- Freeradius-Users - lists.freeradius.org

freeradius + NTLM + samba AD 4.5.x
by Dr. Peer-Joachim Koch 09 Apr '18

09 Apr '18

Hi, we have updated our samba AD domain from 4.4.x to 4.5.x. The release notes for 4.5.0 included "NTLMv1 authentication disabled by default". So we had to enable it to get our radius (freeradius) server working (for 802.1x). What would be the best way to change the freeradius configuration in such a way, that we can disable NTLMv1 again. The radius server is used for WLAN (802.1x) and for VPN. -- Bye, Peer ________________________________________________________ Max-Planck-Institut für Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705

6 5

Calling radius_exec_program() with request set to NULL
by Isaac Boukris 09 Apr '18

09 Apr '18

Hello friends, The comment above it suggests it should be possible to call 'radius_exec_program()' without a request (like at server instantiation): https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/main/exec.c… However, it currently doesn't even let me compile with a NULL request, due to nonull expectation. Would it make sense to fix it, and allow NULL request, or is there a way around it? It works ok with the patch below, though I am not sure what's the correct substitute for all the RDEBUG / RERROR occurrences, see: https://github.com/frenche/freeradius-server/commit/8929b28bd8a4186d2d77226… Thanks!

2 3

Version Upgrdation Issue
by Somanath Mishra 09 Apr '18

09 Apr '18

Hello Tom, We were using Freeradius Version 2.x and it is running well . We want to update now to Version 3.x .So How should we do? There are lots of confusion about version upgradation. Should we install from scratch and reconfigure our settings or we can directly update Version 2 to 3. Please help me on that.Thank you

3 2

Cisco IOS Authentication
by Tom Griffin 09 Apr '18

09 Apr '18

Hello, We are looking into using freeRADIUS to provide authentications to our Cisco IOS devices. There is a very helpful guide on the wiki ( https://wiki.freeradius.org/vendor/Cisco) however, the article only lists 'Cleartext-Password' as an acceptable method for storing the user's password attribute within freeRADIUS. Is it possible to use a more secure method of storing the passwords that is compatible with Cisco IOS? Thanks Tom Griffin University of Sheffield

4 4

Using machine auth from a remote eduroam site
by Alex Sharaz 07 Apr '18

07 Apr '18

For a long long time now I've been using freeradius to auth PEAP and EAP-TLS inbound requests from eduroam to our Tier 1 FreeRadius ( 3.0.16) servers. We now want to enable our managed laptops to connect to eduroam at a remote site using machine authentication using EAP-TTLS. I've got part of the way in that I can see an inbound request from host/<fqdn of laptop> and a failure "Login incorrect (mschap: No such user [0xC0000064]): [host/dpslap001.its.york.ac.uk] (from client yorkcc port 76 cli 80-86-F2-E0-7D-24 via TLS tunnel)" So I guess this makes sense as our machines are in a different part of our AD Tree to our users. On our clearpass system I check for a username of the form host/.....york.ac.uk/ and do an auth against different AD tree branch and everything works. I'm using winbindd on our Tier 1 FR servers. Guess I need to create another mschap instance specifically for machine auths and point it at another part of the AD tree. Assuming that's what I have to do, how do I point mschap at a different part of the AD tree for authentication? Rgds Alex

8 19

source ip check
by Bassem Mettichi 06 Apr '18

06 Apr '18

Hello, i have keeplaived and lvs with 2 freerdaius servers running version 3.0.16 on redhat 7 ( keeplaived is configured with NAT option) when i send an accounting start from a client vm using radclient i get this response: radclient: Received reply to request we did not send. (id=134 socket 3) have you any idea how to resolve this issue, my freeradius servers is listenning on all interfaces ( *). Thanks a lot Mettichi Bassem

3 4

-d <raddb> Set configuration directory (defaults to /etc/raddb).
by Mitch Sullivan 05 Apr '18

05 Apr '18

Hi Team. I'd like to have the configuration directory located at a different location to its default (A docker volume). So do I simply kick off freeradius like below radius -d /pathtodockervolume/ Cheers Mitch. Mitch.Sullivan mitch.sullivan(a)swarm64.com IT administrator | Swarm64 AS Swarm64 AS Zweigstelle Hive Ullsteinstr. 114 | 12109 Berlin | Germany

2 1

Freeradius crashing due to load?
by 8zero2 operations 05 Apr '18

05 Apr '18

Hi, I am attaching error logs of freeradius getting crashed randomly during day. Thu Mar 1 11:45:22 2018 : Info: (1304581) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Thu Mar 1 11:45:22 2018 : Info: (1304581) eap_peap: what went wrong, and how to fix the problem Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 7 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3869), 1 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 6 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3870), 2 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 5 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3871), 3 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 4 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3872), 4 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Error: (1304488) Ignoring duplicate packet from client XXXXXXXX port 44953 - ID: 35 due to unfinished request in component authorize module Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 3 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3873), 5 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 2 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3874), 6 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 1 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3875), 7 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: (1304661) eap_peap: The users session was previously rejected: returning reject (again.) Thu Mar 1 11:45:24 2018 : Info: (1304661) eap_peap: This means you need to read the PREVIOUS messages in the debug output Thu Mar 1 11:45:24 2018 : Info: (1304661) eap_peap: to find out the reason why the user was rejected Thu Mar 1 11:45:24 2018 : Info: (1304661) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Thu Mar 1 11:45:24 2018 : Info: (1304661) eap_peap: what went wrong, and how to fix the problem Thu Mar 1 11:45:25 2018 : Error: (1304618) Ignoring duplicate packet from client XXXXXXXX port 59536 - ID: 16 due to unfinished request in component accounting module Thu Mar 1 11:45:26 2018 : Error: (1304488) Ignoring duplicate packet from client XXXXXXXX port 44953 - ID: 35 due to unfinished request in component authorize module Thu Mar 1 11:45:26 2018 : Error: (1304633) Ignoring duplicate packet from client XXXXXXXX port 41018 - ID: 188 due to unfinished request in component accounting module Thu Mar 1 11:45:26 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x947bd4f29372cdbc Thu Mar 1 11:45:26 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x947bd4f29372cdbc Thu Mar 1 11:45:27 2018 : Error: (1304618) Ignoring duplicate packet from client XXXXXXXX port 59536 - ID: 16 due to unfinished request in component accounting module Thu Mar 1 11:45:28 2018 : Error: (1304488) Ignoring duplicate packet from client XXXXXXXX port 44953 - ID: 35 due to unfinished request in component authorize module Thu Mar 1 11:45:28 2018 : ERROR: (1304488) ERROR: Timeout waiting for child Thu Mar 1 11:45:28 2018 : Error: (1304633) Ignoring duplicate packet from client XXXXXXXX port 41018 - ID: 188 due to unfinished request in component accounting module Thu Mar 1 11:45:29 2018 : Error: (1304618) Ignoring duplicate packet from client XXXXXXXX port 59536 - ID: 16 due to unfinished request in component accounting module Thu Mar 1 11:45:30 2018 : Error: (1304633) Ignoring duplicate packet from client XXXXXXXX port 41018 - ID: 188 due to unfinished request in component accounting module Thu Mar 1 11:45:30 2018 : Error: (1304757) Ignoring duplicate packet from client XXXXXXXX port 44953 - ID: 54 due to unfinished request in component authorize module Thu Mar 1 11:45:31 2018 : Error: (1304618) Ignoring duplicate packet from client XXXXXXXX port 59536 - ID: 16 due to unfinished request in component accounting module Thu Mar 1 11:45:32 2018 : Error: (1304633) Ignoring duplicate packet from client XXXXXXXX port 41018 - ID: 188 due to unfinished request in component accounting module Thu Mar 1 11:45:32 2018 : Error: (1304757) Ignoring duplicate packet from client XXXXXXXX port 44953 - ID: 54 due to unfinished request in component authorize module Thu Mar 1 11:45:32 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x3b06b4a33e01ad19 Thu Mar 1 11:45:32 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x3b06b4a33e01ad19 Thu Mar 1 11:45:33 2018 : Error: (1304618) Ignoring duplicate packet from client XXXXXXXX port 59536 - ID: 16 due to unfinished request in component accounting module Thu Mar 1 11:45:34 2018 : Error: (1304633) Ignoring duplicate packet from client XXXXXXXX port 41018 - ID: 188 due to unfinished request in component accounting module Thu Mar 1 11:45:34 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x4aaec49748aadd2b Thu Mar 1 11:45:34 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x4aaec49748aadd2b Thu Mar 1 11:45:34 2018 : ERROR: (1304618) ERROR: Timeout waiting for child Thu Mar 1 11:45:34 2018 : ERROR: (1304633) ERROR: Timeout waiting for child This is the last log which comes. I have database server modules enabled of sql and ldap. I have monitored them and there is no considerable load on them when this crash happens. I know some module is timing out but i cant quite figure out which. I cannot run it in debug as the crash happens randomly during the day and I have huge amount of users authenticating. How can I debug it and find which module is unresponsive while crash? Just point a finger to a direction i will find the way. PS: freeradius is an awesome software so a big thanks to developers Allan , Arran and everybody Regards, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 5

Unable to Login with LDAP (freeipa) User
by Mohiddin Shaik 05 Apr '18

05 Apr '18

Hi, Recently I installed freeradius server on freeipa server by following configuration, when I tried to test using radtest user <password> serverinfo 1812 somesecret getting error Received Access-Reject Id 226 from 10.0.0.95:1812 to 0.0.0.0:0 length 20 1. -: Expected Access-Accept got Access-Reject (10) Received Access-Request Id 226 from 10.0.0.95:55049 to 10.0.0.95:1812 length 83 (10) User-Name = "test(a)test.org" (10) User-Password = "Reflexis@0418" (10) NAS-IP-Address = 10.0.0.95 (10) NAS-Port = 1812 (10) Message-Authenticator = 0xf9fc18c97a4bc9e5e8f71bb6224f46bb (10) # Executing section authorize from file /etc/raddb/sites-enabled/ default (10) authorize { (10) policy filter_username { (10) if (&User-Name) { (10) if (&User-Name) -> TRUE (10) if (&User-Name) { (10) if (&User-Name =~ / /) { (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@[^@]*@/ ) { (10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (10) if (&User-Name =~ /\.\./ ) { (10) if (&User-Name =~ /\.\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\.$/) { (10) if (&User-Name =~ /\.$/) -> FALSE (10) if (&User-Name =~ /(a)\./) { (10) if (&User-Name =~ /(a)\./) -> FALSE (10) } # if (&User-Name) = notfound (10) } # policy filter_username = notfound (10) [preprocess] = ok (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix: Checking for suffix after "@" (10) suffix: Looking up realm "test.org" for User-Name = "test(a)test.org" (10) suffix: No such realm "test.org" (10) [suffix] = noop (10) eap: No EAP-Message, not doing EAP (10) [eap] = noop (10) [files] = noop rlm_ldap (ldap): Closing connection (11): Hit idle_timeout, was idle for 223 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (9): Hit idle_timeout, was idle for 169 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (12): Hit idle_timeout, was idle for 169 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (13), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://rflxpnqrds02.test.org:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (13) (10) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (10) ldap: --> (uid=test(a)test.org) (10) ldap: Performing search in "dc=test,dc=org" with filter "(uid= test(a)test.org)", scope "sub" (10) ldap: Waiting for search result... (10) ldap: Search returned no results rlm_ldap (ldap): Released connection (13) Need 2 more connections to reach min connections (3) rlm_ldap (ldap): Opening additional connection (14), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://rflxpnqrds02.test.org:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (10) [ldap] = notfound (10) if ((ok || updated) && User-Password) { (10) if ((ok || updated) && User-Password) -> FALSE (10) [expiration] = noop (10) [logintime] = noop (10) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (10) pap: WARNING: Authentication will fail unless a "known good" password is available (10) [pap] = noop (10) } # authorize = ok (10) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (10) Failed to authenticate the user (10) Using Post-Auth-Type Reject (10) # Executing group from file /etc/raddb/sites-enabled/default (10) Post-Auth-Type REJECT { (10) attr_filter.access_reject: EXPAND %{User-Name} (10) attr_filter.access_reject: --> test(a)test.org (10) attr_filter.access_reject: Matched entry DEFAULT at line 11 (10) [attr_filter.access_reject] = updated (10) [eap] = noop (10) policy remove_reply_message_if_eap { (10) if (&reply:EAP-Message && &reply:Reply-Message) { (10) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (10) else { (10) [noop] = noop (10) } # else = noop (10) } # policy remove_reply_message_if_eap = noop (10) } # Post-Auth-Type REJECT = updated (10) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (10) Sending delayed response (10) Sent Access-Reject Id 226 from 10.0.0.95:1812 to 10.0.0.95:55049 length 20 Waking up in 3.9 seconds. (10) Cleaning up request packet ID 226 with timestamp +756 Followed installation steps (Source : https://www.freeipa.org/page/ Using_FreeIPA_and_FreeRadius_as_a_RADIUS_based_software_ token_OTP_system_with_CentOS/RedHat_7) root@ipa ~]# yum install freeradius freeradius-utils freeradius-ldap freeradius-krb5 ... In order to configure the RADIUS server to authenticate with the software token provided by the IPA server, we must let RADIUS accept requests from your clients (including the IPA server itself), enable the default configuration to search for users in the IPA server with LDAP protocol and try to authenticate them with an LDAP bind() operation. All the RADIUS configuration files are in /etc/raddb, and most of the configuration is done by linking files from the mod-available directory to mod-enabled and then editing them as needed. As a first step, add the following lines at the beginning of clients.conf: client localnet { ipaddr = 192.168.1.0/24 proto = * secret = somesecret nas_type = other<------># localhost isn't usually a NAS... limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } In sites-enabled/default and sites-enabled/inner-tunnel replace these line # # The ldap module reads passwords from the LDAP database. -ldap with these # # The ldap module reads passwords from the LDAP database. ldap if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } and uncomment the following lines # Auth-Type LDAP { # ldap # } As a last step, enable and configure the LDAP backend in RADIUS. Add LDAP to the enabled mods: [root@ipa raddb]# ln -s /etc/raddb/mods-available/ldap /etc/raddb/mods-enabled/ [root@ipa raddb]# Edit mods-enable/ldap to change server = "ldap.rrdns.example.org ldap.rrdns.example.org ldap.example.org" and # base_dn = "dc=example,dc=org" to server = "ipa.test.org" and base_dn = "dc=test,dc=org" To reach the RADIUS server from other clients, we must also open the firewall for the required ports: [root@ipa ~]# firewall-cmd --permanent --zone=public --add-port=1812/udp --add-port=1813/udp Success [root@ipa ~]# systemctl restart firewalld.service [root@ipa ~]# *Thanks,* Mohiddin

2 1

Last call for 3.0.17?
by Alan DeKok 04 Apr '18

04 Apr '18

There have been a few minor fixes put in the last few days. Unless I hear any panics, I'll release 3.0.17 tomorrow. Alan DeKok.

1 0