- Freeradius-Users - lists.freeradius.org

Authentication with MACADDRESS and PASSWORD
by Paolo D'Angeli 20 Mar '18

20 Mar '18

It's possibile to enable autentication with Freeradius server using MACADDRESS (username) and password (textmode) ? I've try this: 0014853077be Cleartext-Password := "passwordtest" Tunnel-Private-Group-ID := 3 Using MACADDRESS for "password" it works fine, but I dont know how to set password on client (Mac/Linux/windows) Thanks Paolo

3 2

Freeradius 3.0.16 DHCP static IP assignment
by Wessel de Schrijver 20 Mar '18

20 Mar '18

Dear team Freeradius, We're testing the new Freeradius 3.0.16 server software for assigning static IP's, this works perfectly using the Radius protocol, though we have an IP flow coming in our production network where clients are using DHCP. We would like to use Freeradius because we can setup just one server which will deal with all the assignments so we can use just one MYSQL data table and doesn't need to restart any services when changes are made. I've seen a guide for setting this up: https://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation But it's referring to Freeradius 2.2.0, I would like to know if there is any information available to do the same with Freeradius 3.0.16. *Met vriendelijke groet, kind regards,* *Wessel de Schrijver* *Technisch Beheerder - **Technical Engineer* <https://secure.helpscout.net/mailbox/24be88c0645281b5/new-ticket/170166/www…>

2 3

Radius crashing with "Failed adding event handler for socket: Too many readers"
by Campbell McKenzie 20 Mar '18

20 Mar '18

Hello, I'm running Free Radius 3.0.13 on Redhat 7 and the about once or 10 times a day the service will "crash" (Exit with error code 1) with the error message "Failed adding event handler for socket: Too many readers". The only messages prior to Radius crashing are: Mar 19 21:37:34 radius1.acme.com radiusd[11344]: ... adding new socket proxy address 202.AA.BB.CC port 57158 Mar 19 21:37:34 radius1.acme.com radiusd[11344]: ... adding new socket proxy address 202.AA.BB.CC port 57158 Mar 19 21:37:34 radius1.acme.com radiusd[11344]:Failed adding event handler for socket: Too many readers Then systemd picks up the failure: Mar 19 21:37:34 radius1.acme.com systemd:radiusd.service: main process exited, code=exited, status=1/FAILURE Mar 19 21:37:34 radius1.acme.com systemd:Unit radiusd.service entered failed state. Mar 19 21:37:34 radius1.acme.com systemd:radiusd.service failed. Our configuration consists of about 157 home_servers and about 276 clients and two upstream proxies. The problem is that the program isn't leaving behind core dumps, I don't know how to / can't actually reproduce the issue, I can't leave the server running in debug mode as it is handling upto 1500-3000 requests per minute (every minute) and finally it doesn't crash everyday, but it does some days - sometimes upto 10x a day. Probably the only major difference is that we use 'src_ipaddr' directive throughout the whole configuration. This is because all packets are present via an Anycast interface (and obviously we need to reply to the packets from the same IP address). The issue seems to be similar to: http://lists.freeradius.org/pipermail/freeradius-users/2015-July/078835.html and GitHub issue: https://github.com/FreeRADIUS/freeradius-server/issues/1155 - But these issues got patched in August 2015... I have attached an obfuscated (and truncated) radius debug log. I had to truncate it because it would be 9000 lines before the first request is handled. Any assistance anyone can provide would be appreciated. Thanks Cam. Radius Debug: FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/eduroam-nrads.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/status including configuration file /etc/raddb/sites-enabled/auth-reject main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 120 cleanup_delay = 8 max_requests = 65536 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server eau-tlrs1 { ipaddr = 158.FF.EE.RR port = 1812 type = "auth+acct" secret = <<< secret >>> src_ipaddr = "202.AA.BB.CC" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server eau-tlrs2 { ipaddr = 202.DD.XX.ZZ port = 1812 type = "auth+acct" secret = <<< secret >>> src_ipaddr = "202.AA.BB.CC" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server customer-1 { ipaddr = 178.CC.TT.YY port = 1812 type = "auth+acct" secret = <<< secret >>> src_ipaddr = "202.AA.BB.CC" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } -------- 8< ---------------- 8< ---------------- 8< SNIP home_server conf-1 { ipaddr = 113.EE.KK.FF port = 1812 type = "auth+acct" secret = <<< secret >>> src_ipaddr = "202.AA.BB.CC" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server nwtest-1 { ipaddr = 202.RR.YY.XX port = 1812 type = "auth+acct" secret = <<< secret >>> src_ipaddr = "202.AA.BB.CC" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server auth-reject { virtual_server = "auth-reject" port = 0 response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } realm LOCAL { } home_server_pool auth-reject_pool { home_server = auth-reject } realm NULL { auth_pool = auth-reject_pool } home_server_pool eau-tlrs_authacct { type = fail-over home_server = eau-tlrs2 home_server = eau-tlrs1 } realm DEFAULT { pool = eau-tlrs_authacct nostrip } -------- 8< ---------------- 8< ---------------- 8< SNIP } realm ~\.3gppnetwork\.org$ { auth_pool = auth-reject_pool } radiusd: #### Loading Clients #### client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> shortname = "localhost" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 202.WW.KK.PP { ipaddr = 202.WW.KK.PP require_message_authenticator = no secret = <<< secret >>> shortname = "test-cbr-a-ext1-2" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 202.AA.BB.CC { ipaddr = 202.AA.BB.CC require_message_authenticator = no secret = <<< secret >>> shortname = "eduroam-1.acme.com" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } -------- 8< ---------------- 8< ---------------- 8< ---------------- SNIP } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = Status-Server radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 65536 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server status { # from file /etc/raddb/sites-enabled/status # Loading authorize {...} } # server status server auth-reject { # from file /etc/raddb/sites-enabled/auth-reject # Loading authorize {...} } # server auth-reject radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 1813 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 1813 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "status" ipaddr = 127.0.0.1 port = 18120 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on status address 127.0.0.1 port 18120 bound to server status Listening on proxy address * port 52254 Listening on proxy address :: port 47996 Ready to process requests (0) Received Access-Request Id 6 from 131.X.Y.Z:1814 to 202.AA.BB.CC:1812 length 294

2 1

EAP-TNC support or any other method to enforce some security policies on client?
by Bogdan Rudas 19 Mar '18

19 Mar '18

Hello all! I've found couple of discussions regarding implementation of EAP-TNC in FreeRADIUS (in 2008 and 2013) as well as some core here: https://github.com/trustathsh/tnc-fhh What is a current status of EAP-TNC? Is is integrated into FreeRADIUS? If so, how can I configure it? I guess that built-in TNC was abandoned. Are there any 3rd-party products (probably propriertary) which can extend my FreeRADIUS deployment with security compliance checks? I'd like to enforce specific antivirus software for some platforms, password and screen saver policies mostly for BYOD devices. Thank you. -- Bogdan Rudas Director of IT Europe Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

4 8

Enabling core dumps for ASSERT FAILED src/main/detail.c[545]: data->vps == NULL
by Vikash Badal (IS) 19 Mar '18

19 Mar '18

Greetings Please advise as to what i've done wrong, im trying to get a core dump for an ASSERT FAILED src/main/detail.c[545]: data->vps == NULL logs show: Mar 16 23:24:50 gsm-radius-cellc1 radiusd[36300]: ASSERT FAILED src/main/detail.c[545]: data->vps == NULL Mar 16 23:24:50 gsm-radius-cellc1 radiusd[36690]: Changing value of PR_DUMPABLE not supported on this system Mar 16 23:24:50 gsm-radius-cellc1 radiusd[36690]: Core dumps are enabled -- Mar 16 23:31:34 gsm-radius-cellc1 radiusd[36690]: ASSERT FAILED src/main/detail.c[545]: data->vps == NULL Mar 16 23:31:34 gsm-radius-cellc1 radiusd[37453]: Changing value of PR_DUMPABLE not supported on this system Mar 16 23:31:34 gsm-radius-cellc1 radiusd[37453]: Core dumps are enabled in radius.conf i have: panic_action = "gdb -silent -x ${raddbdir}/panic.gdb %e %p 2>&1 | tee ${logdir}/gdb-${name}-%p.log" allow_core_dumps = yes Freeradius: 3.0.16 FreeBSD : 11.1-RELEASE coredumps are allowed on OS, yet i don't have and dumps root@gsm-radius-cellc1:~ # sysctl -a | grep kern.core kern.corefile: %N.core kern.coredump: 1 kern.coredump_pack_vmmapinfo: 1 kern.coredump_pack_fileinfo: 1 Thanks Vikash Regards Vikash Badal Senior Technical Systems Engineer T +27 11 5750825 C +27 83 6774915 www.is.co.za Internet Solutions is a division of Dimension Data Disclaimer: https://www.is.co.za/legal/#e-mail-confidentiality-notice-and-disclaimer

3 4

multiotp with strongswan has no (ms)-chap-challenge
by karthik kumar 17 Mar '18

17 Mar '18

Hi, I am setting up 2factor auth and we use Strongswan as our VPN server. I use FreeRADIUS as backend of Strongwan. This is the setup mac osx (ikev2 with eap-mschapv2) ---> Strongswan ---> FreeRADIUS --> multiotp First I tried with clear text password in /etc/raddb/users and it is successful. For 2factor I need to pair it with multiOTP. I followed the doc https://wiki.freeradius.org/guide/multiOTP-HOWTO and it is successfully working *# radtest -t mschap kumar `oathtool --totp 3683453456769abc3452` 127.0.0.1 0 testing123* *Sent Access-Request Id 1 from 0.0.0.0:53097 <http://0.0.0.0:53097> to 127.0.0.1:1812 <http://127.0.0.1:1812> length 131* * User-Name = "kumar"* * MS-CHAP-Password = "987897"* * NAS-IP-Address = 127.0.0.1* * NAS-Port = 0* * Message-Authenticator = 0x00* * Cleartext-Password = "987897"* * MS-CHAP-Challenge = 0xcb76ef02a264e636* * MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000021c2d6262c11c88b4265e63da64e4f80dc46364e75d90df* *Received Access-Reject Id 1 from 127.0.0.1:1812 <http://127.0.0.1:1812> to 0.0.0.0:0 <http://0.0.0.0:0> length 61* *(0) multiotp: Executing: /usr/bin/multiotp %{User-Name} %{User-Password} -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}:* *(0) multiotp: EXPAND %{User-Name}* *(0) multiotp: --> kumar* *(0) multiotp: EXPAND %{User-Password}* *(0) multiotp: -->* *(0) multiotp: EXPAND -src=%{Packet-Src-IP-Address}* *(0) multiotp: --> -src=127.0.0.1* *(0) multiotp: EXPAND -chap-challenge=%{CHAP-Challenge}* *(0) multiotp: --> -chap-challenge=* *(0) multiotp: EXPAND -chap-password=%{CHAP-Password}* *(0) multiotp: --> -chap-password=* *(0) multiotp: EXPAND -ms-chap-challenge=%{MS-CHAP-Challenge}* *(0) multiotp: --> -ms-chap-challenge=0xcb76ef02a264e636* *(0) multiotp: EXPAND -ms-chap-response=%{MS-CHAP-Response}* *(0) multiotp: --> -ms-chap-response=0x0001000000000000000000000000000000000000000000000000021c2d6262c11c88b4265e63da64e4f80dc46364e75d90df* *(0) multiotp: EXPAND -ms-chap2-response=%{MS-CHAP2-Response}* *(0) multiotp: --> -ms-chap2-response=* *(0) multiotp: Program returned code (0) and output ''* *(0) multiotp: Program executed successfully* *(0) [multiotp] = ok* But when I use Strongswan, there is no MS-CHAP-Challenge (i tried with %{mschap:Challenge}) *(1) multiotp: Executing: /usr/bin/multiotp %{User-Name} %{User-Password} -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}:* *(1) multiotp: EXPAND %{User-Name}* *(1) multiotp: --> karthik* *(1) multiotp: EXPAND %{User-Password}* *(1) multiotp: -->* *(1) multiotp: EXPAND -src=%{Packet-Src-IP-Address}* *(1) multiotp: --> -src=127.0.0.1* *(1) multiotp: EXPAND -chap-challenge=%{CHAP-Challenge}* *(1) multiotp: --> -chap-challenge=* *(1) multiotp: EXPAND -chap-password=%{CHAP-Password}* *(1) multiotp: --> -chap-password=* *(1) multiotp: EXPAND -ms-chap-challenge=%{MS-CHAP-Challenge}* *(1) multiotp: --> -ms-chap-challenge=* *(1) multiotp: EXPAND -ms-chap-response=%{MS-CHAP-Response}* *(1) multiotp: --> -ms-chap-response=* *(1) multiotp: EXPAND -ms-chap2-response=%{MS-CHAP2-Response}* *(1) multiotp: --> -ms-chap2-response=* Any help on this please ? Thanks

4 12

Secondary Authentication on FreeRadius
by Christian Becerra 16 Mar '18

16 Mar '18

We have a Juniper SSL VPN device that we want to authenticate to AD via the Free Radius. If the Username and password is good - Want to have another check against our Scheduling software that manages the users Time of Allowed VPN. It is front ended by an API via HTTP If the scheduling software says the time is good - We want to send a message back to the Juniper - that access is allowed. If anyone is interested in taking on this project, please respond to me with either an hourly rate of project cost. Let me know Thanks Chris

2 1

is there a way to identify the very first ACCESS-REQUEST
by Michael Hocke 16 Mar '18

16 Mar '18

Hi there, I want to improve our logging and want to keep track of authentication attempts that do not complete. I was thinking of logging the very first ACCESS-REQUEST and then later on the result. Is there a good way to identify the very first ACCESS-REQUEST from the client with unlang? Maybe by checking the contents of the session-state list or some such? Any ideas? Thanks! - Michael

4 6

Additional Step for Authentication
by Christian Becerra 16 Mar '18

16 Mar '18

Good Morning We have FreeRadius authenticating users via AD. We want to perform an additional step of Authorization based on "Time Allowed to Login" We have an API that will already check if the User is allowed in based on their login time. What documentation can I look at to create the script? Basically if FreeRadius checks AD and thats good....then to make the additional check against our API and then to respond to the NAS that logging in is allowed. Let me know and I will start to research. Thanks

2 1

Strongswan integration, Access-Request contains no credentials?
by Phil Frost 16 Mar '18

16 Mar '18

I'm attempting to configure an IKEv2 VPN which uses strongswan's eap-radius plugin to delegate authentication to freeradius. I've configured freeradius to authenticate against Active Directory by executing ntlm_auth, and I'm hoping to use mschapv2 authentication. I'm able to successfully authenticate with radtest: radtest -x -t mschap phil.frost redacted 127.0.0.1 0 redacted Sending Access-Request of id 193 to 127.0.0.1 port 1812 User-Name = "phil.frost" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = redacted MS-CHAP-Response = redacted rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=193, length=84 MS-CHAP-MPPE-Keys = redacted MS-MPPE-Encryption-Policy = redacted MS-MPPE-Encryption-Types = redacted I'm also able to connect to the VPN if I use the eap-mschapv2 strongswan plugin in lieu of eap-radius and configure a plaintext password in strongswan's user database. So it would appear the issue is the integration between the two. Should strongswan be including the credentials? Or should freeradius be doing something to indicate the VPN client should present them? I've learned many ways things could work, but a hint at how they *should* work in this case would very much help me narrow what's otherwise been a fruitless search through a combinatorial explosion of RFCs and protocol options. This seems to be the most salient part of the freeradius output. The unabbridged debug output is attached. rad_recv: Access-Request packet from host 127.0.0.1 port 60479, id=236, length=137 User-Name = "phil.frost" NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 5 NAS-Port-Id = "ikev2-vpn" NAS-IP-Address = 10.6.0.81 Called-Station-Id = "10.6.0.81[4500]" Calling-Station-Id = "73.161.191.57[4500]" NAS-Identifier = "strongSwan" Message-Authenticator = redacted # Executing section authorize from file /etc/freeradius/sites-enabled/postmates +group authorize { ++[preprocess] = ok ++[mschap] = noop +} # group authorize = ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user.

2 1