- Freeradius-Users - lists.freeradius.org

WARNING: Unknown module "tolower" in string expansion "%"
by Юра Фролов 07 Aug '15

07 Aug '15

As an example for setting used http://wiki.freeradius.org/guide/Mac%20Auth (on FreeRADIUS 2.1.12 it configuration works very well) my policy.conf ....... mac-addr = ([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[ ^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2}) rewrite.called_station_id { if((Called-Station-Id) && "%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) { update request { Called-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } if ("%{8}") { update request { Called-Station-Id := "%{Called-Station-Id}:%{8}" } } updated } else { noop } } rewrite.calling_station_id { if((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) { update request { Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } updated } else { noop } } # host-name = host\/[0-9a-f]*\.ww[0-9]{3}\.siemens\.net rewrite.host_name { # if((User-Name) && "%{User-Name}" =~ /^%{config:policy.host-name}$/i) { update request { Tmp-String-0 := "%{tolower:%{User-Name}}" } # } # else { # noop # } } ........ section in conf. file virtual server ....... authorize { preprocess if (!EAP-Message) { rewrite.calling_station_id authorized_mac if ( ok ) { update control { Auth-Type := Accept } } else { reject } } elsif ( (User-Name == "OpenStagePhone") || (User-Name =~ /^001a/) || (User-Name =~ /^0004/) ) { eap } else { rewrite.host_name authorized_name if (ok) { eap } else { reject } } } authenticate { eap authorized_mac } session { } post-auth { if ( (User-Name == "OpenStagePhone") || (User-Name =~ /^001a/) || (User-Name =~ /^0004/) ) { update reply { Cisco-AVPair := "device-traffic-class=voice" } } Post-Auth-Type REJECT { attr_filter.access_reject } } } Add question: tolower this modul similarly rlm-eap or or the structure of the language of programming?

1 0

Switch sends EAP-Fail after Radius Access-Accept
by Preyas Kamath 06 Aug '15

06 Aug '15

When client connects to 802.1x enabled Cisco switch the EAP request, reply are fine, Radius server request, response seems ok. However even though Radius server response with Accept, the Cisco 2960-S send EAP fail to client. I'm using a fairly simple Radius conf file (see below). Setup Windows XP client 10.1.2.100 <--> (port 12) Catalyst switch 2960-S 10.1.2.12 (port 1) <--> Radius server 10.1.2.1 (freeRadius running on Centos 6.4). [preyask@localhost controller-ned]$ cat /etc/raddb/small.conf listen { type = auth ipaddr = * port = 1812 } client 10.1.2.0/24 { # allow packets from 10.1.2.0/24 secret = testing123 shortname = 10.1.2.12 } modules { # We don't use any modules } authorize { # return Access-Accept for PAP and CHAP update control { Auth-Type := Accept } } Wireshark shows Radius Access-Accept with code 2, see packet below, I have a feeling that the switch is looking for something else in the Radius Accept-Accept packet, it's not finding it so it sends EAP Fail to client. Packet No 17 is the Radius Access-Request, No 18 is the Radius Access-Accept No. Time Source Destination Protocol Length Info 17 5.943203000 10.1.2.12 10.1.2.1 RADIUS 200 Access-Request(1) (id=80, l=158) Frame 17: 200 bytes on wire (1600 bits), 200 bytes captured (1600 bits) on interface 0 Interface id: 0 WTAP_ENCAP: 1 Arrival Time: Aug 5, 2015 12:18:53.509276000 EDT [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1438791533.509276000 seconds [Time delta from previous captured frame: 0.708854000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 5.943203000 seconds] Frame Number: 17 Frame Length: 200 bytes (1600 bits) Capture Length: 200 bytes (1600 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0), Dst: HewlettP_74:43:55 (10:60:4b:74:43:55) Destination: HewlettP_74:43:55 (10:60:4b:74:43:55) Address: HewlettP_74:43:55 (10:60:4b:74:43:55) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0) Address: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 10.1.2.12 (10.1.2.12), Dst: 10.1.2.1 (10.1.2.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 186 Identification: 0x0884 (2180) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (17) Header checksum: 0x9aa0 [correct] [Good: True] [Bad: False] Source: 10.1.2.12 (10.1.2.12) Destination: 10.1.2.1 (10.1.2.1) User Datagram Protocol, Src Port: sightline (1645), Dst Port: radius (1812) Source port: sightline (1645) Destination port: radius (1812) Length: 166 Checksum: 0x52d4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x50 (80) Length: 158 Authenticator: 974ac85da269d81595fd54db7effa738 [The response to this request is in frame 18] Attribute Value Pairs AVP: l=11 t=User-Name(1): anonymous User-Name: anonymous AVP: l=6 t=Service-Type(6): Framed(2) Service-Type: Framed (2) AVP: l=6 t=Framed-MTU(12): 1500 Framed-MTU: 1500 AVP: l=19 t=Called-Station-Id(30): 24-B6-57-D3-2C-8C Called-Station-Id: 24-B6-57-D3-2C-8C AVP: l=19 t=Calling-Station-Id(31): 5C-B9-01-B2-4A-15 Calling-Station-Id: 5C-B9-01-B2-4A-15 AVP: l=16 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 1 Length: 14 Type: Identity (1) Identity: anonymous AVP: l=18 t=Message-Authenticator(80): 538bc16f555647f1d590468a82da13dc Message-Authenticator: 538bc16f555647f1d590468a82da13dc AVP: l=2 t=EAP-Key-Name(102): EAP-Key-Name: AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=6 t=NAS-Port(5): 50112 NAS-Port: 50112 AVP: l=23 t=NAS-Port-Id(87): GigabitEthernet1/0/12 NAS-Port-Id: GigabitEthernet1/0/12 AVP: l=6 t=NAS-IP-Address(4): 10.1.2.12 NAS-IP-Address: 10.1.2.12 (10.1.2.12) No. Time Source Destination Protocol Length Info 18 5.943345000 10.1.2.1 10.1.2.12 RADIUS 62 Access-Accept(2) (id=80, l=20) Frame 18: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0 Interface id: 0 WTAP_ENCAP: 1 Arrival Time: Aug 5, 2015 12:18:53.509418000 EDT [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1438791533.509418000 seconds [Time delta from previous captured frame: 0.000142000 seconds] [Time delta from previous displayed frame: 0.000142000 seconds] [Time since reference or first frame: 5.943345000 seconds] Frame Number: 18 Frame Length: 62 bytes (496 bits) Capture Length: 62 bytes (496 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:radius] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: HewlettP_74:43:55 (10:60:4b:74:43:55), Dst: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0) Destination: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0) Address: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: HewlettP_74:43:55 (10:60:4b:74:43:55) Address: HewlettP_74:43:55 (10:60:4b:74:43:55) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 10.1.2.1 (10.1.2.1), Dst: 10.1.2.12 (10.1.2.12) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 48 Identification: 0xdc2b (56363) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0x8683 [correct] [Good: True] [Bad: False] Source: 10.1.2.1 (10.1.2.1) Destination: 10.1.2.12 (10.1.2.12) User Datagram Protocol, Src Port: radius (1812), Dst Port: sightline (1645) Source port: radius (1812) Destination port: sightline (1645) Length: 28 Checksum: 0x183c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Radius Protocol Code: Access-Accept (2) Packet identifier: 0x50 (80) Length: 20 Authenticator: 17e05e8768080f89322124ad63a1eb63 [This is a response to a request in frame 17] [Time from request: 0.000142000 seconds] No. Time Source Destination Protocol Length Info 536 229.314304000 10.1.2.12 10.1.2.1 RADIUS 97 Access-Request(1) (id=81, l=55)

4 4

radclient output
by Lightfoot, Maurice P. 06 Aug '15

06 Aug '15

Hi I am using the FreeRadius beginner's guide, I entered the following command: echo "User-Name=alice, User-Password=passme" | radclient 127.0.01 auth testing123 The following response is what was expected according to the guide: Received response ID 32, code 2, length = 40 Framed-IP-Address = 192.168.1.65 Reply-Message = "Hello, alice" However the message I received from the debugger was the following: Sending Access-Accept ID 85 from 127.0.01:1812 to 127.0.01:60048 Framed-IP-Address= 192.168.1.65 Reply-Message = 'Hello, alice' Is this the correct output because there is no code # to go off of as referenced in the guide???

2 3

WARNING: Unknown module "tolower" in string expansion "%"
by Юра Фролов 06 Aug '15

06 Aug '15

Hello! I installed freeradius version 2.2.5 on debian 8.1 (latest version in repository). For authentification users accept mix 802.1x and mab. List stored in the files: mac-address in mac_db, name users in name_db (no sql database accepted) I also copied all files (configuration files, files users authentification ) with a previously installed and successfully operates freeradius (debian 7.8 freeradius 2.1.12). But when a user tries to authenticate MAC address (or 802.1x) on an error occurs: "Invalid user". The logs present a strange record: "WARNING: Unknown module "tolower" in string expansion "%"" Log failed authentification: rad_recv: Access-Request packet from host 1.1.1.1 (not real) port 1645, id=66, length=209 User-Name = "host/user.mycompany.com" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-21-56-D6-EA-9F" Calling-Station-Id = "8C-73-6E-D9-41-1D" EAP-Message = 0x0201002a01686f73742f5042333030303037303234384e422e77773630302e7369656d656e732e6e6574 Message-Authenticator = 0x2c614fd14a05671b890772dabf25d62f NAS-Port-Type = Ethernet NAS-Port = 50031 NAS-Port-Id = "FastEthernet0/31" NAS-IP-Address = 1.1.1.1 (not real) server snx-auth { # Executing section authorize from file /etc/freeradius/sites-enabled/snx-auth +group authorize { ++[preprocess] = ok ++? if (!EAP-Message) ? Evaluating !(EAP-Message) -> FALSE ++? if (!EAP-Message) -> FALSE ++? elsif ((User-Name == "OpenStagePhone") || (User-Name =~ /^001a/) || (User-Name =~ /^0004/) ) ?? Evaluating (User-Name == "OpenStagePhone") -> FALSE ?? Evaluating (User-Name =~ /^001a/) -> FALSE ?? Evaluating (User-Name =~ /^0004/) -> FALSE ++? elsif ((User-Name == "OpenStagePhone") || (User-Name =~ /^001a/) || (User-Name =~ /^0004/) ) -> FALSE ++else else { +++policy rewrite.host_name { ++++update request { *WARNING: Unknown module "tolower" in string expansion "%"* ++++} # update request = noop +++} # policy rewrite.host_name = noop [authorized_name] expand: %{Tmp-String-0} -> +++[authorized_name] = noop +++? if (ok) ? Evaluating (ok) -> FALSE +++? if (ok) -> FALSE +++else else { ++++[reject] = reject +++} # else else = reject ++} # else else = reject +} # group authorize = reject Invalid user: [host/user.mycompany.com/<no User-Password attribute>] (from client domain port 50031 cli 8C-73-6E-D9-41-1D) The problem is conversion (uppercase - lowercase)? Feature works freeradius version 2.2.5 (undocumented error)? Or something else?

2 1

AAA configuration
by Anisa Allahdadi 05 Aug '15

05 Aug '15

> Hi all, > > I installed FreeRADIUS on Ubuntu, configured the database (mysql), > performed radtest from the localhost and NTradPing from a remote WIN > machine. Now I want to make this process automatic, so that every > connection/disconnection to/from the Internet put a record in *radacct* > table. I realized that I should configure my AP and I found some guides > here: > http://wiki.freeradius.org/vendor/Cisco > > I have 2 specific questions: > > 1. How and where exactly I can run the AAA configuration commands? > 2. What if my NAS is not of Cisco family? Does that make any difference? > > Any help will be really appreciated. > > Thanks, > Anisa >

1 0

Re: Freeradius-Users Digest, Vol 124, Issue 3
by JCA 05 Aug '15

05 Aug '15

> On Aug 3, 2015, at 11:45 PM, JCA <1.41421(a)gmail.com> wrote: >>> What's with the one letter acronyms? It just makes things harder to understand. >> >> It's for conciseness - it's simpler to write R than "RADIUS server" >> every time. My apologies if this misled you. > > It doesn't mislead. It's confusing and broken. "l33t" speak isn't useful, and is discouraged on this list. It's not "l33t" speak; it's compact notation in order to keep things short and to the point. My apologies if that confuses you. > >>> What you want is impossible to do. PAM is designed to do authentication. You CANNOT set group membership with PAM. >> >> You can't, or you shouldn't? > > I distinctly recall writing CANNOT. > >> What prevents one from writing a PAM >> module (or modifying an existing one) so that it will receive group >> information from the RADIUS server and modify /etc/group accordingly >> before returning to the caller? > > Reality? > > Writing to /etc/group is forbidden. For very good reasons. > > Alan DeKok. Well, I have just tried (as root, in CentOS) to edit /etc/group by hand, and I had no problems. Is it not the case that if the RADIUS PAM module runs as root, it will also be able to do so?

3 2

EAP-TLS with server and client certificates by different CA
by Mikhail Gaidamaka 05 Aug '15

05 Aug '15

Good day We use FreeRADIUS 2.1.10 to authorize wi-fi clients. Step 1: many client's devices check server certificate, than we have Comodo EssentialSSL certificate for server. Its certificate chain: - radius_eltex_nsk_ru.crt - http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt - http://crt.comodoca.com/COMODORSAAddTrustCA.crt - AddTrust External CA Root EAP-PEAP-mschapv2 works good with this certificate. Step 2: we want to authorize clients with EAP-TLS We create self-signed CA (/etc/ssl/eltex/eltex-ca.crt) and any clients certs (maria.crt, for example). eap.conf has this parameters eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { #challenge = "Password: " auth_type = PAP } tls { certdir = ${confdir}/certs cadir = /etc/ssl/eltex private_key_password = 123456 private_key_file = ${certdir}/radius.eltex.nsk.ru.key certificate_file = ${certdir}/radius_eltex_nsk_ru.crt CA_file = ${cadir}/eltex-ca.crt \ ${certdir}/COMODORSADomainValidationSecureServerCA.crt \ ${certdir}/COMODORSAAddTrustCA.crt \ ${certdir}/AddTrustExternalCARoot.crt dh_file = ${certdir}/dh random_file = /dev/urandom # fragment_size = 1024 # include_length = yes # check_crl = yes CA_path = ${certdir} # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 # hours max_entries = 255 } verify { tmpdir = /tmp/radiusd client = "/usr/bin/openssl verify -CApath ${..cadir} %{TLS-Client-Cert-Filename}" } } 'cadir' contains eltex-ca.crt, eltex-ca.key only And now we can't authorize with EAP-TLS Client's device sends 'alert unknown ca' (what CA - server or client I can't understand) It was OK, when server ant client certificate were both signed by eltex-ca. I get this error at /var/log/syslog wpa_supplicant[926]: TLS: Certificate verification failed, error 20 (unable to get local issuer certificate) depth 0 for '/OU=Domain Control Validated/OU=EssentialSSL/CN=radius.eltex.nsk.ru' wpa_supplicant[926]: OpenSSL: tls_connection_handshake - SSL_connect error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I try to install all my server certs to system # sudo update-ca-certificates 4 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d.... updating keystore /etc/ssl/certs/java/cacerts... added: /etc/ssl/certs/AddTrustExternalCARoot.pem added: /etc/ssl/certs/COMODORSADomainValidationSecureServerCA.pem added: /etc/ssl/certs/radius_eltex_nsk_ru.pem added: /etc/ssl/certs/COMODORSAAddTrustCA.pem done. done. But it still not authorized with the same error Can we use server and client certificates signed by different CA at one server?

2 1

[ANN] Better JSON parsing
by Arran Cudbard-Bell 04 Aug '15

04 Aug '15

v3.1.x rlm_json module registers a map function to allow mapping fields from JSON structures to attributes. The path through the JSON object is specified with fr jpath, which is the FreeRADIUS implementation of the jpath grammar described here: http://goessner.net/articles/JsonPath/ rlm_json currently implements a subset of the grammar described by the above implementation. Selectors currently implemented are: - $ Root node (only valid at the start of the path). - @ Current node (only valid at the start of the path). - .<name> A field within an object. - [<idx>] Index within an array. - [<start>:<end>[:<step>]] A slice within an array (identical to the Python syntax). - [<idx>,<start>:<end>] Multiple indexes/slices within an array. - .* All the children of the current node Automatic casting will occur between JSON and attribute types where possible. FreeRADIUS does not currently have a signed64 or floating point type, to map large signed numbers and JSON doubles to. These may instead be written to string type attributes. Assignment of JSON objects/arrays to strings is supported, in which case the JSON serialized form of the object/array is used. If a jpath matches multiple nodes, unless the map includes the += operator only the first node's value will be used. If the map uses += then multiple instances of the attribute will be created, each holding a different node value. Simple example: { "user": "bob", "account number": 7124503, "groups": { "admin", "networks", "bob" } } map json "%{rest:GET http://example.org/api/user/%{User-Name}" { &Tmp-Integer-0 := '$.account number' &Group += '$.groups.*" }

1 0

Configuring Error with SSL
by Lightfoot, Maurice P. 04 Aug '15

04 Aug '15

I get this error when I call configure command: configure: error: openssl library version does not match header version I used this command: ./configure --with-openssl-includes=/usr/local/ssl/include --with-openssl-libraries=/usr/local/ssl/lib I am trying to install freeradius server 2.2.5 and the ssl version I have is openssl-1.0.2d I am using centos 7

2 1

Generating CoA
by Cassiano Peixoto 04 Aug '15

04 Aug '15

Hi, I'm using freeradius 3.0.8 as proxy, but i can't generate CoA packets to server 10.0.0.1 on port 4141. What i'm doing wrong? Am i missing something? I've added to my accounting section: update coa { Packet-Dst-IP-Address = 10.0.0.1 Packet-Dst-Port = 4141 User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Framed-IP-Address = "%{Framed-IP-Address}" Mikrotik-Rate-Limit = "256k/256k" } And in my originate-coa i have: home_server example-coa { type = coa ipaddr = 10.0.0.1 port = 4141 secret = testing coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool coa { type = fail-over home_server = example-coa virtual_server = originate-coa.example.com } server originate-coa.example.com { pre-proxy { #update proxy-request { #NAS-IP-Address = 192.0.2.42 #} } post-proxy { switch &proxy-reply:Packet-Type { case CoA-ACK { ok } case CoA-NAK { ok } case Disconnect-ACK { ok } case Disconnect-NAK { ok } case { fail } } Post-Proxy-Type Fail-CoA { ok } Post-Proxy-Type Fail-Disconnect { ok } } } Thanks for your help.

3 6