- Freeradius-Users - lists.freeradius.org

Network ranges in users files
by Sophie Loewenthal 10 Sep '15

10 Sep '15

Hi, I'dl ike to add some addresses into /etc/raddb/users Currently I have this, DEFAULT NAS-IP-Address == 195.222.222.0, Pool-Name := vodafone-nas-m2m But I should change this to, 195.232.191.50 195.232.191.51 195.232.191.52 195.232.191.53 Maybe I could use 195.232.191.52/29 allowing 195.232.191.49 - 195.232.191.54 Would these ideas work? DEFAULT NAS-IP-Address == 195.232.191.52/29, Pool-Name := vodafone-nas-m2m Or, DEFAULT NAS-IP-Address == 195.232.191.50, Pool-Name := vodafone-nas-m2m DEFAULT NAS-IP-Address == 195.232.191.51, Pool-Name := vodafone-nas-m2m DEFAULT NAS-IP-Address == 195.232.191.52, Pool-Name := vodafone-nas-m2m DEFAULT NAS-IP-Address == 195.232.191.53, Pool-Name := vodafone-nas-m2m Kind regards, Sophie

2 3

freeradius X error "failed to load module "perl""
by John Estrella 10 Sep '15

10 Sep '15

Hi All, I have Ubunto 12.04.3 server and installed LinOTP and FreeRadius using the following website instructions. Not sure the versions of LinOTP and FreeRadius installed but I'm guessing the latest versions since I didn't specify a version during download. https://thenetworkcable.wordpress.com/2014/11/28/two-factor-authentication-… I followed each step and had no errors setting anything up. When running "radtest username OTPpassword 127.0.0.1 0 mypass", I receive an error saying "radclient: no response from server for ID 234 socket 3" Afterwards, I ran freeradius -X debug and got the following message: Radius: #### Loading Virtual Servers #### server { #from the file /etc/freeradius/radius.conf modules { Module: Creating Auth-Type = perl Module: Checking authenticate {...} for more modules to load /etc/freeradius/sites-enabled/linotp[13]: Failed to load module "perl". /etc/freeradius/sites-enabled/linotp[12]: Errors parsing authenticate section. I have searched plenty and haven't found any difinitive solutions. Your help is greatly appreciated. John The information in this e-mail message and any attachments may be legally privileged and confidential. If you are not an intended recipient, you are hereby notified that you have received this communication in error and that any review, use, distribution or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately by return e-mail and delete this e-mail message, any copies thereof and any attachments thereto. This email is for informational purposes only and does not constitute an offer to sell or a solicitation of an offer to purchase any interest in any investment vehicles managed by Sandler Capital Management.

4 4

sql accounting
by Edwardo Garcia 09 Sep '15

09 Sep '15

Hi, in accounting {} There is -sql and -ldap can someone explain why they are exampled that way? Does it mean do not use sql and ldap? and it is written this way to specifically not use them, over a compile time default of use them? So if I want to use sql in accounting, I need change -sql to sql? thanks

3 4

Questions regarding trimming User-Name attribute via filter.
by Pro Green European 09 Sep '15

09 Sep '15

Hi. I'm having issues with migrating from 2.1.0 to 3.0.4 (Centos 7.x). In version 2.1.0 I have in /etc/freeradius/users: DEFAULT User-Name =~ ".{5}$" User-Name = `%{0}` This does not work anymore, and I am struggling to understand how to achieve the same thing in 3.0.4. What I want to achieve is, that anything that comes before the last five characters should be removed from the User-Name attribute, and only the last five characters should be left as User-Name. I understand that I have to do this in /etc/raddb/policy.d/filter somehow, but I fail to see how. Would somebody with better knowledge please assist. BR, /PGE

2 1

eapol_test from wpa_supplicat-2.4 fails with MPPE keys mismatch for TTLS:CHAP/MSCHAP/MSCHAPv2
by Patrik Kis 09 Sep '15

09 Sep '15

Hello, I executed eapol_test from wpa_supplicat-2.4 (that is using TLS-1.2) against freeradius-2.2.8 and the following cases are failing with " [ttls] Tunneled challenge is incorrect": EAP-TTLS/CHAP EAP-TTLS/MSCHAP EAP-TTLS/MSCHAPv2 Interestingly the same tests with eapol_test from wpa_supplicat-2.4 (that is using TLS-1.0) are fine. I would be surprised if I was the first who tried to run these tests. Does anybody experienced the same issue? For configuration and test results please refer to the attached file. radiusd in debug mode write this: ... [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Tunneled challenge is incorrect [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [eap] Reply already contained an EAP-Message, not inserting EAP-Failure ++[eap] = noop [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 6 to 127.0.0.1 port 49816 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 The test configuration files looks like this: # cat EAP-TTLS_CHAP.conf ctrl_interface=wpa_supplicant.ctrl network={ ssid="QA test 802.1x network" key_mgmt=IEEE8021X eap=TTLS phase2="auth=CHAP" identity="testuser" anonymous_identity="anonymous" password="testpwd" ca_cert="/etc/raddb/certs/ca.pem" ca_cert2="/etc/raddb/certs/ca.pem" } The raiusd has the default configuration except: /etc/raddb/modules/mschap /etc/raddb/modules/pap /etc/raddb/eap.conf /etc/raddb/users and test certificates were created and added. For the details please see the attached file. The wpa_supplicant was built with the provided "defconfig" configuration. Regards, Patrik Kis

6 14

User authentication - users config file and MySQL databases
by Alexandre Vilarinho 09 Sep '15

09 Sep '15

Hello all I would like to transfer all the configured users in the user conf file to MySQL database, is it possible? I've configured Radius to work with MySQL and created a test user in radcheck database with a test password. Folllow the entry. username - testeattribute - cleartext-passwordop - :=value - teste I also created an entry in radreply database the following entry. username - testeattribute - fall-throughop - =value - yes For this test all others databases are empty. I've started freeradius in debug mode to see if there where any erros, but there wasn't. The log file output. Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #2Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #4Tue Sep 8 23:53:00 2015 : Info: Loaded virtual server inner-tunnelTue Sep 8 23:53:00 2015 : Info: ... adding new socket proxy address * port 52669Tue Sep 8 23:53:00 2015 : Info: Ready to process requests. After radius server was running I tested if the user, teste, was going to be authenticated, and it wasn't. I've received an Reject message. Sending Access-Request of id 147 to 127.0.0.1 port 1812 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=147, length=20 Neither the debug or the log show if Freeradius was searching for this user to the user conf file or in MySQL databases. Since in radius documentation states that if the user is not found it is reject, I wonder where is it searching. Is not clear if it is only searching in the user conf file or if it also searching in radckeck database. Is it possible to add in the debug or in log file where Freeradius is searching for the user? When I test the authentication with an user, teste1, configured in the user conf file, it was accepted. root@Ubuntu-Radius-Server:~# radtest teste1 teste localhost 1812 testing123Sending Access-Request of id 210 to 127.0.0.1 port 1812 User-Name = "teste1" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=210, length=20 I didn't found in the radiusd.conf file or in the sql.conf file a way to configure Radius to force it to use the MySQL databases to authenticate the users. Is it possible to configure it? Thanks for the help. Regards Alex

6 9

reuse EAP-TLS client certificiate
by Matt Zagrabelny 09 Sep '15

09 Sep '15

Greetings, I've done a quick google and scan of the FR user mailing list archives and did not find a definitive answer to the following: With EAP-TLS, can one reuse the same client cert across multiple devices? I'm guessing "yes", but would appreciate confirmation. Tangentially, is there a way to "pin" a certificate to a client's MAC address? Thanks! -m

3 3

Authentication MS SQL Server 2008
by Andrés Gómez 09 Sep '15

09 Sep '15

Hi everyone. I have a list of authorized users stored in a Microsoft SQL Server 2008. My Freeradius system is installed on a Linux server, and I want to store the accounting (radacct table) data in my Linux server (mysql). can freeradius ask to Microsoft SQL Server 2008 to authorize an user? How can I do it? I have searched and I only get information abut how to store accounting data ina a ODBC database, but its not my case. Regards, -- *C. Andrés Gómez R.*

2 1

Realm Strip
by Dennis Xu 09 Sep '15

09 Sep '15

This is our setup: we put a FreeRadius version 2.1.10 on Ubuntu in front of the Cisco ACS 5 and we need the FreeRadius to strip the suffix starting from @ and just pass the username to ACS 5 for authentication(with AD). We use PEAP MS-CHAPv2. It did not work. ACS5 still sees the whole username(i.e, dxu(a)uoguelph.ca) with the suffix. I added the following to the proxy.conf file: realm uoguelph.ca { type = radius authhost = acs5-test2.uoguelph.ca:1812 accthost = acs5-test2.uoguelph.ca:1813 secret = testing123 } I added followings to the radiusd.conf file: realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } authorize { preprocess mschap suffix eap files } authenticate { Auth-Type MS-CHAP { mschap } eap } mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } Did I miss anything? Does FreeRadius strip the realm for both inner and outer IDs for peap authentication? Thank you for your help! --- Dennis Xu, MASc, CCIE #13056 Analyst 3, Network Infrastructure Computing and Communications Services(CCS) University of Guelph 519-824-4120 Ext 56217 dxu(a)uoguelph.ca www.uoguelph.ca/ccs

2 2

User authentication - users config file and MySQL databases
by Alexandre Oliveira 09 Sep '15

09 Sep '15

Hello all, I would like to transfer all the configured users in the users in the users con file to MySQL database, it is possible? I’ve configured Radius to work with MySQL and created a test user, teste, in radcheck database with a test password, teste. Follow the entry: username - teste attribute - cleartext-password op - := value - teste I also created an entry in radreply database. Follow the entry: username - teste attribute - fall-through op - = value - yes For this test all other databases are empty. I’ve stated free radius in debug mode to see if there were any erros, but there weren’t. Follow the log output: root@Ubuntu-Radius-Server:~# tail /var/log/freeradius/radius.log Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #2 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #3 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #4 Tue Sep 8 23:53:00 2015 : Info: Loaded virtual server inner-tunnel Tue Sep 8 23:53:00 2015 : Info: ... adding new socket proxy address * port 52669 Tue Sep 8 23:53:00 2015 : Info: Ready to process requests. After Freeradius server was running I testes if the user from radcheck database was going to be authenticated, and it wasn’t. I received a Rejected Message, as follow. Sending Access-Request of id 47 to 127.0.0.1 port 1812 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=47, length=20 Neither the debug or log shown if Freeradius was searching for his user in the users config file or in radcheck database. Since in Freeradius documentation states that if the user is not found it is rejected, I’m presuming that the user was not found. Although it is not clear if Freeradius is searching only in the users config or if it is searching also in radcheck database. Is is possible to add to the debug or in the log file where is Freeradius searching for he user? when I tested the authentication with an user, teste1, configured in the users config file, the authentication was accepted. root@Ubuntu-Radius-Server:~# radtest teste1 teste localhost 1812 testing123 Sending Access-Request of id 2 to 127.0.0.1 port 1812 User-Name = "teste1" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=2, length=20 I didn’t found in radiusd.conf o in sql.conf files a way to configure Freeradius to search it to use the radcheck database to authenticate the users. Is it possible to configure it? Thanks for the help. Regards Alex

1 0