- Freeradius-Users - lists.freeradius.org

Accept eap-mschapv2 and proxy only mschapv2
by Jacob Julian 07 Dec '15

07 Dec '15

Hey all, Apologies if this is a commonly asked question, I did search and tried to mimic similar attempts. I'm looking to accept eap-mschapv2 auths and proxy only mschapv2 to another RADIUS server, which is set up to authenticate that user and return an Accept or Reject. My understanding is that this is easily accomplishable using FreeRADIUS. I have no prior experience with FreeRADIUS, so excuse any mistakes... This is the output of freeradius -X using RadEapTest on a remote machine, username Administrator. It seems that FreeRadius is attempting to auth the user instead of just proxying it along; this does work when I attempt a PAP connection from that same machine, it gets proxy'd through and auths just fine. Ready to process requests. rad_recv: Access-Request packet from host 172.16.201.10 port 63636, id=0, length=134 User-Name = "Administrator" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000120141646d696e6973747261746f72 Message-Authenticator = 0x67f16acfd64e0bf55afb823fbc79ce2f # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [eap] EAP packet type response id 0 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 0 to 172.16.201.10 port 63636 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd42c15c7d42d0ce1d2efe40d1ce734d1 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.201.10 port 63636, id=1, length=140 User-Name = "Administrator" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02010006031a State = 0xd42c15c7d42d0ce1d2efe40d1ce734d1 Message-Authenticator = 0xe370cdc45d637d5ce7aa63f10cd3fc45 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/mschapv2 [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 1 to 172.16.201.10 port 63636 EAP-Message = 0x010200271a0102002210ae3862a5bd6aa644366843b6155ed7d641646d696e6973747261746f72 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd42c15c7d52e0fe1d2efe40d1ce734d1 Finished request 1. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.201.10 port 63636, id=2, length=206 User-Name = "Administrator" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200481a0202004331268cba76a73d54ea5fb5be72cdcd1b3b000000000000000077ae735bd2f46f781b886e02ff342f798677b30559e5d3830041646d696e6973747261746f72 State = 0xd42c15c7d52e0fe1d2efe40d1ce734d1 Message-Authenticator = 0xe08f96787e24a651d4ae379b44288612 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [eap] EAP packet type response id 2 length 72 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/default [mschapv2] +group MS-CHAP { [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: Administrator [mschap] Client is using MS-CHAPv2 for Administrator, we need NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] = reject +} # group MS-CHAP = reject [eap] Freeing handler ++[eap] = reject +} # group authenticate = reject Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> Administrator attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 2 for 1 seconds Going to the next request

2 1

Freeradiusclient-1.1.7 and IPv6
by Alex Harrison 07 Dec '15

07 Dec '15

All,I hope I am using the right alias for this question. If this belongs elsewhere, I'll happily send it there, but I didn't want to disrespect the intent of the developer list if my question should be posted here. My question concerns whether the 1.1.7 release supports IPv6 addressing or if I misunderstand the release notes. For background, I'm utilizing the freeradius client library(1.1.7 tarball from the freeradius webpage) for a project I'm working on. The server side is set up and responds to radclient (both IPv4 and IPv6) requests properly. I'm trying to use the client library to talk over IPv6. First, I am using one of the included applications such as radiusclient or radlogin to establish a baseline to work with. When I try to send a radius request with one of these applications, I see in my system's log:rc_get_ipaddr: couldn't resolve hostname: feedThis would be for an address such as "feed:beef::17:18:20:10". Looking into the code, it appears that it is expecting IP:Port:Secret and it is parsing the first part of the IPv6 address as the whole address. Looking into the code on github, I see that there is a block in the source intended to deal with [IPv6]:Port:Secret form. I do not see this code in the 1.1.7 tarball. If I use the github code, I can successfully make IPv6 radius requests which is great and I can use. This brings me to my question, is the IPv6 release supposed to support IPv6 and I'm using it incorrectly or am I reading the release notes incorrectly? I see in the release notes: "Added support for IPv6. Patch from Nikos Mavrogiannopoulos." Browsing in the github repo, I see the commits from Nikos that add support for IPv6 along with the comment "Added support for connecting and listening to IPv6 addresses." This commit is from March and I can not find the associated code from the commit in the 1.1.7 tar ball I downloaded. Am I misunderstanding the release note or is IPv6 support I'm looking for actually not in the 1.1.7 release? Thank you for any help,Alex

2 3

Cleartext password does not match "known good" password
by Gang Li 07 Dec '15

07 Dec '15

Hi, I'm now running freeradius 3.0.10 + Mariadb on archLinux 4.1. It keeps telling me my password does not match the "known good"password. =================debug info=============== rlm_sql (sql): Released connection (1) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: ERROR: Cleartext password does not match "known good" password (0) pap: Passwords don't match (0) [pap] = reject (0) } # Auth-Type PAP = reject (0) Failed to authenticate the user ======================================== I checked the database, in the radcheck table, I have one record: admin Cleartext-Password := 111111 In the radpostauth table, there's a Reject record, showing the username/password is exactly what I input: admin 111111 Access-Reject 2015-12-07 23:01:52 Since the two passwords are same, I just don't get why it reject me? What else should I do ? Thank you in advance. Gavin

2 5

Outstanding requests increasing until max_outstanding
by Louis Munro 07 Dec '15

07 Dec '15

Hello, I have a pair of FreeRADIUS (2.2.5) servers acting as load-balancers for a pool of authentication servers behind them that has been running flawlessly for about a year except for one thing. When I look at the list for my auth servers using radmin I get the following: radmin> show home_server list 10.0.0.100 1812 auth alive 150 10.0.0.101 1812 auth alive 223 10.0.0.102 1812 auth alive 130 10.0.0.103 1812 auth alive 114 Where I believe the last column is the number of outstanding requests for each home server (please enlighten me if I am wrong about that). Now the problem I have is that that last number (of outstanding requests) never goes down significantly. It fluctuates a bit during the day, but the trend is clearly up. This morning it was showing the following... radmin> show home_server list 10.0.0.100 1812 auth alive 140 10.0.0.101 1812 auth alive 220 10.0.0.102 1812 auth alive 109 10.0.0.103 1812 auth alive 114 And yesterday it was radmin> show home_server list 10.0.0.100 1812 auth alive 102 10.0.0.101 1812 auth alive 30 10.0.0.102 1812 auth alive 78 10.0.0.103 1812 auth alive 75 And last Friday one of the counters hit 65535 and all proxying to that home server stopped even though it was still responding (and was marked “alive”). I believe that counter is incremented once every time a request is proxied and (should be) decremented every time a reply is received or it times out. It does look though like there may be a case where the counter is not decremented. So my questions are: 1. Do I understand this correctly? 2. Is this a known issue? 3. If so, is it fixed in the latest of v2? or v3? 4. If it’s not an issue, what could I be doing wrong? I have no problem with the answer being “Upgrade” as long as I know that this is something that is indeed fixed in the version I’ll be upgrading to. These servers have performed so well up to now that I have not had a compelling case for upgrading. This could be just it. Regards, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 3

rbtree in freeradius
by srithar jeevadurai 07 Dec '15

07 Dec '15

Hi Friends, I want to understand the rbtree data structure used in freeradius. my requirement is I have to store name-value pair in rbtree and I have to retrieve data base on name. As I understand from existing code. *declaration:* rbtree_t *conf= NULL; *creation: * rbtree_create( <1>, <NULL>, 0); 1-> function pointer to compare data for search 2-> NULL (I don;t know the purpose of 2nd parameter and 3rd parameter) 3->0 *Insert data:* struct data* temp={"Name", "Value"} rbtree_insert(conf, temp); *Search:* rbtree_finddata(conf, "Name"); *Delete:* rbtree_deletebydata(conf, "Name"); *compare function ( function pointer to compare data for search):* static int data_cmp(const void *one, const void two) { const data * data1 = (const data *) one; const data *data2 = (const data*) two; return strcmp(data1->name, data2->name); } -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

2 1

LDAP Clients and Dynamic Clients on 3.0
by Peter Lambrechtsen 06 Dec '15

06 Dec '15

Hi Just looking at how the clients module works with the example config and Dynamic-Clients. Seems that Dynamic clients is loading the standard ldap group attributes. Any objections if I align the clients section of the ldap module and dynamic-clients with two options, either using standard schema and use the group object with the L and OU attributes for Password and shortname. Or using the radiusClient class. I'll also fix the doc/schemas/ldap/edir/freeradius-clients.ldif as that schema LDIF is busted and won't load into eDirectory. Cheers Peter

2 3

FR3.1.x head fails to build on RHEL 6.6
by Peter Lambrechtsen 06 Dec '15

06 Dec '15

Hello After downloading the head version of FR3.1.x it first complained that gcc was lacking C11, so I downloaded the devtoolset-2 rpms from RedHat devtoolset-2-gcc-4.8.2-15.1.el6.x86_64.rpm devtoolset-2-gcc-c++-4.8.2-15.1.el6.x86_64.rpm devtoolset-2-runtime-2.1-4.el6.noarch.rpm devtoolset-2-libstdc++-devel-4.8.2-15.1.el6.x86_64.rpm Now the configure succeeds with /opt/rh/devtoolset-2/root/usr/bin in the path, but when starting the make it fails to compile debug.c CC src/lib/debug.c /tmp/ccuawyBs.s: Assembler messages: /tmp/ccuawyBs.s:581: Error: expecting string instruction after `rep' make: *** [build/objs/src/lib/debug.lo] Error 1 Any idea what other dependencies I would need to upgrade (make?) to build on RHEL?

2 1

Freeradius EAP-TLS - every 2nd (even) attempt unsuccessfull
by gracian＠centrum.cz 05 Dec '15

05 Dec '15

Hello all, First, our environment configuration is: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu configured for EAP-TLS Cisco WLC 2504 Windows 7/8.1 clients Problem: every 1st (odd) connection to WiFi network is without any problem and part of client's certificate contain "TLS-Client-Cert-Common-Name := 'mib(a)example.com'", which I check using check-eap-tls via part below, is visible: server check-eap-tls { authorize { update config { Auth-Type := Accept } if ("%{TLS-Client-Cert-Common-Name}" =~ /^[A-z.]*(a)example\.ccom$/) { update config { Auth-Type := Accept } } else { update config { Auth-Type := Reject } update reply { Reply-Message := "Your certificate is not valid." } } ... ... ... When I try to disconnect from wifi and connect again with the same client, connection fails. I noticed that debug output differ for successfull and unsuccessfull attempt in part below. --------------------------------------------------------------- Successfull attempt log --------------------------------------------------------------- (1) Found Auth-Type = EAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Expiring EAP session with state 0x3190079e31930a29 (1) eap : Finished EAP session with state 0x3190079e31930a29 (1) eap : Previous EAP request found for state 0x3190079e31930a29, released from the list (1) eap : Peer sent method TLS (13) (1) eap : EAP TLS (13) (1) eap : Calling eap_tls to process EAP data (1) eap_tls : Authenticate (1) eap_tls : processing EAP-TLS TLS Length 129 (1) eap_tls : Length Included (1) eap_tls : eaptls_verify returned 11 (1) eap_tls : (other): before/accept initialization (1) eap_tls : TLS_accept: before/accept initialization (1) eap_tls : <<< TLS 1.0 Handshake [length 007c], ClientHello SSL: Client requested cached session b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e reading pairlist file /var/log/radius/tlscache/b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e.vps Couldn't open /var/log/radius/tlscache/b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e.vps for reading: No such file or directory SSL: could not load persisted VPs for session b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e (1) eap_tls : TLS_accept: SSLv3 read client hello A (1) eap_tls : >>> TLS 1.0 Handshake [length 0059], ServerHello (1) eap_tls : TLS_accept: SSLv3 write server hello A (1) eap_tls : >>> TLS 1.0 Handshake [length 0909], Certificate (1) eap_tls : TLS_accept: SSLv3 write certificate A (1) eap_tls : >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (1) eap_tls : TLS_accept: SSLv3 write key exchange A (1) eap_tls : >>> TLS 1.0 Handshake [length 00b2], CertificateRequest (1) eap_tls : TLS_accept: SSLv3 write certificate request A (1) eap_tls : TLS_accept: SSLv3 flush data (1) eap_tls : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode ------------------------------------------------ Unsuccessfull attempt log ------------------------------------------------ (1) Found Auth-Type = EAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Expiring EAP session with state 0x55a42e6f55a72377 (1) eap : Finished EAP session with state 0x55a42e6f55a72377 (1) eap : Previous EAP request found for state 0x55a42e6f55a72377, released from the list (1) eap : Peer sent method TLS (13) (1) eap : EAP TLS (13) (1) eap : Calling eap_tls to process EAP data (1) eap_tls : Authenticate (1) eap_tls : processing EAP-TLS TLS Length 129 (1) eap_tls : Length Included (1) eap_tls : eaptls_verify returned 11 (1) eap_tls : (other): before/accept initialization (1) eap_tls : TLS_accept: before/accept initialization (1) eap_tls : <<< TLS 1.0 Handshake [length 007c], ClientHello SSL: Client requested cached session b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e reading pairlist file /var/log/radius/tlscache/b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e.vps SSL: Successfully restored session b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e (1) eap_tls : TLS_accept: SSLv3 read client hello A (1) eap_tls : >>> TLS 1.0 Handshake [length 0051], ServerHello (1) eap_tls : TLS_accept: SSLv3 write server hello A (1) eap_tls : >>> TLS 1.0 ChangeCipherSpec [length 0001] (1) eap_tls : TLS_accept: SSLv3 write change cipher spec A (1) eap_tls : >>> TLS 1.0 Handshake [length 0010], Finished (1) eap_tls : TLS_accept: SSLv3 write finished A (1) eap_tls : TLS_accept: SSLv3 flush data (1) eap_tls : TLS_accept: Need to read more data: SSLv3 read finished A In SSL Handshake Phase In SSL Accept mode I have noticed that during unsuccessfull attempt is in the log this part (2) eap : EAP TLS (13) (2) eap : Calling eap_tls to process EAP data (2) eap_tls : Authenticate (2) eap_tls : processing EAP-TLS TLS Length 59 (2) eap_tls : Length Included and this in successfull log: (2) eap : EAP TLS (13) (2) eap : Calling eap_tls to process EAP data (2) eap_tls : Authenticate (2) eap_tls : processing EAP-TLS (2) eap_tls : Received TLS ACK (2) eap_tls : Received TLS ACK (2) eap_tls : ACK handshake fragment handler (2) eap_tls : eaptls_verify returned 1 (2) eap_tls : eaptls_process returned 13 (2) eap : New EAP session, adding 'State' attribute to reply 0x3190079e33950a29 (2) [eap] = handled Sorry, but I'm new in Freeradius environment and I surely overlook something easy to solve, but in this moment I would kindly ask you, community for a help. It looks to me like a problem with skip some certificate check or caching, but maybe I'm completely wrong. Thank you for you help Gracian

2 8

Disconnect user session on data counter
by Anirudh Malhotra 04 Dec '15

04 Dec '15

Hi everyone, I am new to this list and using freeradius so please bear with me, if I ask anything silly. I am using freeradius 2.1.12, I have successfully configured data counter and user's are not able to start new sessions/authenticate when data limit is reached. But what I am not able to do is disconnect active sessions when the data limit is reached. So if anybody could help me with it. Thanks a lot in advance. BR, Anirudh Malhotra

2 5

Freeradius stops processing and ready to process requests loops
by Greg Antic 04 Dec '15

04 Dec '15

Hi Everyone, We have been running Freeradius 2.x for many months on Ubuntu 14.04 LTS on a few servers. Our Ubuntu boxes were set to auto update and have been doing auto updates for 1-2 years without incident however this weeks updates appear to have broken Freeradius. Freeradius just stopped processing radius requests. When I ran in debug mode the "Ready to process requests." Just keeps looping down the page when radius packets come into the server and nothing is displayed, the radius log remains empty as well. If I run a tcpdump I see the radius packets coming in. We have 4 servers which exhibit the same symptoms. This morning the server auto updated and broke Freeradius again. Below are the packages that are being installed. Has anyone experienced this or could someone advise how else to debug Freeradius to see why it won't process requests as a result of these updates? Start-Date: 2015-12-04 06:38:00 Install: linux-headers-3.13.0-71:amd64 (3.13.0-71.114, automatic), linux-image-extra-3.13.0-71-generic:amd64 (3.13.0-71.114, automatic), linux-image-3.13.0-71-generic:amd64 (3.13.0-71.114, automatic), linux-headers-3.13.0-71-generic:amd64 (3.13.0-71.114, automatic) Upgrade: linux-headers-generic:amd64 (3.13.0.68.74, 3.13.0.71.77), libgnutls-openssl27:amd64 (2.12.23-12ubuntu2.2, 2.12.23-12ubuntu2.3), linux-image-server:amd64 (3.13.0.68.74, 3.13.0.71.77), linux-server:amd64 (3.13.0.68.74, 3.13.0.71.77), linux-headers-server:amd64 (3.13.0.68.74, 3.13.0.71.77), libgnutls26:amd64 (2.12.23-12ubuntu2.2, 2.12.23-12ubuntu2.3), linux-image-generic:amd64 (3.13.0.68.74, 3.13.0.71.77), linux-generic:amd64 (3.13.0.68.74, 3.13.0.71.77) Listening on authentication address 192.168.10.195 port 1812 Listening on accounting address 192.168.10.195 port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address 192.168.10.195 port 1814 Ready to process requests. Ready to process requests. Ready to process requests. Ready to process requests. Ready to process requests. Ready to process requests. Ready to process requests. Thank you, Greg **************************************************************** The views expressed in this email are, unless otherwise stated, those of the author and not those of Smart Technology Centre or its management. The information in this email is confidential and is intended solely for the addressee. Access to this email by any other party is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted in reliance on this, is prohibited and may be unlawful. Whilst all reasonable steps are taken to ensure the accuracy and integrity of information and data transmitted electronically and to preserve the confidentiality thereof, no liability or responsibility whatsoever is accepted if information or data is, for whatever reason, corrupted or does not reach its intended destination. ***************************************************

3 5