- Freeradius-Users - lists.freeradius.org

Cache errors(?) - single device
by Marcin Marszałkowski 11 Sep '19

11 Sep '19

Hi, I have freeradius 3.0.20 with tls cache enabled (fast reauthentication) running in docker container , sql backend. Everything has been working fine until recently new device (laptop) was added to network. Laptop connects properly to specified network but when roaming it gets answer Access-Accept without any AVP, thus it is assigned to native, trunk network. Since it applies only to one device (MacBook Pro) and debug doesn’t throw any errors I don’t know where to start troubleshooting. I’d removed content of tlscache folder, toggled off/on cache and it didn’t help. Any suggestion? Martin

3 14

Accounting Requests originating from FreeRADIUS
by mufid ay 11 Sep '19

11 Sep '19

Hi there, We have a few Wireless Access Points that support RADIUS authentication only. They won't send out any accounting requests. And we are using FreeRADIUS to proxy authentication requests. I was wondering if we can get FreeRADIUS to send out accounting requests on behalf of Access Points. This will need to be after Access Accept message is received. Is that possible? Is there any configuration examples? thanks.

2 1

Is it possible to automate a Disconnect-Request based on exceeded Monthly-Usage?
by Houman 10 Sep '19

10 Sep '19

Hello, I have setup the FreeRadius like the following to prevent a user from logging in after his monthly usage has been exceeded. echo 'ATTRIBUTE Monthly-Usage 3001 integer64' >> /etc/freeradius/3.0/dictionary sed -i '/authorize {/a\ update request {\ Monthly-Usage = "%{sql:SELECT COALESCE((SUM(`acctoutputoctets`)), 0) FROM radacct WHERE `username`='"'"'%{User-Name}'"'"' AND Month(acctupdatetime)=(Month(NOW())) AND Year(acctupdatetime)=Year(NOW())}"\ }\ ' /etc/freeradius/3.0/sites-enabled/default INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('houman','Monthly-Usage','<',10000); While this works fine, the user won't be disconnected after the monthly-usage has been exceeded. Instead only if the user disconnects voluntarily and tries to reconnect again would he be prevented. So I'm trying to find a way to disconnect the user the moment his limit has been reached. After some research I have come across Dynamic Authorization extension and have enabled it like this: *dae {* * enable = yes * * listen = 0.0.0.0 * * port = 3799 * * secret = secret123 * *}* Now I can disconnect myself from the command line, like this: *echo User-Name=houman | radclient -x 127.0.0.1:3799 <http://127.0.0.1:3799> disconnect ''secret123''* That's very nice. So I could run a Python script via a crontab job to check every minute to see which users have exceeded their monthly-usage and disconnect them. But I was wondering if there is a way to automate the disconnect directly via free radius so that I don't have to run the crontab job. Is there a way that I'm overlooking? Many Thanks, Houman

3 2

Problem with LDAP queries
by edson luiz 09 Sep '19

09 Sep '19

I currently have a freeradius + LDAP server, I'm having a big problem, authentication works inconsistently, even for valid users with correct credentials, there are times when the user authenticates and at times not, the error is displayed: (11) ldap: ERROR: Bind with uid = test, or = wifi, dc = test, dc = org to ldap: //X.X.X.X failed: Other (e.g., implementation specific) error (11) ldap: ERROR: Server said: Failure authenticating with password. The curious thing is that the problem only occurs in the authentication phase, I captured and analyzed the traffic of queries and strangely the information goes incorrect, it uses information from another user (one of the last connections), mixing everything, I think this is the problem, but I don't know what is causing it. * information like server DN and IP has been modified

3 3

Users vs Groups attribute
by Marcin Marszałkowski 08 Sep '19

08 Sep '19

Hi, I have set a few attributes in Groups and as far as I have seen, attribute defined there overrides (same) attribute if is defined in user’s profile. Is there any way to make it working the other way around - user’s attribute would override group’s attribute? Regards Martin

2 2

Python Module Threading Issue
by Kwak Wookjong 07 Sep '19

07 Sep '19

Hi Alan, I recently upgraded FreeRadius server 3.0.16 to 3.0.19 and observed a performance issue on handling multiple thread. I have done some research on this forum and found below discussion for Python Module Threading Issue about a year ago. http://freeradius.1045715.n5.nabble.com/Python-Module-Threading-Issue-td575…<http://freeradius.1045715.n5.nabble.com/Python-Module-Threading-Issue-td575…> As a result of the discussion, it made one of the configuration value changed in rlm_python/rlm_pyton.c (line #1180) for 3.0.18 release. https://github.com/FreeRADIUS/freeradius-server/commit/9a9e7852e52cab5323df…<https://github.com/FreeRADIUS/freeradius-server/commit/9a9e7852e52cab5323df…> module_t rlm_python = { .magic = RLM_MODULE_INIT, .name = "python", - .type = RLM_TYPE_THREAD_SAFE, + .type = RLM_TYPE_THREAD_UNSAFE, and it looked like the change was made in case for using multiple python modules but the thing is, in my case, within a single python module the multiple requests were treated as a single threaded. I have confirmed such behavior with a simple test with using python module and example code provided in /etc/raddb/mods-config/python/example.py by putting few seconds of delay for authenticate. def authenticate(p): print "*** authenticate ***" time.sleep(5) return radiusd.RLM_MODULE_OK Also confirmed, by putting back RLM_TYPE_THREAD_SAFE, multiple requests were handled by multi-threaded and the performance issue was resolved. If it were needed to update RLM_TYPE_THREAD_UNSAFE for using multiple python module, Can you, at least, make it configurable so that it can be set depending on the usage and situation? Let me know, Thanks! Best Regards, wj ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 1

Quota limit on the time of authentication
by Jiuyu Sun 07 Sep '19

07 Sep '19

Hi, I have a FreeRadius server running with EAP-TLS. The client can authenticate with the server with the client-side certificate (which is in a Hotspot 2.0 profile). I want to avoid user misuse of certificate/profile stolen - userA copies the client-side certificate/profile and give it to userB, so that userB can authenticate to the server with the same certificate/profile. Is there something that can be configured in FreeRadius to limit the quota of authentication on one user/certificate? For example, only allow 10 times of user authentication to my FreeRadius server everyday? Thank you! Best, Holly

2 1

Not able to send a challenge
by ngoetz75 06 Sep '19

06 Sep '19

> Thank you for your response. > > You are correct, I meant to type ttls, not tls. > > The Palo Alto firewall that I am using to authenticate against FreeRadius only supports the following types: > PEAP-MSCHAPv2 > PEAP with GTC > EAP-TTLS with PAP > PAP > > Since I am trying to do two-factor (AD and OTP), I need to be able to return a challenge response back to the firewall requesting the user to enter their token. So far I have only gotten this to work properly with PAP. Since PAP is very insecure, I was hopping to use one of the other types. I was hopping that since PAP was working, I could do the same thing using PAP within a TTLS tunnel. Since I am forwarding the second factor (OTP) to another radius servers (safenet), I am assuming the freeradius servers will need the OTP password in clear text to forward to the safenet radius server. I didn't think that the PEAP options would work because they send a hash value instead of the password. > > I am fairly new at doing this, so my assumptions could be incorrect. > > Thanks > > <quote author='Alan DeKok-2'> > > >>> On Sep 6, 2019, at 12:41 PM, ngoetz75 <ngoetz24(a)gmail.com> wrote: >>> >>> I’m not sure what I am doing wrong. I am trying to use eap-tls to >>> authenticate users against active directory, > > EAP-TLS authenticates users by certificate. It doesn't need / use AD. > > The most you could do is to check the username against the user ID in AD. > If the user exists, keep going with EAP-TLS. Otherwise reject them. > >>> and if it passes, I want to prompt the user to enter their OTP. > > EAP-TLS doesn't use passwords. Therefore it doesn't use OTP. > > Maybe you mean TTLS? > >>> This is all working with PAP, but I want to use eap-tls since it is more >>> secure. Everything works fine with the windows authentication, but as >>> soon as I uncomment out the “challenge” line in the code below, I get the >>> following error: >>> >>> (6) ntlm_auth: Program executed successfully >>> (6) [ntlm_auth] = ok >>> (6) if (ok) { >>> (6) if (ok) -> TRUE >>> (6) if (ok) { >>> (6) update reply { >>> (6) Reply-Message := "Please enter OTP" >>> (6) } # update reply = noop >>> (6) policy challenge { >>> (6) update control { >>> (6) &Response-Packet-Type = Access-Challenge >>> (6) } # update control = noop >>> (6) [handled] = handled >>> (6) } # policy challenge = handled >>> (6) } # if (ok) = handled >>> (6) } # Auth-Type ntlm_auth = handled >>> (6) } # server inner-tunnel >>> (6) Virtual server sending reply >>> (6) Reply-Message := "Please enter OTP" >>> (6) eap_ttls: No tunneled reply was found for request 6 , and the request >>> was not proxied: rejecting the user. > > Yes. EAP-TTLS has a fixed packet flow. You can't just inject something > new and expect it to work. > > If you want OTP challenge / response with EAP-TTLS, you have to use > EAP-GTC in the inner tunnel. PAP won't work. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > </quote> > Quoted from: > http://freeradius.1045715.n5.nabble.com/Fwd-Not-able-to-send-a-challenge-tp… > > > _____________________________________ > Sent from http://freeradius.1045715.n5.nabble.com >

1 0

Fwd: Not able to send a challenge
by ngoetz75 06 Sep '19

06 Sep '19

> I’m not sure what I am doing wrong. I am trying to use eap-tls to authenticate users against active directory, and if it passes, I want to prompt the user to enter their OTP. This is all working with PAP, but I want to use eap-tls since it is more secure. Everything works fine with the windows authentication, but as soon as I uncomment out the “challenge” line in the code below, I get the following error: > > (6) ntlm_auth: Program executed successfully > (6) [ntlm_auth] = ok > (6) if (ok) { > (6) if (ok) -> TRUE > (6) if (ok) { > (6) update reply { > (6) Reply-Message := "Please enter OTP" > (6) } # update reply = noop > (6) policy challenge { > (6) update control { > (6) &Response-Packet-Type = Access-Challenge > (6) } # update control = noop > (6) [handled] = handled > (6) } # policy challenge = handled > (6) } # if (ok) = handled > (6) } # Auth-Type ntlm_auth = handled > (6) } # server inner-tunnel > (6) Virtual server sending reply > (6) Reply-Message := "Please enter OTP" > (6) eap_ttls: No tunneled reply was found for request 6 , and the request was not proxied: rejecting the user. > (6) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed > (6) eap: Sending EAP Failure (code 4) ID 6 length 4 > (6) eap: Failed in EAP select > (6) [eap] = invalid > (6) } # Auth-Type eap = invalid > (6) Failed to authenticate the user > (6) Using Post-Auth-Type Reject > (6) Post-Auth-Type sub-section not found. Ignoring. > > > I only get this error when I try to send out a challenge. If I comment out the challenge line, then everything works, except then user does not get promted for their OTP and are allowed to authentice using only their domain password. > > Here is a copy of my inner-tunnel config: > > > server inner-tunnel { > > > listen { > ipaddr = 127.0.0.1 > port = 18120 > type = auth > } > > > authorize { > if (!State) { > if (&User-Password) { > update control { > Auth-Type = ntlm_auth > } > } > else { > reject > } > } > else { > # If State, then proxy request: > update control { > Proxy-To-Realm := "otp" > } > } > } > > > authenticate { > > Auth-Type ntlm_auth { > ntlm_auth > if (ok) { > update reply { > # Create a random State attribute: > # State := "%{randstr:aaaaaaaaaaaaaaaa}" > Reply-Message := "Please enter OTP" > } > # Return Access-Challenge: > # challenge > } > } > > } > > session { > radutmp > } > > post-auth { > > #if (0) { > update reply { > User-Name !* ANY > Message-Authenticator !* ANY > EAP-Message !* ANY > Proxy-State !* ANY > MS-MPPE-Encryption-Types !* ANY > MS-MPPE-Encryption-Policy !* ANY > MS-MPPE-Send-Key !* ANY > MS-MPPE-Recv-Key !* ANY > } > > update { > &outer.session-state: += &reply: > } > #} > > Post-Auth-Type REJECT { > -sql > attr_filter.access_reject > update outer.session-state { > &Module-Failure-Message := &request:Module-Failure-Message > } > } > } > > pre-proxy { > } > > post-proxy { > > eap > } > > } > > > Any help that someone could give me to point me in the right direction would be greatly appreciated. > > Thanks

2 1

chap: ERROR: &control:Cleartext-Password is required for authentication
by Cesare Esposito 06 Sep '19

06 Sep '19

Dear freeradius users, I have the following error for one authorisation: "chap: ERROR: &control:Cleartext-Password is required for authentication" as you can also see in the debug text. Usually this error is related to a missing password or a wrong password. However I am using almost the same authorisation procedure on another freeradius platform And on the other platform the authorisation worked well without problems. So my question is Are there other known grounds to have the above error ? mit freundlichen Grüssen / Best Regards Cesare Esposito Manager Network Engineering Tel: +492215000254 Mobile: +491635000627 Mail: cesare.esposito(a)inquam-solutions.de<mailto:cesare.esposito@inquam-solutions.de<mailto:cesare.esposito@inquam-solutions.de%3cmailto:cesare.esposito@inquam-solutions.de>> ------------------------------------------------------------------ Inquam Solutions GmbH, Adolf-Grimme-Allee 3, D-50829 Köln, Geschäftsführer: Carsten Ullrich, Andrzej Cwik Handelsregister: Amtsgericht Köln HRB 33214 ---------------------------------------------------------------------------------------------------------------- Disclaimer: This e-mail message is for the sole use of the intended recipient(s) and may contain privileged or confidential information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply e-mail and delete the original message including any attachments and destroy all copies thereof. Thank you for your cooperation.

2 1