- Freeradius-Users - lists.freeradius.org

Windows: Client Certificate but User Password
by Michael Schwartzkopff 07 Sep '16

07 Sep '16

Hi, I want to use FreeRADIUS as the AAA backend for 802.1x portsecurity. The windows clients should send the username/password (PEAP/MS-CHAPv2) when a user is logged in. If no user is logged in, the windows client should send its client certificate. FR can check that certificate and authorize the client. My problem is: In Windows 7 I can configure either to use PEAP (Password) OR certificates. But I cannot choose PEAP for user and certificate for client authentication. Has anybody seen this? Anybody for a solution to that problem? Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Schleißheimer Straße 26/MG, 80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

1 0

string manipulation
by Willy Offermans 06 Sep '16

06 Sep '16

Dear freeradius friends, I have the following in the accounting section of my sites-enabled/default file: <snip> if ( request:Asterisk-Unique-ID ) { update request { Acct-Session-Time := &Asterisk-Bill-Sec Called-Station-Id := &Asterisk-Last-Data Calling-Station-Id := &Asterisk-Src Connect-Info := &Asterisk-Disposition # NAS-Port-Type := "Asterisk CDR" } } </snip> The data in Asterisk-Last-Data is something like SIP/7874338439@SIPprovider. I would like to save only the 7874338439 data in Called-Station-Id. So I need something like a sed or awk command to strip out the right data. Something equivalent as `echo 'SIP/7874338439@SIPProv' | sed 's/[a-Z/@]//g'` How can this be achieved within freeradius? -- Met vriendelijke groeten, With kind regards, Mit freundlichen Gruessen, De jrus wah, Will ************************************* W.K. Offermans Powered by .... (__) \\\'',) \/ \ ^ .\._/_) www.FreeBSD.org

3 2

EAP through proxy not working
by Scott McLane Gardner 06 Sep '16

06 Sep '16

I am trying to proxy eap requests from my wireless users (Cisco 5500 controller) but I'm getting error messages. When I point the controller directly at the radius server and not the proxy, it works fine. Here's the debug from the back-end radius server, I can give the proxy debug too, if necessary. I'm sure the answer I'm missing is somewhere in this section: <snip> (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/default (8) authenticate { rlm_eap (EAP): No EAP session matching state 0x8acdf80a8acffcab (8) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (8) eap : Failed in handler (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Login incorrect: [sgardne] (from client radproxy01.uark.edu port 4 cli 88:63:df:a5:2a:c7) </snip> Full debug here: Received Access-Request Id 19 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '22:44:66:88:00:11' Called-Station-Id = '00:22:11:44:33:66:mySite Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.0.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020900080319152b State = 0xad99bf40ad90bb81ebfc470b102b754e Message-Authenticator = 0x6951ea386bc9c4de5deb4c75ad04312e Event-Timestamp = 'Sep 6 2016 09:10:46 CDT' Proxy-State = 0x313234 (5) Received Access-Request packet from host 10.7.0.28 port 32775, id=19, length=315 (5) User-Name = 'myUsername' (5) Chargeable-User-Identity = 0x00 (5) Location-Capable = Civix-Location (5) Calling-Station-Id = '22:44:66:88:00:11' (5) Called-Station-Id = '00:22:11:44:33:66:mySite Test' (5) NAS-Port = 4 (5) Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' (5) Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' (5) Cisco-AVPair = 'mDNS=true' (5) NAS-IP-Address = 10.0.0.19 (5) NAS-Identifier = 'Red 8510' (5) Airespace-Wlan-Id = 8 (5) Service-Type = Framed-User (5) Framed-MTU = 1300 (5) NAS-Port-Type = Wireless-802.11 (5) Tunnel-Type:0 = VLAN (5) Tunnel-Medium-Type:0 = IEEE-802 (5) Tunnel-Private-Group-Id:0 = '477' (5) EAP-Message = 0x020900080319152b (5) State = 0xad99bf40ad90bb81ebfc470b102b754e (5) Message-Authenticator = 0x6951ea386bc9c4de5deb4c75ad04312e (5) Event-Timestamp = 'Sep 6 2016 09:10:46 CDT' (5) Proxy-State = 0x313234 (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5) authorize { (5) filter_username filter_username { (5) if (!&User-Name) (5) if (!&User-Name) -> FALSE (5) if (&User-Name =~ / /) (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@.*@/ ) (5) if (&User-Name =~ /@.*@/ ) -> FALSE (5) if (&User-Name =~ /\\.\\./ ) (5) if (&User-Name =~ /\\.\\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\\.$/) (5) if (&User-Name =~ /\\.$/) -> FALSE (5) if (&User-Name =~ /(a)\\./) (5) if (&User-Name =~ /(a)\\./) -> FALSE (5) } # filter_username filter_username = notfound (5) [preprocess] = ok (5) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (5) auth_log : --> /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (5) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (5) auth_log : EXPAND %t (5) auth_log : --> Tue Sep 6 09:10:46 2016 (5) [auth_log] = ok (5) [mschap] = noop (5) suffix : Checking for suffix after "@" (5) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (5) suffix : No such realm "NULL" (5) [suffix] = noop (5) eap : Peer sent code Response (2) ID 9 length 8 (5) eap : No EAP Start, assuming it's an on-going EAP conversation (5) [eap] = updated rlm_ldap (ldap): Reserved connection (8) (5) ldap : EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (5) ldap : --> (sAMAccountName=myUsername) (5) ldap : EXPAND dc=mySite,dc=org (5) ldap : --> dc=mySite,dc=org (5) ldap : Performing search in 'dc=mySite,dc=org' with filter '(sAMAccountName=myUsername)', scope 'sub' (5) ldap : Waiting for search result... Unable to chase referral "ldaps://walton.mySite.org/DC=walton,DC=mySite,DC=org" (-1: Can't contact LDAP server) Unable to chase referral "ldaps://cast.mySite.org/DC=cast,DC=mySite,DC=org" (-1: Can't contact LDAP server) TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://ForestDnsZones.mySite.org/DC=ForestDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://DomainDnsZones.mySite.org/DC=DomainDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://mySite.org/CN=Configuration,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (5) ldap : User object found at DN "CN=myUsername,OU=mySiteUsers,DC=mySite,DC=org" (5) ldap : Processing user attributes (5) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute (5) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (8) rlm_ldap (ldap): 0 of 3 connections in use. Need more spares rlm_ldap (ldap): Opening additional connection (9) rlm_ldap (ldap): Connecting to adServer01.mySite.org:636 TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (5) [ldap] = ok (5) [expiration] = noop (5) [logintime] = noop (5) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (5) WARNING: pap : Authentication will fail unless a "known good" password is available (5) [pap] = noop (5) } # authorize = updated (5) Found Auth-Type = EAP (5) # Executing group from file /etc/raddb/sites-enabled/default (5) authenticate { rlm_eap (EAP): No EAP session matching state 0xad99bf40ad90bb81 (5) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (5) eap : Failed in handler (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Login incorrect: [myUsername] (from client radproxy01.mySite.org port 4 cli 22:44:66:88:00:11) (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject : EXPAND %{User-Name} (5) attr_filter.access_reject : --> myUsername (5) attr_filter.access_reject : Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated rlm_eap (EAP): No EAP session matching state 0xad99bf40ad90bb81 (5) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (5) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (5) [eap] = noop (5) remove_reply_message_if_eap remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else else { (5) [noop] = noop (5) } # else else = noop (5) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1 seconds Waking up in 0.9 seconds. Received Access-Request Id 19 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 (5) Discarding duplicate request from client radproxy01.mySite.org port 32775 - ID: 19 due to delayed response (5) Sending delayed response (5) Sending Access-Reject packet to host 10.7.0.28 port 32775, id=19, length=0 (5) Proxy-State = 0x313234 Sending Access-Reject Id 19 from 10.7.0.29:1812 to 10.7.0.28:32775 Proxy-State = 0x313234 Waking up in 3.9 seconds. Received Access-Request Id 242 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '22:44:66:88:00:11' Called-Station-Id = '00:22:11:44:33:66:mySite Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.0.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020f00080319152b State = 0xbc6406acbc6b02b16e73611e9c1c8af8 Message-Authenticator = 0x88428ea4082430ec78f14d881ffae5c9 Event-Timestamp = 'Sep 6 2016 09:10:50 CDT' Proxy-State = 0x313238 (6) Received Access-Request packet from host 10.7.0.28 port 32775, id=242, length=315 (6) User-Name = 'myUsername' (6) Chargeable-User-Identity = 0x00 (6) Location-Capable = Civix-Location (6) Calling-Station-Id = '22:44:66:88:00:11' (6) Called-Station-Id = '00:22:11:44:33:66:mySite Test' (6) NAS-Port = 4 (6) Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' (6) Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' (6) Cisco-AVPair = 'mDNS=true' (6) NAS-IP-Address = 10.0.0.19 (6) NAS-Identifier = 'Red 8510' (6) Airespace-Wlan-Id = 8 (6) Service-Type = Framed-User (6) Framed-MTU = 1300 (6) NAS-Port-Type = Wireless-802.11 (6) Tunnel-Type:0 = VLAN (6) Tunnel-Medium-Type:0 = IEEE-802 (6) Tunnel-Private-Group-Id:0 = '477' (6) EAP-Message = 0x020f00080319152b (6) State = 0xbc6406acbc6b02b16e73611e9c1c8af8 (6) Message-Authenticator = 0x88428ea4082430ec78f14d881ffae5c9 (6) Event-Timestamp = 'Sep 6 2016 09:10:50 CDT' (6) Proxy-State = 0x313238 (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) filter_username filter_username { (6) if (!&User-Name) (6) if (!&User-Name) -> FALSE (6) if (&User-Name =~ / /) (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@.*@/ ) (6) if (&User-Name =~ /@.*@/ ) -> FALSE (6) if (&User-Name =~ /\\.\\./ ) (6) if (&User-Name =~ /\\.\\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\\.$/) (6) if (&User-Name =~ /\\.$/) -> FALSE (6) if (&User-Name =~ /(a)\\./) (6) if (&User-Name =~ /(a)\\./) -> FALSE (6) } # filter_username filter_username = notfound (6) [preprocess] = ok (6) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (6) auth_log : --> /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (6) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (6) auth_log : EXPAND %t (6) auth_log : --> Tue Sep 6 09:10:50 2016 (6) [auth_log] = ok (6) [mschap] = noop (6) suffix : Checking for suffix after "@" (6) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) eap : Peer sent code Response (2) ID 15 length 8 (6) eap : No EAP Start, assuming it's an on-going EAP conversation (6) [eap] = updated rlm_ldap (ldap): Reserved connection (9) (6) ldap : EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (6) ldap : --> (sAMAccountName=myUsername) (6) ldap : EXPAND dc=mySite,dc=org (6) ldap : --> dc=mySite,dc=org (6) ldap : Performing search in 'dc=mySite,dc=org' with filter '(sAMAccountName=myUsername)', scope 'sub' (6) ldap : Waiting for search result... Unable to chase referral "ldaps://walton.mySite.org/DC=walton,DC=mySite,DC=org" (-1: Can't contact LDAP server) Unable to chase referral "ldaps://cast.mySite.org/DC=cast,DC=mySite,DC=org" (-1: Can't contact LDAP server) TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://ForestDnsZones.mySite.org/DC=ForestDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://DomainDnsZones.mySite.org/DC=DomainDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://mySite.org/CN=Configuration,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (6) ldap : User object found at DN "CN=myUsername,OU=mySiteUsers,DC=mySite,DC=org" (6) ldap : Processing user attributes (6) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute (6) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (9) rlm_ldap (ldap): 0 of 3 connections in use. Need more spares rlm_ldap (ldap): Opening additional connection (10) rlm_ldap (ldap): Connecting to adServer01.mySite.org:636 TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (6) [ldap] = ok (6) [expiration] = noop (6) [logintime] = noop (6) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (6) WARNING: pap : Authentication will fail unless a "known good" password is available (6) [pap] = noop (6) } # authorize = updated (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/default (6) authenticate { rlm_eap (EAP): No EAP session matching state 0xbc6406acbc6b02b1 (6) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (6) eap : Failed in handler (6) [eap] = invalid (6) } # authenticate = invalid (6) Failed to authenticate the user (6) Login incorrect: [myUsername] (from client radproxy01.mySite.org port 4 cli 22:44:66:88:00:11) (6) Using Post-Auth-Type Reject (6) # Executing group from file /etc/raddb/sites-enabled/default (6) Post-Auth-Type REJECT { (6) attr_filter.access_reject : EXPAND %{User-Name} (6) attr_filter.access_reject : --> myUsername (6) attr_filter.access_reject : Matched entry DEFAULT at line 11 (6) [attr_filter.access_reject] = updated rlm_eap (EAP): No EAP session matching state 0xbc6406acbc6b02b1 (6) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (6) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (6) [eap] = noop (6) remove_reply_message_if_eap remove_reply_message_if_eap { (6) if (&reply:EAP-Message && &reply:Reply-Message) (6) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (6) else else { (6) [noop] = noop (6) } # else else = noop (6) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (6) } # Post-Auth-Type REJECT = updated (6) Delaying response for 1 seconds Received Access-Request Id 6 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '22:44:66:88:00:11' Called-Station-Id = '00:22:11:44:33:66:mySite Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.0.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020c00080319152b State = 0x023da4930231a0622bbcbfb8ac594c59 Message-Authenticator = 0x20a6424d738dd104865b66aa51f1af3e Event-Timestamp = 'Sep 6 2016 09:10:51 CDT' Proxy-State = 0x313236 (7) Received Access-Request packet from host 10.7.0.28 port 32775, id=6, length=315 (7) User-Name = 'myUsername' (7) Chargeable-User-Identity = 0x00 (7) Location-Capable = Civix-Location (7) Calling-Station-Id = '22:44:66:88:00:11' (7) Called-Station-Id = '00:22:11:44:33:66:mySite Test' (7) NAS-Port = 4 (7) Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' (7) Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' (7) Cisco-AVPair = 'mDNS=true' (7) NAS-IP-Address = 10.0.0.19 (7) NAS-Identifier = 'Red 8510' (7) Airespace-Wlan-Id = 8 (7) Service-Type = Framed-User (7) Framed-MTU = 1300 (7) NAS-Port-Type = Wireless-802.11 (7) Tunnel-Type:0 = VLAN (7) Tunnel-Medium-Type:0 = IEEE-802 (7) Tunnel-Private-Group-Id:0 = '477' (7) EAP-Message = 0x020c00080319152b (7) State = 0x023da4930231a0622bbcbfb8ac594c59 (7) Message-Authenticator = 0x20a6424d738dd104865b66aa51f1af3e (7) Event-Timestamp = 'Sep 6 2016 09:10:51 CDT' (7) Proxy-State = 0x313236 (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) if (!&User-Name) (7) if (!&User-Name) -> FALSE (7) if (&User-Name =~ / /) (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@.*@/ ) (7) if (&User-Name =~ /@.*@/ ) -> FALSE (7) if (&User-Name =~ /\\.\\./ ) (7) if (&User-Name =~ /\\.\\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\\.$/) (7) if (&User-Name =~ /\\.$/) -> FALSE (7) if (&User-Name =~ /(a)\\./) (7) if (&User-Name =~ /(a)\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [preprocess] = ok (7) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (7) auth_log : --> /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (7) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (7) auth_log : EXPAND %t (7) auth_log : --> Tue Sep 6 09:10:51 2016 (7) [auth_log] = ok (7) [mschap] = noop (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : Peer sent code Response (2) ID 12 length 8 (7) eap : No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated rlm_ldap (ldap): Reserved connection (10) (7) ldap : EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (7) ldap : --> (sAMAccountName=myUsername) (7) ldap : EXPAND dc=mySite,dc=org (7) ldap : --> dc=mySite,dc=org (7) ldap : Performing search in 'dc=mySite,dc=org' with filter '(sAMAccountName=myUsername)', scope 'sub' (7) ldap : Waiting for search result... Unable to chase referral "ldaps://walton.mySite.org/DC=walton,DC=mySite,DC=org" (-1: Can't contact LDAP server) Unable to chase referral "ldaps://cast.mySite.org/DC=cast,DC=mySite,DC=org" (-1: Can't contact LDAP server) TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://ForestDnsZones.mySite.org/DC=ForestDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://DomainDnsZones.mySite.org/DC=DomainDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://mySite.org/CN=Configuration,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (7) ldap : User object found at DN "CN=myUsername,OU=mySiteUsers,DC=mySite,DC=org" (7) ldap : Processing user attributes (7) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute (7) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (10) rlm_ldap (ldap): 0 of 3 connections in use. Need more spares rlm_ldap (ldap): Opening additional connection (11) rlm_ldap (ldap): Connecting to adServer01.mySite.org:636 TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (7) [ldap] = ok (7) [expiration] = noop (7) [logintime] = noop (7) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (7) WARNING: pap : Authentication will fail unless a "known good" password is available (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/default (7) authenticate { rlm_eap (EAP): No EAP session matching state 0x023da4930231a062 (7) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (7) eap : Failed in handler (7) [eap] = invalid (7) } # authenticate = invalid (7) Failed to authenticate the user (7) Login incorrect: [myUsername] (from client radproxy01.mySite.org port 4 cli 22:44:66:88:00:11) (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/raddb/sites-enabled/default (7) Post-Auth-Type REJECT { (7) attr_filter.access_reject : EXPAND %{User-Name} (7) attr_filter.access_reject : --> myUsername (7) attr_filter.access_reject : Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated rlm_eap (EAP): No EAP session matching state 0x023da4930231a062 (7) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (7) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (7) [eap] = noop (7) remove_reply_message_if_eap remove_reply_message_if_eap { (7) if (&reply:EAP-Message && &reply:Reply-Message) (7) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (7) else else { (7) [noop] = noop (7) } # else else = noop (7) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (7) } # Post-Auth-Type REJECT = updated (7) Delaying response for 1 seconds (6) Sending delayed response (6) Sending Access-Reject packet to host 10.7.0.28 port 32775, id=242, length=0 (6) Proxy-State = 0x313238 Sending Access-Reject Id 242 from 10.7.0.29:1812 to 10.7.0.28:32775 Proxy-State = 0x313238 (5) Cleaning up request packet ID 19 with timestamp +359 Received Access-Request Id 242 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 Sending Access-Reject Id 242 from 10.7.0.29:1812 to 10.7.0.28:32775 Proxy-State = 0x313238 Waking up in 0.9 seconds. Received Access-Request Id 6 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 (7) Discarding duplicate request from client radproxy01.mySite.org port 32775 - ID: 6 due to delayed response Waking up in 0.1 seconds. (7) Sending delayed response (7) Sending Access-Reject packet to host 10.7.0.28 port 32775, id=6, length=0 (7) Proxy-State = 0x313236 Sending Access-Reject Id 6 from 10.7.0.29:1812 to 10.7.0.28:32775 Proxy-State = 0x313236 Waking up in 3.9 seconds. (7) Cleaning up request packet ID 6 with timestamp +364 Waking up in 1999658.5 seconds. Received Access-Request Id 110 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '22:44:66:88:00:11' Called-Station-Id = '00:22:11:44:33:66:mySite Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.0.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020200080319152b State = 0x8acdf80a8acffcabc84459d3446a7597 Message-Authenticator = 0xcbc7ca966e6720ceb5bb735d7c76d697 Event-Timestamp = 'Sep 6 2016 09:11:00 CDT' Proxy-State = 0x313330 (8) Received Access-Request packet from host 10.7.0.28 port 32775, id=110, length=315 (8) User-Name = 'myUsername' (8) Chargeable-User-Identity = 0x00 (8) Location-Capable = Civix-Location (8) Calling-Station-Id = '22:44:66:88:00:11' (8) Called-Station-Id = '00:22:11:44:33:66:mySite Test' (8) NAS-Port = 4 (8) Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' (8) Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' (8) Cisco-AVPair = 'mDNS=true' (8) NAS-IP-Address = 10.0.0.19 (8) NAS-Identifier = 'Red 8510' (8) Airespace-Wlan-Id = 8 (8) Service-Type = Framed-User (8) Framed-MTU = 1300 (8) NAS-Port-Type = Wireless-802.11 (8) Tunnel-Type:0 = VLAN (8) Tunnel-Medium-Type:0 = IEEE-802 (8) Tunnel-Private-Group-Id:0 = '477' (8) EAP-Message = 0x020200080319152b (8) State = 0x8acdf80a8acffcabc84459d3446a7597 (8) Message-Authenticator = 0xcbc7ca966e6720ceb5bb735d7c76d697 (8) Event-Timestamp = 'Sep 6 2016 09:11:00 CDT' (8) Proxy-State = 0x313330 (8) # Executing section authorize from file /etc/raddb/sites-enabled/default (8) authorize { (8) filter_username filter_username { (8) if (!&User-Name) (8) if (!&User-Name) -> FALSE (8) if (&User-Name =~ / /) (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@.*@/ ) (8) if (&User-Name =~ /@.*@/ ) -> FALSE (8) if (&User-Name =~ /\\.\\./ ) (8) if (&User-Name =~ /\\.\\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\\.$/) (8) if (&User-Name =~ /\\.$/) -> FALSE (8) if (&User-Name =~ /(a)\\./) (8) if (&User-Name =~ /(a)\\./) -> FALSE (8) } # filter_username filter_username = notfound (8) [preprocess] = ok (8) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (8) auth_log : --> /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (8) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (8) auth_log : EXPAND %t (8) auth_log : --> Tue Sep 6 09:10:59 2016 (8) [auth_log] = ok (8) [mschap] = noop (8) suffix : Checking for suffix after "@" (8) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) eap : Peer sent code Response (2) ID 2 length 8 (8) eap : No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated rlm_ldap (ldap): Reserved connection (11) (8) ldap : EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (8) ldap : --> (sAMAccountName=myUsername) (8) ldap : EXPAND dc=mySite,dc=org (8) ldap : --> dc=mySite,dc=org (8) ldap : Performing search in 'dc=mySite,dc=org' with filter '(sAMAccountName=myUsername)', scope 'sub' (8) ldap : Waiting for search result... Unable to chase referral "ldaps://walton.mySite.org/DC=walton,DC=mySite,DC=org" (-1: Can't contact LDAP server) Unable to chase referral "ldaps://cast.mySite.org/DC=cast,DC=mySite,DC=org" (-1: Can't contact LDAP server) TLS: error: connect - force handshake failure: errno 104 - moznss error -5961 TLS: can't connect: TLS error -5961:TCP connection reset by peer. Unable to chase referral "ldaps://ForestDnsZones.mySite.org/DC=ForestDnsZones,DC=mySite,DC=org" (-1: Can't contact LDAP server) TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://DomainDnsZones.mySite.org/DC=DomainDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://mySite.org/CN=Configuration,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (8) ldap : User object found at DN "CN=myUsername,OU=mySiteUsers,DC=mySite,DC=org" (8) ldap : Processing user attributes (8) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute (8) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (11) rlm_ldap (ldap): 0 of 3 connections in use. Need more spares rlm_ldap (ldap): Opening additional connection (12) rlm_ldap (ldap): Connecting to adServer01.mySite.org:636 TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (8) [ldap] = ok (8) [expiration] = noop (8) [logintime] = noop (8) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (8) WARNING: pap : Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/default (8) authenticate { rlm_eap (EAP): No EAP session matching state 0x8acdf80a8acffcab (8) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (8) eap : Failed in handler (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Login incorrect: [myUsername] (from client radproxy01.mySite.org port 4 cli 22:44:66:88:00:11) (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/raddb/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject : EXPAND %{User-Name} (8) attr_filter.access_reject : --> myUsername (8) attr_filter.access_reject : Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated rlm_eap (EAP): No EAP session matching state 0x8acdf80a8acffcab (8) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (8) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (8) [eap] = noop (8) remove_reply_message_if_eap remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else else { (8) [noop] = noop (8) } # else else = noop (8) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1 seconds Waking up in 0.9 seconds. Received Access-Request Id 110 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 (8) Discarding duplicate request from client radproxy01.mySite.org port 32775 - ID: 110 due to delayed response (8) Sending delayed response (8) Sending Access-Reject packet to host 10.7.0.28 port 32775, id=110, length=0 (8) Proxy-State = 0x313330 Sending Access-Reject Id 110 from 10.7.0.29:1812 to 10.7.0.28:32775 Proxy-State = 0x313330 Waking up in 3.9 seconds. (8) Cleaning up request packet ID 110 with timestamp +372 Waking up in 1999650.2 seconds. https://directory.uark.edu/people/sgardne Senior Network Engineer University of Arkansas, ITS-NET

3 4

EAP-TTLS+PAP vs. Ubunt 15 / Windows 10
by Bogdan Rudas 06 Sep '16

06 Sep '16

Hi, I'm trying to connect my Ubuntu 15.10 laptop to WLAN with Cisco Aironet WLC and FreeRADIUS 3.0.11. First of all, I've checked if my RADIUS server works with *eapol_test* utility from wpa_supplicant 2.5 suite and modified eap-ttls-pap.conf confguration file. Then I go to Ubuntu laptop and create custom configuration using Network Manager: [wifi-security] group= key-mgmt=wpa-eap pairwise= proto= [802-1x] altsubject-matches= anonymous-identity=anonymous eap=ttls; identity=ttest password-flags=2 phase2-altsubject-matches= phase2-auth=pap Here is server debug output: (0) Received Access-Request Id 153 from 1.2.3.2:32768 to 1.2.3.4:1812 length 264 (0) User-Name = "anonymous" (0) Chargeable-User-Identity = 0x00 (0) Location-Capable = Civix-Location (0) Calling-Station-Id = "c4-8e-8f-f5-eb-4f" (0) Called-Station-Id = "54-7c-69-f2-1c-a0:New" (0) NAS-Port = 1 (0) Cisco-AVPair = "audit-session-id=c0a819020000044557ce6e9b" (0) Acct-Session-Id = "57ce6e9b/c4:8e:8f:f5:eb:4f/2735" (0) NAS-IP-Address = 1.2.3.2 (0) NAS-Identifier = "backup" (0) Airespace-Wlan-Id = 6 (0) Service-Type = Framed-User (0) Framed-MTU = 1300 (0) NAS-Port-Type = Wireless-802.11 (0) Tunnel-Type:0 = VLAN (0) Tunnel-Medium-Type:0 = IEEE-802 (0) Tunnel-Private-Group-Id:0 = "15" (0) EAP-Message = 0x0201000e01616e6f6e796d6f7573 (0) Message-Authenticator = 0xcf196523d6fc7d6179e7b3252525b1ed (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "anonymous", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 1 length 14 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_ttls to process data (0) eap_ttls: Initiating new EAP-TLS session (0) eap_ttls: Flushing SSL sessions (of #0) (0) eap_ttls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 2 length 6 (0) eap: EAP session adding &reply:State = 0x53397887533b6d8a (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Sent Access-Challenge Id 153 from 1.2.3.4:1812 to 1.2.3.2:32768 length 0 (0) EAP-Message = 0x010200061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x53397887533b6d8a7ce5420be31fd0c8 (0) Finished request There are very similar output for Windows 10 with custom-made connection. I expect many Access-Request like in case with *eapol_test* authentification attempt. Please, help me distinguish: is it WiFi client, WLC or FreeRADIUS configuration issue? Thank you. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 4

802.1x in Windows
by Michael Schwartzkopff 06 Sep '16

06 Sep '16

Hi, this might be a little bit off topic, but perhaps someone can help here. I want to set up 802.1x for windows systems. In windows 7 an higher, is it possible to use certificates for the client authentication if no user is logged in, but passwords for the user authentication? Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Schleißheimer Straße 26/MG, 80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

2 2

Use freepbx for Asterisk VOIP
by Mohamad Yazdian 06 Sep '16

06 Sep '16

Hello everyone Can I use freepbx for Asterisk VOIP accounting? On Mon, Sep 5, 2016 at 4:31 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Salted SHA512 (Stefan Paetow) > 2. Re: Salted SHA512 (Alan DeKok) > 3. How to configure non-priveleged LDAP bind in FreeRADIUS > 3.0.11 (Bogdan Rudas) > 4. FreeRadius reboot needed on adding a NAS ? (Frederic Fichter) > 5. Re: FreeRadius reboot needed on adding a NAS ? (Alan DeKok) > 6. Re: How to configure non-priveleged LDAP bind in FreeRADIUS > 3.0.11 (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 5 Sep 2016 10:32:46 +0000 > From: Stefan Paetow <Stefan.Paetow(a)jisc.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Salted SHA512 > Message-ID: <C4E4EB29-B07F-4065-B879-AABF94592823(a)jisc.ac.uk> > Content-Type: text/plain; charset="utf-8" > > > Hmm, not sure where to look. It seems both OpenVPN and StrongSwan send > EAP requests to FreeRADIUS, but from when I can see, EAP only supports MD5 > and Crypt? Does that mean I should change it to PAP instead of EAP? > > Do StrongSwan and OpenVPN allow you to set the inner authentication method > for EAP, i.e. EAP-TTLS/EAP-GTC or EAP-TTLS/EAP-MSCHAPv2 (outer/inner)? If > you can, configure your EAP-TTLS or EAP method to use GTC (Generic Token > Card), which in FreeRADIUS is set up to use PAP. Of course, if they allow > you to set PAP as the inner, you can go straight to PAP in the inner tunnel > :-) > > Stefan Paetow > Moonshot Industry & Research Liaison Coordinator > > t: +44 (0)1235 822 125 > gpg: 0x3FCE5142 > xmpp: stefanp(a)jabber.dev.ja.net > skype: stefan.paetow.janet > > jisc.ac.uk > > Jisc is a registered charity (number 1149740) and a company limited by > guarantee which is registered in England under Company No. 5747339, VAT No. > GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, > Bristol, BS2 0JA. T 0203 697 5800. > > > > >

1 0

create SSH accounts using RADIUS pam
by Janis Heller 06 Sep '16

06 Sep '16

I use the REST module of RADIUS to validate login requests (username & password). Now I would like my users to be able to login to some servers using SSH. Their accounts should be all very unprivileged (just for SSH tunneling). After setting up the pam sshd module I recognized the login would be only possible by creating a new user with an empty password by using: adduser testuser on the server. Is there a way to prevent this and allow users to login in case of RADIUS accepted their username & password. I already searched for this problem: http://serverfault.com/questions/567628/authenticate-radius-user-using-pam-… Setting up ldap would be a bit too much for this I think, isn’t there an easier way? All the best;

5 8

EAP-TTLS sessions and 'anonymous' Access-Request
by Bogdan Rudas 05 Sep '16

05 Sep '16

Hi, When I test eap_ttls setup, for single connection attempt I see at least 6 "Access-Request" with 'anonymous' user name and some of them have log messages like this: *(1) eap_ttls: TLS_accept: unknown state(1) eap_ttls: TLS_accept: Need to read more data: unknown state* Is it encapsulation of stateful TLS session into stateless UDP-based protocol or something goes wrong with my setup? Thank you. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 1

How to configure non-priveleged LDAP bind in FreeRADIUS 3.0.11
by Bogdan Rudas 05 Sep '16

05 Sep '16

Hi, I would like to configure LDAP authentication for WiFi users with OpenLDAP back-ends (passwords are hashed). To perform initial bind to LDAP database I use restricted account which can read directory tree, determine DN on user and most of it's attributes but can't read passwords hashes. Then I expect FreeRadius to bind with DN found on previous step and user-supplied password. But instead of this I've got messages: Ready to process requests (0) User-Name = "brudas" (0) User-Password = "clearpass" (0) NAS-IP-Address = 127.0.0.1 (0) NAS-Port = 10 (0) Message-Authenticator = 0x86f22bc484991235fa4335a8b959a351 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "brudas", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=brudas) (0) ldap: Performing search in "ou=users,dc=office,dc=local" with filter "(uid=brudas)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "cn=Rudas Bogdan,ou=users,dc=office,dc=local" (0) ldap: Processing user attributes *(0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute* (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap.office.local:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> brudas (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated When I use admin user account (which can read password hashes) for initial bind, authentication test with *radtest *works well, but it is not what I want to do. I want to keep my OpenLDAP password policy working, this requires true LDAP bind attempt with credential of end-user. My final destination is EAP-TTLS with PAP inside. Please, help me to establish desired LDAP authorization schema. As far as I know it was possible in FreeRadius 2.1.x and I believe some additional configuration required here. Thank you. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 2

FreeRadius reboot needed on adding a NAS ?
by Frederic Fichter 05 Sep '16

05 Sep '16

Hi gang, I thought - but could not remember where I've read/dreamt that - that NAS defined within a SQL db could be added or removed dynamically (i.e. without the need to stop/start FreeRADIUS) ? Doesn't look to be the case in my lab. OpenWRT NAS, FreeRADIUS 3.0.11. On inserting a new NAS in the NAS table (MySQL db), requests are ignored by FreeRADIUS (as they come from an unknown NAS). Reloading (kill -HUP) the FreeRADIUS process doesn't change the problem, restarting the FreeRADIUS process solves it. Is this by design ? Any workaround available to avoid restarting FreeRADIUS everytime we add a NAS ? Thanks a lot for your help ! Best, Fred

3 2