- Freeradius-Users - lists.freeradius.org

run script on dhcp events
by Семёнов Евгений Владими рович 27 Jan '20

27 Jan '20

Hello, how can I run a script when the freeradius dhcp server returns the address back to the ip-pool? -- Evgeniy

3 6

Windows 10 EAP-TTLS with client certificate
by Ján Máté 27 Jan '20

27 Jan '20

Hi list, I successfully installed and configured our FreeRADIUS server with the following results: EAP-TLS => works on Windows 10, iOS 13, macOS 10.15 (Catalina) EAP-TTLS + PAP (LDAP auth) => works on Windows 10, iOS 13, macOS 10.15 EAP-TTLS + PAP (LDAP auth) + client cert => NOT works on Windows 10, but works on iOS 13, macOS 10.15 The last option with Windows 10 produces the following error logs: (185) eap_ttls: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error (185) eap_ttls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate (185) eap_ttls: ERROR: System call (I/O) error (-1) (185) eap_ttls: ERROR: TLS receive handshake failed during operation (185) eap_ttls: ERROR: [eaptls process] = fail (185) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed Windows 10 logs: Wireless 802.1x authentication failed. Error: 0x80420015 EAP Reason: 0x80420015 EAP Root cause String: EAP Error: 0x80420015 I tried nearly all combinations in the Windows 10 configuration interface, but it never sends the client_cert with EAP-TTLS (the same settings with EAP-TLS work). When trying to connect to Wi-FI the Windows 10 interface looks like: Choose a certificate: <correctly pre-selected certificate> User name: <my username entered manually> but after clicking to connect the server never receives the selected certificate ... Is the optional "client cert" in EAP-TTLS supported on Windows 10? Any ideas to get it working? Thanks, JM

5 8

Grant access to a groups of users to a determinated subnets
by Condor 27 Jan '20

27 Jan '20

Hi all, sorry for bother again, i like to grant access to a groups of users to a determinated subnets. For example: In clients: client 192.168.0.0/16 { ipaddr = 192.168.0.0/16 shortname = LAN secret = ****} In users: test003 Crypt-Password := "$1$Z71rzgee$ZIJbcaMDyHtUtKN/", Huntgroup-Name == gNetworking, Huntgroup-Name == Servers Auth-Type = System, Service-Type = Login, Reply-Message = "Hello Test003", (user: test003 belong to two huntgroups) In huntgroups:Servers NAS-IP-Address =~ "/^172\.16\.0\.(1?\d\d?|2[0-4]\d|25[0-5])$/" gNetworking NAS-IP-Address =~ /^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])$/ Trying also (gNetworking NAS-IP-Address =~ "/^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])$/")Trying also (gNetworking NAS-IP-Address =~ ^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])) Trying also (gNetworking NAS-IP-Address =~ ^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5]), NAS-Group := "networking") I get this error "Parse error (check) for entry gNetworking: Expected end of line or comma", or not work anyway Using this to verify the regex: https://regex101.com/ Following this thread: http://freeradius.1045715.n5.nabble.com/Matching-a-value-within-an-IP-subne… Using:FreeRADIUS Version 3.0.4 Any idea? Thanks!

2 1

Permission denied - MySql database
by James Ngo 26 Jan '20

26 Jan '20

Hello all, So I followed the link to setup the MySQL database to use with Freeradius https://wiki.freeradius.org/guide/SQL-HOWTO But whenever I do this mysql -u root -p radius < /etc/freeradius/sql/mysql/schema.sql The error was Bash - mysql -u root -p radius < /etc/freeradius/sql/mysql/schema.sql : Permission denied Any idea what the problem is? I have root password of the machine, of course

2 1

Access-Accept but condition isn't correct
by Marcin Romanowski 26 Jan '20

26 Jan '20

Hello, I'd like to check mac condition with ISG cisco. in users file: 192.168.10.100 Cleartext-Password := "cisco", *Calling-Station-Id := "00:50:79:66:68:01"* Cisco-Service-info = "QU;200000;D;600000", Cisco-Avpair += 'subscriber:accounting-list=BRAS', Cisco-Avpair += 'subscriber:keepalive=interval 10', Cisco-Avpair += 'subscriber:idle-timeout-direction=inbound' debug: (0) Received Access-Request Id 60 from 1.1.1.3:1645 to 1.1.1.2:1812 length 135 (0) User-Name = "192.168.10.100" (0) User-Password = "cisco" (0) Framed-IP-Address = 192.168.10.100 (0) *Calling-Station-Id = "00:50:79:66:68:00"* (0) NAS-Port-Type = Virtual (0) NAS-Port = 0 (0) NAS-Port-Id = "0/0/0/0" (0) Service-Type = Outbound-User (0) NAS-IP-Address = 1.1.1.3 (0) Acct-Session-Id = "00000FDE" (0) NAS-Identifier = "ASR_1" (0) Event-Timestamp = "Jan 26 2020 18:54:55 UTC" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "192.168.10.100", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry 192.168.10.100 at line 37 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 60 from 1.1.1.2:1812 to 1.1.1.3:1645 length 0 (0) Cisco-Service-Info = "QU;200000;D;600000" (0) Cisco-AVPair = "subscriber:accounting-list=BRAS" (0) Cisco-AVPair = "subscriber:keepalive=interval 10" (0) Cisco-AVPair = "subscriber:idle-timeout-direction=inbound" (0) Finished request Calling-Station-Id is different than in config but i get Access-Accept. Where I'm doing wrong? Best Regards Marcin

1 1

How to deal with switches not sending User-Password attribute for MAC-based authentication
by Martin Gignac 25 Jan '20

25 Jan '20

Hi, I'm setting up wired 802.1x authentication for Juniper and Ubiquiti switches. Each device supports supplicant-based authentication and can fall back to MAC-based authentication. When using the Juniper, if it falls back to MAC-based authentication it sends an Access-Request with User-Name and User-Password attributes that both contain the MAC address of the device connecting to the switch, such as "e6e849A201e8". However, when the Ubiquiti falls back to MAC-based auth the Access-Request it sends only contains the User-Name attribute. Since my sites-enabled/default file contains: if (User-Password) { update control { Auth-Type := rest } } in the authorize section, REST authentication is completely skipped. I then tried adding: if (&NAS-Port-Type == "Ethernet" && !User-Password) { update control { User-Password = &User-Name Auth-Type := rest } } right on top of the previous section, but then I get this: (1) if (&NAS-Port-Type == "Ethernet" && !User-Password) { (1) if (&NAS-Port-Type == "Ethernet" && !User-Password) -> TRUE (1) if (&NAS-Port-Type == "Ethernet" && !User-Password) { (1) update control { (1) User-Password = &User-Name -> 'E6E849A201E8' (1) Auth-Type := rest (1) } # update control = noop (1) } # if (&NAS-Port-Type == "Ethernet" && !User-Password) = noop (1) if (User-Password) { (1) if (User-Password) -> FALSE (1) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (1) pap: WARNING: !!! Ignoring control:User-Password. Update your !!! (1) pap: WARNING: !!! configuration so that the "known good" clear text !!! (1) pap: WARNING: !!! password is in Cleartext-Password and NOT in !!! (1) pap: WARNING: !!! User-Password. !!! (1) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = rest (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) authenticate { (1) rest: ERROR: You set 'Auth-Type = REST' for a request that does not contain a User-Password attribute! (1) [rest] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject So I changed it to this: if (&NAS-Port-Type == "Ethernet" && !User-Password) { update control { Cleartext-Password = &User-Name Auth-Type := rest } } (2) if (&NAS-Port-Type == "Ethernet" && !User-Password) { (2) if (&NAS-Port-Type == "Ethernet" && !User-Password) -> TRUE (2) if (&NAS-Port-Type == "Ethernet" && !User-Password) { (2) update control { (2) Cleartext-Password = &User-Name -> 'E6E849A201E8' (2) Auth-Type := rest (2) } # update control = noop (2) } # if (&NAS-Port-Type == "Ethernet" && !User-Password) = noop (2) if (User-Password) { (2) if (User-Password) -> FALSE (2) pap: WARNING: Auth-Type already set. Not setting to PAP (2) [pap] = noop (2) } # authorize = updated (2) Found Auth-Type = rest (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (2) authenticate { (2) rest: ERROR: You set 'Auth-Type = REST' for a request that does not contain a User-Password attribute! (2) [rest] = invalid (2) } # authenticate = invalid (2) Failed to authenticate the user (2) Using Post-Auth-Type Reject Am I approaching the problem in a wrong way? What would be the best way to deal with the lack of the User-Password attribute? Thanks, -Martin

3 9

Ignoring request to authentication address
by Júlíus Þór Bess Ríkharðsson 23 Jan '20

23 Jan '20

Hi, I have been running FreeRADIUS 2 for quite a while and decided to upgrade to a later version, it went from 2.1.12 to 2.2.6, after the upgrade I get an error like the client isn't defined but it surely is and it's read from the "nas" table in SQL. Ignoring request to authentication address * port 1812 from unknown client 10.10.10.100 port 56010 rlm_sql (sql): Read entry nasname=10.10.10.100,shortname=CISCOWL01,secret=xxxxxxxxx rlm_sql (sql): Adding client 10.10.10.100 (CISCOWL01, server=wifi-vserver) to clients list radmin> show client list 10.10.10.100 Do you know of any changes that were made between these versions might have caused this? Kærkveðja / best regards Júlíus Þór

2 1

Ignoring request to auth address *
by James Ngo 23 Jan '20

23 Jan '20

Hello everyone, I am newbie with Freeradius so hopefully, you could extend your patience with my question I setup FreeRadius server on Ubuntu 18.04. Update and everything went OK. Setup the client and user all OK But when I try to connect to the network from my iPhone, it keep saying password is incorrect. In the sudo freeradius -X, the status keeps saying ----Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.x.xxx port xxxxx ---- I have allowed the ufw as sudo ufw allow 1812/tcp sudo ufw allow 1813/tcp sudo ufw allow 1812/udp sudo ufw allow 1813/udp My user setup format is as in the "users" file username Cleartext := "password123" My Client is the Access point, as in the "client.conf" file Client AP { ipaddr = 192.168.x.xxx secret = test111 } Any idea what I am missing in here?

3 5

Simple use of Huntgroup
by Condor 23 Jan '20

23 Jan '20

Hi there, i running FreeRadius 3.0.4, now i trying to discriminate some access for specific user by groups (huntgroup) For example: /etc/raddb/huntgroups grp001 NAS-IP-Address == x.x.x.x grp002 NAS-IP-Address == y.y.y.y /etc/raddb/users test002 Crypt-Password := "$1$lw0fSZNF$yggOS9C8fjoPpDZSRv6g4." Huntgroup-Name == grp002 Reply-Message = "Hello Test002", test001 Crypt-Password := "$1$Z71rzgee$Z62hAIPIJbcaMDyHtUtKN/" Huntgroup-Name == grp001 Reply-Message = "Hello Test001", So, must to permit test001 only access to grp001 and test002 to grp002 Not working and with "radius -X" and see nothing about huntgroup. I missing enable something? I only see documentation about Huntgroup and SQL Thanks

2 1

ssha passwords openldap problem
by Сергей Черевко 23 Jan '20

23 Jan '20

Hi, i have VPN mikrotik server → freeradius → openldap I have plaintext passwords for users in ldap. And all it’s okay. I encrypted users passwords in SSHA and my VPN don’t working Logs from freeradius (5) ldap: Performing search in "ou=people,dc=fusioncore,dc=local" with filter "(uid=scherevko)", scope "sub" (5) ldap: Waiting for search result... (5) ldap: User object found at DN "uid=scherevko,ou=people,dc=fusioncore,dc=local" (5) ldap: Processing user attributes (5) ldap: control:Password-With-Header += '{SSHA}y11iufAi/kWir/t/5npxER+fpUYSroNSr0VM4Q==' rlm_ldap (ldap): Released connection (11) (5) [ldap] = updated (5) [expiration] = noop (5) [logintime] = noop (5) pap: Converted: &control:Password-With-Header -> &control:SSHA1-Password (5) pap: Removing &control:Password-With-Header (5) pap: Normalizing SSHA1-Password from base64 encoding, 40 bytes -> 28 bytes (5) pap: WARNING: Auth-Type already set. Not setting to PAP (5) [pap] = noop (5) } # authorize = updated (5) Found Auth-Type = mschap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (5) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (5) mschap: Creating challenge hash with username: scherevko (5) mschap: Client is using MS-CHAPv2 (5) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (5) mschap: ERROR: MS-CHAP2-Response is incorrect (5) [mschap] = reject (5) } # authenticate = reject (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> scherevko (5) attr_filter.access_reject: Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) [eap] = noop (5) policy remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) { (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else { (5) [noop] = noop (5) } # else = noop (5) } # policy remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (5) (5) Discarding duplicate request from client mikrotik_router port 56532 - ID: 31 due to delayed response Waking up in 0.6 seconds. (5) (5) Discarding duplicate request from client mikrotik_router port 56532 - ID: 31 due to delayed response Waking up in 0.3 seconds. (5) Sending delayed response (5) Sent Access-Reject Id 31 from 10.10.2.176:1812 to 10.10.2.1:56532 length 103 (5) MS-CHAP-Error = "\001E=691 R=1 C=359def4fd6e2f6ec8965898ccce170c8 V=3 M=Authentication rejected" Waking up in 3.9 seconds. (5) Cleaning up request packet ID 31 with timestamp +1893 Ready to process requests

2 1