- Freeradius-Users - lists.freeradius.org

Debugmode together with Kerberos
by Stefan Kania 30 Oct '23

30 Oct '23

Hi everybody, I have configured freeradius to use gssapi for authentication while searching the LDAP for users or hosts. Now I can't start the debugmode anymore. Everytime I try I'm getting: ---------- rlm_ldap (ldap): Connecting to ldaps://ldap-r01.example.net:636 ldaps://ldap-r02.example.net:636 rlm_ldap (ldap): Starting SASL mech(s): gssapi SASL/GSSAPI authentication started rlm_ldap (ldap): Bind with (anonymous) to ldaps://ldap-r01.example.net:636 ldaps://ldap-r02.example.net:636 failed: Local error rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" ---------- The log from the LDAP-server is showing: ---------- Okt 29 15:27:27 ldap-r01 slapd[620]: conn=1024 fd=26 ACCEPT from IP=192.168.56.47:34490 (IP=0.0.0.0:636) Okt 29 15:27:27 ldap-r01 slapd[620]: conn=1024 fd=26 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Okt 29 15:27:27 ldap-r01 slapd[620]: conn=1024 op=0 UNBIND Okt 29 15:27:27 ldap-r01 slapd[620]: conn=1024 fd=26 closed ---------- Running freeradius normal I can search for a user end check authentication with username and password -------------------- root@radius-r01:~# radtest u1-verw geheim 192.168.56.47 1812 Passw0rd Sent Access-Request Id 143 from 0.0.0.0:34828 to 192.168.56.47:1812 length 77 User-Name = "u1-verw" User-Password = "geheim" NAS-IP-Address = 192.168.56.47 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "geheim" Received Access-Accept Id 143 from 192.168.56.47:1812 to 192.168.56.47:34828 length 20 -------------------- The logfile for m my LDAP-Server is showing: ---------- Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1031 op=2 BIND dn="" method=163 Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1031 op=2 BIND authcid="radius/radius-r01.example.net" authzid="radius/radius-r01.example.net" Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1031 op=2 BIND dn="uid=radius/radius-r01.example.net,cn=gssapi,cn=auth" mech=GSSAPI bind_ssf=56 ssf=256 Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1031 op=2 RESULT tag=97 err=0 qtime=0.000006 etime=0.000187 text= Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1026 op=3 BIND anonymous mech=implicit bind_ssf=0 ssf=256 Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1026 op=3 BIND dn="cn=u1 Verw,ou=users,ou=Verwaltung,dc=example,dc=net" method=128 Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1026 op=3 BIND dn="cn=u1 Verw,ou=users,ou=Verwaltung,dc=example,dc=net" mech=SIMPLE bind_ssf=0 ssf=256 Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1026 op=3 RESULT tag=97 err=0 qtime=0.000007 etime=0.006275 text= ---------- So as you can see, authentication via Kerberos for the search and authentication of users is working. To do the next step, switch to user-authentication via certificate, I want to start the debugmode, but I could not figure out how to get the debugmode running with Kerberos authentication :-( Is there a way to get it running? Stefan

4 7

%{SQL-User-Name} parsing in authorize section - bug?
by Igor Smitran 30 Oct '23

30 Oct '23

Hi list, Have i found a bug or i have made a mistake in configuring freeradius, version 3.2.3 from networkradius ubuntu repo... When i put this into authorize section: authorize { ... # MAC LIMIT update control { Tmp-Integer-3 := "%{sql: SELECT count(*) FROM radcheck WHERE Username = '%{SQL-User-Name}' and (mac_limit='%{Calling-Station-Id}' or mac_limit='*');}" } ... } it doesn't work, SQL-User-Name is empty: (0) update control { (0) EXPAND %{User-Name} (0) --> testuser (0) SQL-User-Name set to 'testuser' rlm_sql (sql): Reserved connection (2) (0) Executing select query: SELECT count(*) FROM radcheck WHERE Username = '' and (mac_limit='' or mac_limit='*'); rlm_sql (sql): Released connection (2) (0) EXPAND %{sql: SELECT count(*) FROM radcheck WHERE Username = '%{SQL-User-Name}' and (mac_limit='%{Calling-Station-Id}' or mac_limit='*');} (0) --> 0 (0) Tmp-Integer-3 := 0 (0) } # update control = noop If User-Name is used instead of SQL-User-Name it works: authorize { ... # MAC LIMIT update control { Tmp-Integer-3 := "%{sql: SELECT count(*) FROM radcheck WHERE Username = '%{User-Name}' and (mac_limit='%{Calling-Station-Id}' or mac_limit='*');}" } ... } (0) update control { rlm_sql (sql): Reserved connection (2) rlm_sql (sql): Released connection (2) (0) EXPAND %{User-Name} (0) --> testuser (0) SQL-User-Name set to 'testuser' rlm_sql (sql): Reserved connection (3) (0) Executing select query: SELECT count(*) FROM radcheck WHERE Username = 'testuser' and (mac_limit='' or mac_limit='*'); rlm_sql (sql): Released connection (3) (0) EXPAND %{sql: SELECT count(*) FROM radcheck WHERE Username = '%{User-Name}' and (mac_limit='%{Calling-Station-Id}' or mac_limit='*');} (0) --> 1 (0) Tmp-Integer-3 := 1 (0) } # update control = noop It looks like SQL-User-Name population is done after authorize is processed, i am not sure. Everywhere else i am able to use SQL-User-Name, including queris.conf. But, not in authorize. Please correct me if i am wrong. I would appreciate any help. If it's my error than even better. It's not so big problem, but it's annoying. Same setup works in 2.1 but not in 3.0 and 3.2 Thank you, Igor Smitran

2 2

Allow requests even if the MAC is not allowed?
by Florian Traxler (mieX GmbH) 30 Oct '23

30 Oct '23

Hello! Can you allow requests via DHCP in FreeRadius 3.0.20 even if the MAC is not allowed? Example: () sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:00:00:AA:BB:CC' ORDER BY id () sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:00:00:AA:BB:CC' ORDER BY id () sql: WARNING: User not found in radcheck table. Can I still assign an IP from the IP pool to this MAC? Thanks

2 1

checkrad alternative
by Igor Smitran 30 Oct '23

30 Oct '23

Hi list, I have a new Cisco ASR. There is no SNMP OID on it for checking simultaneous use with checkrad. Is there an alternative? Am i able to use COA instead of checkrad? If so, any help would be appreciated. Thanx

4 11

auto scaling freeradius instance on openshift and state-ID problem
by Mesut GULNAZ 29 Oct '23

29 Oct '23

I was able to run freeradius instance on kubernetes / openshift. and I am using 2FA via freeradius. my problem is; when I auto-scale the freeradius to more than 1, openshift platform is unable to send the response coming from the client side with state-ID to the correct radius POD. The other radius pod is rejecting the reply coming from the client because of the state created by the other radius POD. is there a solution or workaround for this case? best regards.

4 8

Connect sql with eap-PEAP /MSchapv2
by Laurent Estévez 27 Oct '23

27 Oct '23

hello I have a functional configuration with ntlm_auth link in EAP-PEAP/MSchapv2. I would like to add an sql database as a source, is this possible ? I've done some tests OK with EAP-TTLS, but not with my current configuration, Thanks in advance, Laurent --

3 3

Updating/overwriting attribute with rlm_python
by Norman Elton 26 Oct '23

26 Oct '23

I’m using rlm_python, returning a tuple to update attributes in the reply. I’ve noticed that if the request already has a value for that attribute, it is not overwritten. That is, my operation becomes a no-op. I suppose this matches the behavior of the “=“ operator. Is there a way to behave like the “:=“ operator, overwriting the existing value? Or should I strip the value prior to invoking my python module? Thanks, Norman

2 1

PEAP/mschapv2 password fail log guestion
by 박지연 25 Oct '23

25 Oct '23

1 0

Stuck at "More than 50 roundtrips"
by thomas＠habets.se 24 Oct '23

24 Oct '23

Hi. I'm trying to set up EAP-TLS with certificates with an Android Pixel 7 Pro, latest OS, via a Unifi U6 Pro, using FreeRadius 3.0.17 on a raspberry pi 4. I took the default config, and changed as little as possible: clients.conf, added: client wifi_aps { ipaddr = 192.168.123.0/24 secret = radiuspasswordhere } In case it would help, I also added a user. PEAP auth with username/password works. wifi Cleartext-Password := "XXXXXXX" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "13", Reply-Message = "Hello there!" Made the certificates by editing the .cnf files and doing "make ca.pem", "make server.pem", and "make client.pem". I loaded the .p12 on the Android phone, and changed the paths in mod-enabled/eap. I changed default_eap_type to tls, and added use_tunneled_reply to tls-config. Here's a selection of the output of freeradius -X: First access request in packet 1: (1) Received Access-Request Id 61 from 192.168.XX.Z:59545 to 192.168.XX.Y:1812 length 216 SSL handshake done by packet 8: (8) eap_tls: SSL Connection Established (with client cert details shown) After that there's just a bunch of apparently empty-ish repeating Access-Request/Access-Challenge[1], and it's stuck that way until: (52) eap: ERROR: rlm_eap (EAP): Aborting! More than 50 roundtrips made in session with state 0x8e36e001bc25ed47 What am I doing wrong? In this example I'm putting "wifi" as identity, in case it helps that it's present in the user config. I expect that at some point the server should reply Accepted, instead of a new challenge. I guess the client cert was not enough auth? Is there a config I need to change so that cert is sufficient? I'd appreciate any help. Thanks. [1] (14) Received Access-Request Id 74 from 192.168.XX.Z:59545 to 192.168.XX.Y:1812 length 231 (14) User-Name = "wifi" (14) NAS-IP-Address = 192.168.XX.Z (14) NAS-Identifier = "xxx" (14) Called-Station-Id = "xx-xx-xx-xx-xx-xx:secnet2" (14) NAS-Port-Type = Wireless-802.11 (14) Service-Type = Framed-User (14) Calling-Station-Id = "xx-xx-xx-xx-xx-xx" (14) Connect-Info = "CONNECT 0Mbps 802.11b" (14) Acct-Session-Id = "3E1F2B0282D15C98" (14) Acct-Multi-Session-Id = "3870EEE1F7155662" (14) WLAN-Pairwise-Cipher = 1027076 (14) WLAN-Group-Cipher = 1027076 (14) WLAN-AKM-Suite = 1027073 (14) Framed-MTU = 1400 (14) EAP-Message = 0x02ed00060d00 (14) State = 0x8e36e00182dbed476556c84932fcf3de (14) Message-Authenticator = 0x03a0ae965bd12781a50f91cd3ac1aaf6 (14) session-state: No cached attributes (14) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (14) authorize { (14) policy filter_username { (14) if (&User-Name) { (14) if (&User-Name) -> TRUE (14) if (&User-Name) { (14) if (&User-Name =~ / /) { (14) if (&User-Name =~ / /) -> FALSE (14) if (&User-Name =~ /@[^@]*@/ ) { (14) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (14) if (&User-Name =~ /\.\./ ) { (14) if (&User-Name =~ /\.\./ ) -> FALSE (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (14) if (&User-Name =~ /\.$/) { (14) if (&User-Name =~ /\.$/) -> FALSE (14) if (&User-Name =~ /(a)\./) { (14) if (&User-Name =~ /(a)\./) -> FALSE (14) } # if (&User-Name) = notfound (14) } # policy filter_username = notfound (14) [preprocess] = ok (14) [chap] = noop (14) [mschap] = noop (14) [digest] = noop (14) suffix: Checking for suffix after "@" (14) suffix: No '@' in User-Name = "wifi", looking up realm NULL (14) suffix: No such realm "NULL" (14) [suffix] = noop (14) eap: Peer sent EAP Response (code 2) ID 237 length 6 (14) eap: No EAP Start, assuming it's an on-going EAP conversation (14) [eap] = updated (14) files: users: Matched entry wifi at line 90 (14) [files] = ok (14) [expiration] = noop (14) [logintime] = noop (14) pap: WARNING: Auth-Type already set. Not setting to PAP (14) [pap] = noop (14) } # authorize = updated (14) Found Auth-Type = eap (14) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (14) authenticate { (14) eap: Expiring EAP session with state 0x8e36e00182dbed47 (14) eap: Finished EAP session with state 0x8e36e00182dbed47 (14) eap: Previous EAP request found for state 0x8e36e00182dbed47, released from the list (14) eap: Peer sent packet with method EAP TLS (13) (14) eap: Calling submodule eap_tls to process data (14) eap_tls: Continuing EAP-TLS (14) eap_tls: Peer ACKed our handshake fragment (14) eap_tls: [eaptls verify] = request (14) eap_tls: [eaptls process] = handled (14) eap: Sending EAP Request (code 1) ID 238 length 10 (14) eap: EAP session adding &reply:State = 0x8e36e00183d8ed47 (14) [eap] = handled (14) } # authenticate = handled (14) Using Post-Auth-Type Challenge (14) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (14) Challenge { ... } # empty sub-section is ignored (14) Sent Access-Challenge Id 74 from 192.168.XX.Y:1812 to 192.168.XX.Z:59545 length 0 (14) Tunnel-Type = VLAN (14) Tunnel-Medium-Type = IEEE-802 (14) Tunnel-Private-Group-Id = "13" (14) Reply-Message = "Hello there!" (14) EAP-Message = 0x01ee000a0d8000000000 (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x8e36e00183d8ed476556c84932fcf3de (14) Finished request -- typedef struct me_s { char name[] = { "Thomas Habets" }; char email[] = { "thomas(a)habets.se" }; char kernel[] = { "Linux" }; char *pgpKey[] = { "http://www.habets.pp.se/pubkey.txt" }; char pgp[] = { "9907 8698 8A24 F52F 1C2E 87F6 39A4 9EEA 460A 0169" }; char coolcmd[] = { "echo '. ./_&. ./_'>_;. ./_" }; } me_t;

2 3

Identify the site in logging
by Stephane Bourque 24 Oct '23

24 Oct '23

Hello, We have a need to be able to identify the virtual-server that is generating the log messages. How would you approach this? - Is there a way to get a different logging configuration per server? - Is there a way to add the server name in logging statements? We are not too sure of how to proceed. Thanks for your guidance. -- *Stephane Bourque* *CEO & Founder* *Arilia Wireless Inc.* *"Everything connected"* stephane.bourque(a)arilia.com +1(778)558-3524 *www.arilia.com <http://www.arilia.com>*

3 3