- Freeradius-Users - lists.freeradius.org

Re: User Authorization Using 'PAM Authentication Module(pam_radius_auth.so)
by Deepak Kumar Bhagat 13 Dec '18

13 Dec '18

Hi Alan, As informed earlier, I have created the patch and raised the pull request. Can you please merge the patch to the master branch ?? Here is the pull request for your reference - https://github.com/FreeRADIUS/pam_radius/pull/41 -Many Thanks, Deepak Bhagat

2 2

FreeRADIUS, OpenLDAP password change and RSA SecurID Next-Token-Mode
by "michael böhm" 12 Dec '18

12 Dec '18

Hello everyone we are successfully using FreeRADIUS for some time now. Now we have two more requirements: 1) Password change in OpenLDAP via FreeRADIUS FreeRADIUS is connected to an OpenLDAP via the LDAP-module. We also have Cisco-Devices connected to a tac_plus-Server (http://www.pro-bono-publico.de/projects/tac_plus.html) also using OpenLDAP as backend. In this setup the users can change their LDAP-password via the router's login-prompt after successful authentication with the old password. Can we implement password changes with FreeRADIUS as well when the NAS supports this or is this a TACACS+-only feature? 2) Next-Token-Mode for RSA SecurID We are using Two-Factor-Authentication with FreeRADIUS and RSA SecurID. FreeRADIUS / unlang splits the password string in two parts and is sending the last 6 digits as Token to the RSA SecurID Server via Radius for validation. This works fine. However, in rare conditions a re-sync of the Token-device may be necessary so that the RSA SecurID Server is prompting for the next Token. Access-Challenges are used in this case. Is there a way to handle this in FreeRADIUS? It would be great if you could point me in the right direction for both use cases and tell me what modules or unlang-statements we could try out to solve this. Thanks and best wishes Michael

3 12

Implementation with AD integration on RHEL7
by luckydog xf 12 Dec '18

12 Dec '18

I came across this question and have some knowledge about it. Basically, MS AD means mschap or mschapv2, as you stand NO chance to retrieve user-password from MS AD, I checked its objectclass and schema, User-Password is write-only. :). So unless your network devices support mschap/eap-peap-mschapv2.etc, you cannot use it. On Thu, 2018-12-06 at 12:06 -0800,... wrote: ...... --

1 0

Parsing octets string via rlm_expr
by Lotkov Svyatoslav 11 Dec '18

11 Dec '18

Hi everyone! We are trying to parse byte-string from Nokia ALU device accounting. AV-pairs looks like: Alc-Acct-O-Inprof-Octets-64 = 0x00030000000000000001 Alc-Acct-O-Outprof-Octets-64 = 0x00030000000000003d9f Alc-Acct-O-Inprof-Octets-64 = 0x000400000000000000b1 Alc-Acct-O-Outprof-Octets-64 = 0x000400000000000000e8 Alc-Acct-I-All-Octets_64 = 0x80030000000000000005 Alc-Acct-I-All-Octets_64 = 0x80040000000000000000 We need to obtain second byte from Alc-Acct-O-Inprof-Octets-64 (this byte represents traffic-class number) Also, we need last 8 bytes from the same pair (this counter represents bytes counter itself) Trying this: %{expr: (0x80030000000000003d9f >> 64) & 0xFF} Raises an error - Shift must be less than 63 (was 64) This EXPAND %{expr: ((0x00030000000000003d9f >> 62) >> 2) & 0xFF} (0) --> 255 How can we obtain this counters without using an rlm_perl or rlm_python for av-pair parsing?

2 2

Freeradius crash please help
by 8zero2 operations 11 Dec '18

11 Dec '18

Radius 3.0.17 crashes with CONSISTENCY CHECK FAILED src/main/process.c[824]: Expected VALUE_PAIR "Dynamic-QoS-Param" to be parented by 0x1c87c20 (RADIUS_PACKET), instead parented by 0x1c87a70 (REQUEST) Talloc chunk lineage: 0x1c87c20 (RADIUS_PACKET) < 0x1c87a70 (REQUEST) < 0x1c87860 (auth_listener_pool) Talloc context level 0: Talloc chunk lineage: 0x1c87a70 (REQUEST) < 0x1c87860 (auth_listener_pool) Talloc context level 0: SOFT ASSERT FAILED src/lib/pair.c[2437]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 17 frames: /usr/local/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f08d5216801] /usr/local/lib/libfreeradius-radius.so(fr_assert_cond+0x4c)[0x7f08d521728e] /usr/local/lib/libfreeradius-radius.so(fr_pair_list_verify+0x11c)[0x7f08d522846d] /usr/local/lib/libfreeradius-server.so(+0x24338)[0x7f08d5478338] /usr/local/lib/libfreeradius-server.so(verify_request+0x124)[0x7f08d5478463] radiusd[0x43c369] radiusd[0x43d9d4] radiusd[0x43dc84] radiusd[0x43c970] radiusd(request_receive+0x7c2)[0x43e4b1] radiusd[0x41878e] radiusd[0x4453f8] /usr/local/lib/libfreeradius-radius.so(fr_event_loop+0x5a8)[0x7f08d523e3dc] radiusd(radius_event_process+0x26)[0x4471d7] radiusd(main+0xc77)[0x4313af] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7f08d36833d5] radiusd[0x40ee29] No panic action set Aborted Regards, Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

3 7

Re: Freeradius crash please help
by Peter Hutchison 10 Dec '18

10 Dec '18

Ref: 8zero2 operations <8zero2ops(a)gmail.com<mailto:8zero2ops@gmail.com>> A few things to check: a) Check configuration is syntax is correct. a. Cd /etc/freeradius b. Run 'freeradius -XC' c. Warning and errors should be elimated. b) If using EAP or TLS then you will need to ensure certificates are ok and not expired. a. Cd /etc/freeradius/certs b. Openssl x509 -in server.crt -inform perm -noout -text c) Next check modules in mods-enabled. a. Make sure all these files are links to actual files in mods-available to avoid file discrepencies b. Only include the modules here you are actually using. c. Check all the files and look for any problems. d) Next check your sites, e.g. default, and check that it only loads the modules you need and in the correct section. e) Try running freeradius in debug mode 'freeradius -X' and use a tool like NTRadPing (or radtest from another linux workstation), to test authentication to radius server, you can then view the debug output to see what is going on and where it fails. f) When making changes, only make one change at time, test, and then try the next change. Peter Hutchison MCP Senior Network Systems Specialist University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

1 0

Freeradius 3 status server
by Tim Cheyne 09 Dec '18

09 Dec '18

Hi we receive status requests on our version 3 Freeradius (RedHat 7) server periodically from upstream radius proxies also in our company. Upon investigation I can see that these requests are being rejected. They come in on UDP port 1645. Looking into status it would seem that you can't receive status requests from an upstream radius proxy on the same port (1645) that you process auth requests. You would have to configure 18121 to be allowed thru the interconnecting firewalls etc and at both ends. This is the command I run from another radius (10.241.69.183) and output below it with main status config below that. 10.241.69.183 is also in the clients file and it does have a different secret but I have tried matching that too. Specifying 1645 as status port just results in conflict of ports. Am I missing the point as I just assumed it was misconfigured on my end. Thanks for your help Tim Command: echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 1, Response-Packet-Type = Access-Accept"| radclient -x 10.241.69.185:1645 status adminsecret Log output on radius (.185): (2) Received Status-Server Id 167 from 10.241.69.183:53816 to 10.241.69.185:1645 length 50 Dropping packet without response because of error: Received packet from 10.241.69.183 with invalid Message-Authenticator! (Shared secret is incorrect.) Waking up in 0.3 seconds. (2) Cleaning up request packet ID 167 with timestamp +147 Ready to process requests /etc/raddb/sites-available/status ================================== server status { listen { # ONLY Status-Server is allowed to this port. # ALL other packets are ignored. type = status ipaddr = * port = 18121 #port = 1645 } client admin { ipaddr = 127.0.0.1 secret = adminsecret } client rad020 { ipaddr = 10.241.69.183 secret = adminsecret } This email, including any attachments, is confidential. If you have received this email in error, please let me know and then delete it - do not read, use, or distribute it or its contents. This email does not designate an information system for the purposes of the Contract and Commercial Law Act 2017.

2 2

Access-Reject in Password using Cisco
by MDS Test 07 Dec '18

07 Dec '18

Hi, We are running freeradius 2.2.7 and decided it is time to move to a latest version. The person who built the existing server is no longer with us. Knowing that configuration from version 2 cannot be ported to version 3, we had learn it. So we are able to get a working version 3.13 up and able to proxy the request into an rsa server. Authenticating from a juniper network and linux host works. But when we authenticate from a cisco device it fails. Below is the snippet of the log: ... (0) Converting control list to client fields (0) ipv4addr = 10.8.4.36 (0) secret = xxxxx (0) shortname = evtlmdt-chnp11 (0) nas_type = other (0) virtual_server = default Adding client 10.8.4.36/32 with shared secret "xxxxx" (0) Received Access-Request Id 20 from 10.8.4.36:1812 to 10.8.2.16:1812 length 75 (0) User-Password = "\346)!M\367\341\233\305F\342\344\227\350\245\327\313" (0) NAS-IP-Address = 10.8.4.36 (0) NAS-Port-Type = Virtual (0) NAS-Port = 1 (0) Calling-Station-Id = "10.2.2.31" (0) User-Name = "ec2624" (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/radius/radacct/10.8.4.36/auth-detail-20181207 (0) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.8.4.36/auth-detail-20181207 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Dec 7 18:31:40 2018 (0) [auth_log] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "ec2624", looking up realm NULL (0) suffix: Found realm "NULL" (0) suffix: Adding Stripped-User-Name = "ec2624" (0) suffix: Adding Realm = "NULL" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) files: users: Matched entry DEFAULT at line 1 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> ec2624 (0) sql: SQL-User-Name set to 'ec2624' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'ec2624' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'ec2624' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='ec2624' ORDER BY priority (0) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='ec2624' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 (0) sql: User found in the group table (0) sql: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'TIER-4_RW' ORDER BY id (0) sql: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'TIER-4_RW' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: Group "TIER-4_RW": Conditional check items matched (0) sql: Group "TIER-4_RW": Merging assignment check items (0) sql: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'TIER-4_RW' ORDER BY id (0) sql: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'TIER-4_RW' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: Group "TIER-4_RW": Merging reply items rlm_sql (sql): Released connection (0) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = ok (0) Starting proxy to home server 135.37.245.6 port 1812 (0) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (0) pre-proxy { (0) pre_proxy_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d (0) pre_proxy_log: --> /var/log/radius/radacct/10.8.4.36/pre-proxy-detail-20181207 (0) pre_proxy_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d expands to /var/log/radius/radacct/10.8.4.36/pre-proxy-detail-20181207 (0) pre_proxy_log: EXPAND %t (0) pre_proxy_log: --> Fri Dec 7 18:31:40 2018 (0) [pre_proxy_log] = ok (0) } # pre-proxy = ok (0) Proxying request to home server 135.37.245.6 port 1812 timeout 30.000000 (0) Sent Access-Request Id 216 from 0.0.0.0:44743 to 135.37.245.6:1812 length 103 (0) User-Password = "\346)!M\367\341\233\305F\342\344\227\350\245\327\313" (0) NAS-IP-Address = 10.8.4.36 (0) NAS-Port-Type = Virtual (0) NAS-Port = 1 (0) Calling-Station-Id = "10.2.2.31" (0) User-Name = "ec2624" (0) Event-Timestamp = "Dec 7 2018 18:31:40 GMT" (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x3230 Waking up in 0.3 seconds. (0) Expecting proxy response no later than 29.668236 seconds from now Waking up in 29.6 seconds. (0) Marking home server 135.37.245.6 port 1812 alive (0) Clearing existing &reply: attributes (0) Received Access-Reject Id 216 from 135.37.245.6:1812 to 10.8.2.16:44743 length 24 (0) Proxy-State = 0x3230 (0) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (0) post-proxy { (0) post_proxy_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d (0) post_proxy_log: --> /var/log/radius/radacct/10.8.4.36/post-proxy-detail-20181207 (0) post_proxy_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d expands to /var/log/radius/radacct/10.8.4.36/post-proxy-detail-20181207 (0) post_proxy_log: EXPAND %t (0) post_proxy_log: --> Fri Dec 7 18:31:40 2018 (0) [post_proxy_log] = ok (0) eap: No pre-existing handler found (0) [eap] = noop (0) update proxy-reply { (0) Filter-Id !* ANY (0) Fortinet-Access-Profile !* ANY (0) Juniper-Local-User-Name !* ANY (0) Cisco-AVPair !* ANY (0) PaloAlto-Admin-Role !* ANY (0) PaloAlto-Panorama-Admin-Role !* ANY (0) F5-LTM-User-Info-1 !* ANY (0) } # update proxy-reply = noop (0) if ("%{proxy-reply:Packet-Type}" == Access-Accept) { (0) EXPAND %{proxy-reply:Packet-Type} (0) --> Access-Reject (0) if ("%{proxy-reply:Packet-Type}" == Access-Accept) -> FALSE (0) } # post-proxy = ok (0) EXPAND %{User-Name} failed authentication for %{Packet-Src-IP-Address} (0) --> ec2624 failed authentication for 10.8.4.36 (0) Login incorrect (Home Server says so): [ec2624] (from client evtlmdt-chnp11 port 1 cli 10.2.2.31) ec2624 failed authentication for 10.8.4.36 (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> ec2624 (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 20 from 10.8.2.16:1812 to 10.8.4.36:1812 length 20 Waking up in 3.9 seconds. Waking up in 5.3 seconds. I noticed that this field User-Password = "\346)!M\367\341\233\305F\342\344\227\350\245\327\313" seems to be the issue but i am not certain. I think this data is being sent to the rsa server instead of clear text. The clear text value of that password is 16752550. This is an OTP. But when we are authenticating to a linux host, the password field is clear text. In our version 2.0, we are able to authenticate to the cisco gear. I am still learning freeradius and would like if you can point me how to fix this. mds

2 1

Re: User Authorization Using 'PAM Authentication Module(pam_radius_auth.so)
by Deepak Kumar Bhagat 07 Dec '18

07 Dec '18

Hi Alan, Hi just raised the pull request for the patch, Can you please review and merge the patch to the master. Sharing the pull request for your reference - https://github.com/FreeRADIUS/pam_radius/pull/41 -Deepak Bhagat

1 0

Re: User Authorization Using 'PAM Authentication Module(pam_radius_auth.so)
by Deepak Kumar Bhagat 07 Dec '18

07 Dec '18

Thank You !! Alan for the response, It's very encouraging for me. > If you can update the patch for the current module, I can add it in. I have completed the patch and doing the initial testing with my setup, I will surely share the patch very soon !!

1 0