- Freeradius-Users - lists.freeradius.org

Is it possible to specify which authorization mode is being used?
by Kristian Faller 10 Aug '20

10 Aug '20

Hi everyone, I am brand new to FreeRadius so please excuse me for what could be a simple question with a simple answer. Is it possible to specify which authentication mode and tunnel type are being used? If yes, what files do I need to modify in order to do this? I have tried reading the documentation and looking through some of the config files, but as a complete beginner at this, I'm not sure if I'm even looking in the right places. Background: I work with software testing for reMarkable (we create an E ink tablet based on Linux), and we want to conduct more specified testing on WPA Enterprise (802.1X over Wi-Fi). At the moment we have done testing on our network gear which consists of Ubiquiti Unifi which only implements eap_peap with MSCHAPv2. While this is probably used for many companies all over the world, we would like to test other kinds of authentication and tunnel types, thus I started setting up FreeRadius on a Raspberry Pi 4, running Ubuntu 19.10 for IoT devices. Our tablet runs a flavor of Linux, using wpa_supplicant and should (in theory) be able to connect to most kinds of network. However, we know that certificate-based networks won't work at the moment due to not having a way to import licenses. However, I do believe there are other types of networks not needing certificates, and these are the ones we'd like to test. I got FreeRadius up and running, but for every connection attempt, I can see from the output with "freeradius -X" that eap_peap and MSCHAPv2 are used. I want to be able to set specific (valid) values so that our company can implement and properly test the different variations of auth modes and tunnels. I have also attached the (entire) output from 'freeradius -X'. If I miss any details or lack some information in my above text, please let me know, and I'll make sure to clarify/elaborate. Forhåndsvis vedlegget freeradius -x.txt freeradius -x.txt 85 KB <https://mail.google.com/mail/u/0?ui=2&ik=beb323e764&attid=0.1&permmsgid=msg…> -- *Kristian Faller* QA Engineer kristian.faller(a)remarkable.com +47 908 06 444 <+4790806444> Biermanns gate 6, 0473 Oslo, Norway <https://goo.gl/maps/YU24JR1ZYQM2> remarkable.com [image: cid:85D31282-3FFB-4F74-B5D9-6CB7ED4003E7] The privileged confidential information contained in this email is intended for use only by the addressees as indicated by the original sender of this email. If you are not the addressee indicated in this email or are not responsible for delivery of the email to such a person, please kindly reply to the sender indicating this fact and delete all copies of it from your computer and network server immediately. Your cooperation is highly appreciated. It is advised that any unauthorized use of confidential information of REMARKABLE AS is strictly prohibited.

2 2

rlm_ldap fails but ldapsearch works
by Victor 08 Aug '20

08 Aug '20

Hello, I'm trying to check whether a user belongs to a group or not: (0) if (LDAP-Group == "someusers") { (0) Searching for user in group "someusers" rlm_ldap (ldap): Reserved connection (6) (0) Using user DN from request "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" (0) Checking for user in group objects (0) EXPAND (&(cn=someusers)(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local)))) (0) --> (&(cn=someusers)(|(&(uid=common_user)(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local)))) (0) Performing search in "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" with filter "(&(cn=someusers)(|(&(uid=common_user)(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local))))", scope "sub" (0) Waiting for search result... (0) Search returned no results (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local", scope "base" (0) Waiting for search result... (0) No group membership attribute(s) found in user object rlm_ldap (ldap): Released connection (6) but ldapsearch -b "dc=domain,dc=local" "(&(cn=someusers)(member=uid\3dcommon_user\2ccn\3dusers\2ccn\3daccounts\2cdc\3ddomain\2cdc\3dlocal))" -D uid=common_user,cn=users,cn=accounts,dc=domain,dc=local -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: (&(cn=someusers)(member=uid\3dcommon_user\2ccn\3dusers\2ccn\3daccounts\2cdc\3ddomain\2cdc\3dlocal)) # requesting: ALL # # someusers, groups, accounts, domain.local dn: cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject description: Default group for all users cn: someusers ipaUniqueID: ebca3046-a5a0-11ea-8166-9a6e275fb41f member: uid=common_user,cn=users,cn=accounts,dc=domain,dc=local member: uid=very_special_user,cn=users,cn=accounts,dc=domain,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 and ldapsearch -b "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" -D uid=common_user,cn=users,cn=accounts,dc=domain,dc=local -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=common_user,cn=users,cn=accounts,dc=domain,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # common_user, users, accounts, domain.local dn: uid=common_user,cn=users,cn=accounts,dc=domain,dc=local displayName: utilisateur banal uid: common_user krbCanonicalName: common_user(a)DOMAIN.LOCAL objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson objectClass: inetuser objectClass: posixaccount objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipasshuser objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry objectClass: ipauserauthtypeclass loginShell: /bin/bash initials: ub gecos: utilisateur banal sn: banal homeDirectory: /home/common_user mail: common_user(a)domain.local krbPrincipalName: common_user(a)DOMAIN.LOCAL givenName: utilisateur cn: utilisateur banal ipaUniqueID: some_unique_ID uidNumber: theSameNumber gidNumber: theSameNumber krbPasswordExpiration: the_pass_exp krbLastPwdChange: the_pass_exp memberOf: cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local memberOf: cn=manyemoreusers,cn=groups,cn=accounts,dc=domain,dc=local ipaUserAuthType: o_type ipaSshPubKey: some_pubkey # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Some of the configuration: /etc/raddb/sites-enabled/default ... user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = 'uid=common_user,cn=users,cn=accounts,dc=domain,dc=local' scope = 'sub' membership_filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..ldapgroup})))" membership_attribute = 'memberOf' } /etc/raddb/mods-enabled/ldap ... post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } if (LDAP-Group == "someusers") { update { reply:Class := "OKOKOKOKOK" } } else { update { reply:Class := "NONONONONO" } } } Where to go from here? Kind regards

4 9

Accounting-Packets from Huawei NAS randomly not being written to the database
by Antônio Modesto 08 Aug '20

08 Aug '20

Hello everyone, I have some radius servers configured to use decoupled-accounting to avoid overwhelming the database with real-time writes. In all of them I am having the same problem. Some accounting packets sent from Huawei devices are not being written to the database. I have set up a second detail log file to check if the packets were being sent by the NAS. For example: Packet received from the NAS, stored in the second detail file: Fri Aug 7 08:54:43 2020 User-Name = "andersonoliveira" NAS-Port = 3162917 NAS-IP-Address = X.X.X.X Framed-IP-Address = 100.64.218.153 NAS-Identifier = "TI5-BRAS01" Acct-Status-Type = Stop Acct-Delay-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Session-Id = "TI5-BRA00304080500000a598ccAAADbA" Acct-Authentic = RADIUS Acct-Session-Time = 200 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Terminate-Cause = Lost-Carrier Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Event-Timestamp = "Aug 7 2020 08:54:43 -03" NAS-Port-Type = Ethernet Calling-Station-Id = "58:10:8c:07:48:8f" NAS-Port-Id = "slot=0;subslot=3;port=4;vlanid=805;" Service-Type = Framed-User Framed-Protocol = PPP Connect-Info = "1300000/1000000" Idle-Timeout = 0 Session-Timeout = 0 Huawei-IPHost-Addr = "100.64.218.153 58:10:8c:07:48:8f" Huawei-Input-Peak-Rate = 1000000 Huawei-Input-Peak-Rate = 1000000 Huawei-Input-Average-Rate = 1000000 Huawei-Output-Peak-Rate = 1300000 Huawei-Output-Average-Rate = 1300000 Huawei-Priority = 15 Huawei-Connect-ID = 13206 Huawei-Domain-Name = "provedor_pppoe" Huawei-Accounting-Level = 0 Huawei-Up-Priority = 15 Huawei-Down-Priority = 15 Huawei-Acct-IPv6-Input-Octets = 0 Huawei-Acct-IPv6-Output-Octets = 0 Huawei-Acct-IPv6-Input-Packets = 0 Huawei-Acct-IPv6-Output-Packets = 0 Huawei-Acct-IPv6-Input-Gigawords = 0 Huawei-Acct-IPv6-Output-Gigawords = 0 Huawei-User-Mac = "58:10:8c:07:48:8f" Huawei-Acct-Update-Address = 0 Huawei-Input-Burst-Size = 625000 Huawei-Output-Burst-Size = 812504 Huawei-Input-Peak-Burst-Size = 625000 Huawei-Output-Peak-Burst-Size = 812504 Timestamp = 1596801283 Record in the redacct table: -[ RECORD 5 ]-------+---------------------------------- username | andersonoliveira acctsessionid | TI5-BRA00304080500000a598ccAAADbA acctstarttime | 2020-08-07 08:51:23-03 acctlocalupdatetime | 2020-08-07 08:51:23-03 acctstoptime | As you can see, neither acctlocalupdatetime or acctstoptime were updated with the correct timestamps from the packet received by the NAS. I checked the logs and I couldn’t find any error message related to this. As the server is in production, enabling the debug creates a lot of output. The only thing I think could be causing this is this condition I have in my accounting section: if (noop) { ok } What do you guys suggest? Thanks in advance.

2 5

How to bind Freeradius outbound traffic to a network interface?
by kesavan km 07 Aug '20

07 Aug '20

Hi, With Freeradius Virtual-server construct, there is a possibility to select a Virtual-server instance based on a network interface (eth0 vs wlan0). But when Virtual-server-eth0 uses an LDAP, is it possible to bind the outgoing LDAP requests to eth0 and likewise, outbound LDAP requests initiated from Virtual-server-wlan0 to be bound to wlan0? For example, - Server hosting Freeradius has 3 interfaces Eth0, wlan-corp, wlan-misc - VS-wlan-corp - listening on interface "wlan-corp" --- loads module ldap-wlan-corp: LDAP_IP_X (Reachable only via wlan0) - VS-wlan100 - listening on interface wlan100 --- loads module ldap-wlan100: LDAP_IP_Y (Reachable only via wlan100) Above LDAP is just an example, same holds true for AD, proxy or any outbound communication initiated by Freeradius. Thanks, Kesavan

1 0

scripting pap off to eapol_test?
by Jonathan 06 Aug '20

06 Aug '20

I'm thinking of passing received PAP username and password on a realm/proxy basis to eapol_test to transform a PAP request into a proxied EAP request for further authentication upstream towards a 3rd party radius which only accepts secured EAP-PEAP:mschapv2 requests. If this would be possible, what would be the easiest way to do this from within a proxy config? scenario: 1) hotspot pap send to freeradius 2) freeradius matching realm, transform to eap-peap:mschapv2 request and proxy to upstream 3rd party server

2 1

Exec module questions, v4
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 04 Aug '20

04 Aug '20

Hi all, Does the exec module in v4 still support "non-xlat" use, i.e. where you stipulate a program, run it, maybe collect output pairs values? If so, I have an example where the execution is a bit different from v3, and wanted to query it. Using pretty much stock setup, only just added two bits - one to update the cleartext-password for chap testing, and the other to reject the user every time, for another reason. I have an exec module "testexec" exec testexec { program='/etc/freeradius/test.sh' wait = yes input_pairs = request output_pairs = reply } And my test.sh program #!/bin/bash echo "Reply-Message := \"hello\"" exit 0 Some observations - The stdout output "pickup" didn't seem to be consistent, here I've used radtest to fire a test auth twice in a row without changing anything (let me know if you'd like to see the complete output) .. (0) pap - Setting &control:Auth-Type = pap (0) pap (updated) (0) testexec (yield) (0) EXPAND /etc/freeradius/test.sh (0) --> /etc/freeradius/test.sh (0) Running request (0) tmpl - Resuming execution (0) testexec - EXEC GOT -- Reply-Message := \"hello\" (0) testexec (ok) .. pap - Setting &control:Auth-Type = pap (1) pap (updated) (1) testexec (yield) (1) EXPAND /etc/freeradius/test.sh (1) --> /etc/freeradius/test.sh (1) Running request (1) tmpl - Resuming execution (1) testexec (ok) .. - Also, the module return code isn't the same as it used to be, i.e. where 0 was ok, 1 was reject, 2 fail, as per https://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html If I modify the program to: #!/bin/bash echo "Reply-Message := \"hello\"" exit 1 ./test.sh ; echo $? Reply-Message := "hello" 1 I still get (ok), not (reject), and some more output inconsistency, one has status code, one not, even with no modifications (except the exit code in the script) or restarting the service (3) pap - Setting &control:Auth-Type = pap (3) pap (updated) (3) testexec (yield) (3) EXPAND /etc/freeradius/test.sh (3) --> /etc/freeradius/test.sh (3) Running request (3) tmpl - Resuming execution (3) testexec (ok) pap - Setting &control:Auth-Type = pap (4) pap (updated) (4) testexec (yield) (4) EXPAND /etc/freeradius/test.sh (4) --> /etc/freeradius/test.sh (4) Running request (4) tmpl - Resuming execution (4) Program failed with status code 1 (4) testexec (ok) I'm not modifying the module behaviour with { reject=1 } etc. We used to rely on the text output, even if the exit code was non zero, and that exit code value to do some more stuff after a CoA request. I should try modifying my unlang to do some xlats instead, but thought I'd ask first - is it just me - do I not understand deliberate changes that have taken place? I've tried changing shell_escape value, using sh instead of bash, with similar results. Thanks! Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 6

Does Pam_Radius support Acct-Interim-Interval?
by Mark Antony 04 Aug '20

04 Aug '20

Hello, I have a question about Pam_Radius plugin and Freeradius. Does it only support authentication? I'm asking because while authentication seem to work, Acct-Interim-Interval seem to be completely ignored. post-auth { update reply { Acct-Interim-Interval = 10 } } For testing purposes I have set it to 10 seconds and I was expecting it to fire update-requests every 10 seconds, but this isn't happening. Thanks, Mark

2 1

eapol_test ipv6
by Dave Macias 03 Aug '20

03 Aug '20

Hello, After much googling i was able to use eapol_test with ipv6. Distro provided eapol_test tool does not support ipv6 so had to build from source. Looking at this old post, https://www.spinics.net/lists/hostap/msg06118.html i needed to add the "CONFIG_IPV6=y" to the eapol_test/config_linux file to be able to support radius server's ipv6 address. *Possible to add it to source code?* *I'm willing to PR it.* Just some extra info: Output from distro eapol_test: $ eapol_test -c eapol_test.txt -s <mysecret> -a ::1 -N <whatever> Reading configuration file 'eapol_test.txt' ... Invalid IP address '::1' eapol_test: eapol_test.c:1036: wpa_init_conf: Assertion `0' failed. Aborted Output from source build with CONFIG_IPV6=y: $ ./eapol_test_source -c eapol_test.txt -s <mysecret> -a ::1 -N <whatever> Reading configuration file 'eapol_test.txt' Line: 1 - start of a new network block ... EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit ENGINE: engine deinit MPPE keys OK: 1 mismatch: 0 SUCCESS Thank you for the support! -Dave

1 0

Freeradius and smsotp
by Milovan Kotlica 30 Jul '20

30 Jul '20

Hi, I have installed Freeradius 2.1.12 on Centos 6 and I use Thomas Glanzmann SMSOTP. Now I want to migrate that on Centos 8. I installed Freeradius 3.0.17 and same SMSOTP. When I login on vpn I first type username/password and after that smsotp pin. On new instalation I have issue with smsotp. My first login is OK and smsotp module creates and send smsotp pin. But after I type smsotp pin on vpn radius reject. smsotpd.pl scripts return wornings: Subroutine _call redefined at (eval 155) line 30. Subroutine SendSMSExtService::want_som redefined at (eval 155) line 73. Subroutine AUTOLOAD redefined at (eval 155) line 90. Subroutine SendSMSExtService::SendSMSExt redefined at (eval 155) line 88. Server session encountered read error 104: Connection reset by peer Server session encountered read error 104: Connection reset by peer p.s. In attach is last part of Freeradius debug. Thanks

2 4

Virtual Servers & nas_table Server Column Problem
by Ali Arslan 29 Jul '20

29 Jul '20

Hello, I use freeradius 3.0.20 on ubuntu server 20.04 virtual machines with mssql backend accessed by freetds. I had 3 virtual machines just for freeradius, so i wanted to run them all on a single machine to make better use of resources and decided to make use of Virtual Server capability of freeradius. i kept the defualt site as the server of main ISP and added 2 more virtual servers, namely WISPServer and HotspotServer (for hotels and cafes) whose listen sections are as follows: server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } ... } server WISPServer { listen { type = auth ipaddr = * port = 2812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 2813 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 2812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 2813 type = acct limit { } } ... } server HotspotServer { listen { type = auth ipaddr = * port = 3812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 3813 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 3812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 3813 type = acct limit { } } ... } And sql module definitions are all similar except database names. sql { # default server # sql WISPSQL{ for WISPServer # sql HotspotSQL{ for HotspotServer dialect = "mssql" driver = "rlm_sql_freetds" server = "SQLServer" port = 1433 login = "sa" password = "<<servet>>" radius_db = "ISP" # radius_db = "WISP" for WISPServer # radius_db = "Hotspot" for HotspotServer acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radcheck" delete_stale_sessions = yes pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } read_clients = yes client_table = "nas" group_attribute = "SQL-Group" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } Here i use radcheck GroupName custom column to define groups, a user can only have a singe group and it is a calculated field. nas_table has a Server column to define virtual server name: nas_query = " SELECT Id, IPAddress, ShortName, 'other', Secret, ISNULL(Server, '') FROM ${nas_table}" The attached debug file shows that the client added to WISPServer clients list: rlm_sql (WISPSQL): Adding client 192.168.1.1 (ofis) to WISPServer clients list rlm_sql (192.168.1.1): Client "ofis" (WISPSQL) added But when the client ( 92.168.1.1 ) sends an accountig request i get error: Ignoring request to acct address * port 2813 bound to server WISPServer from unknown client 192.168.1.1 port 41272 proto udp To make it work i needed to do one two things, remove Server column from nas query or make it NULL (actually empty string, NULL does not work either), in this case it adds clients to global client list saying rlm_sql ( WISPSQL): Adding client 192.168.1.1 (ofis) to global clients list For security reasons i wan to define client for a Virtual Server, how can i make it work? An example debug oupt is attached. Thaks.

2 2