- Freeradius-Users - lists.freeradius.org

Accoiunting proxy Issue
by Richard J Palmer 27 Nov '17

27 Nov '17

Hi there We use firebrick Routers as LNS routers and they have worked fine in the past. However I have a new requirement to proxy one realm (authentication and accounting) to a remote server for a customer. I have the auth side working find - and the account start packet. However the firebrick does not provide the username in interim updates or stop messages - which means that the proxy based on realm fails (the username / realm is not there). Is there a way using unlang to proxy these - I was looking at the lines in detail - we do also have the records in our SQL server and from the AcctSessionID I can look up the username which is possible I do have one other possibility. The Interim updates have a field: Chargeable-User-Identity = "XXXXX" Which I can set as part of the auth process (I already add some fields in post_proxy). Is there a way in FreeRadius to inspect this field in a accounting packet and if set to 'resellerx' set the packet to be sent to their proxy / home server ? The second I assume would be faster .... I have also emailed the router manufacturer to see if the username can be added easily in a software patch but that may take time ... An example current accounting packet is: Sun Nov 26 20:00:05 2017 Acct-Status-Type = Interim-Update Chargeable-User-Identity = "BBEU12345675" Event-Timestamp = "Nov 26 2017 20:00:00 GMT" Acct-Input-Octets = 7137840 Acct-Input-Gigawords = 0 Acct-Output-Octets = 487340050 Acct-Output-Gigawords = 0 Acct-Session-Time = 576 Acct-Input-Packets = 99535 Acct-Output-Packets = 342237 Tunnel-Client-Endpoint:0 = "ADSL" NAS-Identifier = "aglovale.merula.net" Acct-Session-Id = "S600000269717072AECC00" NAS-IP-Address = 1.2.3.4 NAS-Port = 697 Connect-Info = "39550000/1000000000" Acct-Unique-Session-Id = "c89cbc69ab30d4afaff763c46057b04e" Timestamp = 1511726405 I would be grateful for any suggestions Richard

2 1

ntlm...ldap
by Carlos Bordon 24 Nov '17

24 Nov '17

Hi , > > I worte from argentina, i want ask you something please, > > i configure the freeradius with ntlm, but now need take groups of AD for the vlans, > > i have to do this part with ldap? > in resume, authentication with ntlm and groups with ldap, is right? > > Regards ands congratulations for this aplication. > Carlos

2 1

Module eap - attributes ca_file and ca_path
by Jérôme BERTHIER 24 Nov '17

24 Nov '17

Hello, Just a question about the section "tls-config tls-common" of the module eap file. Do both attributes ca_file and ca_path permit to verify a client certificate in an EAP-TLS authentication ? And so, if we do NOT want to permit EAP-TLS authentication, we have to : - comment out the attributes ca_file AND ca_path - concatenate the server certificate and the CA certificate (as explained in comments) This setup should allow to establish TLS tunnel for other EAP method (TTLS, PEAP) but refuse an EAP-TLS request. Is it correct ? our am I wrong ? Regards, -- Jérôme BERTHIER

2 2

PEAP correct client certificate
by Oliver Tollning 23 Nov '17

23 Nov '17

Hello, I'm currently setting up a RADIUS server(v. 2.2.8) for the first time. I followed the instructions and could connect with EAP and PEAP to my server. Since I only want to use PEAP I disabled every other authentication method by commenting out everything else in /sites-enabled/default. This works fine, since I cant connect with normal EAP anymore. I went through the process of creating my own certificate with openssl and set everything up in eap.conf under eap-tls{}. In peap{} I added EAP-TLS-Require-Client-Cert = Yes. The problem is, that the client can connect to the server even though he doesnt have the correct client certificate. How can I tell the server to check the client certificate?

4 12

Compiling freeRadius with latest OPENSSL
by kavita jindal 23 Nov '17

23 Nov '17

Hi, I am trying to compile Freeradius 3.0.x with openSSL 1.1.0g . I am getting following errors. openssl version gives following output: OpenSSL 1.1.0g 2 Nov 2017 /modules/rlm_eap/libeap/eapsimlib.c CC src/modules/rlm_eap/libeap/fips186prf.c CC src/modules/rlm_eap/libeap/comp128.c CC src/modules/rlm_eap/libeap/eap_tls.c In file included from src/modules/rlm_eap/libeap/eap_tls.c:46:0: src/modules/rlm_eap/libeap/eap_tls.h:58:1: error: unknown type name ‘fr_tls_status_t’ fr_tls_status_t eaptls_process(eap_handler_t *handler); ^ src/modules/rlm_eap/libeap/eap_tls.h:62:36: error: unknown type name ‘tls_session_t’ int eaptls_request(EAP_DS *eap_ds, tls_session_t *ssn) CC_HINT(nonnull); ^ In file included from src/modules/rlm_eap/libeap/eap_tls.c:46:0: src/modules/rlm_eap/libeap/eap_tls.h:66:45: error: unknown type name ‘SSL’ void eaptls_gen_mppe_keys(REQUEST *request, SSL *s, char const *prf_label); ^ src/modules/rlm_eap/libeap/eap_tls.h:67:28: error: unknown type name ‘SSL’ void eapttls_gen_challenge(SSL *s, uint8_t *buffer, size_t size); ^ src/modules/rlm_eap/libeap/eap_tls.h:68:48: error: unknown type name ‘SSL’ void eaptls_gen_eap_key(RADIUS_PACKET *packet, SSL *s, uint32_t header); ^ src/modules/rlm_eap/libeap/eap_tls.h:69:35: error: unknown type name ‘SSL’ void eap_fast_tls_gen_challenge(SSL *ssl, uint8_t *buffer, uint8_t *scratch, size_t size, char const *prf_label) CC_HINT(nonnull); ^ src/modules/rlm_eap/libeap/eap_tls.h:103:1: error: unknown type name ‘tls_session_t’ tls_session_t *eaptls_session(eap_handler_t *handler, fr_tls_server_conf_t *tls_conf, bool client_cert); ^ src/modules/rlm_eap/libeap/eap_tls.h:103:55: error: unknown type name ‘fr_tls_server_conf_t’ tls_session_t *eaptls_session(eap_handler_t *handler, fr_tls_server_conf_t *tls_conf, bool client_cert); ^ src/modules/rlm_eap/libeap/eap_tls.h:107:1: error: unknown type name ‘fr_tls_server_conf_t’ fr_tls_server_conf_t *eaptls_conf_parse(CONF_SECTION *cs, char const *key); ^ src/modules/rlm_eap/libeap/eap_tls.c:64:1: error: unknown type name ‘tls_session_t’ tls_session_t *eaptls_session(eap_handler_t *handler, fr_tls_server_conf_t *tls_conf, bool client_cert) ^ src/modules/rlm_eap/libeap/eap_tls.c:64:55: error: unknown type name ‘fr_tls_server_conf_t’ If i compile with openssl 1.0.0f it works fine. Is it possible to compile freeradius with latest OPENSSL version. I have a requirement for using latest SSL. Regard Kavita

2 5

ssl3_get_client_hello:no shared cipher
by kavita jindal 23 Nov '17

23 Nov '17

Hi All, I am using free radius 3.0.15 ,while using i am getting following error I searched the forums ,some people have already raised the issue but i could not find any solution. eap_tls: (other): before/accept initialization (1) eap_tls: TLS_accept: before/accept initialization (1) eap_tls: <<< recv TLS 1.2 [length 0042] (1) eap_tls: >>> send TLS 1.2 [length 0002] (1) eap_tls: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error tls: TLS_accept: Error in error (1) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher (1) eap_tls: ERROR: System call (I/O) error (-1) (1) eap_tls: ERROR: TLS receive handshake failed during operation (1) eap_tls: ERROR: [eaptls process] = fail (1) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (1) eap: Sending EAP Failure (code 4) ID 96 length 4 Also when i use ,its shows my ciphersuite : openssl ciphers 'ALL' | grep ECDHE-ECDSA-AES128-GCM-SHA256 In eap file,i have used: default_eap_type = tls cipher_list = "ALL" Please help,i am stuck. Regards Kavita

2 1

virtual servers
by Andrew Meyer 22 Nov '17

22 Nov '17

If I wanted to setup Virtual servers w/ FreeRADIUS 3 could I copy the files in /etc/raddb/sites-enabled/ to a different name and change the server name and the ip address it lives on? I have tried doing this and gotten the following error: Failed binding to auth address 10.2.0.11 port 1812 bound to server wireless: Cannot assign requested address /etc/raddb/sites-enabled/wireless[59]: Error binding to port for 10.2.0.11 port 1812 I am running this on CentOS 7 latest.

2 2

LB layer - Issue with shared secret.
by Andrea Mucci 22 Nov '17

22 Nov '17

Hi all, I would like to use a load balance as the first layer proxy the requests on more than one radius server. In this way, the radius packet will always be sent from the same IP address, so we would have a problem with the shared secret. Can I do that freeradius retrieves client's information via NAS-IP-Address attribute and not via Sender IP Address? I use freeradius-server-3.0.15 on RHEL 7. Best regards Andrea

2 1

Why does 'switch' and case don't work?
by luckydog xf 22 Nov '17

22 Nov '17

Hi, switch statement in post-auth section doesn't work, see below. ============= switch &LDAP-Group { case "network-admins" { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "3", Login-Service = 50, } } case "network-0" { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "0", Login-Service = 50, } } case { reject } } ========================= It always comes down to the 'default' reject part, it looks like <LDAP-Group > match nothing. where if/elsif/else works as expected. What's wrong with my statement above?

3 3

FreeRadius rate limit + CISCO ASR9001
by Yahn do Amaral Almeida Pinheiro 21 Nov '17

21 Nov '17

Can someone tell me how to configure a user's bandwidth limit by the database? I use a Cisco ASR9001. The only attribute I found was: *radgroupreply* | groupname | attribute | op | value ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | 128KB | Cisco-Avpair | := | lcp:interface-config#1=rate-limit input 2000 8000 8000 conform-action transmit exceed-action drop ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | 128KB | Cisco-Avpair | := | lcp:interface-config#1=rate-limit output 2000 8000 8000 conform-action transmit exceed-action drop *radusergroup* username | groupname --------------------------------- user | 128KB But it does not work.

2 1