- Freeradius-Users - lists.freeradius.org

Old "problem" with backquote and Mikrotik-Rate-Limit (fixed)
by Rafael Labiak Olivastro 28 Sep '18

28 Sep '18

Hello Alan, I was facing a problem with backquotes and the Mikrotik-Rate-Limit atribute, this problem happened when I put something like “%{sql: select....}” in the attribute´s value, everything worked fine BUT in the final result the backquotes is not removed, causing problems in the NAS. Well, at first sight I thought that was a FreeRadius problem, BUT it wasn´t. FreeRadius is so well forged that sometimes we need to do a deep dive into it to figure out how to overcome some “problems”. So, this is what I did to “fix” this, note that NOTHING WAS CHANGED in FreeRadius source code, just the CONFIGURATION was done to adapt everything. 1 – Create a new file called “/usr/bin/echo2” with following contents and make it executable (chmod 755 /usr/sbin/echo2): #!/bin/bash echo $1 | sed -r "s/\`//g" 2 – Edit file /etc/raddb/sites-available/default and ADD the following in the post-auth section: if (reply:Mikrotik-Rate-Limit =~ /.*\`$/i) { update reply { &Mikrotik-Rate-Limit := `/usr/bin/echo2 %{0}` } } 3 – Restart radius. So, the “1” is just a way to execute echo and sed together, because “inside” the FreeRadius conf this doesn´t work, number “2” just identify where exist backquotes in the EXPANSION of the atribute, and, in afirmative case, remove they. SO SIMPLE.... Again, thanks a lot for the work with FreeRadius, you and your team deserve all my respects. Best regards, Rafael Labiak Olivastro http://www.vigo.com.br

2 2

Satus server show statistics per client per client
by Nariman Ibadullaev 28 Sep '18

28 Sep '18

Hello. My implementation. 2 NAS(client - 172.20.1.38 and 172.20.1.40) send auth requests to one FreeRadius.(10.20.18.109) NAS defined in sql(nas table.) Satatus server enabled and listen on 18121 port. Satus Server server status { listen { type = status ipaddr = 127.0.0.1 port = 18121 } client admin { ipaddr = 127.0.0.1 secret = adminsecret } authorize { ok Autz-Type Status-Server { ok } } } Follow type of request send to the Status Server is global (no something change if I change "FreeRADIUS-Stats-Client-IP-Address = 172.20.1.38" ) echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-IP-Address = 172.20.1.38 ,FreeRADIUS-Stats-Server-IP-Address = 10.20.18.109, FreeRADIUS-Stats-Server-Port = 1812 " | radclient -x localhost:18121 status adminsecret Sending Status-Server of id 49 to 127.0.0.1 port 18121 Message-Authenticator = 0x00000000000000000000000000000000 FreeRADIUS-Statistics-Type = 35 FreeRADIUS-Stats-Client-IP-Address = 172.20.1.38 FreeRADIUS-Stats-Server-IP-Address = 10.20.18.109 FreeRADIUS-Stats-Server-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 18121, id=49, length=224 FreeRADIUS-Total-Access-Requests = 1 FreeRADIUS-Total-Access-Accepts = 1 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 1 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 0 FreeRADIUS-Total-Accounting-Responses = 0 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 Question: Is it possible to observe statistics per client ? (not global stats)

2 3

Huntgroups and Rejects
by Ing. Andrés Gallo 27 Sep '18

27 Sep '18

Hello We are trying to make two groups of users, General and FixedIP ( IPFIJA ). To achieve that, we want to set a group of NASes to the General Group, serving any customer. And only one NAS, to get ONLY the 'IP-FIJA' customers. Rejecting others. This way, if customer G1 in General group hits the NAS in NAS-Fixed_IP (IPFIJA), it's rejected. And customer F1, in FixedIP group, hits NAS-General, also rejected. Code in 'default' is: update request { Huntgroup-Name := "%{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress='%{NAS-IP-Address}'}" } # if (Huntgroup-Name == "IPFIJA" && SQL-Group != "IP-FIJA") { reject } Works great this way. The question is if there's any way to 'silent' the rejects for the particular case of 'Wrong NAS/Wrong group'. Mean, once customer G1 request auth to NAS-Fixed_IP, instead of 'log' the reject, silently discard it. Because besides the RadPostAuth table whose inserts can be handled by some 'if ..then' like above, the server status ( polled by SNMP statistics ) grows a lot in such cases. Regards Andres

2 2

Issue redundant block - Freeradius 3.0.16.
by Andrea Mucci 27 Sep '18

27 Sep '18

Hi All, I configured a redundant block for two instances of the sql module as described in the radius.conf file. redundant redundant_sql_default { sql_primary_default sql_secondary_default handled } sql_primary_default and sql_secondary_default are two instances of the sql module. It works if I call it as a module in the authorize stream but does not accept it in an expansion. update control { Tmp-String-1 := "%{redundant_sql_default: SELECT VENDOR_ID||'~'||VALUE||'~'||VPDN_VENDOR_CODING_ID FROM NAS a, NAS_TAG b, VPDN_LAC l WHERE A.ID = B.NAS_ID (+) AND B.NAS_TAG_NAME_ID (+) = 1 AND A.ID = L.NAS_ID (+) AND A.IP_ADDR_TXT = '%{NAS-IP-Address}'}" } The service start gives this error. Sep 27 16:17:26 freeradiusmi radiusd[8798]: /etc/raddb/policy.d/windtre-nas-policy[12]: Failed parsing expanded string: Sep 27 16:17:26 freeradiusmi radiusd[8798]: /etc/raddb/policy.d/windtre-nas-policy[12]: %{redundant_sql_default: SELECT VENDOR_ID||'~'||VALUE||'~'||VPDN_VENDOR_CODING_I Sep 27 16:17:26 freeradiusmi radiusd[8798]: /etc/raddb/policy.d/windtre-nas-policy[12]: ^ Unknown module Sep 27 16:17:26 freeradiusmi systemd[1]: radiusd.service: control process exited, code=exited status=1 Sep 27 16:17:26 freeradiusmi systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. -- Subject: Unit radiusd.service has failed What am I doing wrong? Best Regards Andrea

2 1

auth = yes logs too much, auth = no too little
by Hans-Christian Esperer 27 Sep '18

27 Sep '18

Hi All, I would like to log failed login attempts, so I can see the username that was tried. Is there a simple way to do this? Setting auth=yes in radiusd.conf also logs all successful attempts. So basically, I'd like to see lines like this one: Mon Sep 24 13:24:16 2018 : Auth: (34876) Login incorrect (mschap: FAILED: No NT/LM-Password. Cannot perform authentication): [username/<via Auth-Type = eap>] (from client unifi port 0 via TLS tunnel) but not Mon Sep 24 13:15:03 2018 : Auth: (34866) Login OK: [username] (from client unifi port 123456789 cli 00-00-11-22-33-44) Any suggestions on how to achieve this or something similar would be much appreciated. Not directly related, but somewhat: When auth=no is set, and a login fails (be it due to a wrong username, or wrong passphrase), I get the following in the log: Mon Sep 24 13:24:16 2018 : Info: (34877) eap_peap: This means you need to read the PREVIOUS messages in the debug output Mon Sep 24 13:24:16 2018 : Info: (34877) eap_peap: to find out the reason why the user was rejected Mon Sep 24 13:24:16 2018 : Info: (34877) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Mon Sep 24 13:24:16 2018 : Info: (34877) eap_peap: what went wrong, and how to fix the problem And that's all! There are *no previous* messages. There four lines are all that I get. I assume this means that something on my side is misconfigured, like an "if all else fails, reject" kind of statement? Thanks for the help! Cheers HC

3 9

dynamic_clients // Required attribute "FreeRADIUS-Client-Secret" is missing
by Osvaldo T Crispim Filho 27 Sep '18

27 Sep '18

Why is not he finding the "secret"? ============================== Freeradius 3.0.18 Debian 9 amd64 ============================== Table nas: id | nasname | shortname | type | ports | secret | server | community ----+-------------+-----------+-------+-------+--------+--------+----------- 1 | 172.20.0.20 | ap-20 | other | | 123123 | | 2 | 172.20.0.21 | ap-21 | other | | 123123 | | (2 rows) ========================= fradius1:~$ psql -h localhost -d radius -U radius -W -c "select secret from nas where nasname = '172.20.0.21';" Password for user radius: secret -------- 123123 (1 row) ========================== freeradius -X: Ready to process requests (0) server dynamic_clients { (0) # Executing section authorize from file /etc/freeradius/sites-enabled/dynamic-clients (0) authorize { (0) if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { (0) EXPAND %{User-Name} (0) --> (0) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (3) (0) Executing select query: SELECT nasname FROM nas WHERE nasname = '172.20.0.21' (0) SQL query returned no results rlm_sql (sql): Released connection (3) Need 2 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (8), 1 of 24 pending slots used (0) EXPAND %{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'} (0) --> (0) if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") -> FALSE (0) [ok] = ok (0) } # authorize = ok (0) } # server dynamic_clients (0) Converting control list to client fields *(0) ERROR: Cannot add client 172.20.0.21 <http://172.20.0.21>: Required attribute "FreeRADIUS-Client-Secret" is missing* Ignoring request to auth address * port 1812 bound to server default from unknown client 172.20.0.21 port 45122 proto udp Ready to process requests -- - Osvaldo T Crispim Filho -

2 2

EAP-TLS cert validation with intermediate cert
by Zetan Drableg 26 Sep '18

26 Sep '18

In /etc/raddb/mods-enabled/eap client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" Wpa_supplicant is sending a client certificate that is the client + intermediate certificate concatenated. However freeradius only gets the client certificate in TLS-Client-Cert-Filename and openssl fails validation. I checked this by changing the client = verify command to copy the certificate to /var/tmp so I could look at it. I can verify the cert using openssl verify -CAfile ca.pem -untrusted intermediate.pem client.pem but the intermediate is not available to the radius server, or from the received cert chain from the client. I think freeradius should be receiving client+intermediate certs from wpa_client, but it's not. Is there another Filename variable containing the intermediate? Why is freeradius truncating the cert to only the client and removing the intermediate? freeradius 3.0.13

2 1

Detect MSCHAPv2 inner-tunnel state
by Gary Gwin 26 Sep '18

26 Sep '18

The attached radius.log shows successful EAP-PEAP/MSCHAPv2 authentication using a Windows 10 client and Meraki access point with FreeRADIUS 3.0.17. An inner-tunnel Python script uses an API to get the NT hash and sets the NT-Password within authorize. The standard authenticate MS-CHAP module then handles. During the chatty inner-tunnel MSCHAPv2 negotiation, the get NT hash API is invoked twice in requests 7 and 8, which works, but with unnecessary script and API load. I can eliminate the second invocation in step 8 by checking the request EAP-Message for length. That feels fragile. There must be a better way to detect state to determine we're in request 8. Any recommendations? Thanks, Gary

2 2

EAP-PWD with wrong password
by Anja Ruckdaeschel 26 Sep '18

26 Sep '18

Hi there, Is there a way to determine that a user tried to log in with a "wrong password" with eap-pwd? Setup is as recommended by comments in config with an inner-tunnel. EAP-PWD against edir with a correct password works fine and it produces a log line on Access-Accept in the radius-Logfile. But EAP-PWD with the user using a wrong password, does nothing. In debug it just looks like an unfinished eap-request with eap returning handled instead of ok for the last packet. Problem is, that we cannot see "normal" entry in radius.log and trigger some other actions on a reject. Thank you very much Kind regards Anja

3 6

Linelog to same file as default log
by Anja Ruckdaeschel 26 Sep '18

26 Sep '18

Hi there! One question: Is it safe to log to the same file with linelog which is the default log in radiusd.conf? As far as I can see, this works in my tests, but I don't wan't to have "bad surpises" when taking this to production with hundreds of log events. Thank you very much Anja

2 2