- Freeradius-Users - lists.freeradius.org

PEAP correct client certificate
by Oliver Tollning 23 Nov '17

23 Nov '17

Hello, I'm currently setting up a RADIUS server(v. 2.2.8) for the first time. I followed the instructions and could connect with EAP and PEAP to my server. Since I only want to use PEAP I disabled every other authentication method by commenting out everything else in /sites-enabled/default. This works fine, since I cant connect with normal EAP anymore. I went through the process of creating my own certificate with openssl and set everything up in eap.conf under eap-tls{}. In peap{} I added EAP-TLS-Require-Client-Cert = Yes. The problem is, that the client can connect to the server even though he doesnt have the correct client certificate. How can I tell the server to check the client certificate?

4 12

Compiling freeRadius with latest OPENSSL
by kavita jindal 23 Nov '17

23 Nov '17

Hi, I am trying to compile Freeradius 3.0.x with openSSL 1.1.0g . I am getting following errors. openssl version gives following output: OpenSSL 1.1.0g 2 Nov 2017 /modules/rlm_eap/libeap/eapsimlib.c CC src/modules/rlm_eap/libeap/fips186prf.c CC src/modules/rlm_eap/libeap/comp128.c CC src/modules/rlm_eap/libeap/eap_tls.c In file included from src/modules/rlm_eap/libeap/eap_tls.c:46:0: src/modules/rlm_eap/libeap/eap_tls.h:58:1: error: unknown type name ‘fr_tls_status_t’ fr_tls_status_t eaptls_process(eap_handler_t *handler); ^ src/modules/rlm_eap/libeap/eap_tls.h:62:36: error: unknown type name ‘tls_session_t’ int eaptls_request(EAP_DS *eap_ds, tls_session_t *ssn) CC_HINT(nonnull); ^ In file included from src/modules/rlm_eap/libeap/eap_tls.c:46:0: src/modules/rlm_eap/libeap/eap_tls.h:66:45: error: unknown type name ‘SSL’ void eaptls_gen_mppe_keys(REQUEST *request, SSL *s, char const *prf_label); ^ src/modules/rlm_eap/libeap/eap_tls.h:67:28: error: unknown type name ‘SSL’ void eapttls_gen_challenge(SSL *s, uint8_t *buffer, size_t size); ^ src/modules/rlm_eap/libeap/eap_tls.h:68:48: error: unknown type name ‘SSL’ void eaptls_gen_eap_key(RADIUS_PACKET *packet, SSL *s, uint32_t header); ^ src/modules/rlm_eap/libeap/eap_tls.h:69:35: error: unknown type name ‘SSL’ void eap_fast_tls_gen_challenge(SSL *ssl, uint8_t *buffer, uint8_t *scratch, size_t size, char const *prf_label) CC_HINT(nonnull); ^ src/modules/rlm_eap/libeap/eap_tls.h:103:1: error: unknown type name ‘tls_session_t’ tls_session_t *eaptls_session(eap_handler_t *handler, fr_tls_server_conf_t *tls_conf, bool client_cert); ^ src/modules/rlm_eap/libeap/eap_tls.h:103:55: error: unknown type name ‘fr_tls_server_conf_t’ tls_session_t *eaptls_session(eap_handler_t *handler, fr_tls_server_conf_t *tls_conf, bool client_cert); ^ src/modules/rlm_eap/libeap/eap_tls.h:107:1: error: unknown type name ‘fr_tls_server_conf_t’ fr_tls_server_conf_t *eaptls_conf_parse(CONF_SECTION *cs, char const *key); ^ src/modules/rlm_eap/libeap/eap_tls.c:64:1: error: unknown type name ‘tls_session_t’ tls_session_t *eaptls_session(eap_handler_t *handler, fr_tls_server_conf_t *tls_conf, bool client_cert) ^ src/modules/rlm_eap/libeap/eap_tls.c:64:55: error: unknown type name ‘fr_tls_server_conf_t’ If i compile with openssl 1.0.0f it works fine. Is it possible to compile freeradius with latest OPENSSL version. I have a requirement for using latest SSL. Regard Kavita

2 5

ssl3_get_client_hello:no shared cipher
by kavita jindal 23 Nov '17

23 Nov '17

Hi All, I am using free radius 3.0.15 ,while using i am getting following error I searched the forums ,some people have already raised the issue but i could not find any solution. eap_tls: (other): before/accept initialization (1) eap_tls: TLS_accept: before/accept initialization (1) eap_tls: <<< recv TLS 1.2 [length 0042] (1) eap_tls: >>> send TLS 1.2 [length 0002] (1) eap_tls: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error tls: TLS_accept: Error in error (1) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher (1) eap_tls: ERROR: System call (I/O) error (-1) (1) eap_tls: ERROR: TLS receive handshake failed during operation (1) eap_tls: ERROR: [eaptls process] = fail (1) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (1) eap: Sending EAP Failure (code 4) ID 96 length 4 Also when i use ,its shows my ciphersuite : openssl ciphers 'ALL' | grep ECDHE-ECDSA-AES128-GCM-SHA256 In eap file,i have used: default_eap_type = tls cipher_list = "ALL" Please help,i am stuck. Regards Kavita

2 1

virtual servers
by Andrew Meyer 22 Nov '17

22 Nov '17

If I wanted to setup Virtual servers w/ FreeRADIUS 3 could I copy the files in /etc/raddb/sites-enabled/ to a different name and change the server name and the ip address it lives on? I have tried doing this and gotten the following error: Failed binding to auth address 10.2.0.11 port 1812 bound to server wireless: Cannot assign requested address /etc/raddb/sites-enabled/wireless[59]: Error binding to port for 10.2.0.11 port 1812 I am running this on CentOS 7 latest.

2 2

LB layer - Issue with shared secret.
by Andrea Mucci 22 Nov '17

22 Nov '17

Hi all, I would like to use a load balance as the first layer proxy the requests on more than one radius server. In this way, the radius packet will always be sent from the same IP address, so we would have a problem with the shared secret. Can I do that freeradius retrieves client's information via NAS-IP-Address attribute and not via Sender IP Address? I use freeradius-server-3.0.15 on RHEL 7. Best regards Andrea

2 1

Why does 'switch' and case don't work?
by luckydog xf 22 Nov '17

22 Nov '17

Hi, switch statement in post-auth section doesn't work, see below. ============= switch &LDAP-Group { case "network-admins" { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "3", Login-Service = 50, } } case "network-0" { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "0", Login-Service = 50, } } case { reject } } ========================= It always comes down to the 'default' reject part, it looks like <LDAP-Group > match nothing. where if/elsif/else works as expected. What's wrong with my statement above?

3 3

FreeRadius rate limit + CISCO ASR9001
by Yahn do Amaral Almeida Pinheiro 21 Nov '17

21 Nov '17

Can someone tell me how to configure a user's bandwidth limit by the database? I use a Cisco ASR9001. The only attribute I found was: *radgroupreply* | groupname | attribute | op | value ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | 128KB | Cisco-Avpair | := | lcp:interface-config#1=rate-limit input 2000 8000 8000 conform-action transmit exceed-action drop ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | 128KB | Cisco-Avpair | := | lcp:interface-config#1=rate-limit output 2000 8000 8000 conform-action transmit exceed-action drop *radusergroup* username | groupname --------------------------------- user | 128KB But it does not work.

2 1

Operator being rewritten - rlm_python
by Fraser McGlinn 20 Nov '17

20 Nov '17

Hi Guys, Trying to get rlm_python going on 3.0.13 on Centos 7. Got everything working correctly although I am finding that the reply tuple does not appear to be accepting my operator +=. See debug below: authorize - 'reply:Framed-IP-Address' = '192.0.2.0' authorize - 'reply:Cisco-AVPair' += 'ip:dns-servers=192.0.2.255 192.0.2.254' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#10=deny udp any any eq domain' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#20=deny udp any any eq snmp' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#30=deny udp any any eq 1900' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#40=deny tcp any any eq 80' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#50=deny udp any any eq 80' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#60=deny tcp any any eq 443' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#70=deny udp any any eq 443' authorize - 'reply:Cisco-AVPair' += 'ip:outacl#80=permit ip any any' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#10=deny udp any any eq domain' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#20=deny udp any any eq snmp' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#30=deny udp any any eq 1900' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#40=deny tcp any any eq 80' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#50=deny udp any any eq 80' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#60=deny tcp any any eq 443' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#70=deny udp any any eq 443' authorize - 'reply:Cisco-AVPair' += 'ipv6:outacl#80=permit ipv6 any any' authorize - 'config:Cleartext-Password' = 'test' (0) [python] = ok (0) } # authorize = ok (0) Found Auth-Type = CHAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type CHAP { (0) chap: Comparing with "known good" Cleartext-Password (0) chap: CHAP user "test(a)domain.com" authenticated successfully (0) [chap] = ok (0) } # Auth-Type CHAP = ok (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Login OK: [test(a)domain.com] (from client localhost port 0) (0) Sent Access-Accept Id 121 from 127.0.0.1:1812 to 127.0.0.1:54848 length 0 (0) Framed-IP-Address = 192.0.2.0 (0) Cisco-AVPair = "ip:dns-servers=192.0.2.255 192.0.2.254" (0) Cisco-AVPair = "ip:outacl#10=deny udp any any eq domain" (0) Cisco-AVPair = "ip:outacl#20=deny udp any any eq snmp" (0) Cisco-AVPair = "ip:outacl#30=deny udp any any eq 1900" (0) Cisco-AVPair = "ip:outacl#40=deny tcp any any eq 80" (0) Cisco-AVPair = "ip:outacl#50=deny udp any any eq 80" (0) Cisco-AVPair = "ip:outacl#60=deny tcp any any eq 443" (0) Cisco-AVPair = "ip:outacl#70=deny udp any any eq 443" (0) Cisco-AVPair = "ip:outacl#80=permit ip any any" (0) Cisco-AVPair = "ipv6:outacl#10=deny udp any any eq domain" (0) Cisco-AVPair = "ipv6:outacl#20=deny udp any any eq snmp" (0) Cisco-AVPair = "ipv6:outacl#30=deny udp any any eq 1900" (0) Cisco-AVPair = "ipv6:outacl#40=deny tcp any any eq 80" (0) Cisco-AVPair = "ipv6:outacl#50=deny udp any any eq 80" (0) Cisco-AVPair = "ipv6:outacl#60=deny tcp any any eq 443" (0) Cisco-AVPair = "ipv6:outacl#70=deny udp any any eq 443" (0) Cisco-AVPair = "ipv6:outacl#80=permit ipv6 any any" Note in the authorize reply output provided by rlm_python shows the op as +=, but the op in the access accept show =. I note that in the source there is a sanity check to verify the operator passed to rlm_python, but I'm not seeing any logs even in -XX showing that its being rewritten as per the source. Any ideas? Thanks, Fraser

2 2

Error: Discarding duplicate request from client
by Krauss International 20 Nov '17

20 Nov '17

hello I am getting lot of error messages in radius logs saying Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 59350 - ID: 202 due to unfinished request 12 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 36510 - ID: 205 due to unfinished request 17 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 33750 - ID: 207 due to unfinished request 18 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 41954 - ID: 206 due to unfinished request 19 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 60427 - ID: 209 due to unfinished request 21 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 36208 - ID: 210 due to unfinished request 22 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 57888 - ID: 211 due to unfinished request 24 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 59072 - ID: 213 due to unfinished request 26 in component post-auth module exec. Fri Nov 3 14:26:03 2017 : Error: Discarding duplicate request from client CCR port 45146 - ID: 214 due to unfinished request 32 in component post-auth module exec. When users are trying to loh=gin in the NAS I can see in NAS logs that radius is timing out, what could be the reason for this? Thanks & regards Mankomal Singh Krauss International P: +91-9910416231 E: ms(a)kc-india.com PS: Send all bulk emails to sanman.krauss(a)gmail.com ONLY

3 4

FreeIPA- FreeRius--authenticate by One-time-password. DON'T USE users.
by luckydog xf 20 Nov '17

20 Nov '17

Hello, I asked this soluation several days ago, but right now I figure out how, so I write down here just FYI. 1. install FreeIPA and FreeRADIUS, refer to this link, https://www.freeipa.org/page/Using_FreeIPA_and_FreeRadius_as_a_RADIUS_based… 2. Critical part of `module-enabled/ldap` ldap { server = 'localhost' base_dn = 'dc=xxx,dc=com' user { base_dn = "cn=accounts,${..base_dn}" ========================================== group { base_dn = "cn=compat,${..base_dn}" filter = '(objectClass=posixGroup)' name_attribute = cn membership_filter = "(memberUid=%{%{Stripped-User-Name}:-%{User-Name}})" =================================== 3. Grant privileges with post-auth section of site-enabled/default =============================================== if (LDAP-Group == "network-admins") { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "3", Login-Service = 50, } } elsif (LDAP-Group == "network-operators") { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "2", Login-Service = 50, } } else { reject } 4. Create Group named 'network-admins', etc. add Users.. and enable OTP, test by 'radtest user password localhost 0 testing123' 5. That's all, good luck.

1 0