- Freeradius-Users - lists.freeradius.org

My Hotspot is passing some sites without authentication
by mohammed farouk 11 Jan '16

11 Jan '16

Weird issue since users once connected to the Coovachilli and not login login yet to correct freeradius credential they still can brows google and watch youtube. Freeradius can't feel there is packet flow to count or to block from the "freeradius -X" google keeps hopping between lots of IP's which skips the blocked ones and passes another one which not blocked, hotspot creates the following iptables: iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -i eth1 -j DROP -A INPUT -d 10.42.0.1/32 -i tun0 -p icmp -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p udp -m udp --dport 67:68 -j ACCEPT -A INPUT -d 255.255.255.255/32 -i tun0 -p udp -m udp --dport 67:68 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 10000 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 8080 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 4990 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 3990 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -j DROP -A FORWARD -i tun0 -o eth0 -j ACCEPT -A FORWARD -i tun0 ! -o eth0 -j DROP -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -o tun0 -j ACCEPT -A FORWARD -i tun0 -j ACCEPT -A FORWARD -o eth1 -j DROP -A FORWARD -i eth1 -j DROP *Best regards,* *Mohammed Farouk* *+20(0)1144767555* *goo.gl/WWUQrB <http://goo.gl/WWUQrB>*

2 1

Server certificate renewal
by douglas eseng 11 Jan '16

11 Jan '16

Not strictly freeradius issue, perhaps those on the list have insight on the issue. Using freeradius for PEAP authentication, server cert is signed by private CA. We don't use profile to install the CA cert onto iOS devices. After renewal of server cert, existing iOS devices ask user to again trust the cert. Is this normal behaviour? Since it was a renewal, would have thought it is recognized as the same cert and remain trusted. Anyone know once user trusted the cert, what digest/fingerprint of the cert does IOS remember? Unable to find info on this from Apple's site. Thanks.

5 5

Question on anonymous identity
by Mathieu Simon (Lists) 11 Jan '16

11 Jan '16

Hi, A question surfaced recently while I was reworking a configuration: By building 3.0 from source I saw that the upcoming 3.0.11 will be actively logging that anonymous identities should be used* to protect identities. I'm not with eduroam, but try to keep an eye on what participating institutions and others recommend. I see they generally tell users to set one (where possible). The profile data from cat.eduroam.org also contains one. We always recommended students to set an anonymous identity and profiles/config tools given to them would set it for them, but it wasn't actively enforced. If the device wasn't configured for sending an anonymous identity it would still let the device in, if inner-tunnel authentication and authorization requirements passed.** So, what is the current take: Would you / Do you (recommend) enforcing the use of an anonymous identity, resulting in Access-Reject? Do most enduser wireless devices finally support setting an anonymous identity these days? Thanks in advance Mathieu * https://github.com/FreeRADIUS/freeradius-server/commit/ec5cb167dd1de6d3c8e7…

3 4

Re: Logging (was: Freeradius-Users Digest, Vol 129, Issue 3)
by Stefan Paetow 08 Jan '16

08 Jan '16

>Yes, 'detail' is included in the accounting section. Ok, that's not going to log then. It will only log when it gets accounting packets. Look at the 'default' server. In the post-auth section you'll see a reply_log entry that is commented out by default. If you uncomment this, it will start logging entries as per the 'reply_log' line log that is defined in the 'detail.log' module in mods-available. However, note that this will *not* be a single-line entry (which is what's recommended by the eduroam operator in the UK). Look at https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/raddb/modules/l inelog for the current linelog for v2.x. If you're on 3.x, go to https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai lable/linelog - This will come in handy when doing what the Confluence page you found says. >Log file enclosed in ZIP format. Don't do that. Archives are stripped. A simple freeradius -X output capture is useful. >I found this website which may help to enable logging, looks like logging >functionality is different between 2.1.10 and 2.1.12. >http://confluence.diamond.ac.uk/pages/viewpage.action?pageId=22252353 Ahhh... My history comes back to haunt me... ;-) You may want to set up two of the three line logs defined on that page: eduroam_log and inner_auth_log. To log to the *log* directory, do *not* set 'filename' to 'syslog'. Instead set it to whatever you wanted the filename to be... "${logdir}/linelog" is the default in linelog. Tweak that appropriately for the inner_auth_log (if you want to log authentication of your own users separately). Then, like the page says, call 'eduroam_log' in the post-auth section, or, better yet, in the post-proxy section of your eduroam server, since post-proxy gets hit by an incoming reply from a home organisation before post-auth does (and post-auth also gets hit by your own users after their authentication reply returns from the inner-tunnel server). Also, like the page says, call 'inner_auth_log' from the post-auth section of your inner-tunnel. Stop your server. Start it in debug mode. Then hit it with an authentication request (for your own user). You should with any luck get an entry in your inner-tunnel authentication log. Then, if you have a test subject from another institution, get them to authenticate through eduroam and see what happens. Like Alan and others have pointed out, the module files are liberally commented so that it is easier to understand the operation of the server (and what the options do). Of course, if you strip out all comments for a bare-bones configuration, then yes, it becomes distinctly more difficult (or you spend a lot of time on Github to understand what each file does). :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Networkshop44, University of Manchester. Save the date: 22-24 March, 2016. #NWS44 Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200. >

1 0

RE: Freeradius-Users Digest, Vol 129, Issue 3
by Peter Hutchison 08 Jan '16

08 Jan '16

>> We have set up Freeradius on Ubuntu 14.04 LTS but having trouble to >> get it to generating authorization logs for our 'eduroam' >> virtual server. >What does this virtual server do / when is it called? Allows users to authenticate on wireless network using Eduroam with their Active Directory login user (+ domain) and password. Users do authenticate ok no problem, but it is not logging requests for some reason to the /var/log/freeradius/radius-eduroam-yyyy-mm-dd.log >Do you call the linelog or detail modules in any of its sections? Yes, 'detail' is included in the accounting section. >> It is generating logs ok for the default and inner-tunnel but not >> eduroam. I have checked and re-checked the configuration with no >> result. You need to look at the debug output. On ubuntu run it as "freeradius -X" and examine the output then authenticate something you expect to get logs for. > /etc/freeradius/radius.conf log section looks like this: Mostly not useful - you really want linelog or detail, not the main server logging. It’s the requests logging I am interested in which doesn't seem to work. >> And in our eduroam file in sites-available (with link file in >> sites-enabled) has 'auth_log' enabled to in the authorize section. > Any ideas why the log isn't being generated when users connect to it? >Check -X debug output. I cannot see anything obvious, no mention of log being created or updated. >Send the debug here if it doesn't make sense, though it's fairly straightforward to read (if verbose). Right from the FreeRADIUS banner at the >top and including an authentication packet. >A small suspicion is that you might need to put logging in pre/post-proxy sections if you're trying to log non-local auths. I have updated those sections but made no difference with following lines: Pre_proxy_log Post_proxy_log ---- Update: Log file enclosed in ZIP format. I found this website which may help to enable logging, looks like logging functionality is different between 2.1.10 and 2.1.12. http://confluence.diamond.ac.uk/pages/viewpage.action?pageId=22252353 Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Infrastructure Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 1

case-statement regex
by O'Connell, Ryan 07 Jan '16

07 Jan '16

Using version 3.0.10. Can’t seem to implement regex matching with case statements. The request always results in “def” even though the string in the request contains “abc". switch DHCP-Subscriber-Id { case "/(abc)$/" { update control { &Pool-Name := “abc" } } case { update control { &Pool-Name := “def" } } } I have tried a bunch of different variations of the “case” without success. If I use the entire string in the case statement then I get the intended result “abc”. switch DHCP-Subscriber-Id { case 001122334455@abc { update control { &Pool-Name := “abc" } } case { update control { &Pool-Name := “def" } } } Does anyone have a suggestion on how to implement this? I haven’t been able to find examples in the documentation or google about doing this specifically. The same logic implemented with if/else works fine but I was hoping to use switch/case for performance. if (&DHCP-Subscriber-Id =~ /(abc)$/){ update control { &Pool-Name := “abc" } } else { update control { &Pool-Name := “def" } } Thanks, Ryan

2 4

RE: Safe characters, old and new versions of 3.1.0
by Franks Andy (IT Technical Architecture Manager) 07 Jan '16

07 Jan '16

Thanks Alan, that's really useful info, especially the fix - makes good sense. I was doubtful about the older server and what was written to SQL whether it was actually right or not, so this seems better anyway. I've never seen a date expressed with backslashes, dashes yes, forward slashes yes, but backslash is umm, different. Again, thanks very much. Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 07 January 2016 14:36 To: FreeRadius users mailing list Subject: Re: Safe characters, old and new versions of 3.1.0 On Jan 7, 2016, at 8:13 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > We're seeing differences in the way unusual characters are handled in the older version when compared with the newer, in terms of the way variable values with certain characters are expanded. The older versions uses "safe_characters" to determine which characters were "safe". The newer version uses the escape functions provided by the SQL driver. Which is better. Different, but better. > The main problem is it mucks up the SQL character writing - the frontend comes up with an odd asci character that in theory shouldn't be written according to the "safe characters" list afaics. > I can't change what's in the ldap description field we use as the source of this attribute unfortunately - a third party system writes into it which we have no change access to. OK... > Anyway, below are examples on old and new of the ldap attribute source, an example variable expansion of that attribute and lastly what goes into SQL. The examples aren't quite indentical as one is a live system that's so busy it's hard to get exactly the same string from it. Generally the string is "Amended by Directory Manager dd\mm\yyyy" in AD, but that comes over to ldap as dd\\mm?y for some reason, The "backslash digit" is typically used as an escape sequence for special characters. > presumably because of weird characters in the string that look ok in AD console. What gets inserted after that into SQL is, on the old server, > > "Amended by Directory Manager dd(asciicode)mm(asciicode)yy" > Which appears fine within mysql. And is still wrong, to be honest. > On the new server > > "Amended by Directory Manager dd\\mm?y" plus some other non-visible stuff I guess, which isn't fine. In SQL is looks like a square box, not sure of the actual ascii code. It's the escaping. > This character doesn't seem to be part of the "safe characters". Also on the old server and new one, the ordinary backslash makes its way through to sql but I can't see it on the SC list. > Any ideas?! Is there any way of replicating old behaviour or fixing the new? Re-write the date string in FreeRADIUS so that it uses forward slashes instead of backslashes. The easiest way to do this might be to use a regular expression. to parse the string into chunks, and the re-assemble the chunks: if (&control:Ldap-UserDescription =~ /(..).(..).(....)$/) { update control { Ldap-UserDescription := "Amended by Directory Manager %{1}/%{2}/%{3}" } } The simple lesson is "don't use backslashes". The third-party system you're using is broken. Happily, you should be able to fix it with FreeRADIUS. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

proxy implementation
by srithar jeevadurai 07 Jan '16

07 Jan '16

Dear Friends, We have successfully implemented NAS <--> FreeRadius <--> IN However now we have to implement NAS <--> Proxy (auth + acct) <--> FreeRadius <--> IN Can you please help me on the same? When we tried, proxy server is giving below error message. 1. *Auth: Login incorrect: [newhostt(a)domainserver.com <testhost(a)server.com>] (from client 222.222.222.90 port 16634 cli 3455534333)* Proxy server is trying to validate the user however as per my understanding, it has to forward to home server instead of validating the user. Please let me know if you need any configuration files to be uploaded, I will send the same in the email. 1. Proxy server does not obtain persistent connection to home servers and the connection is only when it forwards request (auth or act) home server. Is our understanding correct? because We are doubt that proxy server is connecting to home server or not. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

2 3

Safe characters, old and new versions of 3.1.0
by Franks Andy (IT Technical Architecture Manager) 07 Jan '16

07 Jan '16

Hi all, Sorry to post so much, struggling with differences again in the newer version of FR I have on a server. The older is 3.1.0 git #390f216, the newer 3.1.0 git #f4d5ff6. We're seeing differences in the way unusual characters are handled in the older version when compared with the newer, in terms of the way variable values with certain characters are expanded. The main problem is it mucks up the SQL character writing - the frontend comes up with an odd asci character that in theory shouldn't be written according to the "safe characters" list afaics. I can't change what's in the ldap description field we use as the source of this attribute unfortunately - a third party system writes into it which we have no change access to. Anyway, below are examples on old and new of the ldap attribute source, an example variable expansion of that attribute and lastly what goes into SQL. The examples aren't quite indentical as one is a live system that's so busy it's hard to get exactly the same string from it. Generally the string is "Amended by Directory Manager dd\mm\yyyy" in AD, but that comes over to ldap as dd\\mm?y for some reason, presumably because of weird characters in the string that look ok in AD console. What gets inserted after that into SQL is, on the old server, "Amended by Directory Manager dd(asciicode)mm(asciicode)yy" Which appears fine within mysql. On the new server "Amended by Directory Manager dd\\mm?y" plus some other non-visible stuff I guess, which isn't fine. In SQL is looks like a square box, not sure of the actual ascii code. This character doesn't seem to be part of the "safe characters". Also on the old server and new one, the ordinary backslash makes its way through to sql but I can't see it on the SC list. Any ideas?! Is there any way of replicating old behaviour or fixing the new? Thanks Andy Old server (35) ldap3: control:Ldap-UserDescription := 'Amended by Directory Manager 26\\08?5' Variable expansion (35) EXPAND %{control:LinelogString}, DESC: %{control:Ldap-UserDescription} (35) --> 07-01-2016 11:13:51, WEBSTERC(a)SATH.nhs.uk, Accept, DESC: Amended by Directory Manager 26\\08\2015 Sql config: safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Insert 'Amended by Directory Manager 26=5C08=815' New server (10) ldap5: control:Ldap-UserDescription := 'Amended by Directory Manager 02\\12?4' Variable expansion (10) EXPAND %{control:LinelogString}, DESC: %{control:Ldap-UserDescription} (10) --> 07-01-2016 10:48:56, franksa, Accept, DESC: Amended by Directory Manager 02\\12\2014 '%{control:Ldap-UserDescription}' Sql config: safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Insert Amended by Directory Manager 02\\12?4'

2 1

RE: Freeradius-Users Digest, Vol 129, Issue 10
by Peter Hutchison 07 Jan '16

07 Jan '16

>Hi, > TBH, iu cant recall if expansions work for that section in radiusd.conf - if theres a quirky bug it wont get fixed in 2.1.12 Our Ubuntu server setup uses packages from http://packages.ubuntu.com using apt-get, they are still providing v2.1.12 and they have not changed to v3 yet. Not sure why Ubuntu support have not updated the packages for customers when its out of date.... >but for logging there are 2 ways that do work....and should work fine >1) use the 'detail' module >2) use linelog The detail log is not really what I want. I just want to record requests. It is working for 'default' and 'inner-tunnel' but nothing else :( I tried the linelog method, and that didn't work either. No logs generated. I am not even sure that detail logging is working either. There are a couple of old log files in the radacct directory but nothing newer. >for the details module - i think you are using this(!) ? you should be looking at modules/detail.log file - as thats the file that is actuslly >used for auth_log et al >and if %{Virtual-Server} expansion doesnt work there - easy, just create a new detail entry eg >eduroam_auth_log and call that instead of auth_log in relevant section of the virtual server - and do the same for the other calls to log >functions >eg >detail eduroam_auth_log { > detailfile = ${radacctdir}/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d > detailperm = 0600 > suppress { > User-Password > EAP-MSK > EAP-EMSK > EAP-Message > MS-MPPE-Recv-Key > MS-MPPE-Send-Key > MS-MPPE-Encryption-Policy > MS-MPPE-Encryption-Types > } } > ..for linelog, simply look at the modules/linelog file and configure as required....or make a new one eg >linelog eduroam-linelog { ><put config here!> >} > and then call linelog in relevant place to capture required bits - linelog is generally better as the output can be nicely customised to >contain exactly the stuff needed in format needed... I tried this method, freeradius -X started up ok. But no logs generated... I am stuck at this point. >obviously there are many other methods - eg using the buffered-sql virtual server and copying detail output asynchronously to an SQL server so >you have logs in database format (great for searching) >some of this may only be applicable to 2.2.x - but thats what you should be running as a minimum these days (and even that is around end of >support time) Any other ideas? BTW, what version of Freeradius are you using? Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Infrastructure Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

3 2