- Freeradius-Users - lists.freeradius.org

Listening on proxy address * XXXXXX
by Sezer BAGLAN 14 Feb '20

14 Feb '20

Hi all, When I run freeradius with basic configuration in debug mode I see that freeradius server listens an arbitrary port other than 1812 and 18120. Necessary debug prints are as given below: -------- Listening on auth address 10.0.2.15 port 1812 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel *Listening on proxy address * port* *35629* *--------* Why freeradius server listens such an arbitrary port? Is it possible to configure it? Kind regards, Sezer

3 4

Re: 2FA Challenge via Proxy Realm with valid State
by Bill Noyce 13 Feb '20

13 Feb '20

Thanks Alan, Your advise was spot on. I moved/added the ldap.authenticate so that both steps use the Proxy-To-Realm and this meant the correct Access-Challenge response is sent during the first step. if (!State) { if (&User-Password) { # If !State and User-Password (PAP), then force LDAP: update control { Ldap-UserDN := "%{User-Name}(a)my-domain.com" Auth-Type := LDAP } ldap.authenticate if (!ok) { reject } } else { reject } } update control { Proxy-To-Realm := "proxy-test" } I kept 2 rejects for both a missing User-Password and an invalid LDAP bind. the Proxy-To-Realm always fires off. [user@test-vm ~]$ echo "User-Name=testuser,User-Password=testpassword" |radclient -x 127.0.0.1:1812 auth test1234 Sent Access-Request Id 35 from 0.0.0.0:52833 to 127.0.0.1:1812 length 46 User-Name = "testuser" User-Password = "testpassword" Cleartext-Password = "testpassword" Received Access-Challenge Id 35 from 127.0.0.1:1812 to 0.0.0.0:0 length 117 Reply-Message = "Enter a response from your token with serial number 01234-45678." State = 0x49475261646975733a4445562d455345432d483230333a313831323a31 (0) -: Expected Access-Accept got Access-Challenge [user@test-vm ~]$ echo "User-Name=testuser,User-Password=27938732,State=0x49475261646975733a4445562d455345432d483230333a313831323a31" |radclient -x 127.0.0.1:1812 auth test1234 Sent Access-Request Id 178 from 0.0.0.0:33432 to 127.0.0.1:1812 length 77 User-Name = "testuser" User-Password = "27938732" State = 0x49475261646975733a4445562d455345432d483230333a313831323a31 Cleartext-Password = "27938732" Received Access-Accept Id 178 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 Thanks again, Bill

2 1

Unifi wifi SSHA passwords freeradius
by Сергей Черевко 13 Feb '20

13 Feb '20

Hi! I have Unifi wifi — freeradius — ldap In LDAP i have SSHA password for users. This config on github help me to setup normal auth with SSHA passwords (instead plaintext) https://github.com/hacor/unifi-freeradius-ldap i use ttls + pap All ok, but i have some troubles with timeout (or something else) After a few hours wifi on clients (ios,android,pc) stops working. And users must manually reconnect to the wifi network When we use plaintext password and auth PEAP — all it’s ok. Clients do not stops working Logs Info: rlm_ldap (ldap): Closing connection (11428): Hit idle_timeout, was idle for 61 seconds Info: rlm_ldap (ldap): Closing connection (11433): Hit idle_timeout, was idle for 61 seconds Info: Need 6 more connections to reach 10 spares Info: rlm_ldap (ldap): Opening additional connection (11440), 1 of 28 pending slots used Info: Need 5 more connections to reach 10 spares Info: rlm_ldap (ldap): Opening additional connection (11441), 1 of 27 pending slots used Info: Need 4 more connections to reach 10 spares Info: rlm_ldap (ldap): Opening additional connection (11442), 1 of 26 pending slots used Info: Need 3 more connections to reach 10 spares Info: rlm_ldap (ldap): Opening additional connection (11443), 1 of 25 pending slots used Info: rlm_ldap (ldap): Closing connection (11440): Hit idle_timeout, was idle for 116 seconds Info: rlm_ldap (ldap): Closing connection (11438): Hit idle_timeout, was idle for 116 seconds Info: rlm_ldap (ldap): Closing connection (11426): Hit idle_timeout, was idle for 116 seconds Info: rlm_ldap (ldap): Closing connection (11439): Hit idle_timeout, was idle for 116 seconds Info: rlm_ldap (ldap): Closing connection (11445): Hit idle_timeout, was idle for 105 seconds Info: rlm_ldap (ldap): Closing connection (11442): Hit idle_timeout, was idle for 105 seconds Info: rlm_ldap (ldap): Closing connection (11429): Hit idle_timeout, was idle for 105 seconds Info: rlm_ldap (ldap): Closing connection (11443): Hit idle_timeout, was idle for 105 seconds An here is my config freeradius EAP eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} md5 { } leap { } gtc { auth_type = PAP } tls-config tls-common { private_key_password = XXX private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 # hours } verify { } ocsp { enable = no override_cert_url = yes url = " http://127.0.0.1/ocsp/ " } } tls { tls = tls-common } ttls { tls = tls-common default_eap_type = gtc copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } DEFAULT server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } authorize { filter_username preprocess digest suffix eap { ok = return #updated = return } files -sql ldap expiration logintime pap if (User-Password) { update control { Auth-Type := ldap } } } authenticate { Auth-Type PAP { #pap ldap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap digest #Auth-Type LDAP { ldap #} eap } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY } } update { &reply: += &session-state: } if (LDAP-Group == "vpn") { vpn_l2tp_pool } elsif (LDAP-Group == "vpn-ext") { vpn_l2tp_ext_pool } elsif (LDAP-Group == "vpn-1c") { ok } else { reject } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } INNER TUNNEL server inner-tunnel { listen { ipaddr = * port = 18120 type = auth } authorize { filter_username suffix update control { &Proxy-To-Realm := LOCAL } eap { ok = return } -sql ldap expiration logintime pap if (User-Password) { update control { Auth-Type := ldap } } } authenticate { Auth-Type PAP { #pap ldap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap # Auth-Type LDAP { ldap # } eap } session { radutmp } post-auth { -sql if (LDAP-Group == "wifi") { noop } else { reject } if (0) { update reply { User-Name !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY } update { &outer.session-state: += &reply: } } Post-Auth-Type REJECT { -sql attr_filter.access_reject update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } pre-proxy { } post-proxy { eap } } LDAP ldap { server = 'localhost' identity = 'cn=admin,dc=fusioncore,dc=local' password = fusioncore base_dn = 'ou=people,dc=fusioncore,dc=local' sasl { } update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = "ou=groups,dc=fusioncore,dc=local" filter = '(objectClass=GroupOfNames)' name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = 'memberUid' } profile { } client { base_dn = "${..base_dn}" filter = '(objectClass=radiusClient)' template { } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { start_tls = no } ldap_connections_number = 5 pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } ---------------------------------------------------------------------- ---------------------------------------------------------------------- ---------------------------------------------------------------------- ----------------------------------------------------------------------

3 7

LDAP groups and how to filter
by Daniel Oakes 12 Feb '20

12 Feb '20

Hi there, I've got FreeRadius working off a FreeIPA backend to try and sort some issues with a firewall that won't filter on LDAP groups correctly. I've got my queries working, but now want to use post-auth to update a Group Name that the firewall will expect. Just wondering how in debug mode I could print out to debug all the groups that the user is a memberOf so I can write that logic. Sorry if this has been answered previously, I've not found an example, and I'm not much of an LDAP person. Cheers, Daniel

4 11

2FA Challenge via Proxy Realm with valid State
by Bill Noyce 12 Feb '20

12 Feb '20

Hi, I was hoping to follow the clearly written Wiki article: https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy My problem is that the 2FA Radius Proxy used to verify the OTP requires a valid State value, so currently the login process is a 3 step process! I have allowed State in the Pre-Proxy Attributes filter. So the current flow is: 1) Username/Password request via AD LDAP 2) Unsuccessful OTP request with invalid State value ( returns valid State value from the remote OTP Radius server ) 3) Successful OTP request Anyone able to suggest how I go about getting a valid State value from the OTP radius during the first Access-Request so that the first Access-Challenge response contains this valid State value? Thanks, Bill

2 1

VSA with Vendor 0 Attribute 0 - Have you ever seen this?
by Stefan Paetow 12 Feb '20

12 Feb '20

Hi all, Just a quick question... has anyone ever seen a RADIUS request/response containing a vendor-specific attribute with vendor 0, attribute 0? That's not an IANA packet, is it? I mean... IANA would just be non-VSA. Is this a possible misconfiguration somewhere? With Kind Regards Stefan Paetow Federated Roaming Technical Specialist t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

3 3

freeradius DNS issue
by Satish Patel 12 Feb '20

12 Feb '20

I have two DNS entry in /etc/resolve.conf and somehow today 10.10.0.10 DNS went down and result radius fail to authenticate clients, it was bizarre that 1 hour everything was down and as soon as 10.10.0.10 came back radius start working, I have check 10.10.0.11 is totally functional DNS but look like freeradius just doesn't like getting failover to second DNS, is there any timeout or better solution of this issue? # cat /etc/resolv.conf nameserver 10.10.0.10 nameserver 10.10.0.11

3 5

Need help with EAP-MSCHAPv2 config
by Yongqiang He 11 Feb '20

11 Feb '20

Hi, I am new to freeradius and hope someone here can help me with my setup. Thanks a lot! Here is what i got when running radiusd with -X option: (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "testing", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: Peer sent EAP Response (code 2) ID 2 length 66 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /etc/raddb/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0x065c081f075e1207 (8) eap: Finished EAP session with state 0x065c081f075e1207 (8) eap: Previous EAP request found for state 0x065c081f075e1207, released from the list (8) eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/default (8) eap_mschapv2: authenticate { (8) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (8) mschap: Creating challenge hash with username: testing (8) mschap: Client is using MS-CHAPv2 (8) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (8) mschap: ERROR: MS-CHAP2-Response is incorrect (8) eap_mschapv2: [mschap] = reject (8) eap_mschapv2: } # authenticate = reject (8) eap: Sending EAP Failure (code 4) ID 2 length 4 (8) eap: Freeing handler (8) [eap] = reject (8) } # authenticate = reject (8) Failed to authenticate the user If i run: radtest -t mschap ..., everything seems fine and it output 'Received Access-Accept'. I guess its because the radtest is running with mschap, and my client above is using mschapv2. I can't figure out what config i should do with mschapv2. The radius is running with mysql. user and password are insert to with sql: INSERT INTO `radcheck` VALUES (2,'testing','Cleartext-Password',':=','testuser_mypass'); Thanks a lot!

2 4

Freeradius External Script Auth.
by Vertigo Vertigo 07 Feb '20

07 Feb '20

Hi Freeradius people, I want to authorize users that connect to AP with my external script. Because I have multiple data source ( multiple Active Directory, another API etc.) and I want to make authorization by using these data sources as I want. That's why I'm using an external script to authorization. I updated /etc/raddb/sites-enabled/default's authorize section; authorize{ update { control: += `/usr/bin/myauthscript '%{User-Name}' '%{User-Password}' -c` reply: += `/usr/bin/myauthscript '%{User-Name}' '%{User-Password}' -v` } When I run "radtest" with PAP method, everything is OK, I have "User-Name" and "User-Password" attributes, I'm able to authorize users etc. However, when I make tests with an AP with 802.1x EAP method, , there is no cleartext password (User-Password) and I cannot make authorization. My question is how can I make authorization without "User-Password" attribute. As I said, I have cleartext passwords in my data sources, so I can hash them and compare with other hash that a client sent. How can I perform this operation with EAP, CHAP, MSCHAP etc. methods?

5 4

how to reject users which try to login w/o client certificates
by uj2.hahn＠posteo.de 07 Feb '20

07 Feb '20

Hi! Question: What is an easy way to reject users who are going to connect from a machine which does not have the appropriate client certificate? Note: I'm talking about special users only. Background: At school we have a bunch of electronic whiteboards with WLAN. All of them have the same username/passwd with client certs installed. Just to be on safe side I like to make sure that nobody else is abusing this username/passwd from another device. You never know.... Thanks a lot Uwe

2 1