- Freeradius-Users - lists.freeradius.org

eap-fast: using eap-fast-mschapv2 in anonymous tunnel
by Isaac Boukris 23 Sep '17

23 Sep '17

Hello all, I've been trying to test eap-fast unauthenticated provisioning (RFC 5422), and was getting mschap errors, for which I think I found a fix - see attached patch (v3.0x). With this patch, the mschap authentication stage succeeds using eapol_test and a tunnel-pac is provisioned (while the first eapol exchange ends with reject as allowed by the RFC, the subsequent authentication successes using the newly provisioned pac). My eapol_test config (my server config is almost untouched): network={ ssid="eap-fast-test" key_mgmt=WPA-EAP eap=FAST anonymous_identity="FAST-000102030405" identity="bob" password="hello" phase1="fast_provisioning=1" pac_file="/local/file" } I also tried out the v4.0x branch but encountered some other issues. First had to add a cast to float when comparing with tls_max_version (inst->tls_conf->tls_max_version > (float) 1.1), as otherwise: float x = 1.1; if (x > 1.1) yields true for some reason. Then however, I get a crash which I can't figure so far - logs with back-trace attached. Thanks, Isaac B.

2 1

Proxy CHAP into EAP session
by Jonathan 22 Sep '17

22 Sep '17

I'm looking for a way on how to proxy / recreate a session into an EAP session. STEPS 1 normal RADIUS session with CHAP password Received by RADIUS server1 2 RADIUS server1 converts/proxies it into a second RADIUS request but as an EAP session towards a RADIUS server2 which handles the full request. Any hints on how to do this? Can it even be done?

3 3

Fwd: Bind radius client requests to a database
by Ti Ti 22 Sep '17

22 Sep '17

HI've the following freeradius configuration that I use to bind radius clients to a specific db. The problem is that I use a virtual radius associated to every db and I would avoid this. Is that possible to have a single radius instance listening and forward the request to db using radius client password (eventually contained in the nas table)? server rad1 { listen { ipaddr = * port = 1820 type = auth } listen { ipaddr = * port = 1821 type = acct } authorize { db_rad_1 dailycounter_db_rad_1 noresetcounter_db_rad_1 preprocess chap mschap digest suffix eap { ok = return } files expiration logintime pap totalbytecounter_db_rad_1{ reject = 1 } if(reject){ update reply { Reply-Message := \"SESSION TERMINATED - YOUR TICKET IS EXPIRED\" } reject } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest eap } preacct { preprocess acct_unique suffix files } accounting { db_rad_1 exec attr_filter.accounting_response } session { db_rad_1 } post-auth { exec Post-Auth-Type REJECT { db_rad_1 attr_filter.access_reject } } pre-proxy { } post-proxy { eap } } sql db_rad_1 { database = "mysql" driver = "rlm_sql_${database}" dialect = "mysql" server = "localhost" port = 3306 login = "test" password = "test" radius_db = "radius1" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" delete_stale_sessions = yes sqltrace = no sqltracefile = ${logdir}/sqltrace.sql num_sql_socks = ${thread[pool].max_servers} connect_failure_retry_delay = 60 lifetime = 0 max_queries = 0 group_attribute = "${.:instance}-SQL-Group" read_clients = yes client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf }

3 9

Re: Terminate EAP-TTLS then proxy
by Alan Buxey 22 Sep '17

22 Sep '17

Change default EAP type md5 to ttls in your EAP module, that'll save a resend Next look at how you are handling realms in outer and inner. If only proxying ttls then comment out prefix/suffix from outer server. Finally, by default, there's a big safety switch in the inner tunnel to ensure things don't by default get their proxy changed in ttls , remove the proxy-to-realm statement (read the surrounding warning text) *or* update it to be relevant eg wrap it in unlang statement to only occur if the realm is not passpoint Ps having worked with passpoint myself I think I know what and why you are doing this ;) alan On 21 Sep 2017 11:27 pm, "Alan DeKok" <aland(a)deployingradius.com> wrote: On Sep 21, 2017, at 6:24 PM, <adrian.p.smith(a)bt.com> <adrian.p.smith(a)bt.com> wrote: > > Hi Alan, > > I proxy-to-realn LOCAL in the default server as I was advised to do this as part of the EAP-TTLS termination and Transfer to the inner-tunnel. > > Perhaps this is not needed? It's needed if you don't want to proxy the outer EAP session. > My aim is be able to terminate the EAP and then proxy the request to another server. Then edit the inner tunnel to delete the "Proxy-To-Realm = Local" attribute. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

2 1

Terminate EAP-TTLS then proxy
by adrian.p.smith＠bt.com 22 Sep '17

22 Sep '17

I would like to be able to proxy the Auth request after terminating the EAP-TTLS. FreeRadius sees the realm prefix on the User-Name and wants to proxy first. Is this possible or even sensible please? Regards, Adrian

6 20

Porting ldap module configuration from 2.2.9 to 3.0.15
by Olivier 21 Sep '17

21 Sep '17

Hi, I am curently trying to migrate my sever from freeradius 2 to 3 and am facing a number of problems. The first in in ldap module. In version 2, I did not define an identity nor a password and the binding to ldap server is made with the user name and password, effectively using ldap to authenticate the user. In ldap logs, with Freeradius 2, I have: Aug 31 16:19:41 ldap slapd[550]: conn=60636 fd=98 ACCEPT from IP=192.41.170.6:39806 (IP=192.41.170.6:636) Aug 31 16:19:41 ldap slapd[550]: conn=60636 fd=98 TLS established tls_ssf=256 ssf=256 Aug 31 16:19:41 ldap slapd[550]: conn=60636 op=0 BIND dn="uid=on,ou=People,ou=csim,dc=cs,dc=ait,dc=ac,dc=th" method=128 Aug 31 16:19:41 ldap slapd[550]: conn=60636 op=0 BIND dn="uid=on,ou=People,ou=csim,dc=cs,dc=ait,dc=ac,dc=th" mech=SIMPLE ssf=0 Aug 31 16:19:41 ldap slapd[550]: conn=60636 op=0 RESULT tag=97 err=0 text= Aug 31 16:19:41 ldap slapd[550]: conn=60636 op=1 UNBIND Aug 31 16:19:41 ldap slapd[550]: conn=60636 fd=98 closed showing that radius has properly bound to ldap using the username (dn="on"). With the version3, I see: Aug 31 16:30:32 ldap slapd[550]: conn=60904 fd=107 ACCEPT from IP=192.41.170.3:37996 (IP=192.41.170.6:636) Aug 31 16:30:32 ldap slapd[550]: conn=60904 fd=107 TLS established tls_ssf=256 ssf=256 Aug 31 16:30:32 ldap slapd[550]: conn=60904 op=0 BIND dn="" method=128 where an anonymous bind is attempted (dn=""). I am not sure what has change in this regard between version 2 and 3, but I really need to replicate the same mechanism as in version 2, that is bind with the user name instead of going with some administrator account that would search in the ldap directory. How can I acheive that? Thanks in advance, Olivier --

4 17

Solaris 10 Package for a Radius Client
by Cain, Kenneth L (Ken) 21 Sep '17

21 Sep '17

I'm trying to find a Solaris package to use to set up a Solaris 10 server as a RADIUS client, i.e. to use our corporate servers for RADIUS authentication. I've pulled the files from the website and tried to configure them but I'm having difficulty find the necessary files to configure my server to query a RADIUS server as well as what files I would need to copy over to other servers. Any suggestions? Ken Cain Verizon

2 2

No "known good" password added
by Bhagwat, Shrikant 21 Sep '17

21 Sep '17

(0) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute Admin has permission to read password. Radius server connects to LDAP OK. Bind was successful Our ldap server is Novell eDirectory. Radius Server connect by port 636 only. I don't think we use TLS. Which part of configuration is causing the problem ********************************************************** Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues

2 3

Migrating configuration. Users file
by jan hugo prins 21 Sep '17

21 Sep '17

Hello, In my version 2 config I had a users file that was working fine. In my version 3 config I have moved the content of this file to mods-config/files/authorize My huntsgroup file is working, or at least I see Huntgroup-Name attribute in my Auth-Detail logging. there are a few things I don't see at the moment and they are all related to my users /authorize file: - User to group mappings. - Aruba attributes are not added to an authenticated user - Users in my users file (phones etc) are not able to authenticate. In version 2 I had use_tunneled_reply = yes in my config. In version 3 this is depricated and now I have to do something with update outer.session-state in my inner-tunnel config. In version 2 I had to add some information regarding groups to the /etc/raddb/dictionary file. This file is in my config tree, but I have the idea that it is not being accessed. What could I be missing? Attached is my radiusd -X output file. Jan Hugo Prins

2 7

radtest fails with Access-Rejected
by Mark J. Bobak 21 Sep '17

21 Sep '17

Hi all, First, a bit of background: I've had this freeradius server working well for months. I built it, with Google Authenticator for two-factor authentication. I integrated it with my Dell Sonicwall to implement SSLVPN with two-factor authentication. All that was working fine. Yesterday, I needed to rebuild my AWS VPC (Virtual PRovate Cloud) so we could add a VPN tunnel from another office, which had conflicting IP address ranges, so, I built a new VPC and re-launched my freeradius servers into the new VPC, and stuff stopped working. I'm not sure what's going on here, but even a simple radtest fails. This is: [ec2-user@tfa-primary ~]$ /usr/sbin/radiusd -v radiusd: FreeRADIUS Version 3.0.13, for host x86_64-redhat-linux-gnu, built on Jul 17 2017 at 06:58:38 FreeRADIUS Version 3.0.13 When I run radtest, I get: [ec2-user@tfa-primary ~]$ radtest mbobak Welcome123816449 127.0.0.1:1812 0 NiTs#@\!xyzzy Sent Access-Request Id 36 from 0.0.0.0:51762 to 127.0.0.1:1812 length 76 User-Name = "mbobak" User-Password = "Welcome123816449" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "Welcome123816449" Received Access-Reject Id 36 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject Which doesn't seem to really indicate anything specific, that I can see. When I run radiusd with '-X' option and execute 'radtest', I get: (19) Received Access-Request Id 36 from 127.0.0.1:51762 to 127.0.0.1:1812 length 76 (19) User-Name = "mbobak" (19) User-Password = "Welcome123816449" (19) NAS-IP-Address = 127.0.1.1 (19) NAS-Port = 0 (19) Message-Authenticator = 0xcbae6be380f42f0e8bbff9e2419d229b (19) # Executing section authorize from file /etc/raddb/sites-enabled/default (19) authorize { (19) policy filter_username { (19) if (&User-Name) { (19) if (&User-Name) -> TRUE (19) if (&User-Name) { (19) if (&User-Name =~ / /) { (19) if (&User-Name =~ / /) -> FALSE (19) if (&User-Name =~ /@[^@]*@/ ) { (19) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (19) if (&User-Name =~ /\.\./ ) { (19) if (&User-Name =~ /\.\./ ) -> TRUE (19) if (&User-Name =~ /\.\./ ) { (19) update request { (19) &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s' (19) } # update request = noop (19) [reject] = reject (19) } # if (&User-Name =~ /\.\./ ) = reject (19) } # if (&User-Name) = reject (19) } # policy filter_username = reject (19) } # authorize = reject (19) Using Post-Auth-Type Reject (19) # Executing group from file /etc/raddb/sites-enabled/default (19) Post-Auth-Type REJECT { (19) attr_filter.access_reject: EXPAND %{User-Name} (19) attr_filter.access_reject: --> mbobak (19) attr_filter.access_reject: Matched entry DEFAULT at line 11 (19) [attr_filter.access_reject] = updated (19) [eap] = noop (19) policy remove_reply_message_if_eap { (19) if (&reply:EAP-Message && &reply:Reply-Message) { (19) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (19) else { (19) [noop] = noop (19) } # else = noop (19) } # policy remove_reply_message_if_eap = noop (19) } # Post-Auth-Type REJECT = updated (19) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (19) Sending delayed response (19) Sent Access-Reject Id 36 from 127.0.0.1:1812 to 127.0.0.1:51762 length 20 Waking up in 3.9 seconds. (19) Cleaning up request packet ID 36 with timestamp +5768 Ready to process requests Can someone offer me a clue? Thanks! -Mark

2 1