- Freeradius-Users - lists.freeradius.org

EAP-TTLS certificates
by Tsirkas Georgios 26 Apr '18

26 Apr '18

Hello, Are certificates necessary using EAP-TTLS? Also clients certificates are installed only on Access-Points? Thank you!

2 1

ISSUE: Authentication will fail unless a "known good" password is available
by Somanath Mishra 26 Apr '18

26 Apr '18

Hi Team, I am facing issue with radtest. I am getting error like: Authentication will fail unless a "known good" password is available Below debug details: Received Access-Request Id 241 from 127.0.0.1:38747 to 127.0.0.1:1812 length 74 (3) User-Name = "test" (3) User-Password = "test123" (3) NAS-IP-Address = 127.0.1.1 (3) NAS-Port = 1812 (3) Message-Authenticator = 0x73b04566a900069b236e748aee43500c (3) # Executing section authorize from file /etc/freeradius/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "test", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: No EAP-Message, not doing EAP (3) [eap] = noop (3) [files] = noop (3) sql: EXPAND %{User-Name} (3) sql: --> test (3) sql: SQL-User-Name set to 'test' rlm_sql (sql): Closing connection (8): Hit idle_timeout, was idle for 141 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (9): Hit idle_timeout, was idle for 141 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (7): Hit idle_timeout, was idle for 141 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (10), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.22-0ubuntu0.16.04.1, protocol version 10 rlm_sql (sql): Reserved connection (10) (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (3) sql: User found in radcheck table (3) sql: Conditional check items matched, merging assignment check items (3) sql: User-Password := "test123" (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id (3) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (3) sql: --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (3) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (3) sql: User not found in any groups rlm_sql (sql): Released connection (10) Need 2 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (11), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.22-0ubuntu0.16.04.1, protocol version 10 (3) [sql] = ok (3) [expiration] = noop (3) [logintime] = noop (3) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (3) pap: WARNING: !!! Ignoring control:User-Password. Update your !!! (3) pap: WARNING: !!! configuration so that the "known good" clear text !!! (3) pap: WARNING: !!! password is in Cleartext-Password and NOT in !!! (3) pap: WARNING: !!! User-Password. !!! (3) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (3) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (3) pap: WARNING: Authentication will fail unless a "known good" password is available (3) [pap] = noop (3) } # authorize = ok (3) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (3) Failed to authenticate the user (3) Using Post-Auth-Type Reject (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) Post-Auth-Type REJECT { (3) sql: EXPAND .query (3) sql: --> .query (3) sql: Using query template 'query' rlm_sql (sql): Reserved connection (10) (3) sql: EXPAND %{User-Name} (3) sql: --> test (3) sql: SQL-User-Name set to 'test' (3) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (3) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test123', 'Access-Reject', '2018-04-26 20:51:05') (3) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test123', 'Access-Reject', '2018-04-26 20:51:05') (3) sql: SQL query returned: success (3) sql: 1 record(s) updated rlm_sql (sql): Released connection (10) (3) [sql] = ok (3) attr_filter.access_reject: EXPAND %{User-Name} (3) attr_filter.access_reject: --> test (3) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) [attr_filter.access_reject] = updated (3) [eap] = noop (3) policy remove_reply_message_if_eap { (3) if (&reply:EAP-Message && &reply:Reply-Message) { (3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) else { (3) [noop] = noop (3) } # else = noop (3) } # policy remove_reply_message_if_eap = noop (3) } # Post-Auth-Type REJECT = updated (3) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test/test123] (from client localhost port 1812) (3) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Sending delayed response (3) Sent Access-Reject Id 241 from 127.0.0.1:1812 to 127.0.0.1:38747 length 20 Waking up in 3.9 seconds. (3) Cleaning up request packet ID 241 with timestamp +264 Ready to process requests Please help me on that.

2 1

What is the recommended way of overriding a mod file like "realm"
by Nick Howitt 26 Apr '18

26 Apr '18

The reason I am asking is because domain logins are appearing as "user/machine.domain". I can make it work by adding a realm in proxy.conf (or a parallel file and adding an INCLUDE in radius.conf): realm "~(.*\.)*domain$" { } But I also either have to change the delimiter in the "realm suffix" section of /etc/raddb/mods-available/realm from "@" to "/" which means the file is non non-standard or I have a couple of choices of adding a block: realm realmclearos { format = suffix delimiter = "/" } at the bottom /etc/raddb/mods-available/realm or in its own file in mods-available and symlinking to it from mods-enabled, but then, either way, I also have to add a line "realmclearos" in /etc/raddb/sites-available/default around the line saying "suffix" which makes /etc/raddb/sites-available/default non-standard. There is a fair push on the mailing lists of keeping things standard and I am wondering what is the best direction - or is my solution completely wrong. Thanks, Nick

2 1

having trouble connecting EAP-PEAP
by Carlito Nueno 26 Apr '18

26 Apr '18

hi all, I am not able to connect to any device, iOS, mac os, or linux to EAP-PEAP I used `/etc/raddb/certs/ make` script to generate certificates. I copied the `ca.pem` file to mac OS and installed it. Any advice? using freeradius on docker with alpine linux - FreeRADIUS Version 3.0.15 - OpenSSL 1.0.2o Changes made: /etc/raddb/mods-enabled/eap: default_eap_type = peap /etc/raddb/mods-enabled/mschap use_mppe = yes require_encryption = yes require_strong = yes /etc/raddb/sites-enabled/default # Allow EAP authentication. eap /etc/raddb/sites-enabled/inner-tunnel eap { ok = return } # Allow EAP authentication. eap radius.log Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 58659 Listening on proxy address :: port 46908 Ready to process requests Thread 1 waiting to be assigned a request Thread 5 waiting to be assigned a request Thread 4 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread 2 waiting to be assigned a request Threads: total/active/spare threads = 5/0/5 Waking up in 0.3 seconds. Thread 5 got semaphore Thread 5 handling request 1, (1 handled so far) (1) Received Access-Request Id 7 from 192.168.2.181:40873 to 172.18.0.2:1812 length 190 (1) User-Name = "test" (1) Called-Station-Id = "22-B5-8F-99-AC-00:test11radius" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) NAS-Port = 1 (1) Calling-Station-Id = "11-11-33-23-FC-33" (1) Connect-Info = "CONNECT 54Mbps 802.11a" (1) Acct-Session-Id = "BA289D333A540806" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027076 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x02bc00090174657374 (1) Message-Authenticator = 0xdb1db3b502505a24e81043b7239ef87e (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) files: users: Matched entry test at line 1 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: No User-Password attribute in the request. Cannot do PAP (1) [pap] = noop (1) } # authorize = ok (1) WARNING: Please update your configuration, and remove 'Auth-Type = Local' (1) WARNING: Use the PAP or CHAP modules instead (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> test (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Thread 5 waiting to be assigned a request Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 7 from 172.18.0.2:1812 to 192.168.2.181:40873 length 20 logs on access point: hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: Sending EAP Packet (identifier 188) hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: received EAP packet (code=2 id=188 len=9) from STA: EAP Response-Identity (1) hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: STA identity 'test' hostapd: wlan0-ap: RADIUS Sending RADIUS message to authentication server hostapd: wlan0-ap: RADIUS Next RADIUS client retransmit in 3 seconds hostapd: wlan0-ap: RADIUS Received 20 bytes from RADIUS server hostapd: wlan0-ap: RADIUS Received RADIUS message hostapd: wlan0-ap: STA 11-11-33-23-FC-33 RADIUS: Received RADIUS packet matched with a pending request, round trip time 1.00 sec hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: could not extract EAP-Message from RADIUS message Thanks

3 3

Google authenticator : Access-Reject
by servernemesis＠tutanota.com 25 Apr '18

25 Apr '18

Hello, I followed this tutorial (https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and… <https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and…>) and managed to get it running on Debian 9 with FR 3.0.12 thanks to the help here. But I have another issue : when I try to authenticate with password + googleauth code, I got rejected. I'm able to log on the FR server with domain credentials without problem. The google auth code gets generated without issue either. Radtest: radtest user(a)mydomain.com <mailto:user@mydomain.com> password123456 localhost 18120 testing123 Sent Access-Request Id 226 from 0.0.0.0:38763 to 127.0.0.1:1812 length 92 User-Name = "user(a)mydomain.com <mailto:user@mydomain.com>" User-Password = "password123456" NAS-IP-Address = 127.0.1.1 NAS-Port = 18120 Message-Authenticator = 0x00 Cleartext-Password = "password123456" Received Access-Reject Id 226 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject Log: Ready to process requests Waking up in 0.3 seconds. (0) Received Access-Request Id 226 from 127.0.0.1:38763 to 127.0.0.1:1812 length 92 (0) User-Name = "user(a)mydomain.com <mailto:user@mydomain.com>" (0) User-Password = "password123456" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 18120 (0) Message-Authenticator = 0x53b836642c653e776b0d9f8a542fca3a (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Waking up in 0.3 seconds. Waking up in 0.2 seconds. (0) pam: ERROR: pam_authenticate failed: Authentication failure (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Waking up in 0.7 seconds. (0) Sent Access-Reject Id 226 from 127.0.0.1:1812 to 127.0.0.1:38763 length 20 Waking up in 3.9 seconds. Ready to process requests Regards

3 30

facing issue with Nas configuration..
by Somanath Mishra 25 Apr '18

25 Apr '18

Hi team, i configured Freeradius version3 with ubuntu 16 server. also configured all files. but i am facing issue when i am trying radius.net client.so error screenshot i have added. I am confisued with NAS config in clients.conf file. radiusclient i am calling from my local system.so my configuration is like client user-PC { ipaddr = my radius ip secret = xxxxxxxxxx } Please help me on that.

4 5

Failed to connect Freeradius to OpenLDAP
by Tsirkas Georgios 25 Apr '18

25 Apr '18

Hello, I am trying to use ldap module. But failed to connect.... With SSL // /Wed Apr 25 13:47:07 2018 : Info: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used// //Wed Apr 25 13:47:07 2018 : Debug: rlm_ldap (ldap): Connecting to ldap://ldap-server:636// //Wed Apr 25 13:47:07 2018 : Debug: rlm_ldap (ldap): New libldap handle 0x55de89593c20// //TLS: can't connect: (unknown error code).// //Wed Apr 25 13:47:08 2018 : Error: rlm_ldap (ldap): Bind with cn=admin,dc=mydomain,dc=gr to ldap://ldap-server:636 failed: Can't contact LDAP server// //Wed Apr 25 13:47:08 2018 : Debug: rlm_ldap: Closing libldap handle 0x55de89593c20// //Wed Apr 25 13:47:08 2018 : Error: rlm_ldap (ldap): Opening connection failed (0)// //Wed Apr 25 13:47:08 2018 : Debug: rlm_ldap (ldap): Removing connection pool// //Wed Apr 25 13:47:08 2018 : Error: /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap"/ Without SSL Wed Apr 25 13:51:52 2018 : Info: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): Connecting to ldap://ldap-server:389 Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): New libldap handle 0x55f00a1e4c20 Wed Apr 25 13:51:52 2018 : Error: rlm_ldap (ldap): Bind with cn=admin,dc=mydomain,dc=gr to ldap://ldap-server:389 failed: Can't contact LDAP server Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap: Closing libldap handle 0x55f00a1e4c20 Wed Apr 25 13:51:52 2018 : Error: rlm_ldap (ldap): Opening connection failed (0) Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): Removing connection pool Wed Apr 25 13:51:52 2018 : Error: /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" Any ideas? I am using Freeradius 3.0.12 with Debian....

2 1

radius.log into filebeat
by Alex Sharaz 25 Apr '18

25 Apr '18

What might be the best way to get . the contents of radius.log into filebeat? I'm already generating a suitable detail log file that the filebeat client processes to push radius acct/auth info into our logstash service ? Rgds alex p.s. 3.0.17

3 2

Freeradius 3 and empty password from authorization
by chose 24 Apr '18

24 Apr '18

Good morning, I couldn't authorize over my radius, when I run it with debug, I see that user password is empty: (23) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=domain.tld --username=%{Stripped-User-Name} --password=%{User-Password}: (23) ntlm_auth: EXPAND --username=%{Stripped-User-Name} (23) ntlm_auth: --> --username=user (23) ntlm_auth: EXPAND --password=%{User-Password} (23) ntlm_auth: --> --password= (23) ntlm_auth: ERROR: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)' (23) [ntlm_auth] = reject (23) } # if (&User-Name =~ /(a)domain.tld/ || &User-Name =~ /(a)domain.tld/) = reject (23) } # authorize = reject (23) Invalid user (ntlm_auth: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)'): [user] (from client controler2 port 13 cli 86-e8-4f-43-5c-9b) (23) Using Post-Auth-Type Reject User is not empty. When I try to authorize ntlm_auth from bash, all is OK (NT_STATUS_OK: Success (0x0)) What did I missed ? Thanks and best regards J.Karliak -- Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a DomainKeys/DKIM (s ADSP) a implementaci DMARC. Pokud mate problemy s dorucenim emailu, zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji. My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP) policy and implementation of the DMARC. If you've problem with sending emails to me, start using email origin methods mentioned above. Thank you.

4 5

RE: Multiple Radius Group Name
by Angel Elena 23 Apr '18

23 Apr '18

Ok, thanks -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ www.linkedin.com/in/angel-elena-medina -------------------------------- Zarafa Webapp. -----Mensaje original----- De: Alan DeKok <aland(a)deployingradius.com> Enviado: Lun 23-04-2018 19:01 Asunto: Re: Multiple Radius Group Name Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>; > On Apr 23, 2018, at 12:20 PM, Angel Elena <craem(a)craem.net> wrote: > > > > I have a freeradius 2.2.5 in a debian 8 box with an OpenLdap database. > > You should really upgrade to 2.2.10 at least. It takes about 10 minutes. > > > A simple query: > > > > angel.elena@bulma:/etc/freeradius$ radtest angel.elena password > localhost:1812 0 testing123 > > We don't need to see the output of radclient. > > http://wiki.freeradius.org/list-help > > > Mikrotik group is a mapped attribute in a ldap.attrmap file and works fine: > > > > replyItem Mikrotik-Group radiusGroupName\ > > See the comments at the top of that file. If the comments aren't there, > someone probably deleted them. > > Or, install 2.2.10, and look at the comments at the top of ldap.attrmap in > the source file. > > > Is possible specify two radiusGroupName in a simple reply or any idea to set > this setup ? > > Yes. It's documented in that file. You need to set the operator to "+=" > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0