- Freeradius-Users - lists.freeradius.org

Recommended IP pool module + IPv6 + stickiness
by Vegard Svanberg 03 Feb '21

03 Feb '21

Hi, I'm looking into centralising PPPoE IP address pool assignment/distribution and am setting up a test environment. Backend is SQL. I looked into sqlippool and sqlhpwippool, without managing to decide whether one is better than the other. Any suggestions? Just pick one and go with it? Then there's IPv6. As far as I can see the above modules don't support v6. This is not a major blocker as we could assign large enough pools to the NASes and let them handle v6 assignments. But still would be nice to have this centrally. Are there any modules supporting v6 yet? Lastly: Currently the NAS devices have a "semi-sticky" assignment policy. If a client disconnects and reconnects, they'll usually get the same IP. This is not configurable, so I don't know the internals (like timeout etc). Just wondering if it's straight-forward to mimic this in FR. Thanks in advance! -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

3 4

[802.1X] FreeRADIUS OpenLDAP
by Christian VAN DER ZWAARD 01 Feb '21

01 Feb '21

Hello everyone, I'm using an LDAP directory to store my user accounts and groups. For each group I created a radiusObjectProfile to store the required attributes to assign a VLAN to the user. A user can't be in more than 1 group. My profiles are stored in *cn=group1,ou=profiles,ou=radius,dc=company,dc=com*, each profile's *common name* matches the corresponding group name. How can I configure my LDAP module to get the right profile depending on the user's group? I tried it this way: *profile { filter = '(objectclass=radiusprofile)' default = "cn=%{LDAP-Group},ou=profiles,ou=radius,${..base_dn}"* *}* But it does not work... Here is Freeradius's output: *(0) ldap: EXPAND cn=%{LDAP-Group},ou=profiles,ou=radius,*dc=company,dc=com *(0) ldap: --> cn=,ou=profiles,ou=radius,dc=jdl-network,dc=local(0) ldap: Performing search in "cn=,ou=profiles,ou=radius,*dc=company,dc=com *" with filter "(objectclass=radiusprofile)", scope "base"(0) ldap: Waiting for search result...(0) ldap: ERROR: Failed performing search: Invalid DN syntax(0) ldap: ERROR: Server said: invalid DN.* Obviously, using *%{LDAP-Group}* won't work if the variable has no value.. Do you have any idea how I can get the user's group? Is there a way to extract the group name from the dn ( *uid=cvdz,cn=group1,ou=users,ou=radius,dc=company,dc=com*)? Thank you very much for your help. Kind regards -- Christian VAN DER ZWAARD

1 0

Fwd: help
by valeriobaroni 30 Jan '21

30 Jan '21

HELP Hi all, im trying to setup freeradius witch WLC cisco, but when i trying to connect i cannot receive any IP from the vlan 102, can you help me? # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default authorize { policy filter_username { if (&User-Name) { if (&User-Name) -TRUE if (&User-Name) { if (&User-Name =~ / /) { if (&User-Name =~ / /) -FALSE if (&User-Name =~ /@[^@]*@/ ) { if (&User-Name =~ /@[^@]*@/ ) -FALSE if (&User-Name =~ /\.\./ ) { if (&User-Name =~ /\.\./ ) -FALSE if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -FALSE if (&User-Name =~ /\.$/) { if (&User-Name =~ /\.$/) -FALSE if (&User-Name =~ /(a)\./) { if (&User-Name =~ /(a)\./) -FALSE } # if (&User-Name) = notfound } # policy filter_username = notfound [preprocess] = ok [chap] = noop [mschap] = noop [digest] = noop suffix: Checking for suffix after "@" suffix: No '@' in User-Name = "antonio.spagnolo", looking up realm NULL suffix: No such realm "NULL" [suffix] = noop eap: Peer sent EAP Response (code 2) ID 8 length 46 eap: Continuing tunnel setup [eap] = ok } # authorize = ok Found Auth-Type = eap # Executing group from file /etc/freeradius/3.0/sites-enabled/default authenticate { eap: Expiring EAP session with state 0x15e01da017e4042c eap: Finished EAP session with state 0xb7b3f30ab1bbeaee eap: Previous EAP request found for state 0xb7b3f30ab1bbeaee, released from the list eap: Peer sent packet with method EAP PEAP (25) eap: Calling submodule eap_peap to process data eap_peap: Continuing EAP-TLS eap_peap: [eaptls verify] = ok eap_peap: Done initial handshake eap_peap: [eaptls process] = ok eap_peap: Session established. Decoding tunneled attributes eap_peap: PEAP state send tlv success eap_peap: Received EAP-TLV response eap_peap: Success eap_peap: Using saved attributes from the original Access-Accept eap_peap: Cleartext-Password = "l63dJ2Ye" eap_peap: Tunnel-Type = VLAN eap_peap: Tunnel-Medium-Type = IEEE-802 eap_peap: Tunnel-Private-Group-Id = "102" eap: Sending EAP Success (code 3) ID 8 length 4 eap: Freeing handler [eap] = ok } # authenticate = ok # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -FALSE update { &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -'ECDHE-RSA-AES256-GCM-SHA384' &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -'TLS 1.2' } # update = noop sql: EXPAND .query sql: --.query sql: Using query template 'query' rlm_sql (sql): Reserved connection (14) sql: EXPAND %{User-Name} sql: --antonio.spagnolo sql: SQL-User-Name set to 'antonio.spagnolo' sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M') sql: --INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'antonio.spagnolo', '', 'Access-Accept', '2021-01-21 16:11:14.451111') sql: EXPAND /var/log/freeradius/sqllog.sql sql: --/var/log/freeradius/sqllog.sql sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'antonio.spagnolo', '', 'Access-Accept', '2021-01-21 16:11:14.451111') sql: SQL query returned: success sql: 1 record(s) updated rlm_sql (sql): Released connection (14) [sql] = ok [exec] = noop policy remove_reply_message_if_eap { if (&reply:EAP-Message && &reply:Reply-Message) { if (&reply:EAP-Message && &reply:Reply-Message) -FALSE else { [noop] = noop } # else = noop } # policy remove_reply_message_if_eap = noop } # post-auth = ok Sent Access-Accept Id 34 from 192.168.11.5:1812 to 192.168.14.250:50788 length 0 Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "102" MS-MPPE-Recv-Key = 0x7271712b4d569cfb7ca3339e0a7b56057fbb82f2d1c0571a16de929285a7b101 MS-MPPE-Send-Key = 0x43dd9dbc85f67a42325568da028912e22fc1587cb3d2df3ed4c5b076731f8e85 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "antonio.spagnolo" Finished request

4 5

[802.1x] FreeRADIUS OpenLDAP
by Christian VAN DER ZWAARD 28 Jan '21

28 Jan '21

Hello, I'm actually trying to set up network authentication with FreeRADIUS and OpenLDAP. I'm trying to provide a VLAN depending on the users group. It actually works if I set the *Tunnel-Private-Group-Id* attribute on my user but I'd love to set a Group ID on my group object in LDAP only. FreeRADIUS won't take the Group ID when it's set in *Tunnel-Private-Group-Id* attribute on the group object. Do you have any idea how I can get this to work? Thank you so much for your help Kind regards. -- Christian VAN DER ZWAARD

3 4

AW: Additional reply attributes via eap-pwd possible?
by denny.friebe＠icera-network.de 27 Jan '21

27 Jan '21

I have now found my mistake. I had commented out "updated = return" in the default configuration under authorize in the eap module. The attributes are now passed on an access-accept.

1 0

Passing attributes into inner-tunnel
by lingctam 27 Jan '21

27 Jan '21

Dear all, Is there a way to pass specific attributes from the outer session into the eap_peap tunnels to be processed? I haven't had any success in doing this nor able to find any hints online. Any help would be appreciated. Thanks.

1 1

AW: Additional reply attributes via eap-pwd possible?
by denny.friebe＠icera-network.de 27 Jan '21

27 Jan '21

I have taken a closer look at my configuration. The setting "use_tunneled_reply = yes" is not necessary as long as "if (1)" is configured in the inner-tunnel configuration under post-auth. Am I right? However, commenting out "use_tunneled_reply" under mods-enabled/eap unfortunately did not bring any further change. I am a little confused about the output of eap once the attributes have been read from the database: (2) eap_pwd: } # server inner-tunnel (2) eap_pwd: Got tunneled reply code 0 (2) eap_pwd: LCS-TxRateLimit = 6000 (2) eap_pwd: LCS-RxRateLimit = 2000 (2) eap: Sending EAP Request (code 1) ID 41 length 102 (2) eap: EAP session adding &reply:State = 0x58f212fd59db2661 Is it correct that the EAP state is truncated here? The full EAP state appears to be 0x58f212fd59db26614f0b717cc688911b: (2) Sent Access-Challenge Id 222 from 10.15.1.36:1812 to 10.30.156.65:37368 length 0 (2) EAP-Message = 0x0129006634025fadaeff04481146b40220f1468f31bf13d8294433193d8537db173268433b 15d077dc47f6a540608fd41203c2f3b6c9a13f4ad48634ac66370345c31d7117b1f6597bdb0c 03f576a59f34b90678337e3f41dcd7cd9c67098aa2d30104f9477e (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x58f212fd59db26614f0b717cc688911b

1 0

Configuring MSCHAP to use attributes from PASSWD
by lingctam 27 Jan '21

27 Jan '21

Dear all, Could you please direct me to the correct way to configure the MSCHAP module to use the User-Name and Clear-Text Passwords from the PASSWD file? I have added the expansion under authenticate in the following way: Auth-Type MS-CHAP { %{mschap:"User-Name"} } But I haven't been able to resolve the following error in the debug log: (9) Found Auth-Type = EAP (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) authenticate { (9) eap: Expiring EAP session with state 0x4c7ec85a4c96d246 (9) eap: Finished EAP session with state 0x4c7ec85a4c96d246 (9) eap: Previous EAP request found for state 0x4c7ec85a4c96d246, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) eap_mschapv2: Auth-Type MS-CHAP { (9) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (9) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (9) mschap: Creating challenge hash with username: test (9) mschap: Client is using MS-CHAPv2 (9) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (9) mschap: ERROR: MS-CHAP2-Response is incorrect (9) [mschap] = reject (9) } # Auth-Type MS-CHAP = reject (9) eap: Sending EAP Failure (code 4) ID 232 length 4 (9) eap: Freeing handler (9) [eap] = reject (9) } # authenticate = reject (9) Failed to authenticate the user Any help would be appreciated. Thanks.

2 3

eap-tls fails: "need to read more data"
by Bull, Mary 26 Jan '21

26 Jan '21

We recently updated our radius servers to FreeRADIUS Version 3.0.20 and many clients with correct information are now repeatedly failing to authenticate. The client is a MBP on Mojave (10.14) with a fresh certificate enroll on 1-23-2021, after our server upgrade. This client’s certificate was eventually accepted after being rejected repeatedly for about 24 hours. Does this “need more data” error provide any insight on this mess? Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: Peer indicated complete TLS record size will be 7 bytes Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: Got complete TLS record (7 bytes) Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: [eaptls verify] = length included Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: <<< recv TLS 1.2 [length 0002] Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: TLS_accept: Need to read more data: error Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:140943E8:SSL routines:ssl3_read_bytes:reason(1000) Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: TLS - In Handshake Phase Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: TLS - Application data. Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: ERROR: TLS failed during operation Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: ERROR: [eaptls process] = fail Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap-aerohive-eduroam: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap-aerohive-eduroam: Sending EAP Failure (code 4) ID 136 length 4 Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap-aerohive-eduroam: Failed in EAP select Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) [eap-aerohive-eduroam] = invalid Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) } # Auth-Type eap-aerohive-eduroam = invalid Mary Bull Network Tech 757-221-2491 mbull(a)wm.edu

1 0

AW: Additional reply attributes via eap-pwd possible?
by denny.friebe＠icera-network.de 26 Jan '21

26 Jan '21

Sorry, I just sent you the default config twice. Here is my inner-tunnel config: server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { filter_username suffix update control { &Proxy-To-Realm := LOCAL } eap { ok = return } -sql logintime pap } authenticate { Auth-Type PAP { pap } eap } session { radutmp } post-auth { reply_log -sql if (1) { update reply { User-Name !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY } update { &outer.session-state: += &reply: } } Post-Auth-Type REJECT { -sql attr_filter.access_reject update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } pre-proxy { } post-proxy { eap } }

1 0