- Freeradius-Users - lists.freeradius.org

Variable passing question between modules
by Adam Taylor 01 Nov '19

01 Nov '19

Hey all, I have been trying for a week and I have everything working on a setup I am doing except for one thing. Setting Tmp-String-0 to a string and using that string in the LDAP module. I'm trying to make the config as simple as possible so if I am doing something wrong, please let me know. I have the following in my authorize section: authorize { if (User-Name =~ /(a)ulm\.edu$$/i){ update request { Tmp-String-0 = "Employees" } preprocess mschap eap { ok = return } ldap } if (User-Name =~ /(a)warhawks\.ulm\.edu$$/i) { update request { Tmp-String-0 = "Students" } preprocess mschap eap { ok = return } ldap } } Basically if the login is XXX(a)ulm.edu<mailto:XXX@ulm.edu> set TMP-String-0 to "Employees" or if XXX(a)warhawks.ulm.edu<mailto:XXX@warhawks.ulm.edu> set to "Students" I then have the following in my ldap config: base_dn = 'ou=%{request:Tmp-String-0},ou=People,dc=ulm,dc=edu' The problem is ${request:Tmp-String-0} is always null and I get this in debug: (6) ldap: EXPAND ou=%{request:Tmp-String-0},ou=People,dc=ulm,dc=edu (6) ldap: --> ou=,ou=People,dc=ulm,dc=edu (6) ldap: Performing search in "ou=,ou=People,dc=ulm,dc=edu" with filter "(uid=pp)", scope "sub" I went to verify that it was actually setting the variable and see this: (6) update request { (6) Tmp-String-0 = "Students" (6) } # update request = noop I have tried every different way I can think of and it just will not set Tmp-String-0. I have tried both = and := as well. What am I doing wrong? Thanks, Adam Taylor

3 4

RE: OCSP Response Signed by other CA
by Mike DiBella 31 Oct '19

31 Oct '19

In testing my OCSP responder configuration I've found that the following openssl command: openssl ocsp -issuer client_cer_root.cer -cert client.cer -VAfile ocsp_signer.cer -url http://ocsp.responder.net/ocsp returns: Response verify OK client.cer: good This Update: Oct 31 11:43:47 2019 GMT Next Update: Nov 2 00:03:47 2019 GMT I see that there is a client keyword in the verify section of the eap configuration file. I'm wondering if I can I substitute this command for the default openssl verify command prototyped in the file? In my testing, it looks like openssl returns exit 0 for both verified and responder errors, so I'm wondering how freeradius parses the result of the command. From: Mike DiBella Sent: Wednesday, October 30, 2019 3:08 PM To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Subject: OCSP Response Signed by other CA I'm attempting to add OCSP certificate verification to EAP, but my responder hosts multiple CAs and signs the responses with a cert common to all. I think freeradius is assuming that the signer of the OCSP response will be the same as the signer of the client certificate, and I can't see an option to override this behavior. I've already tried concatenating the OCSP signer to the client trust certificate file, but freeradius still fails validation with "Error: rlm_eap: SSL error error:27069070:OCSP routines:OCSP_basic_verify:root ca not trusted". Any ideas?

2 1

802.1x / EAP Assistance
by J Kephart 31 Oct '19

31 Oct '19

Good morning! We are attempting to implement 802.1x/EAP for the first time, ad we're having some trouble diagnosing what's going on in the various stages of the communications between the NAS and FR. We don't have any experience with it, so it's rather confusing. We're using FR 2.2.8, with the test certs provided. We can see that there is communication, but all attempts to authenticate a device are failing. I've included what I believe to be the relevant portion of the debug output, and I do see several error conditions. The first says that the realm LOCAL is not defined, but in looking at the config, it looks as though it is. There's also a report that there's a missing Cleartext-Password, but that is also defined in the database, so we're at a loss as to the cause of the failure. If someone can point us in the right direction, I'd truly appreciate it! rad_recv: Access-Request packet from host 146.115.19.180 port 50987, id=97, length=394 Acct-Session-Id = "5DB9E1F5-76DF7502" User-Name = "jerry" NAS-IP-Address = 192.168.185.30 NAS-Identifier = "90-3A-72-15-25-1D" NAS-Port = 1 Called-Station-Id = "90-3A-72-15-25-1D:CVGNE_W1" Calling-Station-Id = "D4-53-83-F3-C0-17" Service-Type = Framed-User Chargeable-User-Identity = "" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11a/n/ac" EAP-Message = 0x0208005f1900170303005400000000000000022f4cd34458205cfb0d339d2a9f6dda68b5f7a4ffbd985bbfb9ef4094114e5a1856df8479ea3c4ddc7f293487a00396643c97c4b24f51d67a7c7cc34e9bbbc1c156adc07977d4e095d6fddaa5 State = 0x957bdc849273c5bfd96a2d7f79095e2d Ruckus-SSID = "CVGNE_W1" Ruckus-Attr-14 = 0x903a7215251d Ruckus-Attr-9 = 0x000001c3 Ruckus-SCG-CBlade-IP = 3232282885 Ruckus-Attr-134 = 0x44656661756c74205a6f6e65 Ruckus-Attr-135 = 0x4356474e455f5731 Message-Authenticator = 0xad0239941dd1cf346629d1f1b23805b6 Event-Timestamp = "Oct 30 2019 15:18:14 EDT" Proxy-State = 0x3636 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++update request { sql_xlat expand: select zone_migration_enabled from sites where id='%{NAS-Identifier}' -> select zone_migration_enabled from sites where id='90-3A-72-15-25-1D' rlm_sql (sql_instance2): Reserving sql socket id: 2 SQL query did not return any results rlm_sql (sql_instance2): Released sql socket id: 2 expand: %{sql_instance2: select zone_migration_enabled from sites where id='%{NAS-Identifier}'} -> ... expanding second conditional expand: %{%{sql_instance2: select zone_migration_enabled from sites where id='%{NAS-Identifier}'}:-0} -> 0 ++} # update request = noop ++? if (("%{Called-Station-Id}" =~ /^00-50-E8-/ || "%{Called-Station-Id}" =~ /^20-4C-03-/ )&& Tmp-String-2 == '1') expand: %{Called-Station-Id} -> 90-3A-72-15-25-1D:CVGNE_W1 ?? Evaluating ("%{Called-Station-Id}" =~ /^00-50-E8-/) -> FALSE expand: %{Called-Station-Id} -> 90-3A-72-15-25-1D:CVGNE_W1 ?? Evaluating ("%{Called-Station-Id}" =~ /^20-4C-03-/) -> FALSE ? Skipping (Tmp-String-2 == '1') ++? if (("%{Called-Station-Id}" =~ /^00-50-E8-/ || "%{Called-Station-Id}" =~ /^20-4C-03-/ )&& Tmp-String-2 == '1') -> FALSE ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "jerry", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 8 length 95 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800401a0208003b31197eb5bbc69b47c5363805196ff71ff700000000000000008a49a9ade98c47831f6c39043311438b1a56945caec5a5f5006a65727279 server { [peap] Setting User-Name to jerry Sending tunneled request EAP-Message = 0x020800401a0208003b31197eb5bbc69b47c5363805196ff71ff700000000000000008a49a9ade98c47831f6c39043311438b1a56945caec5a5f5006a65727279 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "jerry" State = 0x2b16a6c52b1ebc1c6619c5138158b3f7 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "jerry", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 8 length 64 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +group MS-CHAP { [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: jerry [mschap] Client is using MS-CHAPv2 for jerry, we need NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] = reject +} # group MS-CHAP = reject [eap] Freeing handler ++[eap] = reject +} # group authenticate = reject Failed to authenticate the user. expand: %{NAS-IP-Address} -> Login incorrect: [jerry/<via Auth-Type = EAP>] (from client Office port 0 via TLS tunnel) Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> jerry attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code Access-Reject MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 97 to 146.115.19.180 port 50987 EAP-Message = 0x0109002e1900170303002334c44a5ec04ae1317ed894226db68ba139a09ceb0517c705c20507823d7bb4bc4a05c6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x957bdc849d72c5bfd96a2d7f79095e2d Proxy-State = 0x3636 Finished request 214. Many thanks! -- Jim

3 6

proxy.conf from mysql database?
by J E H A N Z A I B 31 Oct '19

31 Oct '19

Hi experts, I am currently using proxy.conf to list all the realms. is there anyway i can fetch these realms from mysql database? My proxy.conf realm xx.com { authhost = xx.xx.xx.xx:1812 accthost = xx.xx.xx.xx :1813 secret = xxsecretxx fallback = LOCAL nostrip } -- Regards, Jehanzaib

2 1

Some RLM_MODULE_INVALID events are not logged via detail
by Boris Lytochkin 31 Oct '19

31 Oct '19

Hi. We're trying to catch a bug in some vendor's equipment resulting in "Login incorrect (eap: EAP requires the State attribute to work, but no State exists in the Access-Request packet.)" error appearing in the log and subsequent Access-Reject sent from RADIUS server (version 3.0.15 with a bit of pull requests still not merged :). It seems that this configuration does not catch that particular Access-Reject into detail(ed) log: ================== detail auth_log { header = "%t (%I)" filename = ${radacctdir}/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-%Y%m%d log_packet_header = yes permissions = 0640 } authenticate { Auth-Type EAP { eap { handled = 9999 } if (handled) { auth_log.post-auth # logging is done, return return } # eap module returned OK so we go a bit further perl # Access-Accept/Reject will be logged by authorize section } } post-auth { auth_log Post-Auth-Type REJECT { auth_log } ... } ================== Am I missing something? I took a quick tour though the code and failed to find a place where radiusd decides to **log** " Login incorrect (eap_tls: TLS Alert read:fatal:unknown CA):" into detail and **not to log** "Login incorrect (eap: EAP requires the State attribute to work, but no State exists in the Access-Request packet.)" p/s. Playing around with `handled` in Auth-Type EAP has nothing to do with detailed log as I see the same situation before I tweaked that part of the configuration. pp/s. Is there a way to print packet identifier as it is sent over the wire into detailed log? I made a trivial patch for that seeing no documented way exist to do that: =============== --- a/src/modules/rlm_detail/rlm_detail.c +++ b/src/modules/rlm_detail/rlm_detail.c @@ -336,6 +336,7 @@ static int detail_write(FILE *out, rlm_detail_t *inst, REQUEST *request, RADIUS_ } #endif } + WRITE("\tPacket-Identifier = %d\n", packet->id); WRITE("\tTimestamp = %ld\n", (unsigned long) request->timestamp); WRITE("\n"); =============== -- Boris Lytochkin Yandex NOC +7 (495) 739 70 00 ext. 7671

2 6

OCSP Response Signed by other CA
by Mike DiBella 30 Oct '19

30 Oct '19

I'm attempting to add OCSP certificate verification to EAP, but my responder hosts multiple CAs and signs the responses with a cert common to all. I think freeradius is assuming that the signer of the OCSP response will be the same as the signer of the client certificate, and I can't see an option to override this behavior. I've already tried concatenating the OCSP signer to the client trust certificate file, but freeradius still fails validation with "Error: rlm_eap: SSL error error:27069070:OCSP routines:OCSP_basic_verify:root ca not trusted". Any ideas?

1 0

Upgrading to newest Radius
by Dario Coltri 30 Oct '19

30 Oct '19

Hi, we are actually running to 1.01 version of Freeradius and we would like to upgrade our server to the newest version available. Is There any problem transferring the 1.01 Freeradius Database Mysql to the newest version? How we can do it properly? Best Regards, Dario Coltri AGSM LIGHTING s.r.l ITA

3 4

deployingradius doc site
by J Kephart 30 Oct '19

30 Oct '19

Hi! At one point, I found a link to a wonderful page that documents every aspect, in great detail, of configuring a FR server. Alas, my bookmarks were lost in a crash, and despite an intensive search, I am unable to locate it again, though I believe it was on the deployingradius site. The wiki doesn't seem to have the detail I need (I'm trying to get a full understanding of how to set up 802.1x), and I recall that document giving that level of detail. Can anyone point me at it? Thanks, -- Jim

2 1

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

Re: Authorize access by MAC Address
by Mike DiBella 26 Oct '19

26 Oct '19

I seem to be misunderstanding how authentication and authorization works under FreeRadius. In the default site configuration, I have enabled unix under both the authorize and authenticate sections, and ldap only under authorize. I am using a test client to send an authentication request with a valid User-Name, User-Password, and Calling-Station-Id attributes set. I can see the in logs that the bind is successful and that the search does not return any object matching the filter criteria, as expected. However, an access-accept is still returned to the test client. I am expecting that unix type will only be used for authentication, and that authorization depends on the ldap search being successful, but this does not appear to be the way the configuration is functioning. If I comment out unix from the authorize section of the default site, then access-reject is returned even when the password is valid and the search is successful. Thoughts? rad_recv: Access-Request packet from host 192.168.1.63 port 55161, id=3, length=63 User-Name = "*****" User-Password = "*****" Calling-Station-Id = "5C-95-AE-15-C9-92" # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "*****", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[unix] = updated ++[files] = noop [ldap] performing user authorization for ***** [ldap] expand: (&(wiFiMAC=%{Calling-Station-Id})(deviceCompliance=0)) -> (&(wiFiMAC=5C-95-AE-15-C9-92)(deviceCompliance=0)) [ldap] expand: CN=Managed Devices,CN=Device Directory,O=DiBella Consulting -> CN=Managed Devices,CN=Device Directory,O=DiBella Consulting [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to *****:389, authentication 0 [ldap] bind as CN=scout,CN=Users,CN=Device Directory,O=DiBella Consulting/***** to *****:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in CN=Managed Devices,CN=Device Directory,O=DiBella Consulting, with filter (&(wiFiMAC=5C-95-AE-15-C9-92)(deviceCompliance=0)) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = notfound ++[expiration] = noop ++[logintime] = noop ++[pap] = updated +} # group authorize = updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +group PAP { [pap] login attempt with password "*****" [pap] Using CRYPT password "*****" [pap] User authenticated successfully ++[pap] = ok +} # group PAP = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 3 to 192.168.1.63 port 55161 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 3 with timestamp +31 -----Original Message----- Date: Thu, 24 Oct 2019 11:39:22 +0100 From: Matthew Newton <mcn(a)freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Authorize access by MAC Address Message-ID: <0d97da45933a66ee5e2c46e9845e621eaa08145d.camel(a)freeradius.org> Content-Type: text/plain; charset="UTF-8" On Wed, 2019-10-23 at 23:44 +0000, Mike DiBella wrote: > The access request authorization policy should allow access if the > device object is found in the directory by MAC address, and > deviceCompliance is 0. > > I've looked over the documentation for LDAP backend configuration, > but it is heavy biased towards the authorize-by-user-identity use > case. The defaults check for the username, because that's what most people do. > Are there any configuration examples for mapping identity using MAC > address? Any examples for adding custom LDAP attributes for access- > adjudication? It's all in mods-available/ldap. Update the user filter to match on something other than uid and %{Stripped-User-Name}, e.g. "(&(wiFiMAC=%{Calling-Station- Id})(deviceCompliance=0))" You can change the update{} section to copy any LDAP attributes into RADIUS attributes if you need them. -- Matthew

2 1