- Freeradius-Users - lists.freeradius.org

having trouble connecting EAP-PEAP
by Carlito Nueno 26 Apr '18

26 Apr '18

hi all, I am not able to connect to any device, iOS, mac os, or linux to EAP-PEAP I used `/etc/raddb/certs/ make` script to generate certificates. I copied the `ca.pem` file to mac OS and installed it. Any advice? using freeradius on docker with alpine linux - FreeRADIUS Version 3.0.15 - OpenSSL 1.0.2o Changes made: /etc/raddb/mods-enabled/eap: default_eap_type = peap /etc/raddb/mods-enabled/mschap use_mppe = yes require_encryption = yes require_strong = yes /etc/raddb/sites-enabled/default # Allow EAP authentication. eap /etc/raddb/sites-enabled/inner-tunnel eap { ok = return } # Allow EAP authentication. eap radius.log Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 58659 Listening on proxy address :: port 46908 Ready to process requests Thread 1 waiting to be assigned a request Thread 5 waiting to be assigned a request Thread 4 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread 2 waiting to be assigned a request Threads: total/active/spare threads = 5/0/5 Waking up in 0.3 seconds. Thread 5 got semaphore Thread 5 handling request 1, (1 handled so far) (1) Received Access-Request Id 7 from 192.168.2.181:40873 to 172.18.0.2:1812 length 190 (1) User-Name = "test" (1) Called-Station-Id = "22-B5-8F-99-AC-00:test11radius" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) NAS-Port = 1 (1) Calling-Station-Id = "11-11-33-23-FC-33" (1) Connect-Info = "CONNECT 54Mbps 802.11a" (1) Acct-Session-Id = "BA289D333A540806" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027076 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x02bc00090174657374 (1) Message-Authenticator = 0xdb1db3b502505a24e81043b7239ef87e (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) files: users: Matched entry test at line 1 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: No User-Password attribute in the request. Cannot do PAP (1) [pap] = noop (1) } # authorize = ok (1) WARNING: Please update your configuration, and remove 'Auth-Type = Local' (1) WARNING: Use the PAP or CHAP modules instead (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> test (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Thread 5 waiting to be assigned a request Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 7 from 172.18.0.2:1812 to 192.168.2.181:40873 length 20 logs on access point: hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: Sending EAP Packet (identifier 188) hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: received EAP packet (code=2 id=188 len=9) from STA: EAP Response-Identity (1) hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: STA identity 'test' hostapd: wlan0-ap: RADIUS Sending RADIUS message to authentication server hostapd: wlan0-ap: RADIUS Next RADIUS client retransmit in 3 seconds hostapd: wlan0-ap: RADIUS Received 20 bytes from RADIUS server hostapd: wlan0-ap: RADIUS Received RADIUS message hostapd: wlan0-ap: STA 11-11-33-23-FC-33 RADIUS: Received RADIUS packet matched with a pending request, round trip time 1.00 sec hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: could not extract EAP-Message from RADIUS message Thanks

3 3

Google authenticator : Access-Reject
by servernemesis＠tutanota.com 25 Apr '18

25 Apr '18

Hello, I followed this tutorial (https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and… <https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and…>) and managed to get it running on Debian 9 with FR 3.0.12 thanks to the help here. But I have another issue : when I try to authenticate with password + googleauth code, I got rejected. I'm able to log on the FR server with domain credentials without problem. The google auth code gets generated without issue either. Radtest: radtest user(a)mydomain.com <mailto:user@mydomain.com> password123456 localhost 18120 testing123 Sent Access-Request Id 226 from 0.0.0.0:38763 to 127.0.0.1:1812 length 92 User-Name = "user(a)mydomain.com <mailto:user@mydomain.com>" User-Password = "password123456" NAS-IP-Address = 127.0.1.1 NAS-Port = 18120 Message-Authenticator = 0x00 Cleartext-Password = "password123456" Received Access-Reject Id 226 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject Log: Ready to process requests Waking up in 0.3 seconds. (0) Received Access-Request Id 226 from 127.0.0.1:38763 to 127.0.0.1:1812 length 92 (0) User-Name = "user(a)mydomain.com <mailto:user@mydomain.com>" (0) User-Password = "password123456" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 18120 (0) Message-Authenticator = 0x53b836642c653e776b0d9f8a542fca3a (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Waking up in 0.3 seconds. Waking up in 0.2 seconds. (0) pam: ERROR: pam_authenticate failed: Authentication failure (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Waking up in 0.7 seconds. (0) Sent Access-Reject Id 226 from 127.0.0.1:1812 to 127.0.0.1:38763 length 20 Waking up in 3.9 seconds. Ready to process requests Regards

3 30

facing issue with Nas configuration..
by Somanath Mishra 25 Apr '18

25 Apr '18

Hi team, i configured Freeradius version3 with ubuntu 16 server. also configured all files. but i am facing issue when i am trying radius.net client.so error screenshot i have added. I am confisued with NAS config in clients.conf file. radiusclient i am calling from my local system.so my configuration is like client user-PC { ipaddr = my radius ip secret = xxxxxxxxxx } Please help me on that.

4 5

Failed to connect Freeradius to OpenLDAP
by Tsirkas Georgios 25 Apr '18

25 Apr '18

Hello, I am trying to use ldap module. But failed to connect.... With SSL // /Wed Apr 25 13:47:07 2018 : Info: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used// //Wed Apr 25 13:47:07 2018 : Debug: rlm_ldap (ldap): Connecting to ldap://ldap-server:636// //Wed Apr 25 13:47:07 2018 : Debug: rlm_ldap (ldap): New libldap handle 0x55de89593c20// //TLS: can't connect: (unknown error code).// //Wed Apr 25 13:47:08 2018 : Error: rlm_ldap (ldap): Bind with cn=admin,dc=mydomain,dc=gr to ldap://ldap-server:636 failed: Can't contact LDAP server// //Wed Apr 25 13:47:08 2018 : Debug: rlm_ldap: Closing libldap handle 0x55de89593c20// //Wed Apr 25 13:47:08 2018 : Error: rlm_ldap (ldap): Opening connection failed (0)// //Wed Apr 25 13:47:08 2018 : Debug: rlm_ldap (ldap): Removing connection pool// //Wed Apr 25 13:47:08 2018 : Error: /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap"/ Without SSL Wed Apr 25 13:51:52 2018 : Info: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): Connecting to ldap://ldap-server:389 Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): New libldap handle 0x55f00a1e4c20 Wed Apr 25 13:51:52 2018 : Error: rlm_ldap (ldap): Bind with cn=admin,dc=mydomain,dc=gr to ldap://ldap-server:389 failed: Can't contact LDAP server Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap: Closing libldap handle 0x55f00a1e4c20 Wed Apr 25 13:51:52 2018 : Error: rlm_ldap (ldap): Opening connection failed (0) Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): Removing connection pool Wed Apr 25 13:51:52 2018 : Error: /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" Any ideas? I am using Freeradius 3.0.12 with Debian....

2 1

radius.log into filebeat
by Alex Sharaz 25 Apr '18

25 Apr '18

What might be the best way to get . the contents of radius.log into filebeat? I'm already generating a suitable detail log file that the filebeat client processes to push radius acct/auth info into our logstash service ? Rgds alex p.s. 3.0.17

3 2

Freeradius 3 and empty password from authorization
by chose 24 Apr '18

24 Apr '18

Good morning, I couldn't authorize over my radius, when I run it with debug, I see that user password is empty: (23) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=domain.tld --username=%{Stripped-User-Name} --password=%{User-Password}: (23) ntlm_auth: EXPAND --username=%{Stripped-User-Name} (23) ntlm_auth: --> --username=user (23) ntlm_auth: EXPAND --password=%{User-Password} (23) ntlm_auth: --> --password= (23) ntlm_auth: ERROR: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)' (23) [ntlm_auth] = reject (23) } # if (&User-Name =~ /(a)domain.tld/ || &User-Name =~ /(a)domain.tld/) = reject (23) } # authorize = reject (23) Invalid user (ntlm_auth: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)'): [user] (from client controler2 port 13 cli 86-e8-4f-43-5c-9b) (23) Using Post-Auth-Type Reject User is not empty. When I try to authorize ntlm_auth from bash, all is OK (NT_STATUS_OK: Success (0x0)) What did I missed ? Thanks and best regards J.Karliak -- Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a DomainKeys/DKIM (s ADSP) a implementaci DMARC. Pokud mate problemy s dorucenim emailu, zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji. My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP) policy and implementation of the DMARC. If you've problem with sending emails to me, start using email origin methods mentioned above. Thank you.

4 5

RE: Multiple Radius Group Name
by Angel Elena 23 Apr '18

23 Apr '18

Ok, thanks -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ www.linkedin.com/in/angel-elena-medina -------------------------------- Zarafa Webapp. -----Mensaje original----- De: Alan DeKok <aland(a)deployingradius.com> Enviado: Lun 23-04-2018 19:01 Asunto: Re: Multiple Radius Group Name Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>; > On Apr 23, 2018, at 12:20 PM, Angel Elena <craem(a)craem.net> wrote: > > > > I have a freeradius 2.2.5 in a debian 8 box with an OpenLdap database. > > You should really upgrade to 2.2.10 at least. It takes about 10 minutes. > > > A simple query: > > > > angel.elena@bulma:/etc/freeradius$ radtest angel.elena password > localhost:1812 0 testing123 > > We don't need to see the output of radclient. > > http://wiki.freeradius.org/list-help > > > Mikrotik group is a mapped attribute in a ldap.attrmap file and works fine: > > > > replyItem Mikrotik-Group radiusGroupName\ > > See the comments at the top of that file. If the comments aren't there, > someone probably deleted them. > > Or, install 2.2.10, and look at the comments at the top of ldap.attrmap in > the source file. > > > Is possible specify two radiusGroupName in a simple reply or any idea to set > this setup ? > > Yes. It's documented in that file. You need to set the operator to "+=" > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

PAM missing in FreeRadius 3 w/ Debian 9
by servernemesis＠tutanota.com 23 Apr '18

23 Apr '18

Hello, I just installed FreeRadius 3.0.12 on Stretch in order to provide a Google Authenticator gateway (https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and… <https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and…>), but I'm unable to start the FreeRadius service, here is the debug log : Mon Apr 23 14:23:59 2018 : Debug: # Loading session {...} Mon Apr 23 14:23:59 2018 : Debug: radutmp Mon Apr 23 14:23:59 2018 : Debug: # Loading post-proxy {...} Mon Apr 23 14:23:59 2018 : Debug: eap Mon Apr 23 14:23:59 2018 : Debug: # Loading post-auth {...} Mon Apr 23 14:23:59 2018 : Debug: } # server inner-tunnel Mon Apr 23 14:23:59 2018 : Debug: server default { # from file /etc/freeradius/3.0/sites-enabled/default Mon Apr 23 14:23:59 2018 : Debug: # Loading authenticate {...} Mon Apr 23 14:23:59 2018 : Debug: mschap Mon Apr 23 14:23:59 2018 : Debug: digest Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[489]: Failed to find "pam" as a module or policy. Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[489]: Please verify that the configuration exists in /etc/freeradius/3.0$ Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[452]: Errors parsing authenticate section. Of course there is no "/etc/freeradius/3.0/mods-enabled/pam" Someone had the same problem with Ubuntu 17.10 and FreeRadius 3 before reverting to an older version (https://enterpriseadmins.org/blog/virtualization/build-your-own-two-factor-… <https://enterpriseadmins.org/blog/virtualization/build-your-own-two-factor-…>) Regards

4 7

Multiple Radius Group Name
by Angel Elena 23 Apr '18

23 Apr '18

Hi group. I have a freeradius 2.2.5 in a debian 8 box with an OpenLdap database. A simple query: angel.elena@bulma:/etc/freeradius$ radtest angel.elena password localhost:1812 0 testing123 Sending Access-Request of id 100 to 127.0.0.1 port 1812 User-Name = "angel.elena" User-Password = "password" NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=100, length=47 Mikrotik-Group = "AAA_ADMIN" Mikrotik group is a mapped attribute in a ldap.attrmap file and works fine: replyItem Mikrotik-Group radiusGroupName for a new setup and to not modify all devices, we need specify two radiusGroupName / Mikrotik-Group in every query, ex: Mikrotik-Group = "AAA_ADMIN" Mikrotik-Group = "AAA_CORES" Is possible specify two radiusGroupName in a simple reply or any idea to set this setup ? Thanks. -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ www.linkedin.com/in/angel-elena-medina -------------------------------- Zarafa Webapp.

2 1

More efficient programming of the unlang language
by Marijn van Gool 23 Apr '18

23 Apr '18

Hello freeradius users, I have searched the freeradius unlang documentation, but couldn’t find a way to make the following piece of unlang code more effective: if ("%{sql:SELECT username FROM radcheck WHERE username LIKE '%{string:&ADSL-Agent-Remote-Id}@%%' LIMIT 1}" != "") { update request { User-Name := "%{sql:SELECT username FROM radcheck WHERE username LIKE '%{string:&ADSL-Agent-Remote-Id}@%%' LIMIT 1}" } } Basically what I’m trying to do is to check if the query in question returns the username and to use this username in a self created variable later on. Something like this: username-var = SELECT query; if (username-var != “”) { update-request { User-Name := username-var } } How would I achieve this? What is the syntax that can be used here? Thanks! Met vriendelijke groet \ With kind regards, Marijn van Gool NOC Network Engineer noc(a)comsave.com <mailto:noc@comave.com> +31 88 999 5555 marijn.vangool(a)comsave.com <mailto:marijn.vangool@comsave.com> www.comsave.nl <http://www.comsave.nl/>

2 2