- Freeradius-Users - lists.freeradius.org

Unable to delete unwanted attributes from Disconnect-Request
by Tasos Kotaras 08 Jan '21

08 Jan '21

Hello<https://stackoverflow.com/posts/65629171/timeline> I'm struggling to remove some unwanted attributes from the disconnect message emitted after a failure in the rest module. More specifically, in accounting mode, when I receive a Accounting-Request, I either return an Accounting-Response or Disconnect-Request, depending on the HTTP status returned in a REST interaction. Both cases work properly, the only issue is that the disconnect message also contains these attributes that nag NAS (they cause it to return a NAK): |NAS-Port Teardown-Indicator (as 3GPP VSA) | These attributes are not present in the request. If they were, I could easily remove them and this would also affect the generated disconnect. But apparently, these attributes are added at some point that I have no control. The "/update disconnect {...}/" has no effect, as I guess it is relevant only to received messages (not clear from the documentation). I understand that disconenct belongs to a different connection, so it cannot be related and handled by tampering with 'reply' or anythig that freeradius provides me as variables. Still, I badly need to somehow solve the issue, as I have no control over the NAS itself. Configuration details: _mod-enabled/rest:_ |accounting { uri = "http://x.x.x.x:yyyy/..." method = 'post' body = 'json' tls = ${..tls} } | _sites-enables/default:_ |accounting { rest # this has no effect (same if placed inside rest {...}): update disconnect { NAS-Port !* ANY Teardown-Indicator !* ANY } } | radius -X writes these: |(0) rest: Sending HTTP POST to "http://x.x.x.x:yyyy/..." (0) rest: Encoding attribute "User-Name" (0) rest: Encoding attribute "Framed-IP-Address" (0) rest: Encoding attribute "Acct-Status-Type" (0) rest: Encoding attribute "Acct-Session-Id" (0) rest: Processing response header (0) rest: Status : 503 (Service Unavailable) (0) rest: ERROR: Server returned no data rlm_rest (rest): Released connection (0) Need 5 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (5), 1 of 27 pending slots used rlm_rest (rest): Skipping pre-connect, connect_uri not specified (0) [rest] = fail (0) } # accounting = fail (0) WARNING: Unknown destination 127.0.0.1:3799 for CoA request. (0) Not sending reply to client. (0) Finished request | REST works OK and the 503 is expected for this particular case. I cannot see something wrong (the ERROR and WARNING are not a huge surprise) I wonder if there is some workaround to persuade freeradius not to add these naughty attributes, or otherwise, give me the chance to remove them?

2 1

disable available EAP types for certain caller-id?
by Kacper Wirski 07 Jan '21

07 Jan '21

Hello, I'd like to limit EAP types available depending on called-station-id (ip addresses only for EAP-TLS. Would something like this - in general - in my "default" site work? Maybe there is a better way to achieve the same thing? Overall I want to use other EAP-types, so I can't just comment them out in eap module, but I'd like to filter them for specific connections. I'm using latest stable Freeradius (3.0.21) authorize { ... if (&Called-Station-Id == "<my-public-ip>" && &EAP-Type != EAP-TLS) { reject } eap { ok = return } ..... } Regards, Kacper -- Ta wiadomość została sprawdzona na obecność wirusów przez oprogramowanie antywirusowe Avast. https://www.avast.com/antivirus

2 2

unsubscribe
by Kostya Berger 04 Jan '21

04 Jan '21

unsubscribe

2 1

Show Dhcp assigned IPS with respective MACs.
by CpServiceSPb 01 Jan '21

01 Jan '21

I have Freeradius 3.0.21 on Ubuntu 18.04 LTS Server (no X) acting as Radius itself and as Dhcp one. There is no Freeradius Web UI installed at the time. What are ways to show assigned IPs by DHCP respectively with its MACs from CLI and from some Web UI something like: MAC IP Assignment time Lease (or RElease) time

2 1

Re: Freeradius with lets encrypt certificate
by André 30 Dec '20

30 Dec '20

Hello, Problem solved by using openssl verify for debug and this link: https://stackoverflow.com/questions/50803160/unable-to-openssl-verify-letse… And downloading the correct CA and *ADDING* this CA https://www.identrust.com/dst-root-ca-x3 to a file ca_file = file to the mods-enable/eap # tls-config tls-common { Thank you all for your help. Basically it looks like the rootCA for let's encrypt changed. Best regards, Good 2021 year to all. On Tue, Dec 29, 2020 at 7:47 PM Mark Elkins <mje(a)posix.co.za> wrote: > No idea if this will help but... > > I just had a very similar issue with Exim... my mail system. I was using > the wrong (old) intermediate certificate - which has worked for years. > > I use 'dehydrated' to obtain and renew my Let's Encrypt certs. They have > just stopped cross signing - and that triggered my issue - at 2am on the > 25th Dec. > > EXIM requires the current cert, an intermediate, as well as what's in > /usr/share/ca-certificates/mozilla (they use/are "ISRG_Root_X1.crt")... > "dehydrated" has a file in the 'cert' directory called "fullchain.pem" Look > at the second Certificate it contains - the new intermediate. > > The intermediate is no longer.... > > -----BEGIN CERTIFICATE----- > MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ > ..... cut .... > PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 > KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== > -----END CERTIFICATE----- > > but (in full) > > -----BEGIN CERTIFICATE----- > MIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/ > MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT > DkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFow > MjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT > AlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLs > jVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKp > Tm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnB > U840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7 > gcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel > /xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1R > oYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E > BAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p > ZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE > p7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE > AYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu > Y3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0 > LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYf > r52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B > AQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kH > ejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8 > S8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfL > qjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9p > O5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2Tw > UdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg== > -----END CERTIFICATE----- > > Maybe your problem - otherwise please simply delete this email and ignore > me. > > > On 12/29/20 6:23 PM, André wrote: > > freeradius cloned from github:https://github.com/FreeRADIUS/freeradius-server > > Tue Dec 29 14:31:40 2020: tls - Failed verifying chain: error:1414C086:SSL > routines:ssl_build_cert_chain:certificate verify failed:Verify error:unable > to get issuer certificate > Tue Dec 29 14:31:40 2020: rlm_eap_ttls - Failed initializing SSL context > Tue Dec 29 14:31:40 2020: > /usr/local/freeradius/etc/raddb/mods-enabled/eap[1031]: Instantiation > failed for module "eap.ttls" > > I'm using a let's encrypt certificate , but I'm getting this error message. > > What should the files I should be using for the cert? > > Best regards, > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > -- > > Mark James ELKINS - Posix Systems - (South) Africa > mje(a)posix.co.za Tel: +27.826010496 <+27826010496> > For fast, reliable, low cost Internet in ZA: https://ftth.posix.co.za > > [image: Posix Systems][image: VCARD for MJ Elkins] >

1 0

EAP-TTLS with Windows 10 issue
by André 30 Dec '20

30 Dec '20

Hello, has anyone had issues connecting windows eap-ttls to freeradius , all seems to go well but after challenge is sent to windows 10 , nothing more happens connection is ended and windows only says can't connect, I'm using a valid certificate from let's encrypt and have added let's encrypt authority to windows 10. Any suggestions? More details: freeradius -v (also tested with 3.0.21) radiusd: FreeRADIUS Version 3.0.17, for host x86_64-pc-linux-gnu, built on Apr 22 2019 at 21:23:36 FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 10 (buster) Release: 10 Codename: buster WLC 802.1X WPA2-Enterprise Software Version 8.5.135.0 Cisco 2504 WLC Client Windows 10 - Fails EAP-TTLS No encrypted password Linux Client ubuntu 20.x - Works correctly freeradius -X -xx Using a let's encrypt certificate. Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: EXPAND %{User-Name} Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: --> fern(a)xxxx.local Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: Matched entry DEFAULT at line 12 Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: EAP-Message = 0x0108003d1580000000331403030001011603030028c60ef4913a4a2a8bb545cc619ee5234cfe5c72511aa4d7a9073353f78e23a1189af29a397d34563c allowed by EAP-Message =* 0x Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: Attribute "EAP-Message" allowed by 1 rules, disallowed by 0 rules Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: Message-Authenticator = 0x00000000000000000000000000000000 allowed by Message-Authenticator =* 0x Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: Attribute "Message-Authenticator" allowed by 1 rules, disallowed by 0 rules Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: State = 0x3629afbd3321ba42cccfd968ddb33519 allowed by State =* 0x Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: Attribute "State" allowed by 1 rules, disallowed by 0 rules Mon Dec 28 12:00:08 2020 : Debug: (13) modsingle[post-auth]: returned from attr_filter.access_challenge (rlm_attr_filter) Mon Dec 28 12:00:08 2020 : Debug: (13) [attr_filter.access_challenge.post-auth] = updated Mon Dec 28 12:00:08 2020 : Debug: (13) } # Post-Auth-Type Challenge = updated Mon Dec 28 12:00:08 2020 : Debug: (13) session-state: Nothing to cache Mon Dec 28 12:00:08 2020 : Debug: (13) Sent Access-Challenge Id 133 from 192.168.31.183:1812 to 192.168.31.238:32772 length 0 Mon Dec 28 12:00:08 2020 : Debug: (13) EAP-Message = 0x0108003d1580000000331403030001011603030028c60ef4913a4a2a8bb545cc619ee5234cfe5c72511aa4d7a9073353f78e23a1189af29a397d34563c Mon Dec 28 12:00:08 2020 : Debug: (13) Message-Authenticator = 0x00000000000000000000000000000000 Mon Dec 28 12:00:08 2020 : Debug: (13) State = 0x3629afbd3321ba42cccfd968ddb33519 Mon Dec 28 12:00:08 2020 : Debug: (13) Finished request Mon Dec 28 12:00:08 2020 : Debug: Waking up in 4.9 seconds. Mon Dec 28 12:00:13 2020 : Debug: (8) Cleaning up request packet ID 128 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Debug: (9) Cleaning up request packet ID 129 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Debug: (10) Cleaning up request packet ID 130 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Debug: (11) Cleaning up request packet ID 131 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Debug: (12) Cleaning up request packet ID 132 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Debug: (13) Cleaning up request packet ID 133 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Info: Ready to process requests

2 5

Freeradius with lets encrypt certificate
by André 29 Dec '20

29 Dec '20

freeradius cloned from github: https://github.com/FreeRADIUS/freeradius-server Tue Dec 29 14:31:40 2020: tls - Failed verifying chain: error:1414C086:SSL routines:ssl_build_cert_chain:certificate verify failed:Verify error:unable to get issuer certificate Tue Dec 29 14:31:40 2020: rlm_eap_ttls - Failed initializing SSL context Tue Dec 29 14:31:40 2020: /usr/local/freeradius/etc/raddb/mods-enabled/eap[1031]: Instantiation failed for module "eap.ttls" I'm using a let's encrypt certificate , but I'm getting this error message. What should the files I should be using for the cert? Best regards,

2 3

EAP-TLS local issuer cert problem
by Kostya Berger 21 Dec '20

21 Dec '20

Hi, seems like I poorly expressed my problem in my previous message, sorry for that. I seem to experience a bug in the OpenBSD pkg of Freeradius 3.0.21. Server denies access to client with good certs. These work perfectly well in an absolutely identical nstallation on FreeBSD... And I can't understand what's happening. It verifies the cert, says OK. But then verifies agsin and says NOT OK. Looks like the second time temp. file it's trying to read is already removed.... or what? OpenBSD ktrace output of #radiusd -X session is attached, hope it will help. It's in text format. Thank you for help. Sent from Yahoo Mail on Android

2 1

dynamic-authorization with TLS
by murugesh pitchaiah 21 Dec '20

21 Dec '20

Hi Need help on doing coa with tls: I am working on setting up Radius TLS. Authentication and Accounting works good. But with dynamic-authorization - i see the following issue. TLS Connection between Radius server and NAS is established. But when testing the coa - looks like the radclient to Radis server communication is failing. (snip) ... new connection request on TCP socket Listening on coa from client (127.0.0.1, 41336) -> (*, 3799, virtual-server=coa) Waking up in 0.2 seconds. (0) Initiating new EAP-TLS session (0) Non-TLS data sent to TLS socket: closing Closing TLS socket from client port 41336 (snip) Here is the radclient output: (snip) cat dis.txt | radclient -P tcp -x localhost:3799 disconnect radsec Sent Disconnect-Request Id 209 from 127.0.0.1:41690 to 127.0.0.1:3799 length 36 Acct-Session-Id = "1E000001" Event-Timestamp = "Dec 20 2020 16:46:05 IST" radclient: Received bad packet (snip) To send a coa disconnect/coa request to TLS port is there any other way ? Am i missing any configuration ? Any help please. Thanks murugesh

3 6

unable to get local issuer certificate
by Kostya Berger 18 Dec '20

18 Dec '20

Hello, thank you for your time and effort. I've been successfully using Freeradius3 for some years now for EAP-TLS. But now I've moved config directory (as I've done successfully in the past several times) over to a new installation. It's OpenBSD 6.8 and LibreSSL 3.2.2. Again, the very SAME configuration (certs etc) have been successfully running on OpenBSD 6.6, but on 6.8 I'm getting SSL error "unable to get local issuer certificate".Complete piece of log output from $radiusd -X is attached. It's Freeradius 3.0.21. And the very SAME configuration directory (/etc/raddb) is used on another machine with Freeradius-3.0.21 successfully. What could be the reason for this strange error? Here is the error part: (5) eap_tls: Executing: /usr/bin/openssl verify -CAfile /etc/raddb/certs/ca.crt %{TLS-Client-Cert-Filename}: (5) eap_tls: EXPAND %{TLS-Client-Cert-Filename} (5) eap_tls: --> /tmp/radiusd/radiusd.client.UCCKLTa6 (5) eap_tls: Program returned code (0) and output '/tmp/radiusd/radiusd.client.UCCKLTa6: OK' (5) eap_tls: Client certificate CN guest1 passed external validation (5) eap_tls: TLS - Creating attributes from certificate OIDs (5) eap_tls: TLS-Client-Cert-Serial := "04" (5) eap_tls: TLS-Client-Cert-Expiration := "271014045744Z" (5) eap_tls: TLS-Client-Cert-Valid-Since := "171016045744Z" (5) eap_tls: TLS-Client-Cert-Subject := "/CN=guest1" (5) eap_tls: TLS-Client-Cert-Issuer := "/CN=radius-ca" (5) eap_tls: TLS-Client-Cert-Common-Name := "guest1" (5) eap_tls: TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (5) eap_tls: TLS-Client-Cert-X509v3-Subject-Key-Identifier += "0A:7C:1E:FF:76:49:92:23:E2:01:FC:0E:E2:4C:AD:A4:DF:D7:97:B3" (5) eap_tls: TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:99:FE:50:7E:22:CA:AB:8A:99:DB:BD:AB:F1:5C:7D:9D:13:9C:FB:15\nDirName:/CN=radius-ca\nserial:AD:E7:75:7D:9C:52:62:82\n" (5) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" (5) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (5) eap_tls: Verifying client certificate: /usr/bin/openssl verify -CAfile /etc/raddb/certs/ca.crt %{TLS-Client-Cert-Filename} (5) eap_tls: Executing: /usr/bin/openssl verify -CAfile /etc/raddb/certs/ca.crt %{TLS-Client-Cert-Filename}: (5) eap_tls: EXPAND %{TLS-Client-Cert-Filename} (5) eap_tls: --> /tmp/radiusd/radiusd.client.UCCKLTa6 Error opening certificate file /tmp/radiusd/radiusd.client.UCCKLTa6 9739695490448:error:02FFF002:system library:func(4095):No such file or directory:/usr/src/lib/libcrypto/bio/bss_file.c:255:fopen('/tmp/radiusd/radiusd.client.UCCKLTa6', 'r') 9739695490448:error:20FFF002:BIO routines:CRYPTO_internal:system lib:/usr/src/lib/libcrypto/bio/bss_file.c:257: unable to load certificate (5) eap_tls: ERROR: Program returned code (2) and output '' tls: Certificate CN (guest1) fails external verification! .... Brief summary: /tmp/radiusd IS writable by _freeradius user -- I checked that explicitly by trying to write their by that user. Certificates ARE available in the certdir, which is clear from the string "eap_tls: Program returned code (0) and output '/tmp/radiusd/radiusd.client.UCCKLTa6: OK'". And in the full log attached here there appears message "unable to get local issuer certificate". All certificates were created by the same procedure... though I think I used easy-rsa instead of the Freeradius tools. Just don't remember that. Thank you very much for your time!

2 3