- Freeradius-Users - lists.freeradius.org

eap_peap: TLS Alert read:fatal:unknown CA
by Nicolás Guerra 14 Sep '17

14 Sep '17

Hello everybody, I didn't find a thread with exactly my problem, so I start a new thread. I'm having problem with new certs in my freeradius server. I did what README file but didn't work for me. in radiusd -X log I see this: (14) Received Access-Request Id 143 from 192.168.100.149:43928 to 10.0.130.23:1812 length 343 (14) User-Name = "usuario" (14) Called-Station-Id = "C4-E9-84-91-2E-FE:OpenWrt" (14) NAS-Port-Type = Wireless-802.11 (14) NAS-Port = 1 (14) Calling-Station-Id = "28-56-5A-0B-6D-83" (14) Connect-Info = "CONNECT 54Mbps 802.11g" (14) Acct-Session-Id = "59BA907E-00000018" (14) WLAN-Pairwise-Cipher = 1027076 (14) WLAN-Group-Cipher = 1027076 (14) WLAN-AKM-Suite = 1027073 (14) Framed-MTU = 1400 (14) EAP-Message = 0x02e70090198000000086160301004610000042410492d1ad5ac120e777664ce20c7c650f4e41bc63a2eca81c1dbe4823c38737e4b81569bf9ec7f238534875e6f5b1525501127a1b9d59f780572d294986bb2f82091403010001011603010030d0e814aba78d0c8affc8aca00d5577364bcf5880d8616f (14) State = 0x64dfe0536738f990f317a982d66da244 (14) Message-Authenticator = 0x5340ff52aba979858d1a8e7d661ac258 (14) session-state: No cached attributes (14) # Executing section authorize from file /etc/raddb/sites-enabled/default (14) authorize { (14) policy filter_username { (14) if (!&User-Name) { (14) if (!&User-Name) -> FALSE (14) if (&User-Name =~ / /) { (14) if (&User-Name =~ / /) -> FALSE (14) if (&User-Name =~ /@.*@/ ) { (14) if (&User-Name =~ /@.*@/ ) -> FALSE (14) if (&User-Name =~ /\.\./ ) { (14) if (&User-Name =~ /\.\./ ) -> FALSE (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (14) if (&User-Name =~ /\.$/) { (14) if (&User-Name =~ /\.$/) -> FALSE (14) if (&User-Name =~ /(a)\./) { (14) if (&User-Name =~ /(a)\./) -> FALSE (14) } # policy filter_username = notfound (14) [preprocess] = ok (14) [chap] = noop (14) [mschap] = noop (14) [digest] = noop (14) suffix: Checking for suffix after "@" (14) suffix: No '@' in User-Name = "usuario", looking up realm NULL (14) suffix: No such realm "NULL" (14) [suffix] = noop (14) eap: Peer sent EAP Response (code 2) ID 231 length 144 (14) eap: Continuing tunnel setup (14) [eap] = ok (14) } # authorize = ok (14) Found Auth-Type = eap (14) # Executing group from file /etc/raddb/sites-enabled/default (14) authenticate { (14) eap: Expiring EAP session with state 0x64dfe0536738f990 (14) eap: Finished EAP session with state 0x64dfe0536738f990 (14) eap: Previous EAP request found for state 0x64dfe0536738f990, released from the list (14) eap: Peer sent packet with method EAP PEAP (25) (14) eap: Calling submodule eap_peap to process data (14) eap_peap: Continuing EAP-TLS (14) eap_peap: Peer indicated complete TLS record size will be 134 bytes (14) eap_peap: Got complete TLS record (134 bytes) (14) eap_peap: [eaptls verify] = length included (14) eap_peap: <<< recv TLS 1.0 Handshake [length 0046], ClientKeyExchange (14) eap_peap: TLS_accept: SSLv3 read client key exchange A (14) eap_peap: TLS_accept: SSLv3 read certificate verify A (14) eap_peap: <<< recv TLS 1.0 ChangeCipherSpec [length 0001] (14) eap_peap: <<< recv TLS 1.0 Handshake [length 0010], Finished (14) eap_peap: TLS_accept: SSLv3 read finished A (14) eap_peap: >>> send TLS 1.0 ChangeCipherSpec [length 0001] (14) eap_peap: TLS_accept: SSLv3 write change cipher spec A (14) eap_peap: >>> send TLS 1.0 Handshake [length 0010], Finished (14) eap_peap: TLS_accept: SSLv3 write finished A (14) eap_peap: TLS_accept: SSLv3 flush data (14) eap_peap: (other): SSL negotiation finished successfully (14) eap_peap: SSL Connection Established (14) eap_peap: [eaptls process] = handled (14) eap: Sending EAP Request (code 1) ID 232 length 65 (14) eap: EAP session adding &reply:State = 0x64dfe0536037f990 (14) [eap] = handled (14) } # authenticate = handled (14) Using Post-Auth-Type Challenge (14) Post-Auth-Type sub-section not found. Ignoring. (14) # Executing group from file /etc/raddb/sites-enabled/default (14) Sent Access-Challenge Id 143 from 10.0.130.23:1812 to 192.168.100.149:43928 length 0 (14) EAP-Message = 0x01e80041190014030100010116030100307ed7fccb2ae6411aaf4df33748b8b02954729256ddd506ace2d362f9cd28c4e05489136e8cbd84abb28b3d0921f1300a (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x64dfe0536037f990f317a982d66da244 (14) Finished request (14) Cleaning up request packet ID 143 with timestamp +187 Ready to process requests up to here, everything seems right. but when I start service, in service log I see this: Thu Sep 14 14:09:13 2017 : ERROR: (4) eap_peap: ERROR: TLS Alert read:fatal:unknown CA Thu Sep 14 14:09:13 2017 : ERROR: (4) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Thu Sep 14 14:09:13 2017 : ERROR: (4) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Thu Sep 14 14:09:13 2017 : Auth: (4) Login incorrect (eap_peap: TLS Alert read:fatal:unknown CA): [usuario] (from client wrtnicolas.fder port 1 cli 28-56-5A-0B-6D-83) any help will be wellcome. saludos/greetings Nicolás.

3 4

Resolving Too many differnet filenames for detail log file
by Zhi-Wei Lu 14 Sep '17

14 Sep '17

Hi FreeRadius experts, I would like to seek advice at configuring freeradius to overcome an issue that we had encountered recently. We noticed recently that login into our switches/routers took considerably longer than before. The VM (CentOS 7, with freeradius 3.04) didn't have much load at all: load average: 0.00, 0.01, 0.05 After some more trouble shooting, I realized that the problem was related to writing detail accounting files: Wed Sep 6 13:22:38 2017 : ERROR: (219185) ERROR: detail : Couldn't open file /var/log/radius/radacct/10.1.1.26/detail-20170906: Too many different filenames By searchin online, it appears that there is a hard coded limit of 64 files in log.c lf->max_entries = 64; When we hit that limit, login into our switches/routers become slow. Our normal work load usually does not trig this problem. A handful of network admins log into switches and routers when we need to until we examine switch issue by using a script via cron (with ~40 parallel login into different switches at a time every 10 minutes), then we started to encounter slow login while these jobs were busy. Now that we know the root cause of the problem, we could mitigate the problem by 1. recompile the code with high max_entries number. 2. add more radius servers and randomize switch radius server configuration. 3. optizime freeradius configuration. Our current setup is very basic, unix (nis) authentication, detail file accounting. I would like to hear recommendations of resolving \ this accounting issue, preferably not patching/recompiling code from time to time. Shall we configure MySQL/PostgreSQL database for accounting only? Thank you very much for your help. Zhi-Wei Lu IET-CR-Network Operations Center University of California, Davis (530) 752-0155

2 6

Control sub-TLV attributes order in rest module
by Avner Elizarov 13 Sep '17

13 Sep '17

Hi, I'm using the freeradius rest module to convert form json to radius format. I have a TLV attribute with several sub-attributes and I want to control the order that the rest module puts the sub attributes. For example, lets say I have an example TLV (tlv_example) with 2 sub attributes, a string (*sub1*) and an integer (*sub2*). I want to create 2 instances of the *tlv_example*, each with its own 2 sub attributes. How should I send the information to the rest module in a way that it would generate 2 seperate AVPs (one for each tlv) and how can I control the order of the sub-attributes inside each AVP? The format I used so far was sending an array for each sub attribute and this created a single AVP that contained all of the sub attributes in the follwoing order: <sub1_instance1><sub1_instance2><sub2_instance1><sub2_instance2> Meaning all instances of the same sub attribute were grouped together and i would like the format to be: <sub1_instance1<sub2_instance1>><sub1_instance2><sub2_instance2> Meaning all sub attributes of the same instance to be grouped (in a seperate TLV). What is the json format I need to use for that to happen? Thanks, Avner

4 13

EAP-TLS: Strategies for getting the right certificate to the right user
by Chevalier Violet 13 Sep '17

13 Sep '17

I've been googling around and kind of surprised to not be seeing a ton of resources about this. Maybe you all can help! EAP-TLS: Strategies for getting the right certificate to the right user. It needs to be relatively automated. I do have users coming by with BYOD devices, e.g. iPhones (omg they're super finicky about the freeradius setup but that's another story!), frequently when I'm not around to set them up. Users are starting with no internet access. I was thinking maybe of the following: 1) Use some kind of TTLS-MSCHAPv2 thing with a standard user & password for guests that would change every so often. Maybe let them use the internet either i) for a few minutes at a time or ii) only to access a page on the internal network from which they could download the guest certificate that would allow them to connect via EAP-TLS? 3) the certs would expire after a few days. I have been struggling to get even my own iPhone to have the proper cert! On the bright side, my two linux machines are now working with EAP-TLS so there's hope for me! I wish I could just put the certs on a USB key but that doesn't work for phones. And it's a bunch of Linux machines, no Windows or Macs around. Excuse me if this is a n00b question. Thanks everyone! PS At this link: https://github.com/FreeRADIUS/freeradius-server/issues/2045# issuecomment-324641610 Arr2036 mentions that the hot spot 2.0 standards set out how this could work, with auto-renewing certs and the whole 9 yards. I wasn't able to find how to make that work for linux, for instance with freeradius. Thanks!

5 9

Re: Freeradius-Users Digest, Vol 149, Issue 47
by Chevalier Violet 13 Sep '17

13 Sep '17

Hi Alan (Buxley), Googling a bit and not having a mac or windows machine, it is looking very tricky to set this up "manually". I have been able to download mobile config files in hex form from other universities, but it looks like it'd be a lot easier to generate this automatically. So unless you have a genius solution, I will likely borrow someone's Windows machine (the shame) and generate a profile! I guess that won't be so bad, but if you know of other resources that are easier, I'm all ears! And either way, thanks so much to you and every for the thoughts! On Tue, Sep 12, 2017 at 6:00 AM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: EAP-TLS: Strategies for getting the right certificate to > the right user (Chevalier Violet) > 2. Re: EAP-TLS: Strategies for getting the right certificate to > the right user (Alan Buxey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 12 Sep 2017 01:00:03 -0400 > From: Chevalier Violet <chevalier.violet(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: EAP-TLS: Strategies for getting the right certificate to > the right user > Message-ID: > <CANv8M1sMeczbPX9vicXi=dKUN=NDyEviQUc_t+VDxqeN+a3kkQ@mail. > gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Update: I got my iPhone working. I think the problem was that I needed to > import the client.p12 cert (helpfully mentioned not very often of course). > Anyway, it's working! > > As for how to make THAT relatively automatic... wow, I may need the website > Alan proposed. > > Best, > David > > On Tue, Sep 12, 2017 at 12:29 AM, Chevalier Violet < > chevalier.violet(a)gmail.com> wrote: > > > Hi all, > > > > Thanks for all the thoughts. It's much appreciated to know that maybe > it's > > not just n00bness that is causing me to struggle with this! > > > > I ended up making a pw protected page on my website (sigh)--but the > limits > > of that solution without internet access are pretty obvious I'd say! > > > > And never mind that using TTLS-PAP with passwords saved as SSHA-512 > > doesn't work on the iphone... !!! That's kinda insane if you ask me. But > > obviously apple didn't! > > > > Getting certs on the iPhone has been a real hassle--it'd be easier with > > mac or windows machines around because I could use iTunes, but anyway, it > > has been done through the website option! > > > > Now, I can't get EAP-TLS to work on my iPhone because I can't choose > > "mode" EAP-TLS. Instead, it continually asks me for the username & pass, > > which is precisely what I'm trying to avoid! I think there may be someway > > to signal that my wifi prefers TLS mode that I don't know about. > > > > If you have help on that point, that'd be great, and sigh&thanks! > > > > CV > > > > PS Indeed my routher is not exactly hotspot 2.0 or captive portal > > compliant! > > > > On Mon, Sep 11, 2017 at 10:22 AM, Chevalier Violet < > > chevalier.violet(a)gmail.com> wrote: > > > >> I've been googling around and kind of surprised to not be seeing a ton > of > >> resources about this. Maybe you all can help! > >> > >> EAP-TLS: Strategies for getting the right certificate to the right user. > >> It needs to be relatively automated. I do have users coming by with BYOD > >> devices, e.g. iPhones (omg they're super finicky about the freeradius > setup > >> but that's another story!), frequently when I'm not around to set them > up. > >> > >> Users are starting with no internet access. > >> > >> I was thinking maybe of the following: > >> > >> 1) Use some kind of TTLS-MSCHAPv2 thing with a standard user & password > >> for guests that would change every so often. Maybe let them use the > >> internet either i) for a few minutes at a time or ii) only to access a > page > >> on the internal network from which they could download the guest > >> certificate that would allow them to connect via EAP-TLS? 3) the certs > >> would expire after a few days. > >> > >> I have been struggling to get even my own iPhone to have the proper > cert! > >> On the bright side, my two linux machines are now working with EAP-TLS > so > >> there's hope for me! I wish I could just put the certs on a USB key but > >> that doesn't work for phones. And it's a bunch of Linux machines, no > >> Windows or Macs around. Excuse me if this is a n00b question. > >> > >> Thanks everyone! > >> > >> PS At this link: > >> > >> https://github.com/FreeRADIUS/freeradius-server/issues/2045# > >> issuecomment-324641610 > >> > >> Arr2036 mentions that the hot spot 2.0 standards set out how this could > >> work, with auto-renewing certs and the whole 9 yards. I wasn't able to > find > >> how to make that work for linux, for instance with freeradius. Thanks! > >> > > > > > > > > -- > > "Do not speak, unless it improves on silence." -- Buddha > > > > > > > -- > "Do not speak, unless it improves on silence." -- Buddha > > > ------------------------------ > > Message: 2 > Date: Tue, 12 Sep 2017 07:55:48 +0100 > From: Alan Buxey <alan.buxey(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: EAP-TLS: Strategies for getting the right certificate to > the right user > Message-ID: > <CAOVYXj8MnXE1eG9hA8zB+QBKCf8J-109Tun8Hc8waB9=XEJgrg@ > mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Getting certs onto the iPhone is fairly easy if you just use a > .mobileconfig profile deployment file , as can be created with the apple > tools, manually or with commercial tools :) > > alan > > On 12 Sep 2017 5:31 am, "Chevalier Violet" <chevalier.violet(a)gmail.com> > wrote: > > > Hi all, > > > > Thanks for all the thoughts. It's much appreciated to know that maybe > it's > > not just n00bness that is causing me to struggle with this! > > > > I ended up making a pw protected page on my website (sigh)--but the > limits > > of that solution without internet access are pretty obvious I'd say! > > > > And never mind that using TTLS-PAP with passwords saved as SSHA-512 > doesn't > > work on the iphone... !!! That's kinda insane if you ask me. But > obviously > > apple didn't! > > > > Getting certs on the iPhone has been a real hassle--it'd be easier with > mac > > or windows machines around because I could use iTunes, but anyway, it has > > been done through the website option! > > > > Now, I can't get EAP-TLS to work on my iPhone because I can't choose > "mode" > > EAP-TLS. Instead, it continually asks me for the username & pass, which > is > > precisely what I'm trying to avoid! I think there may be someway to > signal > > that my wifi prefers TLS mode that I don't know about. > > > > If you have help on that point, that'd be great, and sigh&thanks! > > > > CV > > > > PS Indeed my routher is not exactly hotspot 2.0 or captive portal > > compliant! > > > > On Mon, Sep 11, 2017 at 10:22 AM, Chevalier Violet < > > chevalier.violet(a)gmail.com> wrote: > > > > > I've been googling around and kind of surprised to not be seeing a ton > of > > > resources about this. Maybe you all can help! > > > > > > EAP-TLS: Strategies for getting the right certificate to the right > user. > > > It needs to be relatively automated. I do have users coming by with > BYOD > > > devices, e.g. iPhones (omg they're super finicky about the freeradius > > setup > > > but that's another story!), frequently when I'm not around to set them > > up. > > > > > > Users are starting with no internet access. > > > > > > I was thinking maybe of the following: > > > > > > 1) Use some kind of TTLS-MSCHAPv2 thing with a standard user & password > > > for guests that would change every so often. Maybe let them use the > > > internet either i) for a few minutes at a time or ii) only to access a > > page > > > on the internal network from which they could download the guest > > > certificate that would allow them to connect via EAP-TLS? 3) the certs > > > would expire after a few days. > > > > > > I have been struggling to get even my own iPhone to have the proper > cert! > > > On the bright side, my two linux machines are now working with EAP-TLS > so > > > there's hope for me! I wish I could just put the certs on a USB key but > > > that doesn't work for phones. And it's a bunch of Linux machines, no > > > Windows or Macs around. Excuse me if this is a n00b question. > > > > > > Thanks everyone! > > > > > > PS At this link: > > > > > > https://github.com/FreeRADIUS/freeradius-server/issues/2045# > > > issuecomment-324641610 > > > > > > Arr2036 mentions that the hot spot 2.0 standards set out how this could > > > work, with auto-renewing certs and the whole 9 yards. I wasn't able to > > find > > > how to make that work for linux, for instance with freeradius. Thanks! > > > > > > > > > > > -- > > "Do not speak, unless it improves on silence." -- Buddha > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > > list/users.html > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 149, Issue 47 > ************************************************* > -- "Do not speak, unless it improves on silence." -- Buddha

1 0

Freeradius Server seg fault when initializing python module
by Avner Elizarov 13 Sep '17

13 Sep '17

Hi, I'm trying to add the rlm_python module to the freeradius server and After following the instructions in the documentation https://wiki.freeradius.org/modules/Rlm_python The server crashes with a segmentation fault. When I run it in debug mode the follwing debug information is printed : Wed Sep 13 09:18:09 2017 : Debug: # Instantiating module "python" from file /etc/freeradius/mods-enabled/python Wed Sep 13 09:18:09 2017 : Info: Python version: 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609] *Segmentation fault (core dumped)* I ran freeradius using gdb to check the origin of the segmentation fault and this is the output: Program received signal SIGSEGV, Segmentation fault. __strchr_sse2 () at ../sysdeps/x86_64/multiarch/../strchr.S:32 32 ../sysdeps/x86_64/multiarch/../strchr.S: No such file or directory. (gdb) bt #0 __strchr_sse2 () at ../sysdeps/x86_64/multiarch/../strchr.S:32 #1 0x00007ffff53867c1 in PySys_SetPath () from /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0 #2 0x00007ffff57f9d79 in ?? () from /usr/lib/freeradius/rlm_python.so #3 0x00000000004214e4 in module_instantiate () #4 0x00000000004228b5 in modules_init () #5 0x000000000040f7dc in main () It seems that when the server tries to set the python path to that written in mods-available/python (python_path = ${modconfdir}/${.:name}) it crashes. I've tried different strings for the python path and it still crashes. When I removed the python_path line from the file and updated the PYTHONPATH environment variable it worked when running it in debug mode (freeradius -f -X -xx). However it doesn't work when I run the radius server as a service (service freeradius start). The debug output is: Sep 13 09:26:19 radius-server freeradius[6748]: Python version: 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609] Sep 13 09:26:19 radius-server freeradius[6748]: python_function_load - Module 'reorder_tlv' not found Sep 13 09:26:19 radius-server freeradius[6748]: <type 'exceptions.ImportError'> (No module named reorder_tlv) Sep 13 09:26:19 radius-server freeradius[6748]: python_function_load - Failed to import python function 'reorder_tlv.post_auth' Sep 13 09:26:19 radius-server freeradius[6748]: /etc/freeradius/mods-enabled/python[8]: Instantiation failed for module "python" Sep 13 09:26:19 radius-server systemd[1]: freeradius.service: Control process exited, code=exited status=1 Sep 13 09:26:19 radius-server sudo[6717]: pam_unix(sudo:session): session closed for user root Sep 13 09:26:19 radius-server systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. Is someone familiar with this problem? Is there a fix? Thanks in advance

2 1

rlm_rest performance / thread usage
by Бенджамин Томпсон 13 Sep '17

13 Sep '17

We make a billing system which has a JSON API which allows our customers to hook in FreeRADIUS servers to provide RADIUS and DHCP. Up to now we have always used rlm_perl along with a perl script using the JSON and HTTP perl modules to generate the JSON and get it to and from our API. Recently, I have done a few experiments using the rlm_rest module in place of rlm_perl, and I have been very impressed. It is easy to configure and it provides a simpler solution for us, in that it renders the perl script unnecessary. I would like to ask whether there is likely to be any performance difference beteween these two solutions. rlm_perl is performing well for us and as I understand it runs in a multithreaded mode whereby multple perl instances can be created by multiple server threads. I would like to ask whether the rlm_rest module is likely to offer as good as or better performance as we are currently getting with rlm_perl. Also, I would like to understand whether it is necessary to configure multiple instances of rlm_rest and put them for example in a load_balance section in order to get the best performance. Ben Thompson

3 3

Update User-Name
by Dale Lloyd 11 Sep '17

11 Sep '17

FreeRADIUS Version 3.0.4 I wish to modify the User-Name attribute in access-requests by appending the realm, but if I do that, FreeRADIUS refuses to proxy the request. I added the following to /etc/raddb/sites-enabled/default: authorize { if("%{User-Name}" !~ /@/) { update request { User-Name := "%{User-Name}(a)uni.ac.uk" Realm := "eduroam" } ... radiusd -X output: Ready to process requests Received Access-Request Id 0 from 10.10.200.254:36488 to 10.10.2.53:1812 length 148 User-Name = 'testuser' NAS-IP-Address = 6.71.67.224 Calling-Station-Id = '00-00-00-00-00-02' Called-Station-Id = '88-15-44-47-43-E0:TEST' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x0200000d01756e697431323334 Message-Authenticator = 0xca24c7b4bfe0fa73b421bc8c9c1e29a5 (0) Received Access-Request packet from host 10.10.200.254 port 36488, id=0, length=148 (0) User-Name = 'testuser' (0) NAS-IP-Address = 6.71.67.224 (0) Calling-Station-Id = '00-00-00-00-00-02' (0) Called-Station-Id = '88-15-44-47-43-E0:TEST' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = 'CONNECT 11Mbps 802.11b' (0) EAP-Message = 0x0200000d01756e697431323334 (0) Message-Authenticator = 0xca24c7b4bfe0fa73b421bc8c9c1e29a5 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) if ("%{User-Name}" !~ /@/) (0) EXPAND %{User-Name} (0) --> testuser (0) if ("%{User-Name}" !~ /@/) -> TRUE (0) if ("%{User-Name}" !~ /@/) { (0) update request { (0) EXPAND %{User-Name}(a)uni.ac.uk (0) --> testuser(a)uni.ac.uk (0) User-Name := "testuser(a)uni.ac.uk" (0) Realm := 'eduroam' (0) } # update request = noop (0) } # if ("%{User-Name}" !~ /@/) = noop (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = noop (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Request already has destination realm set. Ignoring (0) [suffix] = noop (0) eap : Peer sent code Response (2) ID 0 length 13 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Identity does not match User-Name, setting from EAP Identity (0) eap : Failed in handler (0) [eap] = invalid (0) } # authenticate = invalid (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> testuser(a)uni.ac.uk (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Identity does not match User-Name, setting from EAP Identity (0) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (0) [eap] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Suggestions greatly appreciated.

4 8

Re: Update User-Name
by Alan Buxey 11 Sep '17

11 Sep '17

No no no Please don't do this. If users have incorrect configuration (missing realm) then those users need to be corrected. If that org lets it's users get online without realm then that is not following best practice but means that those users won't work at other eduroam sites anyway So, not only do you cause confusion (but it works at my home org and place down road but nowhere else - this will then waste other sites time/effort 'we must be doing something wrong as this user can work at another site other than home' ) But you will also be causing other users problems... Those users from elsewhere than that org who also don't have realm set ... Who will, instead of being rejected as they should, will now be proxied to the completely wrong site and end up with misconfiguration or sending their details to wrong place. Just REJECT misconfigured users And check with eduroam UK policy to see if it's been updated yet that eduroam auths MUST have the realm even for local auths ... Otherwise a while can of worms gets opened up. don't create policies just because of a bad neighbor. Get them to fix the system. Contact eduroam UK if required to get channels of communication established. alan On 9 Sep 2017 7:20 pm, "Dale Lloyd" <dale.lloyd(a)gmail.com> wrote: Thank you, Alan, for taking the time to reply. > You should really use 3.0.15. Apologies, I followed the example in the FreeRADIUS Technical Guide and typed "yum install freeradius" and this is the version it installed. I will go back and install 3.0.15 manually. > No... read the debug output. The error is something else. When testing and specifying the full username on the client e.g. 'user(a)uni.ac.uk', everything works. Specifying just the short username on the client 'user' fails. Using a packet capture, I see that the request does not get forwarded as hoped. I read the output of radiusd -X and noticed the EAP error, but I don't know whether it is possible to overcome it? > If they're your users, then you should authenticate them. You don't need to edit the User-Name. You don't need to proxy. > Describe the problem you're trying to solve. We are a small entity next to a big university. The neighbouring university allows its users to connect to eduroam locally without specifying the realm in the username, but this can lead to problems because their users are often not aware that they need to use the full username if they wish to roam. We get many visitors from the university and their perception is that our wireless is broken. I want to make it easier for those visitors to connect to eduroam, because I can't explain to all visitors that they should user their full username. I need to proxy and I think that need to add the realm to the username, otherwise the eduroam NRPS won't know what to do with the request. On 9 September 2017 at 18:03, Alan DeKok <aland(a)deployingradius.com> wrote: > On Sep 9, 2017, at 10:11 AM, Dale Lloyd <dale.lloyd(a)gmail.com> wrote: >> >> FreeRADIUS Version 3.0.4 > > You should really use 3.0.15. > >> I wish to modify the User-Name attribute in access-requests by >> appending the realm, but if I do that, FreeRADIUS refuses to proxy the >> request. > > No... read the debug output. The error is something else. > >> I added the following to /etc/raddb/sites-enabled/default: >> >> authorize { >> >> if("%{User-Name}" !~ /@/) { >> update request { >> User-Name := "%{User-Name}(a)uni.ac.uk" >> Realm := "eduroam" >> } > > The better question is why do you think this is necessary? > > If they're your users, then you should authenticate them. You don't need to edit the User-Name. You don't need to proxy. > > Or, if you do proxy, you can just set Proxy-To-Realm: > > if("%{User-Name}" !~ /@/) { > update control { > Proxy-To-Realm := "my-other-server" > } > > >> radiusd -X output: >> >> (0) # Executing group from file /etc/raddb/sites-enabled/default >> (0) authenticate { >> (0) eap : Identity does not match User-Name, setting from EAP Identity >> (0) eap : Failed in handler >> (0) [eap] = invalid >> (0) } # authenticate = invalid >> (0) Failed to authenticate the user >> (0) Using Post-Auth-Type Reject > > That doesn't say "refused to proxy the request". The message is English, and should be clear. > >> Suggestions greatly appreciated. > > Describe the problem you're trying to solve. Don't ask why your proposed solution doesn't work. > > There are likely many other ways of getting the same result. > > Alan DeKok. > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

1 0

Re: not able to install FR 3.0.16+git in (pure) Debian 9
by Rui Ribeiro 11 Sep '17

11 Sep '17

> > Message: 2 > Date: Fri, 11 Aug 2017 17:55:12 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: not able to install FR 3.0.16+git in (pure) Debian 9 > Message-ID: <13B96F99-2D68-4469-9CC1-639938303881(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Aug 11, 2017, at 5:50 PM, Rui Ribeiro <ruyrybeyro(a)gmail.com> wrote: > > What is the best way to send patches? > > > > This is the one for including libjson-c3 > > For small things, that's fine. I've pushed a fix. > > Alan DeKok. > > > > Hi again Alan, After this commit, you can already compile for Debian 9, thanks. If you would not mind, I would also propose striking out the HeartBleed check from debian/rules in 3.0.x, to be able to install it on Debian 9. Otherwise, the dependencies are not satisfied, and Debian 9 refuses to install the packages. --- debian/rules.old 2017-08-16 15:19:15.015393327 +0100 +++ debian/rules 2017-08-16 15:19:27.647279581 +0100 @@ -52,13 +52,6 @@ confflags += --build $(DEB_BUILD_GNU_TYPE) --host $(DEB_HOST_GNU_TYPE) endif -# Add dependency on distribution specific version of openssl that fixes Heartbleed (CVE-2014-0160). -ifeq ($(shell dpkg-vendor --derives-from Ubuntu && echo yes),yes) - SUBSTVARS = -Vdist:Depends="libssl1.0.0 (>= 1.0.1f-1ubuntu2)" -else - SUBSTVARS = -Vdist:Depends="libssl1.0.0 (>= 1.0.1e-2+deb7u5)" -endif - # Add libsystemd-dev as a Build-Depends to debian/control if it is known to this system ifeq ($(shell apt-cache show libsystemd-dev &>/dev/null && echo yes),yes) CONTROL_BUILDDEPS += libsystemd-dev, -- Regards, -- Rui Ribeiro Senior Linux Architect and Network Administrator ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

7 21