- Freeradius-Users - lists.freeradius.org

Conditional EAP Type Acceptance
by Mike DiBella 25 Nov '19

25 Nov '19

I have FR set up to authenticate based EAP-TLS certificate and authorize based on finding an object in LDAP where Calling-Station-Id from the supplicant is equal to an attribute containing the WLAN MAC address, and an additional compliance attribute is equal to zero. This allows me to only accept requests from managed devices that are policy compliant. Now I need to add a way to accept requests from guest devices. So I would need to break the LDAP check into two parts. First, if an object exists where the MAC attribute matches the request Calling-Station-Id , authenticate by EAP-TLS. If authenticated, accept the request if the compliance attribute is zero. If the MAC address is not found, authenticate using PEAP. Accept on credential match. I only need a few guest accounts, so I'd load them in a simple store. Which backend would be most suited for the PEAP accounts? I'd want to be able to rotate the guest account passwords periodically without much fuss.

2 1

A little help on freeradius with ldap
by Marco Miglietta 25 Nov '19

25 Nov '19

A little help on freeradius with ldap I configured freeradius 2.2.5 on debian 8.7 for authentication with LDAP following this usefull post and all works fine... http://mageconfig.blogspot.com/2014/11/configure-radius-with-ldap-for-netwo… Freeradius pass the authentication's task to LDAP. How can I make that only the users present in mysql radius database are checked on LDAP ? I'm not much experienced whit linux ed freeradius. Sorry ! Thank you. Marco.

2 2

Home server failure messages
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 24 Nov '19

24 Nov '19

Hi all, Freeradius 3.0.20-1. Is there a way I can pick up (and report) failures for connections to home servers? I can't think of a way, but normally I'd check the Module-Failure-Message attribute; is there anything similar I can use for proxying as that isn't set here (not a module I guess!) Sorry if it's really obvious and documented somewhere, but I can't see anything that would get set, having checked proxy.conf, tls, pre-proxy, post-proxy bits. I can't use status-server just to check before clients connect, because of using Radsec (it's the future?!), so some requests are returned as rejects. It's good to know when/how often this sort of stuff happens given that some of the servers are external, nothing to do with us (Govroam). Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

3 6

RADIUS Extensions for IP Port Configuration and Reporting
by Ali Arslan 23 Nov '19

23 Nov '19

Hello all, An ISP company uses NAT not to assign a distinct real IP to each user because of insufficient number of real IP. And such ISP companies need NAT IPDR (Internet Protocol Detail Record) report with following format: User_Name | Private_IP | Private_IP_Port_Range_Start | Private_ IP_Port_Range_End |Real_IP | Real_IP_Port_Range_Start | Real_IP_Port_Range_End|Session_Star_Date | Session_EndUpdate_Date | Upload_Byte | Download_Bype | Session_Dsiconnect_Message | Session_State | Session_PVC | Service_Number | Session_Code Here it is needed to get/set IP source transport ports allocated to a user but could not find attributes of such kind in freeRadius. In searching for that info i found RFC 8045 https://tools.ietf.org/html/rfc8045 which defines attributes IP-Port-Limit-Info, IP-Port-Range, IP-Port-Forwarding-Map. Does freeRadius current version (3.0) has support for RFC 8045 ? Are there any way to get the transport port allocated to a user when accounting session starts and write this info in radacct in a custom column so that we can use that port in IPDR reporting? Thanks.

2 2

Help debugging sql problem
by Alex Sharaz 23 Nov '19

23 Nov '19

Hi, I've just upgraded one of my servers to 3.0.2o and have just noticed the following radius.log messages, although I'm fairly sure it's got nothing to do with the version release. My FR setup uses buffered-sql to offload sql writes via the details file. This config works fine on all my other servers ( puppet managed config) but on this one I've noticed 1). I see the following messages in the log Thu Nov 21 15:24:55 2019 : WARNING: (86473) WARNING: Module rlm_sql became unblocked\ Thu Nov 21 15:25:53 2019 : Error: Unresponsive child for request 87765, in component accounting module sql 2). the buffered-sql process copies contents of file detail into detail.work leaving the source to capture subsequent packets.oes An ls -lt shows -rw------- 1 freerad freerad 31359093 Nov 21 15:51 detail -rw------- 1 freerad freerad 101566485 Nov 21 15:51 detail-filebeat -rw------- 1 freerad freerad 63282 Nov 21 14:22 detail.work -rw------- 1 freerad freerad 211324742 Nov 21 06:24 detail-filebeat.1 So detail.work hasn't moved since 14:22 I'm guessing there's something in thre detail.work file causing the sql to fail. How can I debug the buffered-sql server to check this out without generating 3,000,000 logs for the rest of the server ? Rgds Alex

3 3

Enforcing cryptobinding
by Nik Mitev 22 Nov '19

22 Nov '19

Hi, I was looking at this article about the sycophant attack https://sensep ost.com/blog/2019/peap-relay-attacks-with-wpa_sycophant/ and the success of it reportedly hangs on whether cryptobinding is enforced or not. On NPS it is not enforced by default, but there is a "Disconnect clients without cryptobinding" setting that can be enabled. Can anyone confirm what is the FR default on cryptobinding and whether it can be changed in configuration? If it is not enabled by default, can it be enabled? If it is enabled by default, can it be disabled - inadvertently of on purpose. Regards, Nik

2 1

DHCP 82 Option Controls
by Maile Halatuituia 21 Nov '19

21 Nov '19

Hi I have this send to my FreeRadius Server from a BRAS that serves as a DHCP Server for Clients. I want to authorize my user using their phones number as send by the BRAS as the Calling-Station-Id below. I understand that I can't authenticate as this is DHCP, please correct me if I am wrong compare to PPPoE. >From BRAS to FreeRadius Server BRAS (Cisco ASR 1001) --> Freeradius Version 3.0.15 *Nov 21 14:28:36: RADIUS: User-Name [1] 10 "67624029" Nov 21 14:28:36: RADIUS: User-Password [2] 18 *Nov 21 14:28:36: RADIUS: Calling-Station-Id [31] 10 "67624029" *Nov 21 14:28:36: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Nov 21 14:28:36: RADIUS: NAS-Port [5] 6 0 *Nov 21 14:28:36: RADIUS: NAS-Port-Id [87] 35 "NUK-MSAN4 atm 16/13:0.34:67624029" *Nov 21 14:28:36: RADIUS: Vendor, Cisco [26] 47 *Nov 21 14:28:36: RADIUS: Cisco AVpair [1] 41 "circuit-id-tag=NUK-MSAN4 atm 16/13:0.34" *Nov 21 14:28:36: RADIUS: Vendor, Cisco [26] 30 *Nov 21 14:28:36: RADIUS: Cisco AVpair [1] 24 "remote-id-tag=67624029" *Nov 21 14:28:36: RADIUS: Service-Type [6] 6 Outbound [5] *Nov 21 14:28:36: RADIUS: NAS-IP-Address [4] 6 10.254.36.225 *Nov 21 14:28:36: RADIUS: Acct-Session-Id [44] 18 "0000000000000146" *Nov 21 14:28:36: RADIUS: Nas-Identifier [32] 21 "HA_BNG3.kalianet.to" *Nov 21 14:28:36: RADIUS: Event-Timestamp [55] 6 1574299716 My Default Server Control Portion. This is the portion I believe it is relate to this where I attach some realm in this case (prepaid.to) . if ( &WiMAX-BS-Id ) { perl mschap } else { if ( &Calling-Station-Id ) { update request { &User-Name := "%{%{Stripped-User-name}:-%{User-Name}}@prepaid.to" } ### for keyed-balance update control { &Load-Balance-Key := "%{Calling-Station-Id}" } } else { if ( &User-Name !~ /\@/ ){ update request { &User-Name := "%{User-Name}(a)kalianet.to" } } } I am not sure I have this as a valid start or this does something other than what I want to achieve. My problem I can summarise on these two points. 1. First how can I use my Calling Station to authorize the DHCP Clients. ??? 2. Secondly if possible to do Authentication with Calling-Station-Id before address assigned to the Customer.??? Attached is the Debug File. Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

1 0

Freeradius 3 Log user calling IP in table
by JAHANZAIB SYED 21 Nov '19

21 Nov '19

Scenario: We are using Freeradius 3.0.19 & Mikrotik Routerboard as NAS. When any user connects , FR inserts his entry in radacct table with relevant data. We want to additionally log userend calling IP (maybe its called Packet-Src-IP-Address , IP which he gets from the DHCP) in the radacct or in any other table. is it doable ? would appreciate if some tips can be given Regards, Jz <http:///>

3 5

FreeRadius Auth Method variables
by Sep0lkit 21 Nov '19

21 Nov '19

I want to log user auth-method(PAP/CHAP/EAP-TLS/EAP-PEAP), i search the freeradius website and google, but there is nothing. i think this variables is very useful, may this features add in future?

2 4

TLS failover behaviour and a backtrace if want it.
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 20 Nov '19

20 Nov '19

Hi, Using 3.0.19 on Ubuntu from the Ubuntu networkradius repo. I've been doing some testing on tls proxy connections. sites-enabled/tls below. home_server rsh-haproxy-rp1 { ipaddr = 192.168.110.46 port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { private_key_file = /etc/freeradius/certs/privkey.pem certificate_file = /etc/freeradius/certs/fullchain.pem ca_file = /etc/ssl/certs/ca-certificates.crt dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" } limit { idle_timeout = 0 } } home_server prh-haproxy-rp1 { ipaddr = 192.168.12.200 port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { private_key_file = /etc/freeradius/certs/privkey.pem certificate_file = /etc/freeradius/certs/fullchain.pem ca_file = /etc/ssl/certs/ca-certificates.crt dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" } } home_server_pool some_radius_servers { type = fail-over home_server = rsh-haproxy-rp1 home_server = prh-haproxy-rp1 } realm DEFAULT { auth_pool = some_radius_servers } Firstly, I must admit I expected failover to be "within same request", but it takes a repeat request from the client should a tls server be unavailable. I guess this is just me misunderstanding the failover for tls, I assumed same as something like a redundant {} section. If the server isn't listening on 2083, i.e. service stopped: .. (1) Starting proxy to home server 192.168.110.46 port 2083 (1) server default { (1) } Failed opening new proxy socket 'proxy (0.0.0.0, 0) -> home_server (192.168.110.46, 2083)' : Failed connecting socket: Connection refused (1) Failed to insert request into the proxy list (1) There was no response configured: rejecting request .. If the client repeats the request, it tries the next server ok, but I'd be a little concerned some might not after a direct reject reply. Could someone please confirm this is by design? Also, I'm noticing a crash if the home server pool is depleted to zero, i.e. all servers are down. It's unlikely to happen, but you may be interested in coding these out. .. (2) } # authorize = updated (2) ERROR: Failed to find live home server: Cancelling proxy (2) WARNING: No home server selected (2) Clearing existing &reply: attributes (2) Found Post-Proxy-Type Fail-Authentication Thread 3 "freeradius" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffe552e700 (LWP 169613)] 0x0000555555587c8b in ?? () (gdb) bt #0 0x0000555555587c8b in ?? () #1 0x000055555558e61a in ?? () #2 0x0000555555586a75 in ?? () #3 0x00007ffff6bde6db in start_thread (arg=0x7fffe552e700) at pthread_create.c:463 #4 0x00007ffff644b88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

3 9