- Freeradius-Users - lists.freeradius.org

PAM missing in FreeRadius 3 w/ Debian 9
by servernemesis＠tutanota.com 23 Apr '18

23 Apr '18

Hello, I just installed FreeRadius 3.0.12 on Stretch in order to provide a Google Authenticator gateway (https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and… <https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and…>), but I'm unable to start the FreeRadius service, here is the debug log : Mon Apr 23 14:23:59 2018 : Debug: # Loading session {...} Mon Apr 23 14:23:59 2018 : Debug: radutmp Mon Apr 23 14:23:59 2018 : Debug: # Loading post-proxy {...} Mon Apr 23 14:23:59 2018 : Debug: eap Mon Apr 23 14:23:59 2018 : Debug: # Loading post-auth {...} Mon Apr 23 14:23:59 2018 : Debug: } # server inner-tunnel Mon Apr 23 14:23:59 2018 : Debug: server default { # from file /etc/freeradius/3.0/sites-enabled/default Mon Apr 23 14:23:59 2018 : Debug: # Loading authenticate {...} Mon Apr 23 14:23:59 2018 : Debug: mschap Mon Apr 23 14:23:59 2018 : Debug: digest Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[489]: Failed to find "pam" as a module or policy. Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[489]: Please verify that the configuration exists in /etc/freeradius/3.0$ Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[452]: Errors parsing authenticate section. Of course there is no "/etc/freeradius/3.0/mods-enabled/pam" Someone had the same problem with Ubuntu 17.10 and FreeRadius 3 before reverting to an older version (https://enterpriseadmins.org/blog/virtualization/build-your-own-two-factor-… <https://enterpriseadmins.org/blog/virtualization/build-your-own-two-factor-…>) Regards

4 7

Multiple Radius Group Name
by Angel Elena 23 Apr '18

23 Apr '18

Hi group. I have a freeradius 2.2.5 in a debian 8 box with an OpenLdap database. A simple query: angel.elena@bulma:/etc/freeradius$ radtest angel.elena password localhost:1812 0 testing123 Sending Access-Request of id 100 to 127.0.0.1 port 1812 User-Name = "angel.elena" User-Password = "password" NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=100, length=47 Mikrotik-Group = "AAA_ADMIN" Mikrotik group is a mapped attribute in a ldap.attrmap file and works fine: replyItem Mikrotik-Group radiusGroupName for a new setup and to not modify all devices, we need specify two radiusGroupName / Mikrotik-Group in every query, ex: Mikrotik-Group = "AAA_ADMIN" Mikrotik-Group = "AAA_CORES" Is possible specify two radiusGroupName in a simple reply or any idea to set this setup ? Thanks. -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ www.linkedin.com/in/angel-elena-medina -------------------------------- Zarafa Webapp.

2 1

More efficient programming of the unlang language
by Marijn van Gool 23 Apr '18

23 Apr '18

Hello freeradius users, I have searched the freeradius unlang documentation, but couldn’t find a way to make the following piece of unlang code more effective: if ("%{sql:SELECT username FROM radcheck WHERE username LIKE '%{string:&ADSL-Agent-Remote-Id}@%%' LIMIT 1}" != "") { update request { User-Name := "%{sql:SELECT username FROM radcheck WHERE username LIKE '%{string:&ADSL-Agent-Remote-Id}@%%' LIMIT 1}" } } Basically what I’m trying to do is to check if the query in question returns the username and to use this username in a self created variable later on. Something like this: username-var = SELECT query; if (username-var != “”) { update-request { User-Name := username-var } } How would I achieve this? What is the syntax that can be used here? Thanks! Met vriendelijke groet \ With kind regards, Marijn van Gool NOC Network Engineer noc(a)comsave.com <mailto:noc@comave.com> +31 88 999 5555 marijn.vangool(a)comsave.com <mailto:marijn.vangool@comsave.com> www.comsave.nl <http://www.comsave.nl/>

2 2

is this even possible ?
by m.nageh 23 Apr '18

23 Apr '18

https://www.youtube.com/watch?v=HoihKhQWZ7k&feature=youtu.be if it's possible what are the steps to do this with your tool to make a pentesting video just for Educational purpose .and test it on my own ...... so how can i edit the algorithm to make it use EAP-TTLS/PAP... sorry i am not using the freeradius-server much ... i am kinda new to it😔 😕😕😔

1 0

freeradius filter ldap groups
by Juliano 23 Apr '18

23 Apr '18

Dears, I'm having trouble setting an authentication rule on freeradius. To better contextualize my environment, I would like to explain that I have only one freeradius server, one ldap server and two wireless networks (WEB-USERS and WEB-ADMIN). It is also important to remember that each wifi network is associated with a vlan, it´s 500 and 501 and your sub network 10.20.128.0/21 and 10.20.8.0/23, respectively I need is that users of the users-wifi group only connect to the WEB-USERS network and users of the other group, called admin-wifi, can only connect to the WEB-ADMIN network. I read that in the [...] / sites-enabled / default / file there is a section called post-auth, in which I can do this filter. However I don´t haved succeed with this filters. I would like your help in this situation. Best Regards, Juliano Aléssio da Silva

2 1

eduroam howto help with the wrong password scenario
by Francesco Malvezzi 21 Apr '18

21 Apr '18

first of all, how I wished the eduroam howto (http://wiki.freeradius.org/guide/eduroam) was online when I first had to configure freeradius. Lucky those who can start from it: it used to be harder. Still, I have a problem. Following the howto with the files setup, I can handle the happy path result (user with correct password). Everything works. If I modify the ~/eapol_test/peap-mschapv2.conf file with: password="iamthewrongpassword" the request fails after a while, like the server would give the client a second try: eapol logs: [...] EAP-MSCHAPV2: password changing protocol version 3 EAP-MSCHAPV2: failure message: 'Authentication rejected' (retry allowed, error 691) EAPOL: EAP parameter needed [...] and it takes 30 secs to issue the "FAILURE" line. ./sbin/radiusd -X [...] (14) eap_mschapv2: authenticate { (14) mschap: Found Cleartext-Password, hashing to create NT-Password (14) mschap: Found Cleartext-Password, hashing to create LM-Password (14) mschap: Creating challenge hash with username: a_user(a)example.org (14) mschap: Client is using MS-CHAPv2 (14) mschap: ERROR: MS-CHAP2-Response is incorrect (14) [mschap] = reject (14) } # authenticate = reject (14) MSCHAP-Error: ?E=691 R=1 C=3277c9a2969ff694b1e423f83f99ecd4 V=3 M=Authentication rejected (14) Found new challenge from MS-CHAP-Error: err=691 retry=1 challenge=3277c9a2969ff694b1e423f83f99ecd4 (14) ERROR: MSCHAP Failure (14) inner-eap: Sending EAP Request (code 1) ID 9 length 83 (14) inner-eap: EAP session adding &reply:State = 0x30262b3d312f3188 (14) [inner-eap] = handled (14) } # authenticate = handled (14) } # server eduroam-inner (14) Virtual server sending reply (14) EAP-Message = 0x010900531a0408004e453d36393120523d3120433d333237376339613239363966663639346231653432336638336639396563643420563d33204d3d41757468656e7469636174696f6e2072656a6563746564 (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x30262b3d312f318871613eb63a4734ad (14) eap_peap: Got tunneled reply code 11 (14) eap_peap: EAP-Message = 0x010900531a0408004e453d36393120523d3120433d333237376339613239363966663639346231653432336638336639396563643420563d33204d3d41757468656e7469636174696f6e2072656a6563746564 (14) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (14) eap_peap: State = 0x30262b3d312f318871613eb63a4734ad (14) eap_peap: Got tunneled reply RADIUS code 11 (14) eap_peap: EAP-Message = 0x010900531a0408004e453d36393120523d3120433d333237376339613239363966663639346231653432336638336639396563643420563d33204d3d41757468656e7469636174696f6e2072656a6563746564 (14) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (14) eap_peap: State = 0x30262b3d312f318871613eb63a4734ad (14) eap_peap: Got tunneled Access-Challenge (14) eap: Sending EAP Request (code 1) ID 9 length 114 (14) eap: EAP session adding &reply:State = 0x8dc44f9585cd5612 (14) [eap] = handled (14) } # authenticate = handled (14) Using Post-Auth-Type Challenge (14) Post-Auth-Type sub-section not found. Ignoring. (14) # Executing group from file /opt/freeradius/etc/raddb/sites-enabled/default (14) session-state: Saving cached attributes (14) Stripped-User-Name := "a_user" (14) Sent Access-Challenge Id 8 from 127.0.0.1:1812 to 127.0.0.1:46152 length 0 (14) EAP-Message = 0x01090072190017030300674cef3f0c59b8f592198c61cd5c9a8810373267c99f6db7b6e410e43143fec0b5f4fb860d8b544e0b844edd43b9b26b119dfa7f1f7d3053bfab5b22f77511dad11e5369876d20211362ed1e949b67950fa465d6aec569ae4beae10d613101854ea2cbc3276df6df (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x8dc44f9585cd56126b4642e6eb93d427 (14) Finished request [...] Why am I missing the: linelog_send_reject from my logs? If I choose pap (~/eapol_test/eap-ttls.conf), I can see the failure log line (when password is wrong). And the client takes only one sec to tell me there is a failure. What did I do wrong? Freeradius is 3.0.17 on Debian GNU/Linux 9 (stretch), thank you, Francesco

4 3

Server certificate confusion
by Nick Howitt 19 Apr '18

19 Apr '18

I am having problems with the server certificate. If I create a server certificate without the XP Extensions, using eapol_test I can get a validation success, but Windows clients give an 0x80420101 error. If I redo the certificates with the XP Extensions I see the following in the certificate: X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 CRL Distribution Points: Full Name: URI:http://www.example.com/example_ca.crl But eapol_test ends in failure with the following part way through: TLS: Certificate verification failed, error 7 (certificate signature failure) depth 0 for '/C=FR/ST=Radius/O=Example Inc./CN=Example Certificate Authority/emailAddress=admin(a)example.org' CTRL-EVENT-EAP-TLS-CERT-ERROR reason=0 depth=0 subject='/C=FR/ST=Radius/O=Example Inc./CN=Example Certificate Authority/emailAddress=admin(a)example.org' err='certificate signature failure' EAP: Status notification: remote certificate verification (param=certificate signature failure) and "radiusd -X gives: (29) eap_tls: Done initial handshake (29) eap_tls: <<< recv TLS 1.2 [length 0002] (29) eap_tls: ERROR: TLS Alert read:fatal:decrypt error (29) eap_tls: ERROR: TLS_accept: Failed in SSLv3 read client certificate A (29) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read) (29) eap_tls: ERROR: error:1409441B:SSL routines:ssl3_read_bytes:tlsv1 alert decrypt error (29) eap_tls: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure (29) eap_tls: ERROR: System call (I/O) error (-1) (29) eap_tls: ERROR: TLS receive handshake failed during operation (29) eap_tls: ERROR: [eaptls process] = fail (29) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (29) eap: Sending EAP Failure (code 4) ID 5 length 4 Do you know what I'm doing wrong? TIA, Nick

5 15

Check on ADSL-Agent-Remote-Id instead of username
by Marijn van Gool 19 Apr '18

19 Apr '18

Hello freeradius, We’ve been using freeradius for a couple of years now and have expanded to connectiong users via PPPoE. Currently we give our customers a username and password whether they are authorized to connect. We want to change this to ADSL-Agent-Remote-Id, an attribute we see in the Access-Request packet. We are using this version of freeradius: root@server1:~# freeradius -v freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03 We will upgrade to a version beyond 3.x.x soon. I have been searching the web for this, but can’t find something other than modifying the scripts used by freeradius on its mysql backend. Anyone who can help me in the right direction? Met vriendelijke groet \ With kind regards, Marijn van Gool

4 16

DUO 2FA integration with FreeRadius
by Charles Butera 19 Apr '18

19 Apr '18

Hello, Has anyone been able to integrate DUO 2FA with Freeradius? I currently have a radius proxy provided by DUO in order to get this working but I would rather have this done solely by Freeradius if possible. https://duo.com/docs/authproxy_reference#installation Thank you, Charles Butera

5 4

Freeradius 3 and strip username
by chose 19 Apr '18

19 Apr '18

Good afternoon, I use ntlm authorization, but the radius uses for ntlm authorization username(a)domain.tld as it is written in the authorization to eduroam. It is able to change User-Name variable only for the realm. Strip out @domain.tld ? Thanks and best regards J.Karliak -- Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a DomainKeys/DKIM (s ADSP) a implementaci DMARC. Pokud mate problemy s dorucenim emailu, zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji. My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP) policy and implementation of the DMARC. If you've problem with sending emails to me, start using email origin methods mentioned above. Thank you.

2 1