- Freeradius-Users - lists.freeradius.org

FreeRadius 3.0.12 crash on ubuntu
by Olaf Dreyer 17 Mar '17

17 Mar '17

Hi! I am running FreeRadius 3.0.12 on Ubuntu 14.04.5 LTS with freeradius 3.0.12-ppa1~trusty libssl1.0.0:amd64 1.0.1f-1ubuntu2.22 The Radius server is used mainly as AAA server for a bunch of Cisco WLCs with a few hundred Cisco WLAN APs behind. We are doing EAP-TLS, the devices only have to present their certificates. Additionally it is used for authentication of admin users on Cisco devices, here we use the ntlm_auth module. But i think this is not relevant. The server crashes now quite frequently, the error always looks like this: Mar 16 22:44:03 server kernel: [2614480.407628] freeradius[13294]: segfault at 44 ip 00007f21f1317f55 sp 00007f21e4ae5828 error 4 in libssl.so.1.0.0[7f21f12dc000+55000] So, this looks like the crash was related to libssl. in general EAP-TLS works fine, several thousand authentications per day, but then freeradius crashes with the above error. Might be some certificate which openssl 1.0.1f does not understand? Maybe this is a TLSv1.2 certificate? Or should this be already fixed? Regards, Olaf

2 2

TTLS+PAP with Windows
by Herman Øie Kolden 16 Mar '17

16 Mar '17

Hello! I am running FreeRADIUS 2.2.5 on Debian 8.7 (Jessie). The RADIUS server is using TTLS+PAP. I am trying to find a good way to authenticate the server to Windows clients. With macOS, Linux, Android etc., I am using a custom self signed CA certificate. On these devices it is possible to specify that this certificate is only usable for a specific SSID. However, for Windows I have found no way to accomplish this. To make it work, I have to install the CA certificate in the "Trusted Root CA" store. This is rather inconvenient. If I (against all odds) lose the private key, the attacker could use it to issue certificates for web pages, and the Windows clients would accept them. One of the options I have considered is make FreeRADIUS present multiple certificates simultaneously: an LE certificate for Windows and the self signed CA certficiate for other clients. As Windows clients already trust LE, they should also accept the server certificate. 1) Is it possible to use LE certificates with FreeRADIUS? 2) Is it possible to make the server present multiple certificates? The reason for wanting multiple certificates, is that a complete switch to LE would require reconfiguring all the non-Windows clients that use the CA certificate. Naturally, all thoughts concerning EAP and Windows are also welcome. Thanks in advance! -- Herman Øie Kolden Trondheim, Norway

9 21

Sending Access-Challenge instead of Access-Accept using MS-CHAPv2
by Lasse Odden 16 Mar '17

16 Mar '17

Hello! This is my first post in the maillist (that have solved all of my earlier problems), but now I'm not sure if my error is my mistake, Cisco's mistake or FreeRADIUS's mistake. I've set up a two-factor athentication against our Cisco AnyConnect VPN with access-challenge (this works when I use PAP between Cisco and FreeRADIUS). But with the username and password being sent between the Cisco and the FreeRADIUS-server in cleartext I enabled "Password management" on the Cisco ASA, so it sends the password with MS-CHAPv2. The authentication of the user works with MS-CHAPv2. To make the FreeRADIUS send an challenge after the authentication of the user I did this in sites-enabled/default: authenticate { .... Auth-Type MS-CHAP { mschap challenge } .... } The Cisco ASA recieves the Challenge and promts for and challenge. When I type in the correct challenge the FreeRADIUS sends an Access-Accept, but the Cisco ASA won't allow it. My question is if this is allowed by the standard or is it a bug on Cisco's side? Regards, Lasse Odden

3 6

tri-D systems no longer exists
by Alex Sharaz 16 Mar '17

16 Mar '17

While browsing the mods-available directory I found a module called otp. As i've been looking at www.multiotp.net for multi factor authentication I thought I might look at the otp module. http://www.tri-dsystems.com take you to an Indonesian online gambling site and the otp code now seems to be at code.google.ccom/p/otpd. does seem a bit old, perhaps the docn on FR 3.0.13 could be updated Rgds alex

1 0

FR support for RFC 7585
by Rui Ribeiro 16 Mar '17

16 Mar '17

Hi all, I was researching about FR support for RFC 7585 "Dynamic Peer Discovery for RADIUS/TLS", and only found a couple of threads mentioning partial support for 3.1, from around last summer. If I need to test it out in the next couple of weeks, does 3.0 or 3.1 supports it? TIA, Rui -- Regards, -- Rui Ribeiro Senior Linux Architect and Network Administrator ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 3

Freeradius with motp
by Isidro Hortelano 16 Mar '17

16 Mar '17

Hi all, I'm trying to configure freeradius version 3.0.3 with motp, to check to verify the otp i use a external script. This is my current configuration: /etc/raddb/radiusd.conf moudules { ..... exec MOTP { wait = yes program = "/etc/raddb/otpverify.sh %{User-Name} %{User-Password} %{reply:Secret %{reply:Pin} %{reply:Offset}" input_pairs = request output_pairs = reply } ....... } sites-enabled/default Auth-Type External { MOTP } /etc/raddb/users DEFAULT Auth-Type = External Exec-Program-Wait = "/usr/local/etc/raddb/otpverify.sh '%{User-Name}' '%{User-Password}' '%{reply:Secret}' '%{reply:Pin}' '%{reply:Offset}'", Fall-Through = Yes test2 Secret = a843ad39b0bSe12ede3092c0ac30676c23eb23ae, Pin = 1234, Offset = 0 When i start the radius server I'm getting this error, anybody know about it ? radiusd -X error: reading pairlist file /etc/raddb/mods-config/files/authorize /etc/raddb/mods-config/files/authorize[213]: Parse error (check) for entry test2: Unknown value 'External' for attribute 'Auth-Type' Failed reading /etc/raddb/mods-config/files/authorize /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" Regards,

2 1

Gotchas of LDAP Server Side Sort controls
by Arran Cudbard-Bell 16 Mar '17

16 Mar '17

Added SSS support to LDAP URLs for LDAP xlat and maps. Are there any particular gotchas with OpenLDAP or others that I should include in the documentation? -Arran

3 5

Cisco LNS realm redirection
by Richard Savage 15 Mar '17

15 Mar '17

Hi List Im just looking to see if someone can point me in the right direction. I have a slight issue in that im trying to repoint a PPP session that is terminating on a cisco LNS(5.5.5.5) from a DSL carrier (TT/BTW) to another LNS (6.6.6.6) (but the carrier (TT/BTW) dont get to see the customer LNS direct). We get the initial request from the carrier and send back an access accept to the carrier to land this on the LNS which is all fine, then we get the access request from our LNS which we then need to reply back with a different LNS IP (6.6.6.6) instead of itself (5.5.5.5) to tell the cisco LNS to forward the PPP session onto the other LNS. Would be good if we can do this based on realm. Is this possible and whats the best way of achieving this as there seems little info on how to achieve this. Im running freeradius 2.1.12 Many thanks in advance. Radius output below: Rich ============================================================================== Access-Request Id 159 1.1.1.1:1812 -> 2.2.2.2:1812 +4237.896 User-Name = "username@realm" CHAP-Password = 0x01d4aa02ffc6c1364cb2bf3ec9675019a2 CHAP-Challenge = 0xa771f601cd1ffd8b376661995e5a4e09 Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = "lts001.hex" NAS-Port = 2432808109 NAS-Port-Type = Virtual NAS-Port-Id = "L2TP LNS 111789" Medium-Type = DSL Connect-Info = "14144000/1057000" Platform-Type = SmartEdge-800 OS-Version = "12.1.1.9" Tunnel-Type:0 = L2TP Tunnel-Medium-Type:0 = IPv4 Tunnel-Server-Endpoint:0 = "10.177.255.128" Tunnel-Client-Endpoint:0 = "10.160.71.32" Tunnel-Server-Auth-Id:0 = "lts001.hex" Tunnel-Client-Auth-Id:0 = "nge001.sou-re0" Tunnel-Max-Sessions = 65535 Tunnel-Max-Tunnels = 32767 Redback-Attr-226 = 0x0000001e Tunnel-Function = LNS-Only Acct-Tunnel-Connection = "nge001.sou-re0/10.160.71.32:32009:29879" LAC-Port = 34699 Calling-Station-Id = " eth 0/3/1:101@FTTC" Access-Accept Id 159 2.2.2.2:1812 -> 1.1.1.1:1812 +4237.934 Tunnel-Server-Endpoint:0 = "5.5.5.5" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "XXXXXX-TT" Attr-69 = 0x00ba01f1c9da158a65f05e6965298b8b28548e Tunnel-Preference:0 = 1 Cisco-AVPair = "ip:ip-unnumbered=Loopback 1" ============================================================================== Access-Request Id 20 3.3.3.3:1645 -> 4.4.4.4:1812 +4238.251 Framed-Protocol = PPP User-Name = "username@realm" CHAP-Password = 0x02fb4271c598e5b5f54f53d246c7afe7b3 Calling-Station-Id = " eth 0/3/1:101@FTTC" Connect-Info = "14144000/1057000" NAS-Port-Type = ISDN NAS-Port = 20035 NAS-Port-Id = "Uniq-Sess-ID35" Service-Type = Framed-User NAS-IP-Address = 3.3.3.3 Access-Accept Id 20 4.4.4.4:1812 -> 3.3.3.3:1645 +4238.281 Tunnel-Server-Endpoint:0 = "5.5.5.5" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "XXXXXX-TT" Attr-69 = 0x00c5f560efa721d0f0cd39b73e64ca1145004a Tunnel-Preference:0 = 1 Cisco-AVPair = "ip:ip-unnumbered=Loopback 1" ----------------------------------- *NEEDS TO SAY:* Tunnel-Server-Endpoint:0 = "6.6.6.6" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "XXXXXXX-TT" Attr-69 = 0x00c5f560efa721d0f0cd39b73e64ca1145004a Tunnel-Preference:0 = 1 ==============================================================================

2 1

escaped quotes and backslashes in passwords
by John Smith 15 Mar '17

15 Mar '17

Hi, Thanks for reading this and if I am not clear in my thoughts please let me know. FreeRADIUS Version 2.2.5 (deb8 repos) I am using a perl module in authenticate{} to call an external api to validate the passwords received from Radius Proxy (Radius Proxy receives a password from openvpn radius plugin) The quotes and backslashes in the passwords I receive to the radius perl module, inside $RAD_REQUEST{'User-Password'} always end up escaped with backslashes. I was wondering what causes this behaviour and how can it be avoided without resorting to using perl regexps to remove the backslashes from the $RAD_REQUEST{'User-Password'} values? Thanks!

2 1

Send user notification on data usage
by Sachin Yadav 15 Mar '17

15 Mar '17

Dear All, We are using freeradius to control our WiFi hotspot. We have implemented FUP limits for users based on day/week/month. Now, we want to send a user notification if the user has used - let's say 80% of daily allowed limit, informing that data is about to finish, in the form of email/sms. I have 2 ways to implement it - 1. Some hook at freedaius side which can look at consumption in interim updates and based on logic call a webservice(or anything else) which will further take care of notification sending part. 2. Have a bot which will constantly read on radacct table and will send notification if required. I am more inclined towards approach 1 as it would be a neat and fast way of doing it. Reading a highly transaction table such as radacct is no good idea. Kindly suggest. Thanks,Sachin.

3 3