- Freeradius-Users - lists.freeradius.org

Unclear comment in sites-available/default
by Adam Bishop 10 Jan '17

10 Jan '17

How old does the configuration need to be for compatibility with this option to be an issue? + # The "updated" check is commented out for compatibility with + # previous versions of this configuration, but you may wish to + # uncomment it as well; this will further reduce the number of + # LDAP and/or SQL queries for TTLS or PEAP. eap { ok = return +# updated = return } Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

3 3

Re: FreeRADIUS KPI Counter
by chenjiang 10 Jan '17

10 Jan '17

Hi！Alan Thanks for the information, Do you mean FreeRADIUS does support RFC2619“RADIUS Authentication Server MIB”? it will be great. BR! Chen Jiang Microshield Technology Co., Ltd 北京市海淀区西三环北路50号豪柏大厦C2座18-19层100048 (86)10-88518768 (86)18612696123 原始邮件发件人:Alan DeKokaland(a)deployingradius.com 收件人:FreeRadius users mailing listfreeradius-users(a)lists.freeradius.org 发送时间:2017年1月7日(周六) 21:21 主题:Re: FreeRADIUS KPI Counter On Jan 7, 2017, at 2:51 AM, chenjiang chenjiang(a)microshield.com.cn wrote: Hi! Experts Sorry for disturbing. we need monitor our FreeRADIUS system health but wonder where could we find theFreeRADIUS KPI Counters? such as authentication request per Sec/Min/Hrs, succeful authentication per Sec/Min/Hrs, failed authentication per Sec/Min/Hrs for example. No. FreeRADIUS provides the RFCs MIB counters, and a few others. The MIB / statistics system is responsible for deriving other metrics from that. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

FreeRADIUS KPI Counter
by chenjiang 07 Jan '17

07 Jan '17

Hi! Experts Sorry for disturbing. we need monitor our FreeRADIUS system health but wonder where could we find theFreeRADIUS KPI Counters? such as authentication request per Sec/Min/Hrs, succeful authentication per Sec/Min/Hrs, failed authentication per Sec/Min/Hrs for example. Thanks for your great help! BR! Chen Jiang

2 1

Ignore mac if NAS-Port-Type is Ethernet
by HugLeo 05 Jan '17

05 Jan '17

Hi, My BRAS server send two types of radius requisition with NAS-Port-Type. For dhcp it's send "Ethernet" and for pppoe it's send "Virtual" I would like to know if is possiblie that if NAS-Port-Type = Virtual freeradius ignore validating the user by mac.

2 1

Validating plaintext passwords against Samba 4
by Brian Candler 05 Jan '17

05 Jan '17

Hi, There are several documents about how to authenticate MSCHAP requests against Samba 4 / AD. My question is, what's the preferred way to authenticate requests which contain plaintext passwords, i.e. PAP, against S4/AD? rlm_mschap has hooks to talk to ntlm_auth or winbind, but rlm_pap doesn't. It seems to me I could: * use rlm_ldap, and do a bind using the user supplied password * use rlm_krb5 (i.e. kerberos as a password oracle) Is there another/better way? Thanks, Brian.

3 2

redundant-load-balance
by Jonathan Gazeley 05 Jan '17

05 Jan '17

Hi folks, In my RADIUS config on 3.0.12 I've listed a number of LDAP servers, identically configured, and used a redundant-load-balance section to list them. This has always worked in a "normal" situation but over Christmas we had a couple of outages and I have some questions about the behaviour of redundant-load-balance. Firstly, one of the LDAP servers lost power. redundant-load-balance did the right thing, reported "Opening connection failed" and skipped that server. Later, another LDAP server got itself in a funny state where it was up and responsive, accepting connections but timing out when FreeRADIUS tried to bind, with the message "Timed out while waiting for server to respond". For some reason, redundant-load-balance continued to send LDAP queries to the server even though it wasn't working properly. How does rlm_ldap determine if a server is up or down, and what can I configure in my ldap modules or redundant-load-balance to ensure that if the LDAP server misbehaves in future, it will get marked as dead and cause redundant-load-balance to send queries to a different server? Unfortunately as the event happened in the past I don't have debug logs - only the regular radius.log. We also don't know what caused the LDAP server to get into that state (our Windows guys are looking into it) so currently we can't recreate the problem, either. Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

5 11

2 Factor Authentication
by Dudás Péter 05 Jan '17

05 Jan '17

Hello! I'm trying to integrate Duo auth proxy (2.4.19) and Freeradius 3.0.12 on Ubuntu 16.04 to have 2 Factor Authentication on VPN radius requests via Duo security. Active directory intergation done via Samba4 (winbindd). VPN authentication can be SSLVPN or L2TP. Both works - SSL uses pap authentication against the AD, L2TP uses MSCHAPv2 against the AD. SSL sends back only the Filter-Id, L2TP sends Filter-Id and MPPE keys. To have 2 Factor Authentication I created a module for Duo authentication which calls an external script with the user variables and the script writes them to a text file which is the input file for a radclient in the following way: /usr/bin/radclient -f /opt/duoauthproxy/packet -c 1 -r 2 -t 30 -x 127.0.0.1:1645 auth secret -x Radclient connects to the Duo Auth Proxy on the localhost and doing the authentication via Duo services (push/phone/otp code). After the authentication the module returns the Exit code 0 or Exit code 1 (depending on the authentication result). With the SSLVPN it works fine - simply put the Duo authorization before the AD auth in authorize section and works perfectly. With the L2TP it is not working at all. I see the successful authentication (both: Duo and Mschap), MPPE keys and Filter-Id returned, firewall grants the access - and the devices are just not connects. I don't see any errors, and as also the firewall grants the access I have no clue what could this be. Now duo auth happens at post auth section - but it can be anywhere - just not working. Here is the debug: (0) Received Access-Request Id 203 from 10.101.168.3:59819 to 10.148.64.67:1812 length 161 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) User-Name = "Peter Dudas" (0) NAS-IP-Address = 89.212.168.XYZ (0) NAS-Port = 0 (0) MS-CHAP-Challenge = 0x5556c20e9277af608a7ba5335955d181 (0) MS-CHAP2-Response = 0x32006b1c6f8f39c8c7049a9b365ac86156e90000000000000000f7a54abdb5fa7c889557a2729d2234117d36cd4a203ed4ac (0) Proxy-State = 0xfe80000000000000953e77ad63f094ba000000cb (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) if (User-Name != ""){ (0) if (User-Name != "") -> TRUE (0) (User-Name != "") { ... } # empty sub-section is ignored (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/ 10.101.168.3/auth-detail-20170104 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.101.168.3/auth-detail-20170104 (0) auth_log: EXPAND %t (0) auth_log: --> Wed Jan 4 22:35:44 2017 (0) [auth_log] = ok (0) if (User-Name != "" && Service-Type !* "") { (0) if (User-Name != "" && Service-Type !* "") -> FALSE (0) else { (0) if (MS-CHAP2-Response != "" && MS-CHAP-Challenge != "") { (0) if (MS-CHAP2-Response != "" && MS-CHAP-Challenge != "") -> TRUE (0) if (MS-CHAP2-Response != "" && MS-CHAP-Challenge != "") { (0) if (NAS-IP-Address == "89.212.168.XZY" && Framed-Protocol == "PPP") { (0) if (NAS-IP-Address == "89.212.168.XYZ" && Framed-Protocol == "PPP") -> TRUE (0) if (NAS-IP-Address == "89.212.168.XYZ" && Framed-Protocol == "PPP") { (0) if (Service-Type == "Framed-User" && Packet-Type == "Access-Request" ) { (0) EXPAND Packet-Type (0) --> Access-Request (0) if (Service-Type == "Framed-User" && Packet-Type == "Access-Request" ) -> TRUE (0) if (Service-Type == "Framed-User" && Packet-Type == "Access-Request" ) { (0) if (MS-CHAP-Challenge != "" && NAS-PORT == "0" ) { (0) if (MS-CHAP-Challenge != "" && NAS-PORT == "0" ) -> TRUE (0) if (MS-CHAP-Challenge != "" && NAS-PORT == "0" ) { (0) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) if (ok) { (0) if (ok) -> TRUE (0) if (ok) { (0) update reply { (0) Filter-Id := "L2TP-Users" (0) } # update reply = noop (0) } # if (ok) = noop (0) } # if (MS-CHAP-Challenge != "" && NAS-PORT == "0" ) = ok (0) } # if (Service-Type == "Framed-User" && Packet-Type == "Access-Request" ) = ok (0) } # if (NAS-IP-Address == "89.212.168.XYZ" && Framed-Protocol == "PPP") = ok (0) } # if (MS-CHAP2-Response != "" && MS-CHAP-Challenge != "") = ok (0) } # else = ok (0) } # authorize = ok (0) Found Auth-Type = mschap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type mschap { (0) mschap: Creating challenge hash with username: Peter Dudas (0) mschap: Client is using MS-CHAPv2 (0) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{request:User-Name} --domain=site.domain.local --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=site.domain.local\l2tp-users: (0) mschap: EXPAND --username=%{request:User-Name} (0) mschap: --> --username=Peter Dudas (0) mschap: Creating challenge hash with username: Peter Dudas (0) mschap: EXPAND --challenge=%{mschap:Challenge:-00} (0) mschap: --> --challenge=397e282f44bc0581 (0) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00} (0) mschap: --> --nt-response=f7a54abdb5fa7c889557a2729d2234117d36cd4a203ed4ac (0) mschap: Program returned code (0) and output 'NT_KEY: A1A055BBCC2133B2E1FCD8213C6B03FE' (0) mschap: Adding MS-CHAPv2 MPPE keys (0) [mschap] = ok (0) } # Auth-Type mschap = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/ 10.101.168.3/reply-detail-20170104 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.101.168.3/reply-detail-20170104 (0) reply_log: EXPAND %t (0) reply_log: --> Wed Jan 4 22:35:44 2017 (0) [reply_log] = ok (0) duo: Executing: /usr/bin/radclient -f /etc/freeradius/packet -c 1 -r 1 -t 45 127.0.0.1:1645 auth secret -x: (0) duo: Program returned code (0) and output 'Sent Access-Request Id 49 from 0.0.0.0:52464 to 127.0.0.1:1645 length 75 Packet-Type = Access-Request Service-Type = Framed-User Framed-Protocol = PPP User-Name = "Peter Dudas" User-Password = "push" NAS-IP-Address = 89.212.168.XYZ NAS-Port = 0 Cleartext-Password = "push" Received Access-Accept Id 49 from 127.0.0.1:1645 to 0.0.0.0:0 length 48 Reply-Message = "Success. Logging you in..."' (0) duo: Program executed successfully (0) [duo] = ok (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/ 10.101.168.3/reply-detail-20170104 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.101.168.3/reply-detail-20170104 (0) reply_log: EXPAND %t (0) reply_log: --> Wed Jan 4 22:35:44 2017 (0) [reply_log] = ok (0) [exec] = noop (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/ 10.101.168.3/reply-detail-20170104 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.101.168.3/reply-detail-20170104 (0) reply_log: EXPAND %t (0) reply_log: --> Wed Jan 4 22:35:44 2017 (0) [reply_log] = ok (0) } # post-auth = ok (0) Login OK: [Peter Dudas/<via Auth-Type = mschap>] (from client dc1 port 0) (0) Sent Access-Accept Id 203 from 10.148.64.67:1812 to 10.101.168.3:59819 length 0 (0) Filter-Id := "L2TP-Users" (0) MS-CHAP2-Success = 0x32533d34413036444345313735434538323544364344333939363634303638424345343738453634383132 (0) MS-MPPE-Recv-Key = 0x8e2b496673e4be264ff378973bfc4f0a (0) MS-MPPE-Send-Key = 0x3d999c39dd3234adb646ff83015329da (0) MS-MPPE-Encryption-Policy = Encryption-Required (0) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (0) Proxy-State = 0xfe80000000000000953e77ad63f094ba000000cb (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 203 with timestamp +18 I've tried to run the duo auth ant the Authorize, post auth sections - no matter where it is, the connection is not successful. Do you maybe know what change with this second authentication which blocks the L2TP VPN connection? If I comment out the DUO - then L2TP VPN connects without problem. I don't find any difference in the Reply packets (chacked with Wireshark too). Thank you! Peter Dudas

4 13

relay in background?
by Alan Batie 05 Jan '17

05 Jan '17

A while back, I setup a couple of radacct relays for archiving using the new mechanism, however occasionally the archive server is slow (the reason we moved the archival process to another server to start with), and it's impacting the primary because it doesn't respond until the proxying is done. With radrelay, this is done independently and it doesn't matter if it gets a little behind. Is there a way to make the builtin mechanism behave in the same way? If not, I'm going to resurrect radrelay...

3 5

Radius Stering
by Richard J Palmer 04 Jan '17

04 Jan '17

Hi We use FR a lot for authentication etc and this works perfectly... However I have a need for a Wholesale backhaul to run a platform radius setup - this is for session steering. At this point I actually don't care about the username or password. What I'd like to do is look at a combination of the calling-station-ID / the IP address of the radius client sending the request to us. Based on this we will return some parameters to create a L2TP tunnel. The far end will THEN send a L2TP tunnel to us that reaches here and we do the full authentication. Note that with the Calling station ID I am looking for a pattern match and not exact matches (eg We will be passed ABCD1234533 or LLAD433224). I am looking to return one set of answers if the Calling Station ID starts with ABCD and another if it starts LLAD I may also want to send different data IF the request comes from A radius client with IP 1.2.3.4 or 2.3.4.5 I am happy to dig into this but any pointers you can provide would be appreciated Richard

2 1

simultaneous use
by Bill Schoolfield 04 Jan '17

04 Jan '17

I have a client that wanted his customers limited to a single connection. So I implemented: mysql> select * from radgroupcheck; +----+--------------------+------------------+----+-------+ | id | groupname | attribute | op | value | +----+--------------------+------------------+----+-------+ | 1 | Package2MB | Simultaneous-Use | := | 1 | After some time and 100's of subscribers he now wants on a case by case (ie user) basis to allow multiple simultaneous sessions. I thought I just add Simultaneous-Use to radcheck for those users and use the "appropriate" operators. I can't seem to get this to work. I'm trying to avoid dropping the use of radgroupcheck and adding the Simultaneous-Use radcheck attribute to all users. Is this possible? What operators do I use? I used '=' in radgroupcheck and that succeeded in allowing the radcheck item to "override" the radgroupcheck item but the check fails if no radcheck item exists (as will be the case in many instances). Bill

2 5