- Freeradius-Users - lists.freeradius.org

radmin : client/home_server list limited to 256 ?
by Arnaud LAURIOU 07 May '20

07 May '20

Hello, With FR 3.0.16 It seems that radmin 'show client (or home_server) list' has a limit to display 256 hosts max. Is there a way to increase this limit ? Regards, Arnaud Lauriou

3 3

Not able to enable/install extension module python with freeradius
by Tara Khoiwal (tkhoiwal) 07 May '20

07 May '20

Hi, I have installed freeradius 3.0.18 as per the instruction mentioned in the freeradius guide on building and installing from source code. After installation I tried running server. But server did not start completely and not seeing message “Ready to process requests”. I have attached the server log. Kindly help me to resolve the issue. I also tried installing freeradius with yum package installer. However, with that distribution python module is not available. Can I only install specific module? It will be great if you can guide me on either resolve issue with freeradius install from source code or install extensions separately. Thanks, Tara

3 7

How to Initiate EAP-Request Identity
by JAVIER SANDOVAL 06 May '20

06 May '20

Hi experts, this question is a bit related with one i did last week about EAP-start support. Now is a slightly different use case: I have no expertise with freeradius and do not know how flexible Freeradius 3 may be to customize an authentication policy flow. The use case i am interested in is: Freeradius initiates a EAP Identity Request procedure when it receives and EAP-response message containing just only an EAP Identity AVP. (or if a bit more specific approach might be possible, just only when the provided EAP-identity is not known) The rational behind: Some VPN server(s) do not initiates EAP-Identity Request by itself. That may happen as it is not mandatory at RFC 5106 section 3 (EAP-Ikev2). However, the server sends to Radius server an EAP-response type Identity AVP, which is filled with the IKE-ID conveyed by the end customer. Some VPN clients include the EAP user as IKE-ID and all works normally, but some others not, and typically include as IKE-ID the IP address of the supplicant (i.e. windows 10, MAC OS native vpn clients), which is unknown for the radius/db server. I would appreciate your feedback, and, if feasible, some guiding or hints about how to get that policy implemented. Kind regards, Javier

2 7

Aborted connection
by Aurélio de Souza Ribeiro Neto 04 May '20

04 May '20

Hello, I´m using FreeRadius 3.0.19 and MySQL 5.7, and I got many errors in mysql log like: Aborted connection 17531 to db: 'freeradius' user: 'FREERADIUS' host: 'XXXXXXXXXX' (Got an error reading communication packets) My database is up to date and querys running very fast, something like 0.003s When it happens I have this messages in freeradius LOGs: WARNING: (131915) WARNING: Module rlm_sql became unblocked Error: Received conflicting packet from client ce-popfd-rb port 49756 - ID: 101 due to unfinished request in module sql. Giving up on old request What I need to adjust do solve this issue? Thanks

3 3

Vulnerability in FreeRADIUS
by HANCHATE Ravikiran (u5574292) 04 May '20

04 May '20

Dears, we received Vulnerability in FreeRADIUS , Can you please assist here, 1/ How this will impact on our radius infra ? 2/ what steps need to be taken to Apply the Linux Fedora patches regarding the FreeRADIUS vulnerability ? Please provide step by step guides or implement instructions to Apply the Linux Fedora patches ? Please let me know if you need any information on this ? Regards, Ravi *********DISCLAIMER********* This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Orange Belgium does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. Unless clearly and unambiguously stated otherwise, the content of this e-mail and its attachment is provided to you for information purposes only, and nothing herein shall be binding upon, or shall constitute or be construed as a binding offer of Orange Belgium. *****END OF DISCLAIMER*****

4 5

EAP TLS: how the radius server track clients
by Jim Shi 03 May '20

03 May '20

Hi, I have a question about how the radius server keep track of clients in EAP TLS. My understanding is that EAP TLS involves a series of requests/responses. Hence the radius server needs to keep track of status for each client during the handshake. How does the radius server keep track of clients? Based on 'User-Name' in the radius packet request? Thanks Jim

2 1

Re: Freeradius-Users Digest, Vol 181, Issue 4
by Gleb Lisikh 03 May '20

03 May '20

>> I was able to overcome the need for Cleartext password in MSCHAPv2 EAP inner tunnel authentication by adding python to /usr/local/etc/raddb/sites-enabled/inner-tunnel, as well as returning NT-Password in the config return. No other types of hashing have been otherwise recognized by mschap. > Alan: Yes, that's what you were told. Not really... unless I completely missed one of your responses, Alan. The advice was to use PAP for authentication and LDAP or SQL for storing an encrypted password. None of those work for me due to the the client authentication requirements, which I clearly stated. > >It seems like a workable solution for now, unless this would be considered as not in line with best practices and/or will have some undesirable consequences. > Alan: As said before, Cleartext-Password and NT-Password are your only options. As such, using them is necessary. Again, had NT-Password been mentioned somewhere I would have tried it right away. Sorry if I did miss something in your responses. But your overall hints and guidance were very useful! for my in finding the solution. > Alan: This isn't about "best practices" or "undesirable consequences". Nothing else works, so these are your *only* practices. Good to know. Thanks for confirming. We can close this thread. Thanks again! Gleb On Sun, May 3, 2020 at 6:00 AM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Proxy when SIP Request method is MESSAGE (João Vitor Arruda) > 2. Re: Proxy when SIP Request method is MESSAGE (Matthew Newton) > 3. Re: Best/simplest authentication method to validate an > encrypted user/password against encrypted known-good. (Gleb Lisikh) > 4. Re: Best/simplest authentication method to validate an > encrypted user/password against encrypted known-good. (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 2 May 2020 10:30:31 -0300 > From: João Vitor Arruda <joao.arruda(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Proxy when SIP Request method is MESSAGE > Message-ID: > <CABQ6UzXVOeDBqqeozA-6L92HM=ZW4b0q6gnkHzD7LX= > B6n32gg(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hello, > > I currently have FS being used as a B2BUA for voice calls (INVITE SIP > Request method) but I also need to process some MESSAGE type SIP > requests. > > I'm wondering if there is a way to configure FS to completely proxy > those messages.without acting like a B2BUA. > > In my initial try I got a "chatplan" configured to handle those > messages with a lua script that use: freeswitch.Event("info", > "SMS::SEND_MESSAGE"); > > This kinda working but the problem i'm having is that FS will reply > "202 Accepted" to the original sender before it even forward it to the > final destination which breaks our ability to really confirm that the > message was accepted by the final destination. > > Joao Arruda > > > ------------------------------ > > Message: 2 > Date: Sat, 2 May 2020 15:54:43 +0100 > From: Matthew Newton <mcn(a)freeradius.org> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Proxy when SIP Request method is MESSAGE > Message-ID: <472f48e9-50f1-1b8a-6a9d-3dbbbabc0231(a)freeradius.org> > Content-Type: text/plain; charset=utf-8; format=flowed > > On 02/05/2020 14:30, João Vitor Arruda wrote: > > I currently have FS being used as a B2BUA for voice calls (INVITE SIP > > Request method) but I also need to process some MESSAGE type SIP > > requests. > > Wrong list... > > -- > Matthew > > > ------------------------------ > > Message: 3 > Date: Sat, 2 May 2020 13:24:13 -0400 > From: Gleb Lisikh <in4bit.general(a)gmail.com> > To: Alan DeKok <aland(a)deployingradius.com> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Best/simplest authentication method to validate an > encrypted user/password against encrypted known-good. > Message-ID: > < > CAKMAD3nrkKwkkeUam9cYVA9yuO9bqXe3XC8MmUu+1PJttfnzyw(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > I was able to overcome the need for Cleartext password in MSCHAPv2 EAP > inner tunnel authentication by adding python > to /usr/local/etc/raddb/sites-enabled/*inner-tunnel,* as well as returning > *NT-Password* in the config return. > No other types of hashing have been otherwise recognized by mschap. > > It seems like a workable solution for now, unless this would be considered > as not in line with best practices and/or will have some undesirable > consequences. > > Any comments are welcome. > > Thank you, > > Gleb > > > > > On Fri, May 1, 2020 at 5:13 PM Gleb Lisikh <in4bit.general(a)gmail.com> > wrote: > > > Thanks a lot Alan! I am making progress at least in my understanding of > > how everything flows. > > > > The client uses EAP and MSCHAPv2 for EAP/TLS inner-tunnel > authentication. > > And mschap requires Cleartext-Password for known good password. Is there > > any way to substitute such password with an encrypted (e.g. SHA1) string? > > To your earlier point, I can do the following for PAP (in default or/and > > inner-tunnel authorize section) to provide with a hashed password: > > ########## > > config = ( ('SHA-Password', 'aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d'), > ) > > return (radiusd.RLM_MODULE_OK, reply, config) > > ######### > > > > But the Auth-Type is preset to MSCHAPv2, and the mschap demands for > > Cleartext, and fails if it does not get it. > > > > Anything I can do to overcome this Cleartext problem? > > > > On a side note, I'd also rather not use SQL or LDAP for proving an > > encrypted password, but this does not seem to be solving the problem of > > mschap needing only Cleartext either, unless I am terribly confused > > > > Regards, > > > > Gleb > > > > > > On Wed, Apr 29, 2020 at 6:02 PM Alan DeKok <aland(a)deployingradius.com> > > wrote: > > > >> On Apr 29, 2020, at 5:03 PM, Gleb Lisikh <in4bit.general(a)gmail.com> > >> wrote: > >> > I'd like to be able to authenticate a user by comparing password > >> provided > >> > with the client's authentication request with what's in a password > >> store. > >> > It can be easily done by Clear-Text password, of course, but I cannot > >> have > >> > a known good password in that password store in Clear-Text form - only > >> > encrypted (doesn't really matter how). > >> > >> It does matter how. FreeRADIUS has to understand the encrypted form > in > >> order to authenticate the user. > >> > >> > So ideally, i'd like to get an encrypted password string from a > client, > >> and > >> > compare it with an encrypted password string retrieved from the known > >> good > >> > password store. > >> > >> RADIUS doesn't work that way. > >> > >> You can get the clear-text password from the user. It's in the > >> User-Password attribute. You can get the encrypted password from a > >> database such as SQL or LDAP. The "pap" module will then compare the > two. > >> > >> > The retrieval of the known good password is done in the > >> > python module. And I'd rather not use SQL instead for the Python. > >> > >> The python module should just hand the encrypted password to > >> FreeRADIUS, and let FreeRADIUS do the work. > >> > >> See mods-available/pap for documentation on what encrypted formats are > >> supported. > >> > >> > EAP methods encrypt the whole message using the user passwords as a > key > >> (as > >> > far as I understand it), which complicates the matter... > >> > >> No. EAP methods do something rather more complex, like TLS. > >> > >> Alan DeKok. > >> > >> > > > ------------------------------ > > Message: 4 > Date: Sat, 2 May 2020 15:01:33 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: glisikh(a)in4bit.com > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Best/simplest authentication method to validate an > encrypted user/password against encrypted known-good. > Message-ID: <8AC079A7-17C4-4B20-BD06-747DB1BB0105(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On May 2, 2020, at 1:24 PM, Gleb Lisikh <in4bit.general(a)gmail.com> wrote: > > > > I was able to overcome the need for Cleartext password in MSCHAPv2 EAP > inner tunnel authentication by adding python to > /usr/local/etc/raddb/sites-enabled/inner-tunnel, as well as returning > NT-Password in the config return. > > No other types of hashing have been otherwise recognized by mschap. > > Yes, that's what you were told. > > > It seems like a workable solution for now, unless this would be > considered as not in line with best practices and/or will have some > undesirable consequences. > > As said before, Cleartext-Password and NT-Password are your only > options. As such, using them is necessary. > > This isn't about "best practices" or "undesirable consequences". > Nothing else works, so these are your *only* practices. > > Alan DeKok. > > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 181, Issue 4 > ************************************************ >

2 1

Best/simplest authentication method to validate an encrypted user/password against encrypted known-good.
by Gleb Lisikh 02 May '20

02 May '20

Hi guys! I am running into a bit of a problem where I least expected, so looking for a general advice here. I'd like to be able to authenticate a user by comparing password provided with the client's authentication request with what's in a password store. It can be easily done by Clear-Text password, of course, but I cannot have a known good password in that password store in Clear-Text form - only encrypted (doesn't really matter how). So ideally, i'd like to get an encrypted password string from a client, and compare it with an encrypted password string retrieved from the known good password store. The retrieval of the known good password is done in the python module. And I'd rather not use SQL instead for the Python. EAP methods encrypt the whole message using the user passwords as a key (as far as I understand it), which complicates the matter... Any advice as to what standard mechanism(s)/method(s) can be used in such case? I hope I explained it well enough... Thank you so much! Gleb

3 5

Proxy when SIP Request method is MESSAGE
by João Vitor Arruda 02 May '20

02 May '20

Hello, I currently have FS being used as a B2BUA for voice calls (INVITE SIP Request method) but I also need to process some MESSAGE type SIP requests. I'm wondering if there is a way to configure FS to completely proxy those messages.without acting like a B2BUA. In my initial try I got a "chatplan" configured to handle those messages with a lua script that use: freeswitch.Event("info", "SMS::SEND_MESSAGE"); This kinda working but the problem i'm having is that FS will reply "202 Accepted" to the original sender before it even forward it to the final destination which breaks our ability to really confirm that the message was accepted by the final destination. Joao Arruda

2 1

How to force EAP-Identity Request sending after EAP START
by JAVIER SANDOVAL 01 May '20

01 May '20

Hi experts, I would appreciate your help, I am not that familiar with freeradius. I am using FreeRADIUS Version 3.0.20. I do not success Radius server to initiate EAP-Identity Request after START as stated in https://wiki.freeradius.org/modules/Rlm_eap#How_Freeradius_can_handle_EAPST… I get a reject reject, it seems something more is needed partial log: (0) eap: Got EAP_START message (0) [eap] = handled (0) } # authorize = handled (0) There was no response configured: rejecting request Kind regards, Javier

2 6