- Freeradius-Users - lists.freeradius.org

Authentication against Google Apps domain
by Matt Paska 27 Apr '18

27 Apr '18

Hello, I'm looking for steps to configure a wireless network for WPA2-Enterprise encryption with 802.1X authentication against Google Apps domain. With this, your users should be able to use their Google Apps credentials to access secure wireless network. EAP-TTLS/PAP devices. Similar to what is detailed here ( https://wiki.freeradius.org/guide/Enterprise-WiFi) using configuration files for iOS devices and Mac OS computers. Thanks!

1 0

What is the magic to see the Windows User as DOMAIN\user
by Nick Howitt 27 Apr '18

27 Apr '18

I'm sorry for posting this here as it is really a Windows question but it is driving me scatty trying to authenticate with a Windows client. I only seem to get the User-Name come through with machine credentials like host/machine_name.DOMAIN. For the life of me I can't see how to switch Win10 to pass a real user name through to Radius like DOMAIN\user. There must be a setting in Windows which I am overlooking. Can anyone please help? Thanks, Nick

2 1

Using unlang / SQL with single return value; couple of questions.
by Dom Latter 27 Apr '18

27 Apr '18

(This is partly a continuation of the thread "Perl vs. python vs. Lua?" started late February) [1]. First thanks to Alan for pointing me in the right direction. I thought I would describe the process for the benefit of others. Basically we need to assign wifi users a VLAN based on their location and username. If they are rejected we want to put a reason in the Reply-Message (and this *should* in due course end up in the line log and the postauth table). We have been using a PHP script. To replace it I have put the bulk of the logic in to the SELECT clause of the SQL query. If there's a "normal" VLAN available it's in the range 1 to 4096. Return codes 5000 to 5005 indicate "accepted" but with special conditions. Return codes 5010 to 5014 indicate "reject". Return codes above 10000 indicate a VLAN applied a different way, and so on. So in in our default server in the post-auth block we have (for example): update control { CustomVal := "%{sql:SELECT \ CASE \ WHEN (cs_suspended.value = '1') THEN 5010 \ WHEN (u.deleted != '0') THEN 5011 \ // etc Then the unlang code "decodes" the return value: if ( &control:XL-Vlan < 5000 ) { update reply { Filter-Id := &control:CustomVal Reply-Message += "Accept: MAC found." } } elsif (.... So I have managed quite okay without the map functionality of version 4; in fact, as the query should cache quite nicely it's possible that it's much better to put as much logic as possible into the query... I hope the above is reasonably clear - I have done my best with the time available! 1st question: I am currently using a REGEXP in the query to perform a partial match and would prefer to use a LIKE '%foo%' instead... but the % wildcard seems to conflict with freeradius's own substitution. Anybody know a workaround? 2nd question: we use a "magic" MAC address for non-wifi authentication; which contains for no good reason, an exclamation mark. The problem is that in the query the '%{request:Calling-Station-Id} gets expanded such that the '!' becomes '=21'. So my WHEN clause in the SELECT has to match on '=21'. Any workarounds so that the SQL query would see the "real" value? [1] I only do this gig part-time and only part of *that* is spent on freeradius development,

2 3

Are config and control list equal?
by work vlpl 26 Apr '18

26 Apr '18

Hello, The documentation/wiki for rlm_python module https://wiki.freeradius.org/modules/Rlm_python says, that module can return tuple of 3 elements (return code, reply attributes, config attributes) For debug purposes I added additional instructions in raddb/polici.d/debug debug_config { if("%{debug_attr:config:}" == '') { noop } } And noticed in debug output this (6) policy debug_config { (6) if ("%{debug_attr:config:}" == '') { (6) Attributes matching "config:" (6) &control:Auth-Type = MS-CHAP (6) &control:Cleartext-Password = testing (6) EXPAND %{debug_attr:config:} (6) --> (6) if ("%{debug_attr:config:}" == '') -> TRUE (6) if ("%{debug_attr:config:}" == '') { (6) [noop] = noop (6) } # if ("%{debug_attr:config:}" == '') = noop (6) } # policy debug_config = noop and debug_control policy return the same results (6) policy debug_control { (6) if ("%{debug_attr:control:}" == '') { (6) Attributes matching "control:" (6) &control:Auth-Type = MS-CHAP (6) &control:Cleartext-Password = testing (6) EXPAND %{debug_attr:control:} (6) --> (6) if ("%{debug_attr:control:}" == '') -> TRUE (6) if ("%{debug_attr:control:}" == '') { (6) [noop] = noop (6) } # if ("%{debug_attr:control:}" == '') = noop (6) } # policy debug_control = noop Is this means what control and config lists are equal?

2 1

Issue with EAP authentication on packet loss
by jm+freeradiususer＠roth.lu 26 Apr '18

26 Apr '18

Hello, We have a problem when packet loss occurs at step #4 of the EAP dialogue: 1) Access-Request 2) Access-Challenge 3) Access-Request 4) Accept or Reject (in this case: Access-Accept) 5) Access-Request (duplicate) 6) Reject In this case, #4 is sent by the server but gets lost on its way to the NAS. I've managed to reproduce using iptables dropping the packet. So after some time the NAS sends packet #3 again. At that point I am getting "No EAP session matching state" from the eap module in the "authenticate" section and the request is rejected. This is consistent with what we see in step #4 (upon sending the Access-Accept which gets lost), namely this: (1) eap : Expiring EAP session with state 0x2f8521a02f84259c (1) eap : Finished EAP session with state 0x2f8521a02f84259c (1) eap : Previous EAP request found for state 0x2f8521a02f84259c, released from the list Who's at fault? How do you solve this (except for not using UDP)? Do you set aggressive timeouts/retries on the NAS? Thanks, Marki

5 14

radreply is not queried
by Charly 26 Apr '18

26 Apr '18

Hello, I don't understand why radreply table is not queried whereas radgroupreply is queried : (0) authorize { (0) [preprocess] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> john (0) sql: SQL-User-Name set to 'john' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'john' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'john' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'john' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'john' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql-SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'common' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'common' ORDER BY id (0) sql: Group "common": Conditional check items matched (0) sql: Group "common": Merging assignment check items (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql-SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'common' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'common' ORDER BY id (0) sql: Group "common": Merging reply items Thank for your help Charly

2 2

EAP-TTLS certificates
by Tsirkas Georgios 26 Apr '18

26 Apr '18

Hello, Are certificates necessary using EAP-TTLS? Also clients certificates are installed only on Access-Points? Thank you!

2 1

ISSUE: Authentication will fail unless a "known good" password is available
by Somanath Mishra 26 Apr '18

26 Apr '18

Hi Team, I am facing issue with radtest. I am getting error like: Authentication will fail unless a "known good" password is available Below debug details: Received Access-Request Id 241 from 127.0.0.1:38747 to 127.0.0.1:1812 length 74 (3) User-Name = "test" (3) User-Password = "test123" (3) NAS-IP-Address = 127.0.1.1 (3) NAS-Port = 1812 (3) Message-Authenticator = 0x73b04566a900069b236e748aee43500c (3) # Executing section authorize from file /etc/freeradius/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "test", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: No EAP-Message, not doing EAP (3) [eap] = noop (3) [files] = noop (3) sql: EXPAND %{User-Name} (3) sql: --> test (3) sql: SQL-User-Name set to 'test' rlm_sql (sql): Closing connection (8): Hit idle_timeout, was idle for 141 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (9): Hit idle_timeout, was idle for 141 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (7): Hit idle_timeout, was idle for 141 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (10), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.22-0ubuntu0.16.04.1, protocol version 10 rlm_sql (sql): Reserved connection (10) (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (3) sql: User found in radcheck table (3) sql: Conditional check items matched, merging assignment check items (3) sql: User-Password := "test123" (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id (3) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (3) sql: --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (3) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (3) sql: User not found in any groups rlm_sql (sql): Released connection (10) Need 2 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (11), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.22-0ubuntu0.16.04.1, protocol version 10 (3) [sql] = ok (3) [expiration] = noop (3) [logintime] = noop (3) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (3) pap: WARNING: !!! Ignoring control:User-Password. Update your !!! (3) pap: WARNING: !!! configuration so that the "known good" clear text !!! (3) pap: WARNING: !!! password is in Cleartext-Password and NOT in !!! (3) pap: WARNING: !!! User-Password. !!! (3) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (3) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (3) pap: WARNING: Authentication will fail unless a "known good" password is available (3) [pap] = noop (3) } # authorize = ok (3) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (3) Failed to authenticate the user (3) Using Post-Auth-Type Reject (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) Post-Auth-Type REJECT { (3) sql: EXPAND .query (3) sql: --> .query (3) sql: Using query template 'query' rlm_sql (sql): Reserved connection (10) (3) sql: EXPAND %{User-Name} (3) sql: --> test (3) sql: SQL-User-Name set to 'test' (3) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (3) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test123', 'Access-Reject', '2018-04-26 20:51:05') (3) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test123', 'Access-Reject', '2018-04-26 20:51:05') (3) sql: SQL query returned: success (3) sql: 1 record(s) updated rlm_sql (sql): Released connection (10) (3) [sql] = ok (3) attr_filter.access_reject: EXPAND %{User-Name} (3) attr_filter.access_reject: --> test (3) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) [attr_filter.access_reject] = updated (3) [eap] = noop (3) policy remove_reply_message_if_eap { (3) if (&reply:EAP-Message && &reply:Reply-Message) { (3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) else { (3) [noop] = noop (3) } # else = noop (3) } # policy remove_reply_message_if_eap = noop (3) } # Post-Auth-Type REJECT = updated (3) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test/test123] (from client localhost port 1812) (3) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Sending delayed response (3) Sent Access-Reject Id 241 from 127.0.0.1:1812 to 127.0.0.1:38747 length 20 Waking up in 3.9 seconds. (3) Cleaning up request packet ID 241 with timestamp +264 Ready to process requests Please help me on that.

2 1

What is the recommended way of overriding a mod file like "realm"
by Nick Howitt 26 Apr '18

26 Apr '18

The reason I am asking is because domain logins are appearing as "user/machine.domain". I can make it work by adding a realm in proxy.conf (or a parallel file and adding an INCLUDE in radius.conf): realm "~(.*\.)*domain$" { } But I also either have to change the delimiter in the "realm suffix" section of /etc/raddb/mods-available/realm from "@" to "/" which means the file is non non-standard or I have a couple of choices of adding a block: realm realmclearos { format = suffix delimiter = "/" } at the bottom /etc/raddb/mods-available/realm or in its own file in mods-available and symlinking to it from mods-enabled, but then, either way, I also have to add a line "realmclearos" in /etc/raddb/sites-available/default around the line saying "suffix" which makes /etc/raddb/sites-available/default non-standard. There is a fair push on the mailing lists of keeping things standard and I am wondering what is the best direction - or is my solution completely wrong. Thanks, Nick

2 1

having trouble connecting EAP-PEAP
by Carlito Nueno 26 Apr '18

26 Apr '18

hi all, I am not able to connect to any device, iOS, mac os, or linux to EAP-PEAP I used `/etc/raddb/certs/ make` script to generate certificates. I copied the `ca.pem` file to mac OS and installed it. Any advice? using freeradius on docker with alpine linux - FreeRADIUS Version 3.0.15 - OpenSSL 1.0.2o Changes made: /etc/raddb/mods-enabled/eap: default_eap_type = peap /etc/raddb/mods-enabled/mschap use_mppe = yes require_encryption = yes require_strong = yes /etc/raddb/sites-enabled/default # Allow EAP authentication. eap /etc/raddb/sites-enabled/inner-tunnel eap { ok = return } # Allow EAP authentication. eap radius.log Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 58659 Listening on proxy address :: port 46908 Ready to process requests Thread 1 waiting to be assigned a request Thread 5 waiting to be assigned a request Thread 4 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread 2 waiting to be assigned a request Threads: total/active/spare threads = 5/0/5 Waking up in 0.3 seconds. Thread 5 got semaphore Thread 5 handling request 1, (1 handled so far) (1) Received Access-Request Id 7 from 192.168.2.181:40873 to 172.18.0.2:1812 length 190 (1) User-Name = "test" (1) Called-Station-Id = "22-B5-8F-99-AC-00:test11radius" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) NAS-Port = 1 (1) Calling-Station-Id = "11-11-33-23-FC-33" (1) Connect-Info = "CONNECT 54Mbps 802.11a" (1) Acct-Session-Id = "BA289D333A540806" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027076 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x02bc00090174657374 (1) Message-Authenticator = 0xdb1db3b502505a24e81043b7239ef87e (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) files: users: Matched entry test at line 1 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: No User-Password attribute in the request. Cannot do PAP (1) [pap] = noop (1) } # authorize = ok (1) WARNING: Please update your configuration, and remove 'Auth-Type = Local' (1) WARNING: Use the PAP or CHAP modules instead (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> test (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Thread 5 waiting to be assigned a request Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 7 from 172.18.0.2:1812 to 192.168.2.181:40873 length 20 logs on access point: hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: Sending EAP Packet (identifier 188) hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: received EAP packet (code=2 id=188 len=9) from STA: EAP Response-Identity (1) hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: STA identity 'test' hostapd: wlan0-ap: RADIUS Sending RADIUS message to authentication server hostapd: wlan0-ap: RADIUS Next RADIUS client retransmit in 3 seconds hostapd: wlan0-ap: RADIUS Received 20 bytes from RADIUS server hostapd: wlan0-ap: RADIUS Received RADIUS message hostapd: wlan0-ap: STA 11-11-33-23-FC-33 RADIUS: Received RADIUS packet matched with a pending request, round trip time 1.00 sec hostapd: wlan0-ap: STA 11-11-33-23-FC-33 IEEE 802.1X: could not extract EAP-Message from RADIUS message Thanks

3 3