (after setting `virtual_server = default` in mods-available/eap) but they are all empty when I try to read them from the `send Access-Accept` section. In fact, if I uncomment these sections from the default config, the fields are all empty too: # update reply { # &Reply-Message += "%{session-state.TLS-Cert-Serial}" # &Reply-Message += "%{session-state.TLS-Cert-Expiration}" # &Reply-Message += "%{session-state.TLS-Cert-Subject}" # &Reply-Message += "%{session-state.TLS-Cert-Issuer}" # &Reply-Message += "%{session-state.TLS-Cert-Common-Name}" # &Reply-Message += "%{session-state.TLS-Cert-Subject-Alt-Name-Email}" # # &Reply-Message += "%{session-state.TLS-Client-Cert-Serial}" # &Reply-Message += "%{session-state.TLS-Client-Cert-Expiration}" # &Reply-Message += "%{session-state.TLS-Client-Cert-Subject}" # &Reply-Message += "%{session-state.TLS-Client-Cert-Issuer}" # &Reply-Message += "%{session-state.TLS-Client-Cert-Common-Name}" # &Reply-Message += "%{session-state.TLS-Client-Cert-Subject-Alt-Name-Email}" # } The log says: (15,8) update reply { (15,8) EXPAND %{session-state.TLS-Cert-Serial} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Expiration} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Subject} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Issuer} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Common-Name} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Subject-Alt-Name-Email} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Serial} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Expiration} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Subject} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Issuer} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Common-Name} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Subject-Alt-Name-Email} (15,8) --> (null) (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) } # update reply (noop) I am running git rev 89b77dc09571cb4ac3cd4d639aee6c17bea23182, built from source. I saw something in upgrade.adoc about using the `filter` directive but it wasn't clear to me what that meant. Am I missing something simple or is this a bug?

2 1

advice for breaking an array of vendor attributes into local attributes and updating a database
by Matt Zagrabelny 16 Feb '21

16 Feb '21

Greetings FR-users, Scenario: I receive an accounting packet from a Cisco NAS. It has an array of Cisco-AVPair tuples that FR processes. I am hoping to break out the various Cisco-AVPair tuples into key-value pairs to insert into a database. I am starting with a single (and specific) Cisco-AVPair. Snippets of freeradius -X follows... Here is the AVP in the accounting packet... (23) Cisco-AVPair = "mdm-tlv=device-platform-version=10.0.18363 " Here is my unlang... (23) elsif ("%{Foreach-Variable-0}" =~ /^mdm-tlv=device-platform-version=(.*?) *$/) { (23) update reply { (23) EXPAND %{1} (23) --> 10.0.18363 (23) &Local-MDM-TLV-Device-Platform-Version := 10.0.18363 (23) } # update reply = noop Here is the SQL... (23) sql_netdb: EXPAND UPDATE radius_accounting SET [...] cisco_device_platform_version = NULLIF('%{Local-MDM-TLV-Device-Platform-Version}', '') [...] WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' AND AcctStopTime IS NULL (23) sql_netdb: --> UPDATE radius_accounting SET [...] cisco_device_platform_version = NULLIF('', '') [...] WHERE AcctUniqueId = 'FOOBAR' AND AcctStopTime IS NULL You can see the attribute Local-MDM-TLV-Device-Platform-Version is the empty string in the SQL. I am having success with the foreach statement and a regex. In my default site: accounting { [...] foreach Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /^mdm-tlv=device-platform-version=(.*?) *$/) { update reply { &Local-MDM-TLV-Device-Platform-Version := "%{1}" } } } [...] } My dictionary looks like: ATTRIBUTE Local-MDM-TLV-Device-Platform-Version 7772 string Am I using the wrong section in my default site for attempting to set a local (internal) attribute? I know that I am using "update reply" in my unlang. That doesn't feel correct for accounting unlang, but I'll need correction or confirmation in that area. Any advice for breaking an array of vendor attributes into local attributes and then updating a database with those local attributes? Thank you for any help or hints! -m

2 1

NAS-Filter-Rule incorrectly encoded as string
by Pablo Nogueira 16 Feb '21

16 Feb '21

Hello, first post here. I'm trying to implement dynamic access lists for 802.1X authenticated users. To do so, I'm using attribute NAS-Filter-Rule, as defined in RFC 4849 and FreeRADIUS Version 3.0.21 as the RADIUS server. To do so, I've modified users file with the following entry user1 Cleartext-Password := "pass1" Service-Type = Framed-User, Nas-filter-Rule = "permit in tcp from any to 10.2.3.4/24", Nas-filter-Rule += 0x00, Nas-filter-Rule += "permit in ip from 192.168.101.5/32 to 192.168.101.1", Nas-filter-Rule += 0x00, Nas-filter-Rule += "deny in ip from any to any", Nas-filter-Rule += 0x00 According to RFC 4849 "The String field is one or more octets. It contains filter rules in the IPFilterRule syntax defined in [RFC3588], Section 4.3, with individual filter rules separated by a NUL (0x00). A NAS-Filter- Rule attribute may contain a partial rule, one rule, or more than one rule. Filter rules may be continued across attribute boundaries, so implementations cannot assume that individual filter rules begin or end on attribute boundaries. The set of NAS-Filter-Rule attributes SHOULD be created by concatenating the individual filter rules, separated by a NUL (0x00) octet. The resulting data should be split on 253-octet boundaries to obtain a set of NAS-Filter-Rule attributes. On reception, the individual filter rules are determined by concatenating the contents of all NAS-Filter-Rule attributes, and then splitting individual filter rules with the NUL octet (0x00) as a delimiter. " In my example above, RADIUS server is sending NAS-Filter-Rule as a string, thus converting 0x00 into strings "0x00". If I remove the 0x00, then rules are not NUL separated which goes against the RFC, share/dictionary/radius/dictionary.rfc4849 defines NAS-Filter-Rule as ATTRIBUTE NAS-Filter-Rule 92 string I've been able to make it work as I think it should adding the following line to my dictionary # override NAS-Filter-Rule to convey NUL character between rules ATTRIBUTE NAS-Filter-Rule 92 octets My question is, is there any other way to force freeradius to send the entry rules as strings with NUL terminated character? Should I report this as an issue (bug) to freeradius developers so that they change the dictionary.rfc4849 entry? I hope my question is clear. Best regards Pablo

2 3

Accounting Packet not sent
by Michael Fischer 16 Feb '21

16 Feb '21

Hi! My goal is to authenticate WiFi-Users via FreeRadius with an eDirectory backend. FreeRadius should then send an accounting packet to a FortiGate firewall where a SSO agent is running. The authentication part is working find, a user can connect to the WiFi. As far as I understood it, I should configure FreeRadius to write a detail file which is then parsed an an accounting package sent to the Fortigate firewall. I configured a realm in proxy.conf: realm Fortigate { accthost = 172.16.1.253 secret = *********** } And I enabled the site "copy-accounting-to-home-server" with the following configuration: server copy-acct-to-home-server { listen { type = detail filename = ${radacctdir}/detail-* load_factor = 10 } preacct { preprocess suffix files update control { Proxy-To-Realm := 'Fortigate' } } accounting { ok } pre-proxy { } post-proxy { } } Reading the detail file seems to work fine, but no accounting package is sent to the FortiGate firewall (I even checked using Wireshark). See a part of the debug-log here: (9) Login OK: [fimi] (from client private-network-1 port 0 cli F4-60- E2-B3-96-5C) (9) Sent Access-Accept Id 107 from 172.16.1.104:1812 to 192.168.251.51:39578 length 0 (9) Class := 0x54657374 (9) MS-MPPE-Recv-Key = 0x28765691676b5035b99c8aa3b2b5bb8c1e9b4b3e32a457239e11df0cdac127ea (9) MS-MPPE-Send-Key = 0x1120b9224c29ff96b3ed507b19eabd80bb1c7728772cbe8305a876cede81c224 (9) EAP-Message = 0x03d10004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) User-Name += "fimi" (9) Finished request Waking up in 4.8 seconds. detail (/var/log/radius/radacct/detail-*): Polling for detail file detail (/var/log/radius/radacct/detail-*): Renaming /var/log/radius/radacct/detail-192.168.251.51-20210216 -> /var/log/radius/radacct/detail.work detail (/var/log/radius/radacct/detail-*): Read packet from /var/log/radius/radacct/detail.work Packet-Type = Access-Accept Class = 0x54657374 User-Name = "fimi" MS-MPPE-Recv-Key = 0x28765691676b5035b99c8aa3b2b5bb8c1e9b4b3e32a457239e11df0cdac127ea MS-MPPE-Send-Key = 0x1120b9224c29ff96b3ed507b19eabd80bb1c7728772cbe8305a876cede81c224 EAP-MSK = 0x28765691676b5035b99c8aa3b2b5bb8c1e9b4b3e32a457239e11df0cdac127ea1120b 9224c29ff96b3ed507b19eabd80bb1c7728772cbe8305a876cede81c224 EAP-EMSK = 0xd3a64e1f290603568302a9f6c13c3ae00eaea0f45caeff1503b5609e2faf9b06be114 12f1243564b0a08b8df5d58cc33235989699b860f0171b9b73a29bb0e36 EAP-Session-Id = 0x19c2bce2a85918a3ba9ea0068fd39acacb8173753f6c2a19ac67249b606157c82923f 2dacd82dc178f0df970ea5031e0e57b82ad5100de437f43b4f8303af37cae EAP-Message = 0x03d10004 Message-Authenticator = 0x00000000000000000000000000000000 Packet-Original-Timestamp = "Feb 16 2021 14:22:24 CET" Packet-Transmit-Counter = 1 Waking up in 4.6 seconds. See full debug-log attached. I would really appreciate your help! Thanks, Mike

2 3

Multiple sqlippool with different Module-Success-Message values
by Zoltán Kristofóri 16 Feb '21

16 Feb '21

Hello Everyone! First of all I am glad to be here! But i got stuck on a problem. I am calling two different sqlippool module for IP address allocation (IPv4 and IPv6). My problem is that I need send both module result message to the linelog module. It should be easy because the sqlippool module writes the control:Module-Success-Message. But as far as I can see the Module-Success-Message field is not updated the second time. site configuration: post-auth { ... sqlippool_v4 log_sqlippool .. sqlippool_v6 log_sqlippool } sqlippool module configuration: sqlippool sqlippool_v4 { ... messages { exists = "Existing IPv4: %{reply:${..attribute_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IPv4: %{reply:${..attribute_name}} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" ... sqlippool sqlippool_v6 { ... messages { exists = "Existing IPv6: %{reply:${..attribute_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IPv6: %{reply:${..attribute_name}} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" ... linelog module configuration: ... linelog log_sqlippoolv4 { format = "%{control:Module-Success-Message}" filename = syslog permissions = 0600 } Also i can see the problem in debug mode: (1) sqlippool_v4: EXPAND Allocated IPv4: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (1) sqlippool_v4: --> Allocated IPv4: 10.1.1.1 from xpool (did cli xxx port 134219438 user x) (1) [sqlippool_v4] = ok (1) log_sqlippool: EXPAND %{control:Module-Success-Message} (1) log_sqlippool: --> Allocated IPv4: 10.1.1.1 from xpool (did cli xxx port 134219438 user x) (1) [log_sqlippool] = ok ... (1) sqlippool_v6: EXPAND Allocated IPv6: %{reply:Framed-IPv6-Prefix} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (1) sqlippool_v6: --> Allocated IPv6: 2000:::/64 from xpool (did cli xxx port 134219438 user x) (1) [sqlippool_v6] = ok (1) log_sqlippool: EXPAND %{control:Module-Success-Message} (1) log_sqlippool: --> Allocated IPv4: 10.1.1.1 from xpool (did cli xxx port 134219438 user x) (1) [log_sqlippool] = ok Can someone please clarify what am i doing wrong here? Regards!

1 1

user-name with MAC@ format is not accepted
by Hassan, Hazem (Nokia - EG/Cairo) 14 Feb '21

14 Feb '21

Hi , For the matter of getting FreeRadius ready to test , I tried to use some test users (hazem1 , Graham and MAC@) .. hazem1 and Graham went normal but when I edited the user files (adding new user with the given MAC= 64:20:9F:19:5F:53 and adding some AVPs) , it returns the below errors when run "radiusd -X" >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>............................................. tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize /etc/raddb/mods-config/files/authorize[97]: Entry does not begin with a user name Failed reading /etc/raddb/mods-config/files/authorize /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" Any idea? Thanks, Hazem

1 3

Unlang Configuration Problem on Missing Attributes
by StreitLeak 13 Feb '21

13 Feb '21

I have problem on unlang when I want to build SQL Query. The Request packet is missing some attributes on VSA. The Dictionary which I custom it have 150 attributes. But the Request only sent 120 or 130. So if I set all attributes in my sql query, the query will fail with lacking some attributes in Request Packet. -----SQL Schema--- Ex: The table Schema Example create table radacct { attr1 int not null default 0. attr2 varchar(255) not null default '', attr3 int not null default 0. attr4 int not null default 0 } --- SQL Query in sql/main/mysql/querier.conf --- The Query = "insert into radacct ( attr1.attr2.attr3,attr4) values ('%{attr1}', '%{attr2}','%{attr3}','%{attr4}' );" --- Request Packet Example --- Acct-Delay-Time = 437 Attr1-Log-Time = "Mon Feb 8 15:15:11 2021\n" Acct-Status-Type = Stop Acct-Session-Id = "15934598980000000296" Attr2-Session-Ingress-CallId = 65535 Attr3-Session-Egress-CallId = 1 Attr5-Session-Generic-Id = 157 Acct-Multi-Session-Id = "1612768062157" ---- so the real query is "insert into radacct ( attr1.attr2.attr3,attr4) values (' Mon Feb 8 15:15:11 2021\n ', '65535','1','' ) As you can see . the Attr4 is missing in Request Packet. And it cause the query failed. So I need to set some rules to avoid it. But I can't understand the foreach how to check each VSA attributes. Or any easily way to avoid the missing attributes. Have any configuration Example can help me to understand it? 星たちよ汝の命短き眷族の望みな聞くがよい我らの望みそれほ汝の本將ちゆく末な看取るニと -------------《アーヴによる人類帝國》國歌の一節よリ

3 3

REST module Access-Reject 401 Reply-Message
by adrian.p.smith＠bt.com 11 Feb '21

11 Feb '21

Question regarding the REST module please. If we return a 401 which gets translated into an Access-Reject, is there any way to pass something back from REST which can be put into the reply message? In our scenario each user can have a maximum number of sessions, and if that limit is reached, we want to pass that specific error back in the Access-Reject. TIA

3 2

EAP-TLS host certificates
by Vieri Di Paola 10 Feb '21

10 Feb '21

Hi, Several years ago when Windows XP clients were around in my organization I had successfully configured freeradius with EAP-TLS and host certificates. Now, most of my clients are Windows 10 and just a few Windows 7. They can access with PEAP mschap-v2 via WiFi. I am now trying to configure WiFi access with EAP-TLS and host certificates. Please bear with me as I haven't handled freeradius for years now, and I'm a bit rusty. I already have a custom Signing Authority (ca.pem). So, within /etc/raddb/certs I ran the following after adjusting the corresponding *.cnf files: # make server.pem # make server.csr # make inner-server.pem # make client.pem The Windows 10 client has imported both the CA in trusted roots and the client certificate in the "local computer" store. I chose the common name "PC2036" (see below). The wireless connection is set up with a "smart card or other certificate" (computer account). When I try to connect I see this in the radiusd log (please let me know if you need the full log): (132) Received Access-Request Id 67 from 192.168.216.36:58425 to 10.215.144.91:1812 length 209 (132) User-Name = "host/PC2036" (132) NAS-IP-Address = 192.168.216.36 (132) NAS-Identifier = "10:be:f5:c9:ce:90" (132) NAS-Port = 0 (132) Called-Station-Id = "10-BE-F5-C9-CE-98:HMprv" (132) Calling-Station-Id = "4C-1D-96-4E-48-0F" (132) Framed-MTU = 1400 (132) NAS-Port-Type = Wireless-802.11 (132) Connect-Info = "CONNECT 0Mbps 802.11b" (132) EAP-Message = 0x028a001201686f73742f484d414e32303336 (132) Message-Authenticator = 0xc6775ce6e83151b7ecde4018fb87f5d8 (132) # Executing section authorize from file /etc/raddb/sites-enabled/default (132) authorize { [...] (132) ntdomain: Checking for prefix before "\" (132) ntdomain: No '\' in User-Name = "host/PC2036", looking up realm NULL (132) ntdomain: No such realm "NULL" (132) [ntdomain] = noop (132) [expiration] = noop (132) [logintime] = noop (132) } # authorize = updated (132) Found Auth-Type = eap (132) # Executing group from file /etc/raddb/sites-enabled/default (132) authenticate { (132) eap: Peer sent packet with method EAP Identity (1) (132) eap: Calling submodule eap_tls to process data (132) eap_tls: Initiating new TLS session (132) eap_tls: Setting verify mode to require certificate from client (132) eap_tls: [eaptls start] = request (132) eap: Sending EAP Request (code 1) ID 139 length 6 (132) eap: EAP session adding &reply:State = 0x007a782400f175f1 (132) [eap] = handled (132) } # authenticate = handled (132) Using Post-Auth-Type Challenge (132) # Executing group from file /etc/raddb/sites-enabled/default (132) Challenge { ... } # empty sub-section is ignored (132) Sent Access-Challenge Id 67 from 10.215.144.91:1812 to 192.168.216.36:58425 length 0 (132) EAP-Message = 0x018b00060d20 (132) Message-Authenticator = 0x00000000000000000000000000000000 (132) State = 0x007a782400f175f114c01cbf42164dc9 (132) Finished request Waking up in 4.9 seconds. (132) Cleaning up request packet ID 67 with timestamp +2318 Ready to process requests I then read this: https://wiki.freeradius.org/guide/certificate-compatibility So I decided to replace the whole certificate directory just to make sure the test certs work. So I ran this: # ./bootstrap # make inner-server.pem However, when I run the server I get an error reading its certificate. # radiusd -X [...] tls: Failed reading private key file "/etc/raddb/certs/server.pem" tls: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt tls: error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error tls: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error tls: error:0907B00D:PEM routines:PEM_read_bio_PrivateKey:ASN1 lib tls: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to initialise rlm_eap_tls /etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" # ls -l /etc/raddb/certs/server.pem -rw-r----- 1 root radius 3588 Jun 12 2020 /etc/raddb/certs/server.pem freeradius v. 3.0.20 I'm sure this is a silly mistake on my behalf. Any suggestions? Vieri

4 12

DHCP4 and DHCP6
by Hassan, Hazem (Nokia - EG/Cairo) 10 Feb '21

10 Feb '21

Hi , Can anyone guide me how to install DHCP4 and DHCP6 on Cento7 . I plan to run DHCP proxy on BNG and external DHCP is external. Thanks, Hazem

2 1