- Freeradius-Users - lists.freeradius.org

Some RLM_MODULE_INVALID events are not logged via detail
by Boris Lytochkin 31 Oct '19

31 Oct '19

Hi. We're trying to catch a bug in some vendor's equipment resulting in "Login incorrect (eap: EAP requires the State attribute to work, but no State exists in the Access-Request packet.)" error appearing in the log and subsequent Access-Reject sent from RADIUS server (version 3.0.15 with a bit of pull requests still not merged :). It seems that this configuration does not catch that particular Access-Reject into detail(ed) log: ================== detail auth_log { header = "%t (%I)" filename = ${radacctdir}/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-%Y%m%d log_packet_header = yes permissions = 0640 } authenticate { Auth-Type EAP { eap { handled = 9999 } if (handled) { auth_log.post-auth # logging is done, return return } # eap module returned OK so we go a bit further perl # Access-Accept/Reject will be logged by authorize section } } post-auth { auth_log Post-Auth-Type REJECT { auth_log } ... } ================== Am I missing something? I took a quick tour though the code and failed to find a place where radiusd decides to **log** " Login incorrect (eap_tls: TLS Alert read:fatal:unknown CA):" into detail and **not to log** "Login incorrect (eap: EAP requires the State attribute to work, but no State exists in the Access-Request packet.)" p/s. Playing around with `handled` in Auth-Type EAP has nothing to do with detailed log as I see the same situation before I tweaked that part of the configuration. pp/s. Is there a way to print packet identifier as it is sent over the wire into detailed log? I made a trivial patch for that seeing no documented way exist to do that: =============== --- a/src/modules/rlm_detail/rlm_detail.c +++ b/src/modules/rlm_detail/rlm_detail.c @@ -336,6 +336,7 @@ static int detail_write(FILE *out, rlm_detail_t *inst, REQUEST *request, RADIUS_ } #endif } + WRITE("\tPacket-Identifier = %d\n", packet->id); WRITE("\tTimestamp = %ld\n", (unsigned long) request->timestamp); WRITE("\n"); =============== -- Boris Lytochkin Yandex NOC +7 (495) 739 70 00 ext. 7671

2 6

OCSP Response Signed by other CA
by Mike DiBella 30 Oct '19

30 Oct '19

I'm attempting to add OCSP certificate verification to EAP, but my responder hosts multiple CAs and signs the responses with a cert common to all. I think freeradius is assuming that the signer of the OCSP response will be the same as the signer of the client certificate, and I can't see an option to override this behavior. I've already tried concatenating the OCSP signer to the client trust certificate file, but freeradius still fails validation with "Error: rlm_eap: SSL error error:27069070:OCSP routines:OCSP_basic_verify:root ca not trusted". Any ideas?

1 0

Upgrading to newest Radius
by Dario Coltri 30 Oct '19

30 Oct '19

Hi, we are actually running to 1.01 version of Freeradius and we would like to upgrade our server to the newest version available. Is There any problem transferring the 1.01 Freeradius Database Mysql to the newest version? How we can do it properly? Best Regards, Dario Coltri AGSM LIGHTING s.r.l ITA

3 4

deployingradius doc site
by J Kephart 30 Oct '19

30 Oct '19

Hi! At one point, I found a link to a wonderful page that documents every aspect, in great detail, of configuring a FR server. Alas, my bookmarks were lost in a crash, and despite an intensive search, I am unable to locate it again, though I believe it was on the deployingradius site. The wiki doesn't seem to have the detail I need (I'm trying to get a full understanding of how to set up 802.1x), and I recall that document giving that level of detail. Can anyone point me at it? Thanks, -- Jim

2 1

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

Re: Authorize access by MAC Address
by Mike DiBella 26 Oct '19

26 Oct '19

I seem to be misunderstanding how authentication and authorization works under FreeRadius. In the default site configuration, I have enabled unix under both the authorize and authenticate sections, and ldap only under authorize. I am using a test client to send an authentication request with a valid User-Name, User-Password, and Calling-Station-Id attributes set. I can see the in logs that the bind is successful and that the search does not return any object matching the filter criteria, as expected. However, an access-accept is still returned to the test client. I am expecting that unix type will only be used for authentication, and that authorization depends on the ldap search being successful, but this does not appear to be the way the configuration is functioning. If I comment out unix from the authorize section of the default site, then access-reject is returned even when the password is valid and the search is successful. Thoughts? rad_recv: Access-Request packet from host 192.168.1.63 port 55161, id=3, length=63 User-Name = "*****" User-Password = "*****" Calling-Station-Id = "5C-95-AE-15-C9-92" # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "*****", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[unix] = updated ++[files] = noop [ldap] performing user authorization for ***** [ldap] expand: (&(wiFiMAC=%{Calling-Station-Id})(deviceCompliance=0)) -> (&(wiFiMAC=5C-95-AE-15-C9-92)(deviceCompliance=0)) [ldap] expand: CN=Managed Devices,CN=Device Directory,O=DiBella Consulting -> CN=Managed Devices,CN=Device Directory,O=DiBella Consulting [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to *****:389, authentication 0 [ldap] bind as CN=scout,CN=Users,CN=Device Directory,O=DiBella Consulting/***** to *****:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in CN=Managed Devices,CN=Device Directory,O=DiBella Consulting, with filter (&(wiFiMAC=5C-95-AE-15-C9-92)(deviceCompliance=0)) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = notfound ++[expiration] = noop ++[logintime] = noop ++[pap] = updated +} # group authorize = updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +group PAP { [pap] login attempt with password "*****" [pap] Using CRYPT password "*****" [pap] User authenticated successfully ++[pap] = ok +} # group PAP = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 3 to 192.168.1.63 port 55161 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 3 with timestamp +31 -----Original Message----- Date: Thu, 24 Oct 2019 11:39:22 +0100 From: Matthew Newton <mcn(a)freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Authorize access by MAC Address Message-ID: <0d97da45933a66ee5e2c46e9845e621eaa08145d.camel(a)freeradius.org> Content-Type: text/plain; charset="UTF-8" On Wed, 2019-10-23 at 23:44 +0000, Mike DiBella wrote: > The access request authorization policy should allow access if the > device object is found in the directory by MAC address, and > deviceCompliance is 0. > > I've looked over the documentation for LDAP backend configuration, > but it is heavy biased towards the authorize-by-user-identity use > case. The defaults check for the username, because that's what most people do. > Are there any configuration examples for mapping identity using MAC > address? Any examples for adding custom LDAP attributes for access- > adjudication? It's all in mods-available/ldap. Update the user filter to match on something other than uid and %{Stripped-User-Name}, e.g. "(&(wiFiMAC=%{Calling-Station- Id})(deviceCompliance=0))" You can change the update{} section to copy any LDAP attributes into RADIUS attributes if you need them. -- Matthew

2 1

Authorize access by MAC Address
by Mike DiBella 24 Oct '19

24 Oct '19

I am intend to use FreeRadius to create a network access solution for managed mobile devices. Authentication will be using EAP-TLS with a trusted certificate, but the supplicant identity mapping attribute will be the WiFi adapter's MAC address. I have an LDAP directory with a customized schema that has an object for each managed device with an attribute, wiFiMAC, containing the MAC address and second attribute, deviceCompliance, containing the device's adjudicated policy compliance state. The access request authorization policy should allow access if the device object is found in the directory by MAC address, and deviceCompliance is 0. I've looked over the documentation for LDAP backend configuration, but it is heavy biased towards the authorize-by-user-identity use case. Are there any configuration examples for mapping identity using MAC address? Any examples for adding custom LDAP attributes for access-adjudication?

2 1

Using "Tunnel-Private-Group-Id" in linelog
by Burger, Wolfgang 23 Oct '19

23 Oct '19

Dear freeradius-users, I´m using FreeRADIUS Version 2.1.12 to dynamically set the VLAN-ID on some switches by client-mac-address. Works like a charm. I have to modify the logfiles and would like to use linelog. This is my linelog config: linelog vlanlog { filename = ${logdir}/vlanlog permissions = 0600 format = "This is a log message for %{User-Name}" reference = "%{%{Packet-Type}:-format}" Access-Request = "%S: %{reply:Packet-Type} AAA-VLAN-Request for %{User-Name} on %{NAS-Identifier} (%{NAS-IP-Address}) at Port %{NAS-Port-Id}. Put to VLAN %{reply:Tunnel-Private-Group-Id}" Access-Reject = "Rejected access: %{User-Name}" Access-Challenge = "Sent challenge: %{User-Name}" } And this is a Request and Reply for a VLAN-Request: rad_recv: Access-Request packet from host 192.168.1.141 port 1812, id=125, length=320 Framed-MTU = 1466 NAS-IP-Address = 192.168.1.141 NAS-Identifier = "Switch31" User-Name = "0cc47a96a6af" Service-Type = Call-Check Framed-Protocol = PPP NAS-Port = 41 NAS-Port-Type = Ethernet NAS-Port-Id = "41" Called-Station-Id = "00-16-b9-d1-01-d7" Calling-Station-Id = "0c-c4-7a-96-a6-af" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" ... MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 server vlan { # Executing section authorize from file /etc/freeradius/sites-enabled/VLAN +- entering group authorize {...} ++[preprocess] returns ok ++? if (NAS-Identifier == "switch61" && NAS-Port-Id == "11") ? Evaluating (NAS-Identifier == "switch61" ) -> FALSE ? Skipping (NAS-Port-Id == "11") ++? if (NAS-Identifier == "switch61" && NAS-Port-Id == "11") -> FALSE ++- entering else else {...} [vlan_by_macaddr] users: Matched entry DEFAULT at line 8465 +++[vlan_by_macaddr] returns ok ++- else else returns ok [chap] WARNING: Auth-Type already set. Not setting to CHAP ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "0cc47a96a6af", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [0cc47a96a6af] (from client vlan_switch31 port 41 cli 0c-c4-7a-96-a6-af) # Executing section post-auth from file /etc/freeradius/sites-enabled/VLAN +- entering group post-auth {...} [vlanlog] expand: %{Packet-Type} -> Access-Request [vlanlog] expand: %{%{Packet-Type}:-format} -> Access-Request [vlanlog] expand: /var/log/freeradius/vlanlog -> /var/log/freeradius/vlanlog [vlanlog] expand: %S: %{reply:Packet-Type} AAA-VLAN-Request for %{User-Name} on %{NAS-Identifier} (%{NAS-IP-Address}) at Port %{NAS-Port-Id}. -> 2019-10-23 14:27:54: Access-Accept AAA-VLAN-Request for 0cc47a96a6af on Switch31 (192.168.1.141) at Port 41. ++[vlanlog] returns ok } # server vlan Sending Access-Accept of id 125 to 192.168.1.141 port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\0001" Finished request 8. Going to the next request Waking up in 4.9 seconds. Im calling vlanlog only in post-auth { vlanlog Post-Auth-Type REJECT { vlanlog attr_filter.access_reject } } I would like to include the information in "Tunnel-Private-Group-Id" into the linelog. I´ve tried to add %{reply:Tunnel-Private-Group-Id} to the linelog config. But the result in vlanlog is: 2019-10-23 15:42:53: Access-Accept AAA-VLAN-Request for 0cc47a96a6af on Switch31 (192.168.1.141) at Port 41. Put to VLAN How can i include the information in "Tunnel-Private-Group-Id" of Access-Accept into the linelog logfile? Thank you very much and best regards, Wolfgang

2 5

Re: FR3 - EAP-[T]LS - Win10
by Ted Hyde (RSI) 23 Oct '19

23 Oct '19

Alan - after a few mis-starts, flushing and installing FR3 greater than 3.0.11 (my testing platform of the time) did fire right up. Deb9 now has 3.0.12 in the repo currently and it runs as expected. Kindest regards as always, Ted. On 10/14/2019 6:00 AM, freeradius-users-request(a)lists.freeradius.org wrote: > 1. Re: FR3 - EAP-[T]LS - Win10 (Alan Buxey) > 2. Re: Server timeout (Alan Buxey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 14 Oct 2019 10:02:14 +0100 > From: Alan Buxey<alan.buxey(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FR3 - EAP-[T]LS - Win10 > Message-ID: > <CAOVYXj8kMZVFp3LooLcGf2K03zo09e-jwxpDQAxQmPiiYy784Q(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > hi, > > Win10 etc work with the default out of the box FreeRADIUS certs - what > are ou trying to do (what have you done relating to the cert Makefile > or environment etc?) > > I would guess the issue is at the client end and how the client cert > was installed? > > PS EAP-TLS is still the best > > alan -- Ted Hyde Solutions Engineer, Real Simple Ideas, LLC thyde(a)rndstudio.com tel (407) 996-1075 x340 Orlando, FL CONFIDENTIAL The information in this e-mail/ fax message is intended for the confidential use of the addressees only. The information is the confidential work product or property of RSI. This email/ fax may include Trade Secrets of which the entire contents should be treated as strictly confidential. Recipients should not file copies of this e-mail with publicly accessible records. If you are not an addressee or an authorized agent responsible for delivering this e-mail/ fax to a designated addressee, you have therefore received this e-mail / fax in error, and any further review, dissemination distribution, copying or forwarding of this e-mail/ fax is strictly prohibited. If you received this e-mail/ fax in error, please notify us immediately at (407) 996-1075. Thank you.

1 0

pubkey-auth, EAP-GTC
by dev＠cyphermonks.org 22 Oct '19

22 Oct '19

hi! we want to use public-key-authentication with WPA2. the appropriate method to use seems to be EAP-GTC (plain, nothing around it needed). this (site config): authorize { update control { Auth-Type := `query-user-pubkey_decrypt-challenge_compare.script '%{User-Name}' '%{User-Password}' '%{Client-IP-Address}' '%{Challenge}'` } } (with script returnig Accept or Reject) seems to work in general. first problem is that %{challenge} (or %{Challenge} or %{Access-Challenge}) seems not to expand to the challenge - what's the challenge's variable name? the second problem is: how can the challenge be set dynamically? setting "challenge" in eap{gtc{}} to a script using `` does not work. anybody with hints on this? regards, Chris

2 1