- Freeradius-Users - lists.freeradius.org

AW: Additional reply attributes via eap-pwd possible?
by denny.friebe＠icera-network.de 27 Jan '21

27 Jan '21

I have now found my mistake. I had commented out "updated = return" in the default configuration under authorize in the eap module. The attributes are now passed on an access-accept.

1 0

Passing attributes into inner-tunnel
by lingctam 27 Jan '21

27 Jan '21

Dear all, Is there a way to pass specific attributes from the outer session into the eap_peap tunnels to be processed? I haven't had any success in doing this nor able to find any hints online. Any help would be appreciated. Thanks.

1 1

AW: Additional reply attributes via eap-pwd possible?
by denny.friebe＠icera-network.de 27 Jan '21

27 Jan '21

I have taken a closer look at my configuration. The setting "use_tunneled_reply = yes" is not necessary as long as "if (1)" is configured in the inner-tunnel configuration under post-auth. Am I right? However, commenting out "use_tunneled_reply" under mods-enabled/eap unfortunately did not bring any further change. I am a little confused about the output of eap once the attributes have been read from the database: (2) eap_pwd: } # server inner-tunnel (2) eap_pwd: Got tunneled reply code 0 (2) eap_pwd: LCS-TxRateLimit = 6000 (2) eap_pwd: LCS-RxRateLimit = 2000 (2) eap: Sending EAP Request (code 1) ID 41 length 102 (2) eap: EAP session adding &reply:State = 0x58f212fd59db2661 Is it correct that the EAP state is truncated here? The full EAP state appears to be 0x58f212fd59db26614f0b717cc688911b: (2) Sent Access-Challenge Id 222 from 10.15.1.36:1812 to 10.30.156.65:37368 length 0 (2) EAP-Message = 0x0129006634025fadaeff04481146b40220f1468f31bf13d8294433193d8537db173268433b 15d077dc47f6a540608fd41203c2f3b6c9a13f4ad48634ac66370345c31d7117b1f6597bdb0c 03f576a59f34b90678337e3f41dcd7cd9c67098aa2d30104f9477e (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x58f212fd59db26614f0b717cc688911b

1 0

Configuring MSCHAP to use attributes from PASSWD
by lingctam 27 Jan '21

27 Jan '21

Dear all, Could you please direct me to the correct way to configure the MSCHAP module to use the User-Name and Clear-Text Passwords from the PASSWD file? I have added the expansion under authenticate in the following way: Auth-Type MS-CHAP { %{mschap:"User-Name"} } But I haven't been able to resolve the following error in the debug log: (9) Found Auth-Type = EAP (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) authenticate { (9) eap: Expiring EAP session with state 0x4c7ec85a4c96d246 (9) eap: Finished EAP session with state 0x4c7ec85a4c96d246 (9) eap: Previous EAP request found for state 0x4c7ec85a4c96d246, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) eap_mschapv2: Auth-Type MS-CHAP { (9) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (9) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (9) mschap: Creating challenge hash with username: test (9) mschap: Client is using MS-CHAPv2 (9) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (9) mschap: ERROR: MS-CHAP2-Response is incorrect (9) [mschap] = reject (9) } # Auth-Type MS-CHAP = reject (9) eap: Sending EAP Failure (code 4) ID 232 length 4 (9) eap: Freeing handler (9) [eap] = reject (9) } # authenticate = reject (9) Failed to authenticate the user Any help would be appreciated. Thanks.

2 3

eap-tls fails: "need to read more data"
by Bull, Mary 26 Jan '21

26 Jan '21

We recently updated our radius servers to FreeRADIUS Version 3.0.20 and many clients with correct information are now repeatedly failing to authenticate. The client is a MBP on Mojave (10.14) with a fresh certificate enroll on 1-23-2021, after our server upgrade. This client’s certificate was eventually accepted after being rejected repeatedly for about 24 hours. Does this “need more data” error provide any insight on this mess? Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: Peer indicated complete TLS record size will be 7 bytes Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: Got complete TLS record (7 bytes) Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: [eaptls verify] = length included Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: <<< recv TLS 1.2 [length 0002] Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: TLS_accept: Need to read more data: error Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:140943E8:SSL routines:ssl3_read_bytes:reason(1000) Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: TLS - In Handshake Phase Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: TLS - Application data. Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: ERROR: TLS failed during operation Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap_tls: ERROR: [eaptls process] = fail Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap-aerohive-eduroam: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap-aerohive-eduroam: Sending EAP Failure (code 4) ID 136 length 4 Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) eap-aerohive-eduroam: Failed in EAP select Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) [eap-aerohive-eduroam] = invalid Jan 25 22:45:32 is-auth-02 freeradius[166005]: (6972) } # Auth-Type eap-aerohive-eduroam = invalid Mary Bull Network Tech 757-221-2491 mbull(a)wm.edu

1 0

AW: Additional reply attributes via eap-pwd possible?
by denny.friebe＠icera-network.de 26 Jan '21

26 Jan '21

Sorry, I just sent you the default config twice. Here is my inner-tunnel config: server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { filter_username suffix update control { &Proxy-To-Realm := LOCAL } eap { ok = return } -sql logintime pap } authenticate { Auth-Type PAP { pap } eap } session { radutmp } post-auth { reply_log -sql if (1) { update reply { User-Name !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY } update { &outer.session-state: += &reply: } } Post-Auth-Type REJECT { -sql attr_filter.access_reject update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } pre-proxy { } post-proxy { eap } }

1 0

AW: Additional reply attributes via eap-pwd possible?
by denny.friebe＠icera-network.de 26 Jan '21

26 Jan '21

The last reply was accidentally sent directly to your email. Here again for the mailing list: > You've added the attributes in the inner-tunnel, but you haven't told the server to send them to the client. > You need to copy the inner tunnel attributes to the outer tunnel. See sites-available/inner-tunnel: > Then also see sites-available/default: > this comment applies to EAP-PWD, too. Follow the instructions there. > Alan DeKok. Thank you for your help. I have already done this so far. Or have I overlooked something? Here is my configuration: sites-enabled/default: ################################ server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 0 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } authorize { filter_username preprocess suffix rewrite_calling_station_id eap { ok = return updated = return } -sql logintime } authenticate { eap } preacct { preprocess acct_unique suffix } accounting { detail -sql exec attr_filter.accounting_response } session { } post-auth { update { &reply: += &session-state: } -sql exec Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } ################################ sites-enabled/inner-tunnel: ################################ server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 0 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } authorize { filter_username preprocess suffix rewrite_calling_station_id eap { ok = return updated = return } -sql logintime } authenticate { eap } preacct { preprocess acct_unique suffix } accounting { detail -sql exec attr_filter.accounting_response } session { } post-auth { update { &reply: += &session-state: } -sql exec Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } ################################

1 0

Additional reply attributes via eap-pwd possible?
by denny.friebe＠icera-network.de 26 Jan '21

26 Jan '21

I am currently configuring my freeradius server with mysql to implement authentication via eap-pwd. Later it should be possible to log in to an access point by username/password. The login works without any problems. As access point i use devices from lancom which support additional attributes like "LCS-RxRateLimit" and "LCS-TxRateLimit" to throttle the bandwidth of the client. I have added these two attributes to the user in the radreply table. However, after successful authentication, the two attributes are not transmitted. (checked with wireshark) Is this possible at all via eap-pwd?

2 3

REST POST buffer overflow
by adrian.p.smith＠bt.com 25 Jan '21

25 Jan '21

We are running 3.0.15 and are seeing occasional issues when a large accounting packet is passed to our REST server: It appears that a buffers gets a bit full and if this occurs when an attribute name is written, but not the value, the next chunk starts with the value of the NEXT AVP instead of the one that was being processed when the buffer got full: Here is some debug I captured (various values obfuscated) : Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Length : 1 Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Value : 0 Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Encoding attribute "Calling-Station-Id" Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Length : 17 Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Value : aa-bb-cc-dd-ee-ff Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Encoding attribute "Called-Station-Id" Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Length : 26 Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Value : AAAA-BBBB-CC-DDDD%3A_EEEE-FF Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: POST Data: User-Name=ccccccc%2F2-e0f81c520daf44eba1335f1c508b65d2-form%4014143d&NAS-Port=8&NAS-IP-Address=10.101.0.2&Framed-IP-Address=10.101.16.156&Class=0x62746f7a2d2d2d35666664356238612f37303a62633a31303a36383a32373a65322f31333938323736392f313631303433393537342d2d2d&Class=0x52454749442166383534626439392d613335652d343033302d613331632d623632333837363535373866&NAS-Identifier=ccccccccc%2F&Airespace-Wlan-Id=90&Acct-Session-Id=5ffd5b8a%2F70%3Abc%3A10%3A68%3A27%3Ae2%2F13982769&NAS-Port-Type=Wireless-802.11&Cisco-AVPair=audit-session-id%3D980027d9008b75188a5bfd5f&Acct-Authentic=RADIUS&Tunnel-Type=VLAN&Tunnel-Medium-Type=IEEE-802&Tunnel-Private-Group-Id=2566&Event-Timestamp=Jan%2012%202021%2012%3A31%3A05%20GMT&Acct-Status-Type=Interim-Update&Acct-Input-Octets=2714442414&Acct-Input-Gigawords=0&Acct-Output-Octets=1012626742&Acct-Output-Gigawords=0&Acct-Input-Packets=3975169&Acct-Output-Packets=2035021&Acct-Session-Time=15090&Acct-Delay-Time=0&Calling-Station-Id=aa-bb-cc-dd-ee-ff&Called-Station-Id= Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Returning 995 bytes of POST data (buffer full or chunk exceeded) Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Encoding attribute "Tmp-String-9" Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Length : 3 Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Value : ai%3A Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Encoding attribute "Acct-Unique-Session-Id" Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Length : 32 Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Value : 8c229aac7dd2a7fff9df0b5128d9a736 Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: POST Data: ai%3A&Acct-Unique-Session-Id=8c229aac7dd2a7fff9df0b5128d9a736 Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Returning 61 bytes of POST data Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Processing response header Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Status : 100 () Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Continuing... Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Processing response header Tue Jan 12 12:31:05 2021 : Debug: (53749687) rest: Status : 200 () Is this something that would fix if we upgrade to 3.0.21 or a bug that could be fixed? TIA Adrian

3 8

Directing clients from specific SSID to use set passwords
by lingctam 25 Jan '21

25 Jan '21

Dear all, I need to set up a guest SSID and auth requests from this SSID need to be directed to the freeradius USERS and PASSWD file for authentication. Under the running virtual server, I have added the following line: If (Called-Station-Id =~ /SSID/) { Files Passwd } I am getting the following errors in the debugging log: (19) elsif (Called-Station-Id =~ /SSID/) { (19) ERROR: Failed retrieving values required to evaluate condition Could you please point me towards what may cause this? Am I missing some attributes that need to be in the files/authorize file? Thank you.

2 1