- Freeradius-Users - lists.freeradius.org

Google authenticator : Access-Reject
by servernemesis＠tutanota.com 25 Apr '18

25 Apr '18

Hello, I followed this tutorial (https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and… <https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and…>) and managed to get it running on Debian 9 with FR 3.0.12 thanks to the help here. But I have another issue : when I try to authenticate with password + googleauth code, I got rejected. I'm able to log on the FR server with domain credentials without problem. The google auth code gets generated without issue either. Radtest: radtest user(a)mydomain.com <mailto:user@mydomain.com> password123456 localhost 18120 testing123 Sent Access-Request Id 226 from 0.0.0.0:38763 to 127.0.0.1:1812 length 92 User-Name = "user(a)mydomain.com <mailto:user@mydomain.com>" User-Password = "password123456" NAS-IP-Address = 127.0.1.1 NAS-Port = 18120 Message-Authenticator = 0x00 Cleartext-Password = "password123456" Received Access-Reject Id 226 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject Log: Ready to process requests Waking up in 0.3 seconds. (0) Received Access-Request Id 226 from 127.0.0.1:38763 to 127.0.0.1:1812 length 92 (0) User-Name = "user(a)mydomain.com <mailto:user@mydomain.com>" (0) User-Password = "password123456" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 18120 (0) Message-Authenticator = 0x53b836642c653e776b0d9f8a542fca3a (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Waking up in 0.3 seconds. Waking up in 0.2 seconds. (0) pam: ERROR: pam_authenticate failed: Authentication failure (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Waking up in 0.7 seconds. (0) Sent Access-Reject Id 226 from 127.0.0.1:1812 to 127.0.0.1:38763 length 20 Waking up in 3.9 seconds. Ready to process requests Regards

3 30

facing issue with Nas configuration..
by Somanath Mishra 25 Apr '18

25 Apr '18

Hi team, i configured Freeradius version3 with ubuntu 16 server. also configured all files. but i am facing issue when i am trying radius.net client.so error screenshot i have added. I am confisued with NAS config in clients.conf file. radiusclient i am calling from my local system.so my configuration is like client user-PC { ipaddr = my radius ip secret = xxxxxxxxxx } Please help me on that.

4 5

Failed to connect Freeradius to OpenLDAP
by Tsirkas Georgios 25 Apr '18

25 Apr '18

Hello, I am trying to use ldap module. But failed to connect.... With SSL // /Wed Apr 25 13:47:07 2018 : Info: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used// //Wed Apr 25 13:47:07 2018 : Debug: rlm_ldap (ldap): Connecting to ldap://ldap-server:636// //Wed Apr 25 13:47:07 2018 : Debug: rlm_ldap (ldap): New libldap handle 0x55de89593c20// //TLS: can't connect: (unknown error code).// //Wed Apr 25 13:47:08 2018 : Error: rlm_ldap (ldap): Bind with cn=admin,dc=mydomain,dc=gr to ldap://ldap-server:636 failed: Can't contact LDAP server// //Wed Apr 25 13:47:08 2018 : Debug: rlm_ldap: Closing libldap handle 0x55de89593c20// //Wed Apr 25 13:47:08 2018 : Error: rlm_ldap (ldap): Opening connection failed (0)// //Wed Apr 25 13:47:08 2018 : Debug: rlm_ldap (ldap): Removing connection pool// //Wed Apr 25 13:47:08 2018 : Error: /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap"/ Without SSL Wed Apr 25 13:51:52 2018 : Info: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): Connecting to ldap://ldap-server:389 Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): New libldap handle 0x55f00a1e4c20 Wed Apr 25 13:51:52 2018 : Error: rlm_ldap (ldap): Bind with cn=admin,dc=mydomain,dc=gr to ldap://ldap-server:389 failed: Can't contact LDAP server Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap: Closing libldap handle 0x55f00a1e4c20 Wed Apr 25 13:51:52 2018 : Error: rlm_ldap (ldap): Opening connection failed (0) Wed Apr 25 13:51:52 2018 : Debug: rlm_ldap (ldap): Removing connection pool Wed Apr 25 13:51:52 2018 : Error: /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" Any ideas? I am using Freeradius 3.0.12 with Debian....

2 1

radius.log into filebeat
by Alex Sharaz 25 Apr '18

25 Apr '18

What might be the best way to get . the contents of radius.log into filebeat? I'm already generating a suitable detail log file that the filebeat client processes to push radius acct/auth info into our logstash service ? Rgds alex p.s. 3.0.17

3 2

Freeradius 3 and empty password from authorization
by chose 24 Apr '18

24 Apr '18

Good morning, I couldn't authorize over my radius, when I run it with debug, I see that user password is empty: (23) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=domain.tld --username=%{Stripped-User-Name} --password=%{User-Password}: (23) ntlm_auth: EXPAND --username=%{Stripped-User-Name} (23) ntlm_auth: --> --username=user (23) ntlm_auth: EXPAND --password=%{User-Password} (23) ntlm_auth: --> --password= (23) ntlm_auth: ERROR: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)' (23) [ntlm_auth] = reject (23) } # if (&User-Name =~ /(a)domain.tld/ || &User-Name =~ /(a)domain.tld/) = reject (23) } # authorize = reject (23) Invalid user (ntlm_auth: Program returned code (1) and output 'NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)'): [user] (from client controler2 port 13 cli 86-e8-4f-43-5c-9b) (23) Using Post-Auth-Type Reject User is not empty. When I try to authorize ntlm_auth from bash, all is OK (NT_STATUS_OK: Success (0x0)) What did I missed ? Thanks and best regards J.Karliak -- Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a DomainKeys/DKIM (s ADSP) a implementaci DMARC. Pokud mate problemy s dorucenim emailu, zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji. My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP) policy and implementation of the DMARC. If you've problem with sending emails to me, start using email origin methods mentioned above. Thank you.

4 5

RE: Multiple Radius Group Name
by Angel Elena 23 Apr '18

23 Apr '18

Ok, thanks -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ www.linkedin.com/in/angel-elena-medina -------------------------------- Zarafa Webapp. -----Mensaje original----- De: Alan DeKok <aland(a)deployingradius.com> Enviado: Lun 23-04-2018 19:01 Asunto: Re: Multiple Radius Group Name Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>; > On Apr 23, 2018, at 12:20 PM, Angel Elena <craem(a)craem.net> wrote: > > > > I have a freeradius 2.2.5 in a debian 8 box with an OpenLdap database. > > You should really upgrade to 2.2.10 at least. It takes about 10 minutes. > > > A simple query: > > > > angel.elena@bulma:/etc/freeradius$ radtest angel.elena password > localhost:1812 0 testing123 > > We don't need to see the output of radclient. > > http://wiki.freeradius.org/list-help > > > Mikrotik group is a mapped attribute in a ldap.attrmap file and works fine: > > > > replyItem Mikrotik-Group radiusGroupName\ > > See the comments at the top of that file. If the comments aren't there, > someone probably deleted them. > > Or, install 2.2.10, and look at the comments at the top of ldap.attrmap in > the source file. > > > Is possible specify two radiusGroupName in a simple reply or any idea to set > this setup ? > > Yes. It's documented in that file. You need to set the operator to "+=" > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

PAM missing in FreeRadius 3 w/ Debian 9
by servernemesis＠tutanota.com 23 Apr '18

23 Apr '18

Hello, I just installed FreeRadius 3.0.12 on Stretch in order to provide a Google Authenticator gateway (https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and… <https://www.techdrabble.com/citrix/14-2factor-with-google-authenticator-and…>), but I'm unable to start the FreeRadius service, here is the debug log : Mon Apr 23 14:23:59 2018 : Debug: # Loading session {...} Mon Apr 23 14:23:59 2018 : Debug: radutmp Mon Apr 23 14:23:59 2018 : Debug: # Loading post-proxy {...} Mon Apr 23 14:23:59 2018 : Debug: eap Mon Apr 23 14:23:59 2018 : Debug: # Loading post-auth {...} Mon Apr 23 14:23:59 2018 : Debug: } # server inner-tunnel Mon Apr 23 14:23:59 2018 : Debug: server default { # from file /etc/freeradius/3.0/sites-enabled/default Mon Apr 23 14:23:59 2018 : Debug: # Loading authenticate {...} Mon Apr 23 14:23:59 2018 : Debug: mschap Mon Apr 23 14:23:59 2018 : Debug: digest Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[489]: Failed to find "pam" as a module or policy. Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[489]: Please verify that the configuration exists in /etc/freeradius/3.0$ Mon Apr 23 14:23:59 2018 : Error: /etc/freeradius/3.0/sites-enabled/default[452]: Errors parsing authenticate section. Of course there is no "/etc/freeradius/3.0/mods-enabled/pam" Someone had the same problem with Ubuntu 17.10 and FreeRadius 3 before reverting to an older version (https://enterpriseadmins.org/blog/virtualization/build-your-own-two-factor-… <https://enterpriseadmins.org/blog/virtualization/build-your-own-two-factor-…>) Regards

4 7

Multiple Radius Group Name
by Angel Elena 23 Apr '18

23 Apr '18

Hi group. I have a freeradius 2.2.5 in a debian 8 box with an OpenLdap database. A simple query: angel.elena@bulma:/etc/freeradius$ radtest angel.elena password localhost:1812 0 testing123 Sending Access-Request of id 100 to 127.0.0.1 port 1812 User-Name = "angel.elena" User-Password = "password" NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=100, length=47 Mikrotik-Group = "AAA_ADMIN" Mikrotik group is a mapped attribute in a ldap.attrmap file and works fine: replyItem Mikrotik-Group radiusGroupName for a new setup and to not modify all devices, we need specify two radiusGroupName / Mikrotik-Group in every query, ex: Mikrotik-Group = "AAA_ADMIN" Mikrotik-Group = "AAA_CORES" Is possible specify two radiusGroupName in a simple reply or any idea to set this setup ? Thanks. -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ www.linkedin.com/in/angel-elena-medina -------------------------------- Zarafa Webapp.

2 1

More efficient programming of the unlang language
by Marijn van Gool 23 Apr '18

23 Apr '18

Hello freeradius users, I have searched the freeradius unlang documentation, but couldn’t find a way to make the following piece of unlang code more effective: if ("%{sql:SELECT username FROM radcheck WHERE username LIKE '%{string:&ADSL-Agent-Remote-Id}@%%' LIMIT 1}" != "") { update request { User-Name := "%{sql:SELECT username FROM radcheck WHERE username LIKE '%{string:&ADSL-Agent-Remote-Id}@%%' LIMIT 1}" } } Basically what I’m trying to do is to check if the query in question returns the username and to use this username in a self created variable later on. Something like this: username-var = SELECT query; if (username-var != “”) { update-request { User-Name := username-var } } How would I achieve this? What is the syntax that can be used here? Thanks! Met vriendelijke groet \ With kind regards, Marijn van Gool NOC Network Engineer noc(a)comsave.com <mailto:noc@comave.com> +31 88 999 5555 marijn.vangool(a)comsave.com <mailto:marijn.vangool@comsave.com> www.comsave.nl <http://www.comsave.nl/>

2 2

is this even possible ?
by m.nageh 23 Apr '18

23 Apr '18

https://www.youtube.com/watch?v=HoihKhQWZ7k&feature=youtu.be if it's possible what are the steps to do this with your tool to make a pentesting video just for Educational purpose .and test it on my own ...... so how can i edit the algorithm to make it use EAP-TTLS/PAP... sorry i am not using the freeradius-server much ... i am kinda new to it😔 😕😕😔

1 0