- Freeradius-Users - lists.freeradius.org

FreeRADIUS and radiusCheckItem
by Gianluca Gerunda 24 Jul '18

24 Jul '18

Hi all, first of all sorry if the question has been already treated, but I haven't found nothing about it. So, I successfully configured a FreeRADIUS 3 with an OpenLDAP 2.4 as backend and, luckily, all works fine: I can authenticate users from their clients, with some specific return-attribute and all that configuration is stored on Ldap. Now I'd like to check user's check-attributes list, storing them also on Ldap with the others user attributes: I tried to play with radiusCheckItem attribute, but surely I'm losing some piece around.... Can someone help me? An example configuration or a good link are enough. Thanks for your time, Gianluca -- /*GERUNDA Gianluca* System Engineer Xech s.r.l. Via Ajraghi, 30 20156 Milano (Italy) Mob.: +39 347 8318200 E-mail: ggerunda(a)xech.it / *IMPORTANTE*: il contenuto di questa e-mail e degli eventuali allegati, è strettamente confidenziale e destinato alla/e persona/e a cui è indirizzato. Se avete ricevuto per errore questa e-mail, Vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail, potr´ essere perseguito ai sensi di legge. *IMPORTANT*: The contents of this email, and any attachments, are CONFIDENTIAL and intended only for the person(s) to whom they are addressed. If you have received the email in error please notify the sender immediately and delete it from your computer system. Do not copy or distribute it or disclose its contents to any person. Any improper use of the contents of this email will be prosecuted by law.

2 1

Radius with Google Authenticator/LDAP
by Daniel Lumb 24 Jul '18

24 Jul '18

Hi all, First time using FreeRadius so apologies if these aren’t great questions but I’ve done a fair amount of internet trawling and haven’t found anything that addresses my issue. So, I’m looking to configure FreeRadius as an authentication source for a Cisco VPN with 2FA. I’d like to use Google authenticator for the second factor. There are plenty of guides on integrating Google authenticator with FreeRadius, which appear to point FreeRadius to use PAM and then add the Google authenticator config to the Radius PAM stack. In all of these examples, the OTP code must be entered on the end of the user password in the same input field, which is fine. The issue is that all of these examples use local linux users in the PAM stack, like this: #@include common-auth #@include common-account #@include common-password #@include common-session auth requisite pam_google_authenticator.so forward_pass auth required pam_unix.so use_first_pass I currently have Radius setup to authenticate against LDAP (Through the FreeRadius config itself, nothing to do with PAM) - is there a way that I can use the LDAP account as a the second part of this 2FA rather than a local account? It seems that it will have to involve PAM because as part of the google authenticator setup you have to tell FreeRadius to use PAM in the authorize/authenticate config. Any advice? Is it just a case of picking a different source for the OTP that is better integrated with FreeRadius? Thanks, Dan

2 1

Configuring Freeradius to keep a local copy of accounting records and send a copy to a remote server
by Frank Godek 24 Jul '18

24 Jul '18

Hi Everyone, I've used Radius for many, many years but have not had to worry about the accounting records until now. I have a client that is going to provide authentication for a remote partner organization. They will be billing them based on both having their clients connect and also, to some extent, on how much data the partner's clients use. The remote partner needs to get accounting records in order for them to make payment. At the same time, my client wants copies of the records so they can verify that they are getting paid correctly. I setup a new FreeRadius server for this purpose so I'm running 3.0.17 on Ubuntu 16.04. In the wireless APs that are providing service, I can easily set two accounting servers but, as has been the case since I started using Radius, the secondary server is a fallback for the primary not a location where duplicate entries are sent. I have tried setting up a realm that points to the remote partner and to use the copy-acct-to-home-server module. That worked great as far as sending the records to the remote partner but I could see that what it was doing was renaming the details file, transferring the contents of that file to the remote server, and then deleting the renamed details file. Of course, that left me without details on the local server. So, what's the best and/or easiest way for me to keep a copy locally? Do I need to define a virtual server and setup a home-server-pool with the remote server? I looked at that but it seemed that the home-server-pools were either setup for either load balancing or failover. I don't want either. I want a copy of every record to stay local AND be sent to the remote server. Thank you in advance for your help. I've been reading through the docs and also online examples but haven't found much that was very clear on this setup. Frank Godek

3 2

raddebug
by Bassem Mettichi 23 Jul '18

23 Jul '18

Hello, i would like to konw if the use of raddebug and radmin on a production environnement is safe or no? is the use of radmin can make security problems for the server? Thanks Mettichi Bassem

2 1

Problem with ntlm_auth between freeradius 3.0 and Samba 4 AD
by Benjamin DUPALUT 23 Jul '18

23 Jul '18

Hello, First of all, sorry for my english if there is some mistakes. I'm trying to set up an authentication between a freeradius 3.0 server and a Samba 4 AD using ntlm_auth. I apply the configuration from deployingradius.com/documents/configuration/active_directory.html but i got an error when testing with the "radtest -t mschap user passwd 127.0.0.1 0 testing123" command. Here is the issue of the freeradius -X debug : (11) Received Access-Request Id 115 from 127.0.0.1:60705 to 127.0.0.1:1812 length 143 (11) User-Name = "dupalutb(a)esiee.fr" (11) NAS-IP-Address = 127.0.1.1 (11) NAS-Port = 0 (11) Message-Authenticator = 0xe7c32a18a131310841e6f149e528647b (11) MS-CHAP-Challenge = 0x9aa1c8732f3e45a9 (11) MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000c93d69617f9ccbf98d1b673b2d75a401034e14ac56100964 (11) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/eduroam (11) authorize { (11) if (!(User-Name =~ /@/)){ (11) if (!(User-Name =~ /@/)) -> FALSE (11) if (User-Name =~ /@$/){ (11) if (User-Name =~ /@$/) -> FALSE (11) if (User-Name =~ /@.+?@/){ (11) if (User-Name =~ /@.+?@/) -> FALSE (11) if (User-Name =~ /@.+?[^[:alnum:]\\.-]/){ (11) if (User-Name =~ /@.+?[^[:alnum:]\\.-]/) -> FALSE (11) if (User-Name =~ /(a)[\\.-]/){ (11) if (User-Name =~ /(a)[\\.-]/) -> FALSE (11) if (User-Name =~ /@.+?[\\.-]$/){ (11) if (User-Name =~ /@.+?[\\.-]$/) -> FALSE (11) if (User-Name =~ /(a)[^\\.]+$/){ (11) if (User-Name =~ /(a)[^\\.]+$/) -> FALSE (11) if (User-Name =~ /@.+?\\.\\./){ (11) if (User-Name =~ /@.+?\\.\\./) -> FALSE (11) if (User-Name =~ /(a)myabc\\.com$/i){ (11) if (User-Name =~ /(a)myabc\\.com$/i) -> FALSE (11) if (User-Name =~ /@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i){ (11) if (User-Name =~ /@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i) -> FALSE (11) if (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i){ (11) if (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE (11) if (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i){ (11) if (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE (11) if (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i){ (11) if (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE (11) if (User-Name =~ /(a)\\.?ac\\.uk$/i){ (11) if (User-Name =~ /(a)\\.?ac\\.uk$/i) -> FALSE (11) if (User-Name =~ /@.+?\\.ax\\.uk$/i){ (11) if (User-Name =~ /@.+?\\.ax\\.uk$/i) -> FALSE (11) [preprocess] = ok (11) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (11) auth_log: --> /var/log/freeradius/radacct/ 127.0.0.1/auth-detail-20180703 (11) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20180703 (11) auth_log: EXPAND %t (11) auth_log: --> Tue Jul 3 17:36:31 2018 (11) [auth_log] = ok (11) policy operator-name.authorize { (11) if ("%{client:Operator-Name}") { (11) EXPAND %{client:Operator-Name} (11) --> (11) if ("%{client:Operator-Name}") -> FALSE (11) } # policy operator-name.authorize = ok (11) policy cui.authorize { (11) if ("%{client:add_cui}" == 'yes') { (11) EXPAND %{client:add_cui} (11) --> (11) if ("%{client:add_cui}" == 'yes') -> FALSE (11) } # policy cui.authorize = ok (11) [chap] = noop (11) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (11) [mschap] = ok (11) [digest] = noop (11) suffix: Checking for suffix after "@" (11) suffix: Looking up realm "esiee.fr" for User-Name = "dupalutb(a)esiee.fr" (11) suffix: Found realm "esiee.fr" (11) suffix: Adding Stripped-User-Name = "dupalutb" (11) suffix: Adding Realm = "esiee.fr" (11) suffix: Authentication realm is LOCAL (11) [suffix] = ok (11) eap: No EAP-Message, not doing EAP (11) [eap] = noop (11) files: users: Matched entry DEFAULT at line 1 (11) [files] = ok (11) [expiration] = noop (11) [logintime] = noop (11) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (11) pap: WARNING: Authentication will fail unless a "known good" password is available (11) [pap] = noop (11) } # authorize = ok (11) Found Auth-Type = mschap (11) # Executing group from file /etc/freeradius/3.0/sites-enabled/eduroam (11) authenticate { (11) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (11) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (11) mschap: Client is using MS-CHAPv1 with NT-Password (11) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (11) mschap: ERROR: MS-CHAP2-Response is incorrect (11) [mschap] = reject (11) } # authenticate = reject (11) Failed to authenticate the user (11) Using Post-Auth-Type Reject (11) # Executing group from file /etc/freeradius/3.0/sites-enabled/eduroam (11) Post-Auth-Type REJECT { (11) attr_filter.access_reject: EXPAND %{User-Name} (11) attr_filter.access_reject: --> dupalutb(a)esiee.fr (11) attr_filter.access_reject: Matched entry DEFAULT at line 11 (11) [attr_filter.access_reject] = updated (11) [eap] = noop (11) policy remove_reply_message_if_eap { (11) if (&reply:EAP-Message && &reply:Reply-Message) { (11) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (11) else { (11) [noop] = noop (11) } # else = noop (11) } # policy remove_reply_message_if_eap = noop (11) } # Post-Auth-Type REJECT = updated (11) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (11) Sending delayed response (11) Sent Access-Reject Id 115 from 127.0.0.1:1812 to 127.0.0.1:60705 length 61 (11) MS-CHAP-Error = "\000E=691 R=1 C=32c072eb4937c259 V=2" Waking up in 3.9 seconds. (11) Cleaning up request packet ID 115 with timestamp +545 It seems that radius try to use mschap authentication method instead of ntlm_auth. Where did i make a mistake ? Thanks in advance for your suggestions. Regards , *Benjamin Dupalut* Administrateur système et réseau Service des Moyens Informatiques Généraux (SMIG) ESIEE Paris 2 bd Blaise Pascal - 93162 Noisy-le-Grand Cedex T : +33 1 45 92 66 17 benjamin.dupalut(a)esiee.fr www.esiee.fr / www.cci-paris-idf.fr

4 10

LDAP and AD authentication on the same FreeRadius server
by Denis CLAVIER 23 Jul '18

23 Jul '18

Hi, I am trying to set up a FreeRadius server for a VPN connection used by users stored in an LDAP or in an AD. I succeeded to authenticate on LDAP and on AD separately with the two following radtest commands : LDAP : radtest dclavier "password" localhost 0 testing123 AD : radtest -t mschap dclavier "Password1234*" localhost 0 testing123 However, I would like to configure the FreeRadius server to authenticate users on LDAP or AD, based on the realm. For example, user dclavier(a)ldap.com should use ldap authentication, and dclavier(a)ad.com should use mschap authentication (or ntlm_auth) without specifying which method to use. So, I would like FreeRadius to choose the right Auth-Type according to the realm. At least, I would like FreeRadius to try the second auth-type if the first failed. I looked at the proxy.conf file to perform what I want, but I can't find how to specify the auth type for each realm. So I would like to know if it is possible to perform authentication for users from LDAP and users from AD with only one FreeRadius server. If yes, I would be happy if you can suggest how to do it. Regards, Denis CLAVIER

2 2

eap_peap: We sent a success, but the client did not agree [FreeRadius + samba4 AD + dynamic vlans]
by Elias Pereira 23 Jul '18

23 Jul '18

Hello guys, At first everything is ok with the settings. I made internal tests with radtest and the authentication of a domain user is done correctly. I also tested with pfsense's captiveportal and it worked correctly. We have a wifi controller from the motorola and created a ssid and set the AAA profile as it showed in the extreme support itself. After trying to connect via mobile with android, the following error occurs: Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: [eaptls process] = ok Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Session established. Decoding tunneled attributes Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: PEAP state send tlv success Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Received EAP-TLV response Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Client rejected our response. The password is probably incorrect *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but the client did not agree* *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed* Wed Jul 18 14:44:25 2018 : Debug: (71) eap: Sending EAP Failure (code 4) ID 12 length 4 Wed Jul 18 14:44:25 2018 : Debug: (71) eap: Failed in EAP select Wed Jul 18 14:44:25 2018 : Debug: (71) modsingle[authenticate]: returned from eap (rlm_eap) Wed Jul 18 14:44:25 2018 : Debug: (71) [eap] = invalid Wed Jul 18 14:44:25 2018 : Debug: (71) } # authenticate = invalid Wed Jul 18 14:44:25 2018 : Debug: (71) Failed to authenticate the user Wed Jul 18 14:44:25 2018 : Debug: (71) Using Post-Auth-Type Reject Wed Jul 18 14:44:25 2018 : Debug: (71) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Wed Jul 18 14:44:25 2018 : Debug: (71) Post-Auth-Type REJECT { Wed Jul 18 14:44:25 2018 : Debug: (71) modsingle[post-auth]: calling ldap (rlm_ldap) https://pastebin.com/raw/Nzki0y1d (sites-enable/default and inner-tunnel Has anyone ever had this problem? -- Elias Pereira

2 6

Use Max-Daily-Session But Timeout Session every 30mins if limit not reached
by Uchenna Nebedum 22 Jul '18

22 Jul '18

Good Day All, I am using dailycounter for Max-Daily-Session but i still want to timeout user session every 30mins till Max-Daily-Session reached. A way i thought to achieve this would be to add unlang after dailycounter in the conf, something like (if reply Session-Timeout > 1800){ Session-Timeout := 1800 } I'm not sure if this method would work and not sure of the implications. Not too sure of what the unlang should look like. Please any help would be greatly appreciated. Uchenna Nebedum

2 3

Cache TTL and Cache-Status-Only
by work vlpl 21 Jul '18

21 Jul '18

Hello, judging by the rlm_cache module code, Freeradius will not update cache TTL for cache records. Am I right? Also is it possible to show current cache TTL in debug output? I tried to do this "%{control:Cache-TTL}" but it was expanded in an empty string.

3 2

ca_file and refresh mechanism
by Henti Smith 20 Jul '18

20 Jul '18

Good day. I'm trying to find information on how freeradius handles updating of the ca_file during operational use. If a revocation has taken place and the ca_file was updated, do I need to restart the daemon, or will it re-read the file for any new requests, hence not needing to restarted the daemon? Regards Henti -- --

2 2