- Freeradius-Users - lists.freeradius.org

Using EAP-PSK with Radius server 3.0.17
by Naik Sarita Prakash 29 Aug '18

29 Aug '18

Hi, Wanted to know if we can configure EAP-PSK with latest radius server version? If yes, any link that can help me to configure it? Regards, Sarita Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.

2 1

RE: can't auth
by Martin Edge 29 Aug '18

29 Aug '18

Hi, Perhaps this has something to do with it? > (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority (0) sql: User not found Best read the logs .. they offer some valuable insight. Thanks Martin. -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+medge=emersion.com(a)lists.freeradius.org> On Behalf Of Somanath Mishra Sent: Wednesday, 29 August 2018 5:34 PM To: freeradius-users(a)lists.freeradius.org Subject: Hi All, I have configured freeradius3. Now i am facing issue with radtest. I am getting Accept-Reject response. My request: radius3@radius3:~$ radtest testuser testpassword localhost 1812 testing123 Sent Access-Request Id 141 from 0.0.0.0:57910 to 127.0.0.1:1812 length 78 User-Name = "testuser" User-Password = "testpassword" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "testpassword" Received Access-Reject Id 141 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject radius DB: +----+--------------------+--------------------+----+--------------+ | id | username | attribute | op | value | +----+--------------------+--------------------+----+--------------+ | 1 | testuser | Cleartext-Password | := | testpassword | | 2 | testuser(a)gmail.com | Cleartext-Password | := | testpassword | | 3 | user(a)gmail.com | user-password | := | password | and my debug log: Ready to process requests (0) Received Access-Request Id 141 from 127.0.0.1:57910 to 127.0.0.1:1812 length 78 (0) User-Name = "testuser" (0) User-Password = "testpassword" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x8c4403cf542c7a3facd04010b82c4b76 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/defaul t (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALS E (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "testuser", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> testuser (0) sql: SQL-User-Name set to 'testuser' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE us ername = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE us ername = 'testuser' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User- Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'testuser' O RDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE userna me = 'testuser' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth -Type (0) pap: WARNING: Authentication will fail unless a "known good" password is ava ilable (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> testuser (0) sql: SQL-User-Name set to 'testuser' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet- Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testpassword', 'Access-Reject', '2018-08-29 08:26:50') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authda te) VALUES ( 'testuser', 'testpassword', 'Access-Reject', '2018-08-29 08:26:50') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> testuser (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 141 from 127.0.0.1:1812 to 127.0.0.1:57910 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 141 with timestamp +47 Ready to process requests Please help me on that.Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2

(no subject)
by Somanath Mishra 29 Aug '18

29 Aug '18

Hi All, I have configured freeradius3. Now i am facing issue with radtest. I am getting Accept-Reject response. My request: radius3@radius3:~$ radtest testuser testpassword localhost 1812 testing123 Sent Access-Request Id 141 from 0.0.0.0:57910 to 127.0.0.1:1812 length 78 User-Name = "testuser" User-Password = "testpassword" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "testpassword" Received Access-Reject Id 141 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject radius DB: +----+--------------------+--------------------+----+--------------+ | id | username | attribute | op | value | +----+--------------------+--------------------+----+--------------+ | 1 | testuser | Cleartext-Password | := | testpassword | | 2 | testuser(a)gmail.com | Cleartext-Password | := | testpassword | | 3 | user(a)gmail.com | user-password | := | password | and my debug log: Ready to process requests (0) Received Access-Request Id 141 from 127.0.0.1:57910 to 127.0.0.1:1812 length 78 (0) User-Name = "testuser" (0) User-Password = "testpassword" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x8c4403cf542c7a3facd04010b82c4b76 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/defaul t (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALS E (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "testuser", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> testuser (0) sql: SQL-User-Name set to 'testuser' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE us ername = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE us ername = 'testuser' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User- Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'testuser' O RDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE userna me = 'testuser' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth -Type (0) pap: WARNING: Authentication will fail unless a "known good" password is ava ilable (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> testuser (0) sql: SQL-User-Name set to 'testuser' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet- Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testpassword', 'Access-Reject', '2018-08-29 08:26:50') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authda te) VALUES ( 'testuser', 'testpassword', 'Access-Reject', '2018-08-29 08:26:50') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> testuser (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 141 from 127.0.0.1:1812 to 127.0.0.1:57910 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 141 with timestamp +47 Ready to process requests Please help me on that.Thanks

1 1

Freeradius3 with PEAP and LDAP
by Carsten Schulze 29 Aug '18

29 Aug '18

Hi, I try to convert our freeradius2 setup to a new freeradius3 configuration. A setup with TTLS + PAP is working, but when I switch to PEAP I'll get the following output. Any idea, or a howto with a LDAP-Provider with NT-Hashes? radiusd: FreeRADIUS Version 3.0.12, for host x86_64-pc-linux-gnu, built on Aug 10 2017 at 07:05:06 (10) redundant { rlm_ldap (server1): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (server1): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (server1): Connecting to ldap://ldap1.DOMAIN:389 rlm_ldap (server1): Waiting for bind result... rlm_ldap (server1): Bind successful rlm_ldap (server1): Reserved connection (0) (10) server1: EXPAND (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(radiusaccessattribute=EDUROAM)) (10) server1: --> (&(uid=whans)(radiusaccessattribute=EDUROAM)) (10) server1: Performing search in "ou=user,DOMAIN" with filter "(&(uid=whans)(radiusaccessattribute=EDUROAM))", scope "sub" (10) server1: Waiting for search result... (10) server1: User object found at DN "uid=whans,ou=W,ou=Mitarbeiter,ou=User,DOMAIN" (10) server1: Processing user attributes (10) server1: control:NT-Password := 0x3144364643424433303630373744363633453233373735453535423346324535 rlm_ldap (server1): Released connection (0) rlm_ldap (server1): Need 2 more connections to reach 10 spares rlm_ldap (server1): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (server1): Connecting to ldap://ldap1.leuphana.de:389 rlm_ldap (server1): Waiting for bind result... rlm_ldap (server1): Bind successful (10) [server1] = updated (10) } # redundant = updated (10) [mschap] = noop (10) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes (10) pap: No User-Password attribute in the request. Cannot do PAP (10) [pap] = noop (10) } # authorize = updated (10) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (10) Failed to authenticate the user (10) Using Post-Auth-Type Reject Regrads Carsten

2 2

Freeradius + google authenticator + Cisco Anyconnect
by Charbel Soueid 28 Aug '18

28 Aug '18

Hi, I am new to freeradius and recently just deployed a freeradius server on ubuntu to authenticate our Cisco Anyconnect VPN users against using two authentication factor with google authenticator. My configs are in place and everything is working fine, users are able to connect using the radius password+google pin however I would like to restrict users access to a specific tunnel-group/split-tunnel on my ASA. I followed the below link for my config: https://www.petenetlive.com/KB/Article/0001256 I need to understand how to apply the specific attributes in my radius so I can pass them to my ASA Where and how should I apply the attributes "ASA-Group-Policy" and "ASA-IPsec-Split-Tunnel-List" ? Any sample config for radius and asa you can share? Regards

2 1

freeradius service start not working..
by Somanath Mishra 28 Aug '18

28 Aug '18

Hi All, I have configured freeradius. So after finish configuration when i started i got this error. Aug 28 15:21:59 radius3 freeradius[7330]: /etc/freeradius/sites-enabled/default[405]: Failed to find "sql" as a module or policy. Aug 28 15:21:59 radius3 freeradius[7330]: /etc/freeradius/sites-enabled/default[405]: Please verify that the configuration exists in /etc/freeradius/mods-enabled/sql. Aug 28 15:21:59 radius3 freeradius[7330]: /etc/freeradius/sites-enabled/default[273]: Errors parsing authorize section. Aug 28 15:21 I modified these linesin this file. sudo nano /etc/freeradius/mods-available/sql login = "freeradius" server="localhost" port=3306 password = "radius123" and uncommented read_clients = yes and client_table="nas" change database table configuration: radius_db="radius" and also in sudo nano /etc/freeradius/sites-enabled/default file all 4 sections(authorize,accounting,session,post-auth) sql are uncommented. What am I missing? Any suggestion highly appreciated

2 1

separately logging of multiple conditionals
by Bartek Chmielewski 28 Aug '18

28 Aug '18

Hello, Is is possible to include multiple separated linelog calls in different exceptions of single virtual server? Goal is to catch authenticated user-names, separately, depending on various addressed proxy servers (realms). I tried also detail.log pre_proxy_log, but it might be tedious to work with later on. Alternatively is there a way to write addressed proxy server to authentication log or linelog? Best regards, Bartek Chmielewski

2 1

Question on radgroupreply query
by J Kephart 27 Aug '18

27 Aug '18

We use FR in a hospitality environment, and user credentials are created dynamically. Because those credentials are set to expire after a preset period of time, we have a process that removes stale entries from the various tables. Otherwise, a user who reconnects after his session expires gets a reject, because FR returns the older attributes, rather than the newest ones. I have not reviewed the code (not an expert), but I wonder if by changing the query, adding "order by id desc," this situation might be remedied. Will that do the trick for us? Thanks, -- Jim

2 1

originate coa and rest
by JB 27 Aug '18

27 Aug '18

Hi! We've been using the REST module for authorization and accounting and would like to be able to originate CoA packets when receiving these acct requests. We've tried a couple of things but cannot figure out how to successfully combine 'update coa' with the rest module. I would be very thankful for any pointers. Cheers! JB

2 3

www.freeradius.org + subdomains, and wiki.freeradius.org down from 16:00EST for maintenance
by Arran Cudbard-Bell 25 Aug '18

25 Aug '18

Hi All, We're consolidating the infrastructure that runs the freeradius web presence. For relatively static hosts: - www.freeradius.org and subdomains - ftp.freeradius.org disruption should only be about 5 minutes (assuming everything goes to plan!). For hosts with dynamic content: - wiki.freeradius.org - git.freeradius.org - @freeradius.org email addresses disruption may be as long as an hour. This is because the VMs need to be shut down to prevent data loss and moved (copied) between virtualisation servers. The good news is the new virtualisation hosts are SAN backed, which means we (hopefully) won't go through the same level of disruption should a virtualisation host fail, or need to be replaced for some other reason at some point in the future. -Arran

1 0