- Freeradius-Users - lists.freeradius.org

EAP-TLS - How to log TLS-Client-Cert-* attributes from expired certificates
by Andreas Gryphius 15 Feb '19

15 Feb '19

Hello freeradius user list, I have a running freeradius from the default package coming with Debian 9 stretch , which is based on version 3.0.12 . It is configured to auth only via EAP-TLS. Clients sent their certificates, no passwords and no (real) username. Accepts and Rejects work as expected. What I am not happy with is that I can not find a way to log the certificate details if a user is sending an expired certificate. For users with valid certificates I see all the values for TLS-Client-Cert-* in %{pairs:request:} in linelog . The linelog-command for successful auth is set in the post-auth{} section in sites-enabled/default . With expired client-certificates the eap module jumps direct into Post-Auth-Type REJECT {} (located within post-auth{} section) and none of the TLS-Client-Cert-* details are available (I tried with debug_all). Only Module-Failure-Message is mentioning "... expired certificate ..." and some SSL info. As all of the clients are configured to use an anonymised identity (all use the same) as the username I can not see to whom the expired certificate belongs. In debug mode it says there are TLS attributes created for an expired certificate. So there might be hope to save them for later use ... Does anyone have an idea how I can make these attributes available in linelog? This is an example what I get for an expired certificate in debug mode . Note the lines (226) eap_tls: Creating attributes from certificate OIDs I want to log the value of TLS-Client-Cert-Subject and/or TLS-Client-Cert-Common-Name. freeradius -fxx -l stdout 2>&1 | tee /tmp/freeradius_debug.log Thread 4 handling request 226, (92 handled so far) (226) Received Access-Request Id 110 from 10.1.2.3:32847 to 10.100.0.1:1812 length 554 (226) User-Name = "anonymous(a)example.org" (226) NAS-IP-Address = 192.168.1.12 (226) NAS-Identifier = "0418d67042af" (226) NAS-Port = 0 (226) Called-Station-Id = "04-18-D6-78-55-E1:wifi-radius" (226) Calling-Station-Id = "60-36-DD-7C-E2-DC" (226) Framed-MTU = 1400 (226) NAS-Port-Type = Wireless-802.11 (226) Connect-Info = "CONNECT 0Mbps 802.11b" (226) EAP-Message = xxxxxxxxx... (226) State = 0x3aec898e31c584882f19a28945c85c1b (226) Message-Authenticator = 0x8eeb70cc5c6a84bf36523e303d207ff6 (226) session-state: No cached attributes (226) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (226) authorize { (226) policy split_username_nai { (226) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (226) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) -> TRUE (226) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (226) update request { (226) EXPAND %{1} (226) --> anonymous (226) &Stripped-User-Name := anonymous (226) EXPAND %{3} (226) --> example.org (226) &Stripped-User-Domain = example.org (226) } # update request = noop (226) [updated] = updated (226) } # if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) = updated (226) ... skipping else: Preceding "if" was taken (226) } # policy split_username_nai = updated (226) if (noop || !&Stripped-User-Domain) { (226) if (noop || !&Stripped-User-Domain) -> FALSE (226) if (&Stripped-User-Domain != "example.org") { (226) if (&Stripped-User-Domain != "example.org") -> FALSE (226) if ( &Stripped-User-Name !~ /otherPKI/i ) { (226) if ( &Stripped-User-Name !~ /otherPKI/i ) -> TRUE (226) if ( &Stripped-User-Name !~ /otherPKI/i ) { (226) eap: Peer sent EAP Response (code 2) ID 41 length 369 (226) eap: No EAP Start, assuming it's an on-going EAP conversation (226) [eap] = updated (226) return (226) } # if ( &Stripped-User-Name !~ /otherPKI/i ) = updated (226) } # authorize = updated (226) Found Auth-Type = eap (226) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (226) authenticate { (226) eap: Expiring EAP session with state 0x3aec898e31c58488 (226) eap: Finished EAP session with state 0x3aec898e31c58488 (226) eap: Previous EAP request found for state 0x3aec898e31c58488, released from the list (226) eap: Peer sent packet with method EAP TLS (13) (226) eap: Calling submodule eap_tls to process data (226) eap_tls: Continuing EAP-TLS (226) eap_tls: Got final TLS record fragment (363 bytes) (226) eap_tls: [eaptls verify] = ok (226) eap_tls: Done initial handshake (226) eap_tls: TLS_accept: SSLv3/TLS write server done (226) eap_tls: <<< recv TLS 1.2 [length 13a3] (226) eap_tls: Creating attributes from certificate OIDs (226) eap_tls: Creating attributes from certificate OIDs (226) eap_tls: Creating attributes from certificate OIDs (226) eap_tls: TLS-Cert-Serial := "17887d08b33e3d" (226) eap_tls: TLS-Cert-Expiration := "190709235900Z" (226) eap_tls: TLS-Cert-Subject := "/C=DE/O=Example/OU=ExampleOU/CN=Example-CA-02" (226) eap_tls: TLS-Cert-Issuer := "/C=DE/O=Example/OU=Example-PKI/CN=Example-CA-01" (226) eap_tls: TLS-Cert-Common-Name := "Example-CA-02" (226) eap_tls: TLS-Cert-Subject-Alt-Name-Email := "ca(a)example.org" (226) eap_tls: Creating attributes from certificate OIDs (226) eap_tls: TLS-Client-Cert-Serial := "1a694699888a48" (226) eap_tls: TLS-Client-Cert-Expiration := "181115121610Z" (226) eap_tls: TLS-Client-Cert-Subject := "/C=DE/ST=ExampleST/L=ExampleL/O=Example/OU=ExampleOU/CN=Expired_Example_Cert" (226) eap_tls: TLS-Client-Cert-Issuer := "/C=DE/O=Example/OU=ExampleOU/CN=Example-CA-02" (226) eap_tls: TLS-Client-Cert-Common-Name := "Expired_Example_Cert" (226) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Upn := "anonymous(a)example.org" (226) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Email := "gryphius(a)example.org" (226) eap_tls: ERROR: SSL says error 10 : certificate has expired (226) eap_tls: >>> send TLS 1.2 [length 0002] (226) eap_tls: ERROR: TLS Alert write:fatal:certificate expired tls: TLS_accept: Error in error (226) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (226) eap_tls: ERROR: System call (I/O) error (-1) (226) eap_tls: ERROR: TLS receive handshake failed during operation (226) eap_tls: ERROR: [eaptls process] = fail (226) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (226) eap: Sending EAP Failure (code 4) ID 41 length 4 (226) eap: Failed in EAP select (226) [eap] = invalid (226) } # authenticate = invalid (226) Failed to authenticate the user (226) Using Post-Auth-Type Reject (226) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (226) Post-Auth-Type REJECT { (226) if ( &Module-Failure-Message[1] =~ /expired/ ) { (226) if ( &Module-Failure-Message[1] =~ /expired/ ) -> TRUE (226) if ( &Module-Failure-Message[1] =~ /expired/ ) -> TRUE (226) if ( &Module-Failure-Message[1] =~ /expired/ ) { (226) linelog_cert_expired: EXPAND +++++ linelog_CERT-EXPIRED +++++, %{pairs:session-state:} (226) linelog_cert_expired: --> +++++ linelog_CERT-EXPIRED +++++, (226) [linelog_cert_expired] = ok (226) } # if ( &Module-Failure-Message[1] =~ /expired/ ) = ok (226) attr_filter.access_reject: EXPAND %{User-Name} (226) attr_filter.access_reject: --> anonymous(a)example.org (226) attr_filter.access_reject: Matched entry DEFAULT at line 11 (226) [attr_filter.access_reject] = updated (226) linelog_send_reject: EXPAND action = Send-REJECT, User-Name = "%{User-Name}", Acesspoint-IP = "%{NAS-IP-Address}", Endgeraet-MAC = "%{Calling-Station-Id}", Stripped-User-Name = "%{Stripped-User-Name}", Stripped-User-Domain = "%{Stripped-User-Domain}", EAP-Type = "%{EAP-Type}", Module-Failure-Message(s) = "%{Module-Failure-Message[*]}" (226) linelog_send_reject: --> action = Send-REJECT, User-Name = "anonymous(a)example.org", Acesspoint-IP = "192.168.1.12", Endgeraet-MAC = "60-36-DD-7C-E2-DC", Stripped-User-Name = "anonymous", Stripped-User-Domain = "example.org", EAP-Type = "TLS", Module-Failure-Message(s) = "eap_tls: SSL says error 10 : certificate has expired,eap_tls: TLS Alert write:fatal:certificate expired,eap_tls: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed,eap_tls: System call (I/O) error (-1),eap_tls: TLS receive handshake failed during operation,eap_tls: [eaptls process] = fail,eap: Failed continuing EAP TLS (13) session. EAP sub-module failed" (226) [linelog_send_reject] = ok (226) } # Post-Auth-Type REJECT = updated (226) Delaying response for 1.000000 seconds Thanks, Andreas

3 4

Freeradius filter-id + FreeIPA
by Boudjoudad Abdelkader 15 Feb '19

15 Feb '19

Hello, We have a FreeIPA as domain controller and we are planing to use Freeradius as authentication for the Wireless, i configured freeradius with LDAP and i can do authentication with a domain user with the command radtest, now the network team asked me to configure freeradius to return a filter-i of the user group assigned ID, example we have user1: dn: uid=user1,cn=users,cn=accounts,dc=subdmain,dc=domain,dc=com with the group ID:gid=1471600000 I did some research on google and i found that i have to modify the file /etc/raddb/sites-enabled/default like in the link bellow but not exactly the same thing and which command i have to use get this value: FreeIPA_Freeeradius <https://stackoverflow.com/questions/43913834/freeradius-filter-id> Any suggestion please ? Thanks

1 0

EAP-TLS with user base in SQL not happening
by Mankomal Singh 15 Feb '19

15 Feb '19

Hi I am doing EAP-TLS test to authenticate only known users that are in SQL to authenticate via TLS method, how can I achieve this? can some one share me any guide on this, I have been able to achieve TLS authentication on files but not able to do so via SQL Server. My issue is that even if the user is not found in SQL it is able to authenticate via TLS Cheers MK Singh +91-9910416231 www.shouut.com

2 1

Accept user if his account expired
by mohamad buvaydanı 13 Feb '19

13 Feb '19

hello I am using freeradius v3 . I want when expired user trying to access his account the freeradius will send accept packet with new ip pool for example 'expired ' I am using this code in authorize section expiration{ userlock = 1 } if(userlock){ # Let him connect with EXPIRED pool in reply ok update reply { Reply-Message := "Your account has expired, %{User-Name} / Reason: DATE LIMIT REACHED / " Framed-Pool := "expired" } } but user still get reject , without get new ip pool I tried to insert that same code in to Post-Auth-Type REJECT section the users rejected but get new ip pool where is my error thank you

3 3

Output Memory allocation error (0xc0000017)
by Burn Zero 13 Feb '19

13 Feb '19

Hi, Freeradius server version : 3.0.17, 64bit OS : CentOS 7.2 We have setup Freeradius to authenticate users to get access to WiFi. Freeradius is connected to Active Directory servers for authentication. Recently Freeradius logged the message "NT_STATUS_ACCESS_DENIED" in the authentication logs and users were not authenticated. Additionally, I can see the below logs in Freeradius: ERROR: (3978) ntlm_auth: ERROR: Program returned code (1) and output 'NT_STATUS_NO_MEMORY: Memory allocation error (0xc0000017)' Auth: (3978) Login incorrect (ntlm_auth: Program returned code (1) and output 'NT_STATUS_NO_MEMORY: Memory allocation error (0xc0000017)') On the another day we got the same issue, same error message and in the Freeradius logs, we got: ERROR: (43458) mschap: ERROR: Program returned code (1) and output 'Memory allocation error (0xc0000017)' Auth: (43458) Login incorrect (mschap: Program returned code (1) and output 'Memory allocation error (0xc0000017)') When we rejoin the Active Directory domain, the issue gets resolved. Not sure where the issue lies. Kindly help me. Thank you. Regards, Burn Zero

2 1

Cause of relatively large retransmission-rate in radsniff output
by Fekete Tamás 13 Feb '19

13 Feb '19

Hello! I would like to ask help with understanding my radsniff output as usually I get a huge number of Access-Request retransmission rate. When I have run radsniff -W 1, I got the following output: ... Access-Request counters: Total : 66.000/s Linked : 64.000/s Unlinked : 0.000/s Access-Request latency: High : 1000.607ms Low : 0.260ms Average : 17.473ms MA : 23.723ms Access-Request retransmits & loss: RT (0) : 56.000/s ... As it can be seen above, I got 56 retransmission. It is a huge number compared to the 66 Total Access Request / sec. I checked if the RT (retransmission) value contains the loss packets and the Access-Requests which has been resent due to Access-Challenges. My result is that loss packets are separately show up in this statistics like: Access-Request retransmits & loss: Lost : 1.000/s RT (0) : 55.000/s And Access-Requests followed by Access-Challenges are not count into the Retrasmission. Here is an output from a virtual machine which was tested with eapol_test (with peap-mschapv2 method): Interface capture rate: ens3 : 0.000/s lo : 40.000/s Access-Request counters: Total : 10.000/s Linked : 10.000/s Unlinked : 0.000/s Access-Request latency: High : 6.417ms Low : 0.119ms Average : 0.949ms MA : 0.949ms Access-Accept counters: Total : 1.000/s Linked : 1.000/s Unlinked : 0.000/s Access-Accept latency: High : 0.190ms Low : 0.190ms Average : 0.190ms MA : 0.190ms Access-Challenge counters: Total : 9.000/s Linked : 9.000/s Unlinked : 0.000/s Access-Challenge latency: High : 6.417ms Low : 0.119ms Average : 1.033ms MA : 1.033ms It means that the Access-Requests followed by Access-Challenges are not evaluated like Retransmitted requests. They are counted like new Access-Requests. So my question is, do you think this retransmission rate is normal? And if not or not sure, do you have a hint or suggestion where to start the investigation? If I should use debug output of Freeradius, what is the thing I have to look in it? - Tamas Fekete

2 2

rlm_rest in 3.0.17: cert validation of HTTPS server not working
by Stefan Winter 12 Feb '19

12 Feb '19

Hello, I'm using rlm_rest to validate second-factor tokens to a privacyIDEA server. This worked fine with a test env in HTTP, but now doesn't on HTTPS with cert validation enabled. I have this on the command-line: # openssl s_client -connect 2fa.restena.lu:443 -CAfile /usr/local/freeradius/config/raddb/mods-config/rest/trustroot.pem CONNECTED(00000003) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Assured ID Root CA verify return:1 depth=1 C = NL, ST = Noord-Holland, L = Amsterdam, O = TERENA, CN = TERENA SSL CA 3 verify return:1 depth=0 C = LU, L = Esch-sur-Alzette, O = Fondation RESTENA, CN = *.restena.lu verify return:1 --- Certificate chain 0 s:/C=LU/L=Esch-sur-Alzette/O=Fondation RESTENA/CN=*.restena.lu i:/C=NL/ST=Noord-Holland/L=Amsterdam/O=TERENA/CN=TERENA SSL CA 3 1 s:/C=NL/ST=Noord-Holland/L=Amsterdam/O=TERENA/CN=TERENA SSL CA 3 i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA --- [...] Verify return code: 0 (ok) I.e. the server sends the intermediate, and the matching root is in the trustroot.pem file. But when I transpose this into the rlm_rest config like this: rest { tls { ca_file = ${confdir}/mods-config/rest/trustroot.pem check_cert = "yes" # doesn't work regardless if check_cert_cn is yes or no [...] Then I get an error message during FreeRADIUS' cert validation phase: rlm_rest (rest): Reserved connection (0) (15) rest: Expanding URI components (15) rest: EXPAND https://2fa.restena.lu (15) rest: --> https://2fa.restena.lu (15) rest: EXPAND //validate/radiuscheck (15) rest: --> //validate/radiuscheck (15) rest: Sending HTTP POST to "https://2fa.restena.lu//validate/radiuscheck" (15) rest: EXPAND user=%{urlquote:%{User-Name}}&pass=%{urlquote:%{TOTP-Token}} (15) rest: --> user=swinter&pass=thetokenvalue (15) rest: ERROR: Request failed: 83 - Issuer check against peer certificate failed (15) rest: ERROR: Server returned no data rlm_rest (rest): Released connection (0) I don't really know what to make of "Issuer check against peer certificate failed". The root appears to be recognised, and the intermedaite chain is the expected one. So what would be failing here? For reference, the two CA certs are pasted at the end. They are the root and intermediate, concatenated. If I only place the root cert itself into the file -> same result. Greetings, Stefan Winter -----BEGIN CERTIFICATE----- MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+ wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4 VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/ AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe +o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIE+zCCA+OgAwIBAgIQCHC8xa8/25Wakctq7u/kZTANBgkqhkiG9w0BAQsFADBl MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv b3QgQ0EwHhcNMTQxMTE4MTIwMDAwWhcNMjQxMTE4MTIwMDAwWjBkMQswCQYDVQQG EwJOTDEWMBQGA1UECBMNTm9vcmQtSG9sbGFuZDESMBAGA1UEBxMJQW1zdGVyZGFt MQ8wDQYDVQQKEwZURVJFTkExGDAWBgNVBAMTD1RFUkVOQSBTU0wgQ0EgMzCCASIw DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMV2Dw/ZQyk7bG3RR63eEL8jwnio Snc18SNb4EweQefCMQC9iDdFdd25AhCAHo/tZCMERaegOTuBTc9jP8JJ/yKeiLDS lrlcinQfkioq8hLIt2hUtVhBgUBoBhpPhSn7tU08D08/QJYbzqjMXjX/ZJj1dd10 VAWgNhEEEiRVY++Udy538RV27tOkWUUhn6i+0SftCuirOMo/h9Ha8Y+5Cx9E5+Ct 85XCFk3shKM6ktTPxn3mvcsaQE+zVLHzj28NHuO+SaNW5Ae8jafOHbBbV1bRxBz8 mGXRzUYvkZS/RYVJ+G1ShxwCVgEnFqtyLvRx5GG1IKD6JmlqCvGrn223zyUCAwEA AaOCAaYwggGiMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMHkG CCsGAQUFBwEBBG0wazAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQu Y29tMEMGCCsGAQUFBzAChjdodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGln aUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqgOKA2hjRodHRw Oi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3Js MDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVk SURSb290Q0EuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxo dHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMB0GA1UdDgQWBBRn/YggFCeYxwnS JRm76VERY3VQYjAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzANBgkq hkiG9w0BAQsFAAOCAQEAqSg1esR71tonHqyYzyc2TxEydHTmQN0dzfJodzWvs4xd xgS/FfQjZ4u5b5cE60adws3J0aSugS7JurHogNAcyTnBVnZZbJx946nw09E02DxJ WYsamM6/xvLYMDX/6W9doK867mZTrqqMaci+mqege9iCSzMTyAfzd9fzZM2eY/lC J1OuEDOJcjcV8b73HjWizsMt8tey5gvHacDlH198aZt+ziYaM0TDuncFO7pdP0GJ +hY77gRuW6xWS++McPJKe1e9GW6LNgdUJi2GCZQfXzer8CM/jyxflp5HcahE3qm5 hS+1NGClXwmgmkMd1L8tRNaN2v11y18WoA5hwnA9Ng== -----END CERTIFICATE----- -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 3

Eduroam and setting identity privacy in Windows
by Jim Potter 12 Feb '19

12 Feb '19

Hi all, I've been tasked with addressing our FreeRadius servers for our eduroam setup here. What I would like to achieve is authentication to happen invisibly where possible - our laptops would perform machine authentication, users would log in and would re-authenticate to wireless invisibly (currently each user needs to set up the wireless connection on each device the use - this is really bad from a user experience point of view, especially for students using laptops from a bank). Has anyone else had any success doing anything like this? The big problem I have run in to is in fact not really FreeRadius at all, rather the domain bound windows clients sending their credentials in the wrong format. Computer authentication comes in the form *host/mypc.bathspa.ac.uk <http://mypc.bathspa.ac.uk>* and users in the format *DOMAIN\myusername, *not *myusername(a)bathspa.ac.uk <myusername(a)bathspa.ac.uk>* as required by eduroam. I've updated the policy files on FreeRadius to authenticate the above formats successfully, but if staff are to be able to use their devices on remote eduroam sites, they need either their username ( at least their anonymous ID/identity privacy name) to be sent in the format *someone(a)bathspa.ac.uk <someone(a)bathspa.ac.uk>* Has anyone found a way of doing this? thanks in advance, Jim Server Engineer Bath Spa University

4 7

what would cause sql to return reject response?
by Bipin Patel 11 Feb '19

11 Feb '19

i have the below in authorize sql { notfound = 1 reject = 2 } if (notfound) { update reply { Reply-Message := "Incorrect Username or Password" } reject } if (reject) { update reply { Reply-Message := "Your account is disabled, contact admin" } reject } expiration { userlock = 1 } if (userlock) { update reply { Reply-Message := "Your account has expired, contact admin" } reject } logintime pap but the reject response is never generated from the sql module, if the username doesnt match it generates the notfound and if password doesnt match the pap module rejects the request and sql responds ok but what i want is the sql module to generate the reject response. can anyone guide me under what circumstances does the sql module generate a reject response coz i tried setting Auth-Type attribute to reject but still sql doesnt generate reject

2 4

Problem with migrating from macOS Server to FreeRADIUS 3.0.17
by Stephan Jung 11 Feb '19

11 Feb '19

Hello, I am trying to migrate a Server from maOS Server Version 5.6.1 (17S2109) to FreeRADIUS 3.0.17 and I have to configure OpenDirectory integration. I am following Apple’s macOS Server— Service Migration Guide | March 2018 <https://developer.apple.com/support/macos-server/macOS-Server-Service-Migra…> and set up everything accordingly. The server runs currently macOS 10.13.6 and serves also Opendirectory, but the rlm_opendirectory.dylib is nowhere to be found! I installed FreeRADIUS through brew. A) on the step "Configure FreeRADIUS” of Apple’s migration guide 4) Run the following command:  ls /usr/local/lib/rlm_opendirectory.* You should see the following in the output: • rlm_opendirectory.a • rlm_opendirectory.dylib • rlm_opendirectory.la Since I installed FreeRADIUS through Brew I checked in ls /usr/local/Cellar/freeradius-server/3.0.17/lib/rlm_opendirectory.* too, but nothing is found in both locations! B) on the last step "Set up users” when testing the configuration I get: /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/opendirectory[20]: Failed to link to module 'rlm_opendirectory': dlopen(/usr/local/Cellar/freeradius-server/3.0.17/lib/rlm_opendirectory.dylib, 6): image not found This is the complete output: I wrote on stackoverfow <https://stackoverflow.com/questions/54617087/freeradius-problems-with-open-…>, serverfault <https://serverfault.com/questions/953195/suddenly-radius-authentication-is-…> as well as Apple discussion forum <https://discussions.apple.com/thread/250152034>. Does someone now how to configure this? Where these library files come from? How to force macOS to write them? Thank you very much in advance!!! Stephan

3 7