- Freeradius-Users - lists.freeradius.org

Version 3.0.15 and 2.2.10 have been released.
by Alan DeKok 19 Jul '17

19 Jul '17

Guido Vranken found some issues with OpenVPN, so I asked him to look at FreeRADIUS. The good news is we're releasing new versions of the server. The bad news is he found things: http://freeradius.org/security/fuzzer-2017.html The various vendors have already been notified, and should have patches ready. Alan DeKok.

7 15

Stuck on EAP-challenge remote client version 3.0.15
by Mathieu Devos 19 Jul '17

19 Jul '17

Hello, Finally managed to get the full installation running, and got a local user test to pass the system. This works very smoothly with user-identity and user-password. The commands that work are the following: radtest alice alice localhost 0 testing123 radtest -t eap-md5 alice alice localhost 0 testing123 However trying to run this from a remote client passes the authorize, however the autehnticate seems to get stuck in a challenge <> request loop. Pastebin of radiusd -X is available here: https://pastebin.com/ePFCQhtF First ones are me remotely trying (with the built in test on the client AP, and on my phone), last one is a straightforward radtest localhost. Note that this same setup was used on freeradius 2.x in a previous build and was confirmed to be working. BR, Mathieu

3 3

Informix error in "id" field ?
by vanish 19 Jul '17

19 Jul '17

Hi all! 1. I have freeradius v3.0.12, iodbc and informix database. 2. In informix i have tables - "accounts" with users logins and "acct_details" with passwords. 3. One user (login) can have 2 or more passwords in "acct_details" table. 4. Fields in tables: ...accounts... - fscontrol VARCHAR (64) NOT NULL, - this is username ...acct_details... - fiacct_dtl_id SERIAL, - fspassword VARCHAR(64)NOT NULL, 5. My radcheck_query: authorize_check_query = "\ SELECT p.fiacct_dtl_id id, '%{SQL-User-Name}' username, \ 'Cleartext-Password' attribute, trim(p.fspassword) value,':=' op \ FROM accounts a inner join acct_details p on a.fiaccount_id = \ p.fiaccount_id \ WHERE a.fscontrol = '%{SQL-User-Name}'" 6. In debug i see: Debug: (2) pppoe: Executing select query: SELECT p.fiacc_dtl_id id, '0015w' username, 'Cleartext-Password' attribute, trim(p.fspassword) value, ':=' op FROM accounts a inner join acct_details p on a.fiaccount_id = p.fiaccount_id WHERE a.fscontrol = '0015w' ERROR: (2) pppoe: Invalid op "??s???" for attribute ??s??? ERROR: (2) pppoe: Error parsing user data from database result ERROR: (2) pppoe: Error getting check attributes Debug: rlm_sql (pppoe): Released connection (3) Debug: (2) modsingle[authorize]: returned from pppoe (rlm_sql) Debug: (2) [pppoe] = fail Debug: (2) } # authorize = fail In informix cli i see next result for query: "id" ; username ; attribute ; value ; op "2567890"; 0015w ; Cleartext-Password ; password ; := 7. If replace "p.fiacct_dtl_id id" on "1 id" in query, then everything work fine. Where can be the problem?

2 1

Installation failure during make and general confusion
by Mathieu Devos 19 Jul '17

19 Jul '17

Hello, Recently started as a part time system admin at this work, and in an effort to upgrade our systems we're looking at installing a RADIUS server. We only have 1 office, with around 50 employees, who all have the same access rights (just plain Internet access). As such the idea is to set up a very straightforward authentication RADIUS server, no need for accounting yet. My eye spotted freeradius, and I've started working with it. Throughout the Internet I found a mixed bag of tutorials (quite confusing tbh) who mostly all suggest to run apt-get install freeradius and just work with that. Now I've tried that but ran into issues when moving towards TTLS (maybe another email will follow once I have set that up). I also found the git repo, and have cloned this (I'm on the v4 branch), however, the ./configure runs properly fine. I have attempted to run the ./configure as both normal user, and as root, both with the same output (they complete). However running the make is where issues arise. I'm not getting very far in this entire endeavor. CC src/protocols/dhcpv4/packet.c In file included from src/protocols/dhcpv4/packet.c:31:0: src/freeradius-devel/dhcpv4/dhcpv4.h:138:1: error: unknown type name ‘RADIUS_PACKET’ RADIUS_PACKET *fr_dhcpv4_udp_packet_recv(int sockfd); ^ src/freeradius-devel/dhcpv4/dhcpv4.h:139:31: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_udp_packet_send(RADIUS_PACKET *packet); ^ src/freeradius-devel/dhcpv4/dhcpv4.h:146:1: error: unknown type name ‘RADIUS_PACKET’ RADIUS_PACKET *fr_dhcpv4_packet_ok(uint8_t const *data, ssize_t data_len, fr_ipaddr_t src_ipaddr, ^ src/freeradius-devel/dhcpv4/dhcpv4.h:169:30: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_packet_decode(RADIUS_PACKET *packet); ^ src/freeradius-devel/dhcpv4/dhcpv4.h:171:30: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_packet_encode(RADIUS_PACKET *packet); ^ In file included from src/protocols/dhcpv4/packet.c:31:0: src/freeradius-devel/dhcpv4/dhcpv4.h:180:70: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_raw_packet_send(int sockfd, struct sockaddr_ll *p_ll, RADIUS_PACKET *packet); ^ src/freeradius-devel/dhcpv4/dhcpv4.h:182:1: error: unknown type name ‘RADIUS_PACKET’ RADIUS_PACKET *fr_dhcv4_raw_packet_recv(int sockfd, struct sockaddr_ll *p_ll, RADIUS_PACKET *request); ^ src/freeradius-devel/dhcpv4/dhcpv4.h:182:79: error: unknown type name ‘RADIUS_PACKET’ RADIUS_PACKET *fr_dhcv4_raw_packet_recv(int sockfd, struct sockaddr_ll *p_ll, RADIUS_PACKET *request); ^ src/protocols/dhcpv4/packet.c:101:29: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_packet_decode(RADIUS_PACKET *packet) ^ src/protocols/dhcpv4/packet.c:295:29: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_packet_encode(RADIUS_PACKET *packet) ^ scripts/boiler.mk:635: recipe for target '/home/vagrant/freeradius-server/build/objs/src/protocols/dhcpv4/packet.lo' failed make: *** [/home/vagrant/freeradius-server/build/objs/src/protocols/dhcpv4/packet.lo] Error 1 this is the output I'm getting from make. As such my questions are the following: 1) how to fix this issue? 2) should I just ignore the entire git repo and straightforward run apt-get install freeradius BR, Mathieu

4 4

rlm_checkval: Could not find item named Calling-Station-Id in request
by Karim Bourenane 18 Jul '17

18 Jul '17

Hello Im novice on Freeradius. I hope you can help me in my small problem. I want to install a new platform with in front the radius proxy server, and in backend the Radius server with binding a local LDAP : Devices -> RadiusProxy -> RadiusBackend -> OpenLdap. On the RadiusProxy the request was sent weel to the RadiusBackend. The local Ldap binding running also weel, but he reject the user because he dont find on the request ( proxy i believe) the Calling Station ID. Here my error on RadiusBackend : Debug: rlm_checkval: Could not find item named Calling-Station-Id in request The request sending by the proxy doesnt contain any info about this value : Sending Access-Request Id 239 from 10.166.120.43:43997 to 10.166.120.133:1812 User-Name = 'idtestradius2' User-Password = 'testradius' NAS-IP-Address = 10.166.120.43 NAS-Port = 0 Message-Authenticator = 0xfaf2b385fae53a0feb636c4940dc9f9e Event-Timestamp = 'Jul 17 2017 14:38:42 CEST' Proxy-State = 0x3235 Can you help me please ? Regards -- Mr Karim Bourenane +33686464439

5 11

eap-tls, debug
by Miha 18 Jul '17

18 Jul '17

Hello i would kindly ask you for a little help regarding tls as I do not know how to debug this and if this is ok. I have enabled tls under eap (before it was md5) and i have add CA. here i am pasting log from freeradius. Is this is ok is not:) Ready to process requests (0) Received Access-Request Id 15 from 172.31.1.120:1812 to 172.31.1.124:1812 length 92 (0) NAS-IP-Address = 172.31.1.120 (0) NAS-Port = 50022 (0) NAS-Port-Type = Ethernet (0) User-Name = "y" (0) Calling-Station-Id = "00-90-33-46-04-AD" (0) Service-Type = Framed-User (0) EAP-Message = 0x020400060179 (0) Message-Authenticator = 0x605db39095dcdbe2e0b5efc1ada118f1 (0) # Executing section authorize from file /etc/raddb/sites- enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "y", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 4 length 6 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_tls to process data (0) eap_tls: Initiating new EAP-TLS session (0) eap_tls: Flushing SSL sessions (of #0) (0) eap_tls: Setting verify mode to require certificate from client (0) eap_tls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 5 length 6 (0) eap: EAP session adding &reply:State = 0xfba9e51efbace8c4 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Sent Access-Challenge Id 15 from 172.31.1.124:1812 to 172.31.1.120:1812 length 0 (0) EAP-Message = 0x010500060d20 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xfba9e51efbace8c410d4292907198e26 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 16 from 172.31.1.120:1812 to 172.31.1.124:1812 length 164 (1) NAS-IP-Address = 172.31.1.120 (1) NAS-Port = 50022 (1) NAS-Port-Type = Ethernet (1) User-Name = "y" (1) Calling-Station-Id = "00-90-33-46-04-AD" (1) Service-Type = Framed-User (1) State = 0xfba9e51efbace8c410d4292907198e26 (1) EAP-Message = 0x0205003c0d0016030100310100002d030200002534152332c149557c927d87c699b1b a10d7e5ec5b4b1a1ea5f64e50f0d70000060035002f000a0100 (1) Message-Authenticator = 0x26446079a357c5cedc89cf1c8c2c6d7b (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/raddb/sites- enabled/default (1) authorize { (1) policy filter_username { (1) if (!&User-Name) { (1) if (!&User-Name) -> FALSE (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@.*@/ ) { (1) if (&User-Name =~ /@.*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "y", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 5 length 60 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = EAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xfba9e51efbace8c4 (1) eap: Finished EAP session with state 0xfba9e51efbace8c4 (1) eap: Previous EAP request found for state 0xfba9e51efbace8c4, released from the list (1) eap: Peer sent packet with method EAP TLS (13) (1) eap: Calling submodule eap_tls to process data (1) eap_tls: Continuing EAP-TLS (1) eap_tls: Got final TLS record fragment (54 bytes) (1) eap_tls: WARNING: Total received TLS record fragments (54 bytes), does not equal indicated TLS record length (0 bytes) (1) eap_tls: [eaptls verify] = ok (1) eap_tls: Done initial handshake (1) eap_tls: (other): before/accept initialization (1) eap_tls: TLS_accept: before/accept initialization (1) eap_tls: <<< UNKNOWN TLS VERSION ?0000? [length 0005] (1) eap_tls: <<< TLS 1.1 [length 0031] (1) eap_tls: TLS_accept: SSLv3 read client hello A (1) eap_tls: >>> UNKNOWN TLS VERSION ?0000? [length 0005] (1) eap_tls: >>> TLS 1.1 [length 004a] (1) eap_tls: TLS_accept: SSLv3 write server hello A (1) eap_tls: >>> UNKNOWN TLS VERSION ?0000? [length 0005] (1) eap_tls: >>> TLS 1.1 [length 03e8] (1) eap_tls: TLS_accept: SSLv3 write certificate A (1) eap_tls: >>> UNKNOWN TLS VERSION ?0000? [length 0005] (1) eap_tls: >>> TLS 1.1 [length 006a] (1) eap_tls: TLS_accept: SSLv3 write certificate request A (1) eap_tls: TLS_accept: SSLv3 flush data (1) eap_tls: TLS_accept: Need to read more data: SSLv3 read client certificate A (1) eap_tls: TLS_accept: Need to read more data: SSLv3 read client certificate A (1) eap_tls: In SSL Handshake Phase (1) eap_tls: In SSL Accept mode (1) eap_tls: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 6 length 1004 (1) eap: EAP session adding &reply:State = 0xfba9e51efaafe8c4 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Sent Access-Challenge Id 16 from 172.31.1.124:1812 to 172.31.1.120:1812 length 0 (1) EAP-Message = 0x010603ec0dc0000004ab160302004a02000046030258004f0a64cff924337d9ed0f50 0fb5489194fc4fbaa32a0d311de2ab53251002077853703cfefd060585ada2b1ccce810 bce4905b2744bd062170f5c8e84e8aa000350016030203e80b0003e40003e10003de308 203da308202c2a0030201020201 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xfba9e51efaafe8c410d4292907198e26 (1) Finished request Waking up in 4.9 seconds. tnx so much! miha

2 1

TLS communication, EAP does not work
by Luciano Fernandes da Rocha 16 Jul '17

16 Jul '17

Dear, Briefly, our scenario has 3 servers with FreeRadius 3.0.14. 2 institutions (ufjfteste.br and rnpteste.br) and 1 FLR (.br). On the institution level we run RadSec (embedded TCP/TLS in FreeRadius3) to communicate with our FLR, a radsecproxy. So, using this TLS communication, EAP does not work, but turning off it and doing the communication between all servers using only UDP (disabling RadSec at institutions and radsecproxy at FLR), all EAP methods works. To confirm it, if we turn on the TLS communication, we could only authenticate using 'radtest' (as we know, a simple authentication without EAP). We suspect that EAP messages are lost during the exchanging when TLS communication are enable. Do you have any ideia about it to help us? * Our real scenario here in Brazil is similar to this, with institutions using FreeRadius (today with radsecproxy) and the FLR using radsecproxy too. Now we are conducting this validations to update our infrastructure to use FreeRadius3 with RadSec in institution level, and maintaining radsecproxy in FLR. Thanks in advance, -- Luciano Fernandes da Rocha. Analista de Operações DAGSer - Diretoria Adjunta de Gestão de Serviços RNP – Rede Nacional de Ensino e Pesquisa Site:http://www.rnp.br e-mail:luciano.rocha@rnp.br Tel.:+55 61 3243-4389

4 7

Best FR backend authentication method for Microsoft AD
by Diggins Mike 15 Jul '17

15 Jul '17

I've been running FreeRadius v2 for many years with Samba and NTLM_AUTH to authenticate my users with very few issues. I'm about to refresh my FreeRadius servers to V3 and wondered if that was still the best method to use. My organization has a number of other services using LDAP to authenticate to AD and I am considering changing to that, or at least I was until I read that this was NOT recommended. If I must use the AD backend (and I must), what is the best method from a reliability, security, and performance perspective? My FR authenticates and authorizes my Wi-Fi users (WPA2 enterprise with certs) and VPN. I also have a separate pair of FR servers for Eduroam. My AD is Windows 2016 if that helps. -Mike

3 2

FR3 RadSec proxying
by Edelberto Franco 14 Jul '17

14 Jul '17

Hi all. Is possible to use RadSec (sites-enabled/tls) in FR3 as a proxy for many home servers? I would like to stop using radsecproxy at the federation level. Thanks in advance, --E

2 5

Re: FreeRADIUS 4.0.0 and DHCP
by Montana Bag 13 Jul '17

13 Jul '17

Hello Alan > I have a problem with "listen" section for the dhcp module. > > I download and install last version freeradius 4.0.0 (with github) > > Please use a stable, released version of FreeRADIUS. > > Version 4 hasn't been released. Until it's released officially, the > only reason to use it is if you're a developer, or if you need the extra > functionality it provides. > > > Before that, I used freeradius 4.0.0 with the dhcp module and it worked > > How to properly configure the socket for DHCP? > > Why are you using v4? > I'm using v4 because of the "map" function, which makes it possible to get multiple attributes of one sql query. Thanks for your reply, I will wait for the release FreeRADIUS 4 P. S. Sorry is my bad English.

1 0