- Freeradius-Users - lists.freeradius.org

Questions about EAP-TLS
by mramadany 08 Oct '20

08 Oct '20

Hello everyone, I've recently set-up EAP-TLS on my home access point using freeradius, it works perfectly fine and everything went smoothly. However, I have some questions regarding the protocol and I hope someone on this list will clear things up for me: 1- Before the supplicant sends any certificates to the server, it usually verifies the server's identity. After it does, how can it ensure that it's still talking to the correct server for further communication, does it establish a tunnel after verifying the server's identity? 2- If the above case is correct and it does establish a tunnel, what if the supplicant doesn't verify the server's identity. Does it establish a tunnel using whatever certificate that the server presents? Does it not establish a tunnel at all and simply sends further messages using plaintext? In Android for example, if you choose to not verify the server's identity, it warns: "No certificate specified. Your connection will not be private". What does it mean here? Does it mean that it's potentially not private because an attacker might impersonate the server because it'll accept whatever cert the server provides? If that's the case, then why does authentication with this method generate way fewer lines in `radiusd -X`? RFC 5216 Section 2.1.4 says that privacy (protecting client certificate information and stuff like that) is optional, yet Section 5.5 says that there's integrity protection in the protocol. How does that work if the privacy mode is optional? Does the supplicant sign the information somehow without encrypting it? 3- Since the privacy mode is optional, does freeradius enable it by default? If not, how do I enable it? 4- After the client has been authorized, what happens exactly? How is the shared symmetric key derived? How is it passed along to the Access Point/Client so that it can receive/send data from/to the supplicant (since the RADIUS server's part ends after doing the authentication)? (Resending because my last e-mail doesn't seem to be posted)

3 4

EAP-TTLS works for MacOS supplicants but not Win10
by Evan Sharp 08 Oct '20

08 Oct '20

Hi List, This is my first message so please advise me of any participation gafs. I have a working 801.2x wifi termination with Aruba APs binding Google LDAP users via FreeRADIUS 3.0.21 using EAP-TTLS. It is only successful with MacOS supplicants though. When I start debugging Windows 10 clients, the connection fails somewhere. Comparing debug outputs, the win10 exchange just seems to stop, with no errors thrown, where the mac flow otherwise continues. Pastebin of a successful bind (mac) <https://pastebin.com/wfpDxpMH> Pastebin to a failed bind (win) <https://pastebin.com/BneBgPAN> Although the users for testing are different, there is no explicit Auth-reject to tell me that's the issue. I'd be very grateful for help understanding what's going on! Evan

5 10

How to configure freeRadius with couchbase
by Sagar Shinde 08 Oct '20

08 Oct '20

Hi , Need some basic help to configure FreeRadius and couchbase to track authentication and authorization information. -- Thanks and Regards, Sagar S. Shinde +91-9970375687

2 3

control authentication/authorization by SSID
by Munroe Sollog 07 Oct '20

07 Oct '20

I've been reviewing: https://wiki.freeradius.org/guide/Mac-Auth#additional-modifications_mac-aut… I have two SSIDs. One of them is mac-auth and the other is .1x. My wireless environment presents freeradius with %{Aruba-Essid-Name} to denote the SSID. If I am interpreting the above documentation correctly, it suggests that I alter what I'm storing in the mac address database to also include the SSID so it can compare both the mac address and the SSID. However, as we don't have multiple SSIDs that do mac auth, is it possible to create some sort of logic in the authorize section based on SSID? Something like: if %{Aruba-Essid-Name} == "mac-auth ssid" { do mac auth} elif %{Aruba-Essid-Name} == ".1x ssid" {do eap} else {reject} That seems like a simpler solution,especially since it doesn't require me to mess with the database of mac addresses. Any input would be appreciated. -- Munroe Sollog (He/Him/His) Senior Network Engineer munroe(a)lehigh.edu

2 1

Freeradius latest rpm on centos7
by Ammad Ali 06 Oct '20

06 Oct '20

Hi, I have installed latest RPM of freeradius from https://packetfence.org/downloads/PacketFence/CentOS7/devel/x86_64/RPMS/ on centos 7. Below are the list of installed RPMs. freeradius-mysql-3.0.21-8.1.x86_64 freeradius-config-3.0.21-8.1.x86_64 freeradius-unixODBC-3.0.21-8.1.x86_64 freeradius-utils-3.0.21-8.1.x86_64 freeradius-3.0.21-8.1.x86_64 freeradius-perl-3.0.21-8.1.x86_64 After fresh install when I start radius in debug mode, it gives me below errors of auth and acct protocol. Mon Sep 28 16:34:26 2020 : Debug: Created signal pipe. Read end FD 5, write end FD 6 Mon Sep 28 16:34:26 2020 : Debug: radiusd: #### Opening IP addresses and Ports #### Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = * Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct with path: /usr/lib64/freeradius/proto_acct.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct failed: /usr/lib64/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "acct" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = * Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipv6addr = :: Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct with path: /usr/lib64/freeradius/proto_acct.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct failed: /usr/lib64/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "acct" Mon Sep 28 16:34:26 2020 : Debug: ipv6addr = :: Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = 127.0.0.1 Mon Sep 28 16:34:26 2020 : Debug: port = 18120 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address * port 1812 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on acct address * port 1813 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address :: port 1812 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on acct address :: port 1813 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Mon Sep 28 16:34:26 2020 : Debug: Opened new proxy socket 'proxy address * port 34165' Mon Sep 28 16:34:26 2020 : Debug: Listening on proxy address * port 34165 Mon Sep 28 16:34:26 2020 : Debug: Opened new proxy socket 'proxy address :: port 59302' Mon Sep 28 16:34:26 2020 : Debug: Listening on proxy address :: port 59302 Mon Sep 28 16:34:26 2020 : Info: Ready to process requests Need your advise. --

3 10

Run sql Module after exec in radpostauth
by Muhammed Buvaydani 05 Oct '20

05 Oct '20

Hello I am using external php script for authentication which I configured in users file , the PHP script will return the reason of the reject and I want to save this reason in radpost auth table, the problem is if I set SQL module before exec and the user was accepted as PAP but rejected from my script then the radpost auth will have access-accept even if he is rejected by my PHP script , this is the debug (1) Received Access-Request Id 245 from 127.0.0.1:53576 to 127.0.0.1:1812 length 96 (1) User-Name = "abhibose" (1) User-Password = "1234" (1) Calling-Station-Id = "4e:f9:5e:77:0c:9a" (1) NAS-Port = 102 (1) NAS-IP-Address = 103.200.57.138 (1) Framed-Protocol = PPP (1) Framed-IP-Address = 192.168.0.1 (1) NAS-Identifier = "nas" (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "abhibose", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) files: users: Matched entry DEFAULT at line 48 (1) files: EXPAND /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "%{User-Name}" "%{User-Password}" "%{Calling-Station-Id}" "%{NAS-Port}" "%{NAS-IP-Address}" "%{Framed-Protocol}" "%{Framed-IP-Address}" "%{Filter-Id}" "%{NAS-Identifier}" (1) files: --> /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "abhibose" "1234" "4e:f9:5e:77:0c:9a" "102" "103.200.57.138" "PPP" "192.168.0.1" "" "nas" (1) [files] = ok (1) sql: EXPAND %{User-Name} (1) sql: --> abhibose (1) sql: SQL-User-Name set to 'abhibose' rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 68 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Reserved connection (0) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'abhibose' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'abhibose' ORDER BY id (1) sql: User found in radcheck table (1) sql: Conditional check items matched, merging assignment check items (1) sql: Simultaneous-Use := 1 (1) sql: Cleartext-Password := "1234" (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'abhibose' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'abhibose' ORDER BY id rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'cloudradius' on Localhost via UNIX socket, server version 5.5.65-MariaDB, protocol version 10 (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'abhibose' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'abhibose' ORDER BY priority (1) sql: User not found in any groups rlm_sql (sql): Released connection (0) (1) [sql] = ok (1) if (User-Name =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { (1) if (User-Name =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> FALSE (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Auth-Type PAP { (1) pap: Login attempt with password (1) pap: Comparing with "known good" Cleartext-Password (1) pap: User authenticated successfully (1) [pap] = ok (1) } # Auth-Type PAP = ok (1) # Executing section session from file /usr/local/etc/raddb/sites-enabled/default (1) session { (1) sql: EXPAND %{User-Name} (1) sql: --> abhibose (1) sql: SQL-User-Name set to 'abhibose' rlm_sql (sql): Reserved connection (5) (1) sql: EXPAND SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL (1) sql: --> SELECT COUNT(*) FROM radacct WHERE username = 'abhibose' AND acctstoptime IS NULL (1) sql: Executing select query: SELECT COUNT(*) FROM radacct WHERE username = 'abhibose' AND acctstoptime IS NULL rlm_sql (sql): Released connection (5) (1) [sql] = ok (1) } # session = ok (1) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (1) post-auth { (1) sql: EXPAND .query (1) sql: --> .query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (1) sql: EXPAND %{User-Name} (1) sql: --> abhibose (1) sql: SQL-User-Name set to 'abhibose' (1) sql: EXPAND INSERT into radpostauth (username, pass, mac,framedipaddress, nasportid, calledstationid, nasipaddress, reply, authdate, reason) values ('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{Calling-Station-Id}','%{Framed-IP-Address}', '%{NAS-Port-Id}','%{Called-Station-Id}','%{NAS-IP-Address}', '%{reply:Packet-Type}', NOW(), '%{reply:Reply-Message}') (1) sql: --> INSERT into radpostauth (username, pass, mac,framedipaddress, nasportid, calledstationid, nasipaddress, reply, authdate, reason) values ('abhibose', '1234', '4e:f9:5e:77:0c:9a','192.168.0.1', '','','103.200.57.138', 'Access-Accept', NOW(), '') (1) sql: Executing query: INSERT into radpostauth (username, pass, mac,framedipaddress, nasportid, calledstationid, nasipaddress, reply, authdate, reason) values ('abhibose', '1234', '4e:f9:5e:77:0c:9a','192.168.0.1', '','','103.200.57.138', 'Access-Accept', NOW(), '') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (1) [sql] = ok (1) exec: Executing: /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "abhibose" "1234" "4e:f9:5e:77:0c:9a" "102" "103.200.57.138" "PPP" "192.168.0.1" "" "nas" : (1) exec: ERROR: Program returned code (1) and output 'Reply-Message := "Your Account has been expired."' (1) [exec] = reject (1) } # post-auth = reject (1) Delaying response for 1.000000 seconds Waking up in 0.1 seconds. Waking up in 0.8 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 245 from 127.0.0.1:1812 to 127.0.0.1:53576 length 52 (1) Reply-Message := "Your Account has been expired." Waking up in 3.9 seconds. (1) Cleaning up request packet ID 245 with timestamp +68 Ready to process requests ^CYou have new mail in /var/spool/mail/root so if I put SQL module after exec , then the sqk will not run at all . so how can I run SQL module after exec thank you in advance

2 4

Acct-Input-Octets Unknown Module
by Osama Zien Adden 04 Oct '20

04 Oct '20

Dears, I installed FreeRadius 3 on CentOS 7. I got this error message: # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log /etc/raddb/mods-config/sql/main/oracle/queries.conf[28]: Failed parsing expanded string: /etc/raddb/mods-config/sql/main/oracle/queries.conf[28]: ...ed-IP-Address}','%{Service-Type}','%{Acct-Input-Octets:-0}','%{Acct-Output-Octets:-0}','%{NA... /etc/raddb/mods-config/sql/main/oracle/queries.conf[28]: ^ Unknown module The Acct-Input-Octets considered as Unknown Module. I enabled "redis" and "rediswho" and installed redis-server .. even I think that "redis" is not the module that I missed. Kindly advice, why FreeRadius can not deal with "Acct-Input-Octets" ? What is the required module in mods-enabled that I should activate to use "Acct-Input-Octets" ? Best regards

2 2

Question about FreeRADIUS and LDAP
by rainer＠ultra-secure.de 02 Oct '20

02 Oct '20

Hi, I think I've managed to get authentication against a CentOS 8 389-server working. https://www.nasirhafeez.com/freeradius-with-ldaps-on-azure-ad-domain-servic… Now, traditionally, our users and the configuration are just in a text-file "users" with the password in clear-text. If I move the users (and only the users) into 389-server, how would the text-file look like? Currently, an entry is like that? bla@blue Cleartext-Password := "test" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 192.168.1.5, Framed-Netmask = 255.255.255.0, Framed-Routing = None, Cisco-AVPair = "vpdn:tunnel-id=VRF1", Cisco-AVPair = "vpdn:tunnel-type=l2tp", Cisco-AVPair = "vpdn:ip-addresses=a.b.c.d", Cisco-AVPair = "vpdn:l2tp-tunnel-password=**********", Cisco-AVPair = "lcp:interface-config#1=ip vrf forwarding bla@blue", Cisco-AVPair = "lcp:interface-config#2=ip unnumbered Loopback80" Or is it better to move everything to LDAP anyway? The iplanet schema seems to import, after adding changetype: modify add: attributetypes But it's missing some of the above key-words. How do I add these? Best Regards Rainer

2 1

sending multiple Class attributes in Rest POST
by Mark Grayson (mgrayson) 01 Oct '20

01 Oct '20

Hi there Is there a way to be able to POST multiple Class attributes using Rest? I am currently testing returning multiple class attributes and can see they are being sent in the accounting-request trace: (10) Framed-IP-Address = 10.192.230.1 (10) Class = 0x31323334353637383957424149443d64756d6d792e6d656d6265723a5553 (10) Class = 0x37334a773b51793453716c44264e5548405929 Is there a way I can pass both received class attributes in a rest POST? It looks like the Rest %{Class} simply picks the first one. Cheers, Mark

3 6

Radius and LDAP permissions
by lingctam 30 Sep '20

30 Sep '20

Hello, Currently, my radius server is configured to use ldap. Would there be an issue if the radius and ldap daemons are ran with a different id group? Radius: ran by user (w/o root privilege) LDAP: ran by root If this would cause an issue, what would resolve the issue of radius requests not being able to go through the ldap server? Thanks.

2 1