- Freeradius-Users - lists.freeradius.org

EAP error
by TOURE Amidou Florian 07 May '16

07 May '16

Hi all ,Ecxuse me to disturb again but I have a problem when I want to authenticate a radius local user on a NAC solution which is Packetfence.I have installed a windows certificate on the client and on my server. But I got this specific error : (8) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [Administrateur] (from client 192.168.1.5 port 50003 cli 00:40:d0:67:d0:b1) Is someone know how to solve this? This my radius debug output Regards Amidou 8) eap_peap: This means you need to read the PREVIOUS messages in the debug output (8) eap_peap: to find out the reason why the user was rejected (8) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (8) eap_peap: what went wrong, and how to fix the problem (8) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (8) eap: Sending EAP Failure (code 4) ID 10 length 4 (8) eap: Failed in EAP select (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [Administrateur] (from client 192.168.1.5 port 50003 cli 00:40:d0:67:d0:b1) (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence (8) Post-Auth-Type REJECT { (8) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { (8) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) -> FALSE (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> Administrateur (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) attr_filter.packetfence_post_auth: EXPAND %{User-Name} (8) attr_filter.packetfence_post_auth: --> Administrateur (8) attr_filter.packetfence_post_auth: Matched entry DEFAULT at line 10 (8) [attr_filter.packetfence_post_auth] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (8) linelog: --> messages.Access-Reject (8) linelog: EXPAND %t : [mac:%{Calling-Station-Id}] Rejected user: %{User-Name} (8) linelog: --> Sat May 7 17:23:12 2016 : [mac:00:40:d0:67:d0:b1] Rejected user: Administrateur (8) linelog: EXPAND /usr/local/pf/logs/radius.log (8) linelog: --> /usr/local/pf/logs/radius.log (8) [linelog] = ok (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 54 from 192.168.10.1:1812 to 192.168.1.5:1645 length 44 (8) EAP-Message = 0x040a0004 (8) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. (0) Cleaning up request packet ID 46 with timestamp +3 (1) Cleaning up request packet ID 47 with timestamp +3 (2) Cleaning up request packet ID 48 with timestamp +3 (3) Cleaning up request packet ID 49 with timestamp +3 (4) Cleaning up request packet ID 50 with timestamp +4 (5) Cleaning up request packet ID 51 with timestamp +4 (6) Cleaning up request packet ID 52 with timestamp +4 Waking up in 0.1 seconds. (7) Cleaning up request packet ID 53 with timestamp +4 (8) Cleaning up request packet ID 54 with timestamp +4 Ready to process requests Envoyé depuis Yahoo Mail pour Android

2 1

Radius problem
by TOURE Amidou Florian 06 May '16

06 May '16

Hi all when starting my radius server I got this error/etc/init.d/radiusd: line 23: /lib/lsb/init-functions: No such file or directory How can I solve the problem?Thanks

2 1

EAP-TLS: Same cert, multiple servers and locations?
by Ted Hyde 06 May '16

06 May '16

Greets - I've just recently returned back to the 'ol-RADIUS-game' and was pleasantly surprised to see how much easier it has become. I was able to accelerate through PAP/MD5/LEAP and for the past week have been dancing around full-on EAP-TLS for wireless supplicants, and am happy to be successful. I built our certs using OpenSSL, and have a variety of sup's to deploy, including ipads and windows devices. It dawned on me just now that some of the ipads would like to actually roam amongst different server setups - completely different physical networks, which could be accommodated with different SSIDs and certs, just load them all onto the ipads and go. That seems to be a little bit of a headache to scale up to larger numbers. We did try to anticipate this to some extent as our current wifi setup is a single SSID for all of our wifi networks, regardless of their physical location (spanning different cities even), but we were using WPA2/PSK, so it was pretty easy to administer. I would love to maintain that "walk-and-go" ability that a single SSID and PSK combo gave us. With the certificates, however, they get locked to a common name for installation, and I have traditionally always used the server name for that. For a lot of reasons, the server names are different site to site, so using the server names for common names in the certificates results in many certificates. ie: site01-s1, site02-s1, site03-s1....... Can I use a single common name (ie. myglobalsites) for the certificate set across my entire domain, and simply copy the entire set, (ca/pem/der/p12) from site to site? Does openssl and freeradius together use any hardware info (CPU serial, resolved ip addr, etc) that would cause a copied cert to crash? I am aware of "Cert builder apps" as well as traditional (verisign) SSL-certs that are built off-site that would have no idea of my actual hardware config, so my understanding is that this would work. However I have not used the standalone apps for building, only openssl on the host machine (and prior to this just for VPN security, which was pretty straightforward). I realize this may be a little more openssl-oriented than freeradius specifically, however I'm curious if anyone has experience with the process having a specific relationship or change to freeradius. Thanks in advance! Regards, Ted.

2 1

Radius error
by TOURE Amidou Florian 06 May '16

06 May '16

Hi all after installing freeradius on centOS 6.7 I got this errorerror reading /etc/raddb [FAILED : file or directoryHow can I solve this.Thanks

2 1

Virtual server with dedicated database
by Lorenzo Milesi 06 May '16

06 May '16

Hi. I have created a second virtual server on my FreeRADIUS 2.2.9 with a dedicated database, but I'm having troubles with checks. My goal is to have a second port which is identical to the first, same db structure, but separate user base. In sql.conf I modified the standard 'sql' instance and renamed it to 'sql_principale', then created a 'sql_biblioteche' for the second virtual server. In the virtual server I modified all the 'sql' occurrences with the new instance, and the 'default' server with 'sql_principale'. Everything seems to be ok, but I just noticed that restrictions check were not applied anymore. For example Max-Daily-Session was not enforced. So I noticed I didn't replace the sqlmod-inst option in counter.conf. After doing that I realized that this means the same Max-Daily-Session on both virtual server would be checked against the first database only! So, since the sql instance is bonded to the database check, this means I would have to redefine and duplicate all checks for the second database? I'd like to understand if this is the correct way to go, because I'd rather not duplicate and differentiate the attributes between the two servers. Did I miss something in the configuration, or is this the only way to go? thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

2 3

regex in hints file
by Ana Gallardo Gómez 06 May '16

06 May '16

Hello :) Can I use regex in Hints file?? DEFAULT User-Name =~ /^[0-9]/ Thank you very much -- :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::

2 5

Selective disabling of radacct and radpostauth entries for specific users in 3.0.12
by Alex Sharaz 06 May '16

06 May '16

Hi, With FR 2.x I configured stuff so that for locally generated "Health-Check" users I didn't write entries into the back end database. some of these users authenticate every 30 seconds. This worked fine. I've now set up two 3.0.12 servers that write radacctg and radpostauth info into a postgresql back end db. Again everything works fine and I can see appropriate entries in the db tables. What I can't find is where to put my "If auths from this client don't write to the db" clause in my sites-enable directory files. I thought something like if ("%{client:shortname}" != "systems0") { -sql } would work but FR is hanging in there and still writing the users into the db. I should point out that I'm using the "null" sql driver and writing accoiunting and postauth stuff into a text file with radsqlrelay actually doing the job of getting the data into the db. rgds Alex

2 2

FreeRadius - Wifi - Active directory (Eap-Peap-MSCHAP)
by Milka Net 06 May '16

06 May '16

Hello, I am trying to set a freeradius authentification against a MS Active directory for Wifi. all went right: - debian in AD - net ads testjoin- wbinfo -a test- /usr/bin/ntlm_auth --request-nt-key --domain=DOM --username=u1 --password=thepassord So basically: authenticating with a AD user is really fine.... even from a "windows 7" laptop is fine, AS LONG as i get prompt for the user/pass, and that I enter it in the form or USER/PASS When i try to use the "automatic", so that it's the "laptop" that sends the credential, it does not work: it does send it as: DOMAIN\\USER. domain: galaxy.privuser: test here is the freeradius -X output. rad_recv: Access-Request packet from host 10.2.103.17 port 59985, id=177, length=173 User-Name = "galaxy\\test" NAS-Identifier = "44d9e7fc21c1" NAS-Port = 0 Called-Station-Id = "46-D9-E7-FD-21-C1:FreeRadius" Calling-Station-Id = "00-1E-65-22-14-C2" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x027300100167616c6178795c74657374 Message-Authenticator = 0x3d46f71089cc7034c3a6636b891a17af# Executing section authorize from file /etc/freeradius/sites-enabled/default+group authorize {++[preprocess] = ok[ntdomain] Looking up realm "galaxy" for User-Name = "galaxy\test"[ntdomain] Found realm "GALAXY"[ntdomain] Adding Stripped-User-Name = "test"[ntdomain] Adding Realm = "GALAXY"[ntdomain] Authentication realm is LOCAL.++[ntdomain] = ok[suffix] Request already proxied. Ignoring.++[suffix] = ok++[chap] = noop++[mschap] = noop++[digest] = noop[suffix] Request already proxied. Ignoring.++[suffix] = ok[eap] EAP packet type response id 115 length 16[eap] No EAP Start, assuming it's an on-going EAP conversation++[eap] = updated++[files] = noop++[expiration] = noop++[logintime] = noop[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.++[pap] = noop+} # group authorize = updatedFound Auth-Type = EAP# Executing group from file /etc/freeradius/sites-enabled/default+group authenticate {[eap] EAP Identity[eap] processing type tls[tls] Initiate[tls] Start returned 1++[eap] = handled+} # group authenticate = handledSending Access-Challenge of id 177 to 10.2.103.17 port 59985 EAP-Message = 0x017400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1d729faf1a330fa1233dbe164274a4fFinished request 1.Going to the next requestWaking up in 4.9 seconds. Would you guys have any things i could test? Any advice would be welcome ! Thanks in advance Milkanet

4 5

LDAP CONFIGURATION IN FreeRadius
by WINANT, KEVIN 05 May '16

05 May '16

Hi Folks, On the FreeRadius servers we have inherited, I am trying to locate where LDAP is configured. Our Servers communicate with an External Authentication server (companies phone directory for user id/pswd verification) so I know someplace in there the LDAP server is specified and should indicate which port (389 or 636) it is using. FreeRadius doc indicates this is defined in radiusd.conf In checking radiusd.conf I do not see anything specifying LDAP. Was thinking would see something similar to this in radiusd.conf: server = "ldap" port = 636 #port = 389 SO my question is, is there someplace else where the LDAP server may be configured? Or radius.conf is the place.?? I have poked around in etc/raddb but unable to locate these settings. Appreciate any information anyone may be able to provide. Thanks in Advance

6 16

LDAP + SASL Freeradius 3.0.11
by Matthew Beckler 05 May '16

05 May '16

Hello, I'm currently learning Freeradius so most of this is new to me. My ultimate goal is to authenticate users via winbind and check group membership via LDAP to Active Directory in post_auth. I was feeling good until I got to ldap section. I have the following working: Winbind authentication LDAPSearch is working for testing with : ldapsearch -LLL -Y "DIGEST-MD5" -h dc.dc.local -U ldaplookup -W -b "ou=Users,ou=OU,dc=dc,dc=local" sAMAccountName=usertoget However when running freeradius -X I receive the following: rlm_ldap (ldap): Connecting to ldap://dc.dc.local:389 rlm_ldap (ldap): Starting SASL mech(s): DIGEST-MD5 SASL/DIGEST-MD5 authentication started rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 52e, v1db1. rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/freeradius/mods-enabled/ldap[8]: Instantiation failed for module "ldap" Obviously I have checked username and password at least 10 times and pasted them in. It appears 52e is correct username but bad password. I'm probably setting up my ldap config wrong so here are the sections I have changed I did not change anything else below this line. Maybe I'm doing this totally incorrectly. ldap { server = 'dc.dc.local' # Port to connect on, defaults to 389, will be ignored for LDAP URIs. # port = 389 # Administrator account for searching and possibly modifying. If using SASL + KRB5 these should be commented out. identity = 'ldaplookup' password = **************** # Unless overridden in another section, the dn from which all searches will start from. base_dn = 'ou=Users,ou=Company,dc=dc,dc=local' # # SASL parameters to use for admin binds # # When we're prompted by the SASL library, these control the responses given, as well as the identity and password directives above. # # If any directive is commented out, a NULL response will be provided to cyrus-sasl. # # Unfortunately the only way to control Keberos here is through environmental variables, as cyrus-sasl provides no API to set the krb5 config directly. # # Full documentation for MIT krb5 can be found here: # # http://web.mit.edu/kerberos/krb5-devel/doc/admin/env_variables.html # # At a minimum you probably want to set KRB5_CLIENT_KTNAME. # sasl { # SASL mechanism mech = 'DIGEST-MD5' # SASL authorisation identity to proxy. # proxy = 'autz_id' # SASL realm. Used for kerberos. # realm = 'example.org' } Thanks for any assistance Matt

2 1