- Freeradius-Users - lists.freeradius.org

AD Authentication via python module eventually fails
by Orestes Leal Rodríguez 03 Oct '19

03 Oct '19

Hi guys, I have a freeradius 3.0.16 (ubuntu 18.04.3) running authenticating users against an AD via ldap binds, I call a module (small python program) that calls the ldap binds, etc. So this module's return value indicates to the freeradius if auth was successful or not. From time to time the server starts to return (maybe a month) auth failures. I believe that this module loading for each auth user makes the server's state change or in general leave it in a unconsistent state. The module is loaded from the 'python' module putting the name of the module's filename. This module is on /usr/lib/python2.7/custom_module.py. This configuration was transfered from another (older freeradius version, ubuntu 16.04) to this new freeradius server. I suggested go through the ntlm_auth route but the IT manager decided to go this route (the module using ldap binds) which it works but we have this problem and the original person that used the module also have. I wonder if anybody can iluminate what's happening at the server state level. To fix this I have to restart the freeradius process and everything start to work again so it's not something on the AD side. I suspect an 'in-memory' state or something is the cause. Any ideas? Thanks,

4 7

multiple DHCP virtual host
by Maxime Gerges 02 Oct '19

02 Oct '19

Hello all, I have a use case for the DHCP vhost where I would need to create 3 DHCP vhost on the same machine. The first one would listen to incoming DHCP requests from external relays (UDP 67) and relay the requests to 2 different specific DHCP vhost on the same machine based on some criteria. Each on these 2 DHCP vhost would have their own FSM to reply to client. This mechanism is already available in the RADIUS world of freeRADIUS as per the vhost capability and internal proxying. Is this possible as per the v3.0.x mainstream ? If not I guess that It would be possible to simulate 2 FSM on the same DHCP vhost using 2 different policies along with if/else. ------ if (first DHCP) { policy_1 } else { policy_2 } ------ Best Regards Maxime.

3 3

Problems getting along with Open Directory
by Philip Ershler 01 Oct '19

01 Oct '19

Hello, I am trying to use LDAP access to Open Directory on a 10.14.6 machine. I installed Freeradius from MacPorts. I am attempting to use Freeradius to authenticate wireless users. If I make the following edit to /opt/local/etc/raddb/mods-config/files/authorize, I can make a wireless connection without problems. # The canonical testing user which is in most of the # examples. # #bob Cleartext-Password := "hello" # Reply-Message := "Hello, %{User-Name}" # # ershler Cleartext-Password := “mypass" Reply-Message := "Hello, %{User-Name}" # Here you can see the Reply-Message in several places as the authentication proceeds. Received Access-Request Id 73 from 155.100.140.233:58880 to 155.100.140.85:1812 length 196 (9) User-Name = "ershler" (9) NAS-IP-Address = 155.100.140.233 (9) NAS-Port = 0 (9) Called-Station-Id = "00-26-BB-74-F6-1F:CVRTI-G" (9) Calling-Station-Id = "A0-99-9B-10-AF-65" (9) Framed-MTU = 1400 (9) NAS-Port-Type = Wireless-802.11 (9) Connect-Info = "CONNECT 0Mbps 802.11" (9) EAP-Message = 0x02b200251900170303001a44ad024358ecd35da92afbb2e7970520a3c18852ced0f46ef259 (9) State = 0xe2201e71ea92079232d7793ca94d3ef5 (9) Message-Authenticator = 0x1383e35fceb57971f268e1e223750d27 (9) Restoring &session-state (9) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (9) &session-state:TLS-Session-Version = "TLS 1.2" (9) # Executing section authorize from file /opt/local/etc/raddb/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "ershler", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 178 length 37 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /opt/local/etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x9638639a978a7940 (9) eap: Finished EAP session with state 0xe2201e71ea920792 (9) eap: Previous EAP request found for state 0xe2201e71ea920792, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: [eaptls verify] = ok (9) eap_peap: Done initial handshake (9) eap_peap: [eaptls process] = ok (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state phase2 (9) eap_peap: EAP method MSCHAPv2 (26) (9) eap_peap: Got tunneled request (9) eap_peap: EAP-Message = 0x02b200061a03 (9) eap_peap: Setting User-Name to ershler (9) eap_peap: Sending tunneled request to inner-tunnel (9) eap_peap: EAP-Message = 0x02b200061a03 (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = "ershler" (9) eap_peap: State = 0x9638639a978a79408050c69dcac660aa (9) Virtual server inner-tunnel received request (9) EAP-Message = 0x02b200061a03 (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = "ershler" (9) State = 0x9638639a978a79408050c69dcac660aa (9) WARNING: Outer and inner identities are the same. User privacy is compromised. (9) server inner-tunnel { (9) session-state: No cached attributes (9) # Executing section authorize from file /opt/local/etc/raddb/sites-enabled/inner-tunnel (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [chap] = noop (9) [mschap] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "ershler", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) update control { (9) &Proxy-To-Realm := LOCAL (9) } # update control = noop (9) eap: Peer sent EAP Response (code 2) ID 178 length 6 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) files: users: Matched entry ershler at line 92 (9) files: EXPAND Hello, %{User-Name} (9) files: --> Hello, ershler (9) [files] = ok (9) [expiration] = noop (9) [logintime] = noop (9) pap: WARNING: Auth-Type already set. Not setting to PAP (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = eap (9) # Executing group from file /opt/local/etc/raddb/sites-enabled/inner-tunnel (9) authenticate { (9) eap: Expiring EAP session with state 0x9638639a978a7940 (9) eap: Finished EAP session with state 0x9638639a978a7940 (9) eap: Previous EAP request found for state 0x9638639a978a7940, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap: Sending EAP Success (code 3) ID 178 length 4 (9) eap: Freeing handler (9) [eap] = ok (9) } # authenticate = ok (9) # Executing section post-auth from file /opt/local/etc/raddb/sites-enabled/inner-tunnel (9) post-auth { (9) if (0) { (9) if (0) -> FALSE (9) } # post-auth = noop (9) } # server inner-tunnel (9) Virtual server sending reply (9) Reply-Message = "Hello, ershler" (9) MS-MPPE-Encryption-Policy = Encryption-Allowed (9) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) MS-MPPE-Send-Key = 0x7a8a71ab9a85e2ccc32c93159586c440 (9) MS-MPPE-Recv-Key = 0x5731187423009b1ee0e1a8ce75e482ca (9) EAP-Message = 0x03b20004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) User-Name = "ershler" (9) eap_peap: Got tunneled reply code 2 (9) eap_peap: Reply-Message = "Hello, ershler" (9) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (9) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) eap_peap: MS-MPPE-Send-Key = 0x7a8a71ab9a85e2ccc32c93159586c440 (9) eap_peap: MS-MPPE-Recv-Key = 0x5731187423009b1ee0e1a8ce75e482ca (9) eap_peap: EAP-Message = 0x03b20004 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: User-Name = "ershler" (9) eap_peap: Got tunneled reply RADIUS code 2 (9) eap_peap: Reply-Message = "Hello, ershler” ************************************************************************************** With dscl, I can see the following apple-enabled-auth-mech enabled admin$ dscl /LDAPv3/127.0.0.1 read /Config/dirserv apple-enabled-auth-mech dsAttrTypeNative:apple-enabled-auth-mech: DHX DIGEST-MD5 GSSAPI SRP CRAM-MD5 WEBDAV-DIGEST SMB-NTLMv3 EAP-MSCHAPv2 SMB-NTLMv2 If I take my name and password out of /opt/local/etc/raddb/mods-config/files/authorize, then I get the following errors from FreeRadius. I am wondering what or where the problem is. ************************************************************************************** (30) FreeRADIUS-Proxied-To = 127.0.0.1 (30) User-Name = "ershler" (30) State = 0xfdbd9f93fd6a85f8a445b5c272e47828 (30) WARNING: Outer and inner identities are the same. User privacy is compromised. (30) server inner-tunnel { (30) session-state: No cached attributes (30) # Executing section authorize from file /opt/local/etc/raddb/sites-enabled/inner-tunnel (30) authorize { (30) policy filter_username { (30) if (&User-Name) { (30) if (&User-Name) -> TRUE (30) if (&User-Name) { (30) if (&User-Name =~ / /) { (30) if (&User-Name =~ / /) -> FALSE (30) if (&User-Name =~ /@[^@]*@/ ) { (30) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (30) if (&User-Name =~ /\.\./ ) { (30) if (&User-Name =~ /\.\./ ) -> FALSE (30) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (30) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (30) if (&User-Name =~ /\.$/) { (30) if (&User-Name =~ /\.$/) -> FALSE (30) if (&User-Name =~ /(a)\./) { (30) if (&User-Name =~ /(a)\./) -> FALSE (30) } # if (&User-Name) = notfound (30) } # policy filter_username = notfound (30) [chap] = noop (30) [mschap] = noop (30) suffix: Checking for suffix after "@" (30) suffix: No '@' in User-Name = "ershler", looking up realm NULL (30) suffix: No such realm "NULL" (30) [suffix] = noop (30) update control { (30) &Proxy-To-Realm := LOCAL (30) } # update control = noop (30) eap: Peer sent EAP Response (code 2) ID 215 length 66 (30) eap: No EAP Start, assuming it's an on-going EAP conversation (30) [eap] = updated (30) [files] = noop (30) [expiration] = noop (30) [logintime] = noop (30) [pap] = noop (30) } # authorize = updated (30) Found Auth-Type = eap (30) # Executing group from file /opt/local/etc/raddb/sites-enabled/inner-tunnel (30) authenticate { (30) eap: Expiring EAP session with state 0xfdbd9f93fd6a85f8 (30) eap: Finished EAP session with state 0xfdbd9f93fd6a85f8 (30) eap: Previous EAP request found for state 0xfdbd9f93fd6a85f8, released from the list (30) eap: Peer sent packet with method EAP MSCHAPv2 (26) (30) eap: Calling submodule eap_mschapv2 to process data (30) eap_mschapv2: # Executing group from file /opt/local/etc/raddb/sites-enabled/inner-tunnel (30) eap_mschapv2: authenticate { (30) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (30) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (30) mschap: No NT-Password configured. Trying OpenDirectory Authentication (30) mschap: OD username_string = ershler, OD shortUserName=ershler (length = 7) (30) mschap: ERROR: rlm_mschap: authentication failed - status = eDSAuthMethodNotSupported (30) eap_mschapv2: [mschap] = reject (30) eap_mschapv2: } # authenticate = reject (30) eap: Sending EAP Failure (code 4) ID 215 length 4 (30) eap: Freeing handler (30) [eap] = reject (30) } # authenticate = reject (30) Failed to authenticate the user (30) Using Post-Auth-Type Reject (30) # Executing group from file /opt/local/etc/raddb/sites-enabled/inner-tunnel (30) Post-Auth-Type REJECT { (30) attr_filter.access_reject: EXPAND %{User-Name} (30) attr_filter.access_reject: --> ershler (30) attr_filter.access_reject: Matched entry DEFAULT at line 11 (30) [attr_filter.access_reject] = updated (30) update outer.session-state { (30) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: rlm_mschap: authentication failed - status = eDSAuthMethodNotSupported' (30) } # update outer.session-state = noop (30) } # Post-Auth-Type REJECT = updated (30) } # server inner-tunnel ************************************************************************************ Thanks, Phil Ershler

2 1

TLS error 'Failed in proxy receive'
by Sharma, Nitin 01 Oct '19

01 Oct '19

Hello Guys, I started seeing below errors related to TLS. ``` Fri Aug 23 09:57:32 2019 : Error: tls: Failed in proxy receive Fri Aug 23 09:57:32 2019 : Error: tls: error:140F3042:SSL routines:ssl_undefined_const_function:called a function you should not call Fri Aug 23 09:57:32 2019 : Error: tls: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init Fri Aug 23 09:57:32 2019 : Error: tls: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init Fri Aug 23 09:57:32 2019 : Error: tls: error:140F3042:SSL routines:ssl_undefined_const_function:called a function you should not call Fri Aug 23 09:57:32 2019 : Error: tls: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init Fri Aug 23 09:57:32 2019 : Error: tls: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init Fri Aug 23 09:57:32 2019 : Error: tls: error:140F3042:SSL routines:ssl_undefined_const_function:called a function you should not call Fri Aug 23 09:57:32 2019 : Error: tls: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init Fri Aug 23 09:57:32 2019 : Error: tls: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init Fri Aug 23 09:57:32 2019 : Error: tls: error:140F3042:SSL routines:ssl_undefined_const_function:called a function you should not call Fri Aug 23 09:57:32 2019 : Error: tls: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init Fri Aug 23 09:57:32 2019 : Error: tls: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init ``` Any suggestion on this will really help. Thanks & Regards, Nitin Sharma

5 7

Re : example dictionary entries wanted for 6929 - for new Extended Type 241.XX and Long ExtendedType 246.XX
by robert.stannard＠bt.com 30 Sep '19

30 Sep '19

I am new to Radius and trying to implement the extensions to RFC2865 specified in RFC6929. Are there any example dictionary entries showing how the new extensions are coded ? I am referring to, 1. Extended Type (e.g 241) 2. Long Extended Type (e.g. 245) 3. TLV 4. EVS For example, for 1. should the entry in our vendor dictionary be like, a) "ATTRIBUTE XY-NEW-EXTENDED Extended-Vendor-Specific-1.1 STRING" or b) "ATTRIBUTE XY-NEW-EXTENDED 241.1 STRING" examples for the other would be helpful as well as any references to examples / docs etc. thank you.

3 6

Re: FreeRadius 3.0.12 - Select radreply but dont send them
by Alan DeKok 27 Sep '19

27 Sep '19

On Sep 27, 2019, at 10:33 AM, Thibault Lansiaux <thibault.lansiaux(a)wiconnect.fr> wrote: > > Hi Allan, > > The '==' seems not to be the problem, the same radreply (same base.table) is ok with our old freeradius. That is not a useful response. It's quite rude. You can (a) waste your time thinking that you're smarter than everyone else, or (b) follow instructions and fix the problem. Alan DeKok.

1 0

FreeRadius 3.0.12 - Select radreply but dont send them
by Thibault Lansiaux 27 Sep '19

27 Sep '19

Hi, We are having a problem with a freeradius migration, from two different servers. The first (old) 1.x : is OK On the new server (freeradius 3.0.12) FreeRadius select the user's radreply but don't send them in the "Access-Accept" We compared "sites-enabled/default" from the old and new, and didn't find differences in "authorize {" and "preprocess {" Bellow the Freeradius -X request : Ready to process requests (0) Received Access-Request Id 212 from 4.5.6.7:20506 to 1.2.3.4:1812 length 179 (0) Acct-Session-Id = "008fe531" (0) NAS-Port = 0 (0) NAS-Port-Type = Virtual (0) User-Name = "MY-NAS-ID" (0) Calling-Station-Id = "01-02-03-04-05-06" (0) Called-Station-Id = "11-12-13-14-15-16" (0) Framed-IP-Address = 192.168.3.254 (0) User-Password = "mypassword" (0) NAS-Identifier = "MY-NAS-ID" (0) NAS-IP-Address = 10.0.50.1 (0) Framed-MTU = 1496 (0) Connect-Info = "HTTPS" (0) Service-Type = Administrative-User (0) Message-Authenticator = 0x26fc427cba3a98946382a756c6659634 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) update request { (0) EXPAND %{User-Name} (0) --> MY-NAS-ID (0) SQL-User-Name set to 'MY-NAS-ID' rlm_sql (sql): Reserved connection (0) (0) Executing select query: SELECT groupname FROM radhuntgroup WHERE nasipaddress="MY-NAS-ID" rlm_sql (sql): Released connection (0) rlm_sql (sql): Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 (0) EXPAND %{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress="%{NAS-Identifier}"} (0) --> my-nas-id-group (0) &Huntgroup-Name := my-nas-id-group (0) } # update request = noop (0) if (&Huntgroup-Name == "%{sql:SELECT groupname FROM radusergroup WHERE username="%{User-Name}"}"){ (0) EXPAND %{User-Name} (0) --> MY-NAS-ID (0) SQL-User-Name set to 'MY-NAS-ID' rlm_sql (sql): Reserved connection (1) (0) Executing select query: SELECT groupname FROM radusergroup WHERE username="MY-NAS-ID" rlm_sql (sql): Released connection (1) (0) EXPAND %{sql:SELECT groupname FROM radusergroup WHERE username="%{User-Name}"} (0) --> my-nas-id-group (0) if (&Huntgroup-Name == "%{sql:SELECT groupname FROM radusergroup WHERE username="%{User-Name}"}") -> TRUE (0) if (&Huntgroup-Name == "%{sql:SELECT groupname FROM radusergroup WHERE username="%{User-Name}"}") { (0) [ok] = ok (0) } # if (&Huntgroup-Name == "%{sql:SELECT groupname FROM radusergroup WHERE username="%{User-Name}"}") = ok (0) ... skipping else: Preceding "if" was taken (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/4.5.6.7/auth-detail-20190927 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/4.5.6.7/auth-detail-20190927 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Sep 27 11:58:20 2019 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "MY-NAS-ID", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [unix] = notfound (0) sql: EXPAND %{User-Name} (0) sql: --> MY-NAS-ID (0) sql: SQL-User-Name set to 'MY-NAS-ID' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'MY-NAS-ID' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'MY-NAS-ID' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "mypassword" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'MY-NAS-ID' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'MY-NAS-ID' ORDER BY id (0) sql: User found in radreply table, merging reply items (0) sql: Colubris-AVPair == "access-list=loginserver,DENY,all,192.168.0.0/18,all" (0) sql: Colubris-AVPair == "access-list=loginserver,DENY,all,172.16.0.0/12,all" (0) sql: Colubris-AVPair == "access-list=loginserver,DENY,all,10.0.0.0/8,all" (0) sql: Colubris-AVPair == "access-list=loginserver,ACCEPT,tcp,www.mydomain.com,all" (0) sql: Colubris-AVPair == "use-access-list=loginserver" (0) sql: Colubris-AVPair == "logo=https://webportail.mydomain.com/directory/logo.gif" (0) sql: Colubris-AVPair == "fail-page=https://webportail.mydomain.com/directory/fail.html" (0) sql: Colubris-AVPair == "session-page=https://webportail.mydomain.com/directory/session.html" (0) sql: Colubris-AVPair == "messages=https://webportail.mydomain.com/directory/messages.txt" (0) sql: Colubris-AVPair == "transport-page=https://webportail.mydomain.com/directory/transport.html" (0) sql: Colubris-AVPair == "login-err-url=https://webportail.mydomain.com/directory/login-error.php" (0) sql: Colubris-AVPair == "goodbye-url=https://webportail.mydomain.com/directory/goodbye.php" (0) sql: Colubris-AVPair == "login-url=https://webportail.mydomain.com/directory/index.php?mac=%m" (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'MY-NAS-ID' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'MY-NAS-ID' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'my-nas-id-group' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'my-nas-id-group' ORDER BY id (0) sql: Group "my-nas-id-group": Conditional check items matched (0) sql: Group "my-nas-id-group": Merging assignment check items (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'my-nas-id-group' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'my-nas-id-group' ORDER BY id (0) sql: Group "my-nas-id-group": Merging reply items rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/4.5.6.7/reply-detail-20190927 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/4.5.6.7/reply-detail-20190927 (0) reply_log: EXPAND %t (0) reply_log: --> Fri Sep 27 11:58:20 2019 (0) [reply_log] = ok (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (3) (0) sql: EXPAND %{User-Name} (0) sql: --> MY-NAS-ID (0) sql: SQL-User-Name set to 'MY-NAS-ID' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'MY-NAS-ID', 'mypassword', 'Access-Accept', '2019-09-27 11:58:20') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'MY-NAS-ID', 'mypassword', 'Access-Accept', '2019-09-27 11:58:20') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (3) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Login OK: [MY-NAS-ID/mypassword] (from client MY_CLIENT-WAN-IP port 0 cli 01-02-03-04-05-06) (0) Sent Access-Accept Id 212 from 1.2.3.4:1812 to 4.5.6.7:20506 length 0 (0) Finished request Waking up in 4.9 seconds. Regards, -- /Thibault Lansiaux/

2 1

Is it possible to use CHAP authentication with pam_radius?
by Dan Swartzendruber 27 Sep '19

27 Sep '19

I'm trying to implement external authentication for an appliance running CentOS 7. My research turned up the easiest solution as simply installing pam_radius from the repository. I did, and it works just fine (tested against a Freeradius 3.0 server with a single test user.) Running freeradiux with '-X' indicates that is using PAP: (0) User-Name = "XXX" (0) User-Password = "XXX" (0) NAS-IP-Address = XXX.XXX.XXX.XXX (0) NAS-Identifier = "sshd" (0) NAS-Port = 15050 (0) NAS-Port-Type = Virtual (0) Service-Type = Authenticate-Only ... (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok For security reasons, I'd really like to use CHAP instead, but it doesn't seem to support that? The man pages and such don't mention CHAP. I went as far as downloading 1.4.0 and extracting the tarball and looking at the code. User-Password is Radius attribute 2, and looking at the source: 0 radius.h <global> 71 #define PW_PASSWORD 2 and 1 pam_radius_auth.c add_password 541 attr = find_attribute(request, PW_PASSWORD); 2 pam_radius_auth.c add_password 543 if (type == PW_PASSWORD) { 3 pam_radius_auth.c build_radius_packet 721 add_password(request, PW_PASSWORD, password, conf->server->secret); 4 pam_radius_auth.c build_radius_packet 727 add_password(request, PW_PASSWORD, "", conf->server->secret); 5 pam_radius_auth.c talk_radius 975 add_password(request, PW_PASSWORD, password, old_password); 6 pam_radius_auth.c talk_radius 978 add_password(request, PW_PASSWORD, password, server->secret); Am I missing something? Or am I out of luck? Thanks!

4 8

Freeradius - how to reply "memberof" active directory information for Strongswan
by Sébastien Genesta 25 Sep '19

25 Sep '19

Hi, I'm using Freeradius for the Active Directory authentication of my Strongswan clients. My goal is to declare 2 vpn connections with different virtual IP leases, allowing me to separate traffic (as an example, one vpn connection for sales and the other for technicians). To do it, I'm trying to use Group selection option (rightgroups) on Strongswan. According to Strongswan documentation ( https://wiki.strongswan.org/projects/strongswan/wiki/EapRadius) I have to use class attribute on my freeradius server to return the group membership. The issue is that I don't know how. I'm using mschap for authentication to Active Directory. *My current configuration:* */etc/freeradius/3.0/mods-available/mschap* with_ntdomain_hack = yes require_encryption = yes require_strong = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" */etc/freeradius/3.0/mods-enabled/eap* eap { [...] default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = no */etc/freeradius/3.0/clients.conf* client localhost { ipaddr = 127.0.0.1 proto = * secret = <radius-secret> require_message_authenticator = no nas_type = other limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } # IPv6 Client #client localhost_ipv6 { # ipv6addr = ::1 # secret = testing123 #} I've tried to follow this post but it didn't work http://freeradius.1045715.n5.nabble.com/Return-User-Groups-in-Class-field-t… More precisaly below part (replacing ldap module by mschap module and also changing path because my freeradius version is 3.0): *1) Added a mapping in ldap mod.* # /etc/raddb/mods-enabled/ldap ldap { ... update { ... reply:memberOf += 'memberOf' } ... } *2) Added an Attribute reference* # /etc/raddb/dictionary ATTRIBUTE memberOf 3001 string *3) Added a update reply* # /etc/raddb/sites-enabled/default post-auth { ... foreach &reply:memberOf { update reply { Class += "%{Foreach-Variable-0}" } } ... } I also tried to set below information (according to http://freeradius.1045715.n5.nabble.com/Reply-with-group-attribute-td278105… ) post-auth { ... update reply { Class += %{Group} } } ... } I've searched accross the Internet but didn't find a way to do it properly. Is there any official guide explaning how to reply memberOf attribute? How can I do it? Thanks for your help <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Garanti sans virus. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#m_-4546190989838674270_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

2 4

How to set Tag = 0x00 in Tunnel-Private-Group-ID attribute
by Phani Siriki 24 Sep '19

24 Sep '19

Hi Team Is there a way to set "Tag = 0x00" in Tunnel-Private-Group-ID attribute? I have the following user listed in users file. When access-accept is sent, tag-id is set to 0x00 in Tunnel-Medium-Type and Tunnel-Type attributes. RFC 2868 didn't mention anything about tag=0x00 and I assume thats the reason we are not sending it from Freeradius. IxiaScale12000 Cleartext-Password := passwd12000 Tunnel-Medium-Type:0 = IEEE-802 , Tunnel-Type:0 = VLAN , Tunnel-Private-Group-Id:0 = "105", Filter-id = "Radius-block", Session-timeout = 500, Termination-Action = RADIUS-Request Version: ====== [root@yagna-freeradius1 ~]# radiusd -X FreeRADIUS Version 3.0.17 Best Regards Phani

2 4