- Freeradius-Users - lists.freeradius.org

FR3 and EAP-TLS session cache
by Jyri Palis 22 Jun '15

22 Jun '15

Hi, I have been trying to get FR (3.0.4) EAP-TLS session caching to work with ‘check-eap-tls’ virtual server, so far no luck. Initial EAP-TLS session is established correctly and Windows 7 clients get access to protected WLAN but requests following initial request fail to utilise data stored TLS session cache data client is force to proceed with full TLS handshake. Virtual server 'check-eap-tls’ which is configured to verify client certificates fails when cached TLS session calls this method, variables needed for verification are not propagated correctly. server check-eap-tls { authorize { if ("%{TLS-Client-Cert-Subject-Alt-Name-Upn}" =~ /^([a-z0-9]|[\w\.-]?)+\(a)example\.com$/i) { update config { Auth-Type := Accept } } elsif ("%{TLS-Client-Cert-Subject-Alt-Name-Dns}" =~ /^([a-z0-9]|[\w\-]?)+\.example\.com$/i) { update config { Auth-Type := Accept } } else { update config { Auth-Type := Reject } } } This is a fragment from log file: Sun Jun 14 14:56:11 2015 : Auth: (44) Login incorrect (eap: Failed continuing EAP TLS (13) session. EAP sub-module failed): [host/xxxxx.example.com/<via Auth-Type = EAP>] (from client wc-s1-01 port 2 cli 00-24-d7-03-2b-38) Sun Jun 14 14:56:16 2015 : Error: Couldn't open /var/log/radius/tlscache/c0373a395b8cc8bc3bd2fe453c3f235454b5216a47c1cb66e30580cd697033f1.vps for reading: No such file or directory Sun Jun 14 14:56:16 2015 : Auth: (52) Login OK: [host/xxxxx.example.com] (from client wc-s1-01 port 2 cli 00-24-d7-03-2b-38 via TLS tunnel) Sun Jun 14 14:56:16 2015 : Auth: (52) Login OK: [host/xxxxx.example.com] (from client wc-s1-01 port 2 cli 00-24-d7-03-2b-38) So is there a way to check session status in ‘authorize’ block and accept auth when cached TLS session is detected? This is written to stdout when running in debug mode (15) eap_tls : Length Included (15) eap_tls : eaptls_verify returned 11 (15) eap_tls : (other): before/accept initialization (15) eap_tls : TLS_accept: before/accept initialization (15) eap_tls : <<< TLS 1.0 Handshake [length 007c], ClientHello SSL: Client requested cached session f35d02540a8e9c4faf8620dfe25e4e82941192f8686390ec3591df41ba22f967 reading pairlist file /var/log/radius/tlscache/f35d02540a8e9c4faf8620dfe25e4e82941192f8686390ec3591df41ba22f967.vps Couldn't open /var/log/radius/tlscache/f35d02540a8e9c4faf8620dfe25e4e82941192f8686390ec3591df41ba22f967.vps for reading: No such file or directory SSL: could not load persisted VPs for session f35d02540a8e9c4faf8620dfe25e4e82941192f8686390ec3591df41ba22f967 (15) eap_tls : TLS_accept: SSLv3 read client hello A (15) eap_tls : >>> TLS 1.0 Handshake [length 0059], ServerHello (15) eap_tls : TLS_accept: SSLv3 write server hello A (15) eap_tls : >>> TLS 1.0 Handshake [length 0c46], Certificate (15) eap_tls : TLS_accept: SSLv3 write certificate A (15) eap_tls : >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (15) eap_tls : TLS_accept: SSLv3 write key exchange A (15) eap_tls : >>> TLS 1.0 Handshake [length 005b], CertificateRequest (15) eap_tls : TLS_accept: SSLv3 write certificate request A (15) eap_tls : TLS_accept: SSLv3 flush data (15) eap_tls : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode Regards, Jyri.

4 23

Fwd: (0) No reply from server for ID 168 socket 3
by jose luis sanchez ortiz 20 Jun '15

20 Jun '15

---------- Forwarded message ---------- From: jose luis sanchez ortiz <docentesanortiz(a)gmail.com> Date: 2015-06-20 9:12 GMT-05:00 Subject: (0) No reply from server for ID 168 socket 3 To: Freeradius-Devel(a)lists.freeradius.org Hi friend I need help, I finish my graduation project I run radtest and show 3 time Sent Access-Request Id 168 from 0.0.0.0:48323 to 127.0.0.1:1812 length 78 User-Name = 'proyecto' User-Password = '123' NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = '123' (0) No reply from server for ID 168 socket 3 thanks in advance

1 0

Sql counter
by Randeep 20 Jun '15

20 Jun '15

Hi, I'm trying to set maximum data limit for a user. In the /etc/raddb/sql/mysql/counter.conf I have created this. sqlcounter testcounter { counter-name = Max-Data-Used check-name = Max-Data sqlmod-inst = sql key = User-Name reset = daily reply-message = “You have reached your bandwidth limit” sqlmod-inst = sql query = “SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username=’%{%k}'” } } When I checked the accounting flow, the flow is as follows, New acct request -> Preacct ->accounting -> Send response So I tried to put the testcounter in /etc/raddb/sites-enabled/default In preacct and accounting blocks. But it gave me errors Sat Jun 20 13:12:54 2015 : Error: /etc/raddb/sites-enabled/default[389]: "SQL Counter" modules aren't allowed in 'accounting' sections -- they have no such method. Sat Jun 20 13:12:54 2015 : Error: /etc/raddb/sites-enabled/default[382]: Errors parsing accounting section. Also I'm confused about the parameters in the testcounter. We have to declare these two variables anywhere? counter-name = Max-Data-Used check-name = Max-Data Where we can specify the max data limit to the user. Please advice. Also please give some links if you which I can refer. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr

1 1

using ippol
by Randeep 20 Jun '15

20 Jun '15

Hi all, I'm trying to configure freeradius to send the ip for the user. In the radiusd.conf i have uncommented $INCLUDE sqlippool.conf in the sqlippool.conf, I have enabled mysql ippool.conf in the file /etc/raddb/modules/ippool, I have defined ippool main_pool. And specified the range, netmask etc in the block. Key I have specified as key = "%{NAS-IP-Address} %{NAS-Port}" But my radippool table is empty. Do I have to specify anything there? I'm testing with radtest. I hope this can be tested with it. In the respose i'm getting like this [root@localhost ~]# radtest randeep randeep123 192.168.1.182 0 lukup124 Sent Access-Request Id 110 from 0.0.0.0:49548 to 192.168.1.182:1812 length 77 User-Name = 'randeep' User-Password = 'randeep123' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = 'randeep123' Received Access-Accept Id 110 from 192.168.1.182:1812 to 0.0.0.0:0 length 56 Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.0 Framed-MTU = 1500 Framed-Routing = Broadcast-Listen Framed-Compression = Van-Jacobson-TCP-IP Service-Type = Framed-User [root@localhost ~]# Do I have to give sqlippool or mainpool in authenticate/authorize/account/preauth in sites-enabled/default? Please advice. Regards, Randeep

2 7

Populating radacct
by Randeep 19 Jun '15

19 Jun '15

Hi, I would like to test limiting the max usable size for a user. But I dont have a real NAS and client. Is there anyway I can send fake usage updates and when next Access-Request comes I can check the total used data and maximum limit and reject the request? Please advice. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 1

post-proxy section ( 3.0.9 bump )
by Peter Balsianok 19 Jun '15

19 Jun '15

Hi, I want to log proxy request in the case of Access-Reject from proxy server In the conf file (site-enables/default): post-proxy { log_proxy_reply Post-Proxy-Type Fail-Authentication { log_proxy_request log_control } } I've tested it with Fail or Fail-Authentication. The same result, proxy request wasn't printed out. Debug ouput: .... post-proxy { log_proxy_reply Post-Proxy-Type Fail-AuthenticationOpening new proxy socket 'proxy address * port 0' Listening on proxy address * port 43154 (0) Proxying request to home server 127.0.0.1 port 10812 timeout 14.000000 (0) Sent Access-Request Id 129 from 0.0.0.0:43154 to 127.0.0.1:10812 length 182 (0) NAS-Port-Type = Virtual (0) CHAP-Password = 0x0103d8b4385d31b89f746a2838b87fa049 (0) Service-Type = Framed-User (0) Called-Station-Id = 'proxy.corp' (0) Calling-Station-Id = '421905725408' (0) Framed-Protocol = PPP (0) CHAP-Challenge = 0xe3c6f04f3c08c6067deb9c79c060e966 (0) User-Name = '421905725408' (0) Connect-Info = '8640000' (0) NAS-IP-Address = 85.237.227.1 (0) NAS-Port = 385 (0) Qos-Policy-Policing = 'Uniq-Sess-ID385' (0) Event-Timestamp = 'Jun 18 2015 11:48:41 CEST' (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x313131 Waking up in 0.3 seconds. (0) Clearing existing &reply: attributes (0) Received Access-Reject Id 129 from 127.0.0.1:10812 to 127.0.0.1:43154 length 25 (0) Proxy-State = 0x313131 (0) # Executing section post-proxy from file ./sites-enabled/default (0) post-proxy { (0) log_proxy_reply: EXPAND /app_log/radius/auth/radius.log (0) log_proxy_reply: --> /app_log/radius/auth/radius.log (0) log_proxy_reply: EXPAND %t : Info PROXY-REPLY(%{User-Name}): %{pairs:proxy-reply:} (0) log_proxy_reply: --> Thu Jun 18 11:48:41 2015 : Info PROXY-REPLY(421905725408(a)proxy.corp): Proxy-State = 0x313131 (0) [log_proxy_reply] = ok (0) } # post-proxy = ok (0) Login incorrect (Home Server says so): [421905725408(a)proxy.corp/<via Auth-Type = CHAP>] (from client localhost port 385 cli 421905725408) (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file ./sites-enabled/default (0) Sent Access-Reject Id 111 from 127.0.0.1:1812 to 127.0.0.1:33136 length 0 (0) Finished request What i am doing wrong ? Thx.

2 3

processing in case of proxied authentification
by Peter Balsianok 19 Jun '15

19 Jun '15

Hi, In the documentation ( http://networkradius.com/doc/FreeRADIUS%20Technical%20Guide.pdf) on the page 42 is Figure 4.3 Packet Processing Section Usage. In case of Proxied authentification following sections will be processed: Authorize, Pre-proxy and Post-proxy. As i can see in the debug output also post-auth section is processed. Is it correct ? .. (2) # Executing section post-proxy from file ./sites-enabled/default (2) post-proxy { ... (2) } # post-proxy = ok (2) Found Auth-Type = Accept (2) Auth-Type = Accept, accepting the user (2) # Executing section post-auth from file ./sites-enabled/default (2) post-auth { .... (2) } # post-auth = reject (2) Using Post-Auth-Type Reject (2) Post-Auth-Type sub-section not found. Ignoring. ... Thx.

2 1

LDAP Operations Error
by Syed Rais Ahmad NON DRI 18 Jun '15

18 Jun '15

In my FreeRadius configuration, ntlm_auth gives me successful search output: [root@rscradiuspr01 samba]# ntlm_auth --request-nt-key --domain=DRI_NT1 --username=SYEDRA password: NT_STATUS_OK: Success (0x0) However, RADIUS rejects the user: Thu Jun 18 16:02:46 2015 : Debug: [ldap] waiting for bind result ... Thu Jun 18 16:02:46 2015 : Debug: [ldap] Bind was successful Thu Jun 18 16:02:46 2015 : Debug: [ldap] performing search in ou=users,dc=darden,dc=com, with filter (uid=SYEDRA) Thu Jun 18 16:02:46 2015 : Error: [ldap] ldap_search() failed: Operations error Thu Jun 18 16:02:46 2015 : Info: [ldap] search failed Thu Jun 18 16:02:46 2015 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Jun 18 16:02:46 2015 : Info: ++[ldap] returns fail Thu Jun 18 16:02:46 2015 : Info: Using Post-Auth-Type Reject Thu Jun 18 16:02:46 2015 : Info: # Executing group from file /etc/raddb/sites-enabled/default Thu Jun 18 16:02:46 2015 : Info: +- entering group REJECT {...} Thu Jun 18 16:02:46 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> SYEDRA Thu Jun 18 16:02:46 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jun 18 16:02:46 2015 : Info: ++[attr_filter.access_reject] returns updated Thu Jun 18 16:02:46 2015 : Info: Delaying reject of request 1 for 1 seconds Thu Jun 18 16:02:46 2015 : Debug: Going to the next request What could be the cause of this reject? Thanks. This e-mail message is for the sole use of the intended recipient and may contain information that is confidential, proprietary or privileged. Any unauthorized review, use, distribution, copying or disclosure is strictly prohibited. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, please notify sender of the delivery error by replying to this message and then delete it from your system. Receipt by anyone other than the intended recipient is not a waiver of confidentiality or privilege.

3 2

Using AD and SQL to authenticate Wi-Fi users
by Bruno de Paula Larini 18 Jun '15

18 Jun '15

Hi guys, I've been using FR (3.0.4) to authenticate Wi-Fi users against Active Directory and it is working fine. But now I need to check users in SQL database too, like this: SSID1 -> check for users in AD SSID2 -> check for users in SQL database I've managed to get it working, but only if the other authentication method is disabled. Only one would work at a time. To get SQL working, I've either commented the ntlm_auth from mods-enabled/mschap or added the following to the authorize section in sites-enabled/inner-tunnel: ... update control { MS-CHAP-Use-NTLM-Auth := No } mschap ... Removing the above and/or uncommenting the ntlm_auth line, users from AD are authenticated successfully but SQL users are not. I wanted to use unlang to check if the request came from a specific Called-Station-Id, but the inner-tunnel doesn't bring this information and always return false. Is there some check I can use to know where the request came from? Thank you!

3 2

Valid SSL certificate deployment process
by Sunil Kulkarni -X (sunikulk - PERSISTENT SYSTEMS INC at Cisco) 18 Jun '15

18 Jun '15

Hello All, I am using FR 3.0.8 version. I have done setup EAP-TTLS with PAP. For local setup and testing, I have used self-signed certificates. Now my setup and configuration is done and I want to do setup on production side. I have following certificates from CA, however, I am not getting how do I deploy certificates in FreeRadius because /etc/raddb/certs folder contains lots of certificate and its related to file. Root-ca.cer Ca.cer Server.cer Kindly help me on this? --- Thanks, Sunil Kulkarni

2 1