- Freeradius-Users - lists.freeradius.org

Framed-IPv6-Prefix and Delegated-IPv6-Prefix + SQL
by Martin Brault 22 Oct '14

22 Oct '14

Hello, I have been searching how to add Framed and Delegated IPv6 accounting data into SQL and have come across this relatively old info: http://freeradius.1045715.n5.nabble.com/IPv6-Accounting-td4432174.html I am using RedHat/CentOS EL7 with the packaged freeradius-3.0.1 I have started modding queries.conf and have made some good progress: specific changes, I added columns in the SQL radacct table (and I altered the table to add the columns in question): column_list = "\ acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctupdatetime, \ acctstoptime, acctsessiontime, acctauthentic, \ connectinfo_start, connectinfo_stop, acctinputoctets, \ acctoutputoctets, calledstationid, callingstationid, \ acctterminatecause, servicetype, framedprotocol, \ framedipaddress, framedipv6address, framedipv6pool,\ framedipv6prefix, delegatedipv6prefix" and in the start { query, I added: '%{Framed-IPv6-Address}', '%{Framed-IPv6-Pool}', '%{Framed-IPv6-Prefix}', '%{Delegated-IPv6-Prefix}' )" When I look at the detail file, I see the info I am wishing to insert into the database, note the mask of /64 and /56 Tue Oct 21 17:30:04 2014 Acct-Session-Id = '0098EF19' Tunnel-Type:0 = L2TP Tunnel-Medium-Type:0 = IPv4 Tunnel-Server-Endpoint:0 = '192.168.204.210' Tunnel-Client-Endpoint:0 = '192.168.204.231' Tunnel-Assignment-Id:0 = 'foo' Tunnel-Client-Auth-Id:0 = 'foo' Tunnel-Server-Auth-Id:0 = 'pppoe' Acct-Tunnel-Connection = '26314987' Delegated-IPv6-Prefix = 2001:db8:a000::/56 Framed-Protocol = PPP Framed-Interface-Id = 5c73:a540:688f:37e2 Framed-IPv6-Prefix = 2001:db8:a000:ff::/64 Framed-IP-Address = 192.168.138.1 User-Name = 'pppoeuser' Acct-Authentic = RADIUS X-Ascend-Connect-Progress = LAN-Session-Up [...snip...] strangely, when I check what was logged in the SQL table however, I get for some reason /38 netmask for both pieces of information (apologies for the formatting...): MariaDB [radius]> select * from radacct where radacctid = '1494'; | 1494 | 009E2FDE | 7a22c13be9bcca21aaab7d7494ed1826 | pppoeuser | | | 192.168.128.24 | 2546 | Virtual | 2014-10-21 17:30:41 | 2014-10-21 17:30:41 | NULL | 0 | 0 | RADIUS | 2000000000 | | 0 | 111 | | lag-72:450 | | Framed-User | PPP | 72.10.138.1 | | | 2001:db8:a000:ff:0:0:0:0/38 | 2001:db8:a000:0:0:0:0:0/38 | why would the detail file have the correct /64 and /56 netmasks, yet the INSERT (which seems to explode the data into proper ipv6addr format with padded zeroes) would have this strange /38 netmask added? I feel I am close, any help would be much appreciated. Thanks, M.

4 7

tunnel-private-group-id in access-accept
by Marc Boisis 22 Oct '14

22 Oct '14

Hello, The attribute « Tunnel-Private-Group-Id » is sent in an access challenge packet but never in the Access-Accept response, how can I have it in the access accept ? Thanks Sending Access-Challenge of id 50 to 10.9.0.1 port 38933 Tunnel-Private-Group-Id:0 = "1" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Class = 0x4f553d61646d696e3b EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x066c0c42066e157cccd2b11a53caf40e Sending Access-Accept of id 61 to 10.9.0.1 port 38933 User-Name = "mdelavau\000" MS-MPPE-Recv-Key = 0xe9ac2590a2e51a4337dbabcf1a506eb3fce9d4823514315e383a85d526b4118c MS-MPPE-Send-Key = 0x99ecc593acf1721f395abf9d3e5b195edc16dd881842737d5cb3299fa77ca5ed EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000

3 3

Re: CHAP authentication fails when radtest communicates with freeradius 3.0.4 server through radsecproxy 1.6.2
by anoop 22 Oct '14

22 Oct '14

> Hi, > In process of evaluating Radsec feature, We encountered the failure with CHAP authentication. Authentication was successful with PAP, MSCHAP and eap-md5. Version(3.0.4) of freeradius is same in Client and Server. Radsecproxy version is 1.6.2. > > The following is the radtest command used and the output. > $radtest -x -t chap root root1234 127.0.0.1:1812 1812 radsec > Sending Access-Request Id 80 from 0.0.0.0:35860 to 127.0.0.1:1812 > User-Name = 'root' > CHAP-Password = 0xdb78dddafe77d7bb8d5d554b24d26ba2bb > NAS-IP-Address = 127.0.1.1 > NAS-Port = 1812 > Message-Authenticator = 0x00 > Received Access-Reject Id 80 from 127.0.0.1:1812 to 127.0.0.1:35860 > length 33 > Reply-Message = 'Hello, root' > (0) -: Expected Access-Accept got Access-Reject > > > The following is the freeradius 3.0.4 server log. > > Wed Oct 22 19:47:17 2014 : Debug: (0) Reading from socket 14 > READ FROM SSL 138 > 00: 17 03 01 00 20 63 12 16 67 d9 d9 9b 72 10 c9 28 > 10: 29 28 f9 9d a3 91 76 34 76 50 c2 02 0d ed a3 de > 20: d0 b5 b6 05 41 17 03 01 00 60 ed 50 88 08 7f 9f > 30: ed 15 d8 ed b9 0a c7 ea f8 75 21 fe df a9 1c 56 > 40: 91 85 c8 e8 4c fd 7d e3 14 52 78 a2 3d f0 fe fa > 50: 57 a6 bc b7 87 4a 18 95 63 4f 6d 41 7e f4 dc f0 > 60: 10 f3 72 39 3b 58 8f 8c 0a 9f 0f 88 1a 5e 19 d4 > 70: 60 f6 c3 57 d7 a6 88 95 f0 5d f2 c6 de ee 93 0b > 80: d0 24 74 ae 2a 6c 8e 8c 79 96 > Wed Oct 22 19:47:17 2014 : Debug: (0) Application data status 7 > TUNNELED DATA > 75 > 00: 01 01 00 4b ad 6c 2d c3 12 71 3a 32 7a 8a ed ae > 10: 47 a7 34 4f 01 06 72 6f 6f 74 03 13 db 78 dd da > 20: fe 77 d7 bb 8d 5d 55 4b 24 d2 6b a2 bb 04 06 7f > 30: 00 01 01 05 06 00 00 07 14 50 12 07 3f 6b 50 ab > 40: d7 1b 3f d8 e9 b1 2b 4e eb 18 e4 > Wed Oct 22 19:47:17 2014 : Debug: (0) tls_recv: Access-Request packet > from host 192.168.14.56 port 2083, id=1, length=75 > Wed Oct 22 19:47:17 2014 : Debug: Waking up in 0.3 seconds. > Wed Oct 22 19:47:17 2014 : Debug: Thread 1 got semaphore > Wed Oct 22 19:47:17 2014 : Debug: Thread 1 handling request 8, (2 > handled so far) > User-Name = 'root' > CHAP-Password = 0xdb78dddafe77d7bb8d5d554b24d26ba2bb > NAS-IP-Address = 127.0.1.1 > NAS-Port = 1812 > Message-Authenticator = 0x073f6b50abd71b3fd8e9b12b4eeb18e4 > Wed Oct 22 19:47:17 2014 : Debug: (8) Received Access-Request packet > from host 192.168.14.56 port 2083, id=1, length=75 > Wed Oct 22 19:47:17 2014 : Debug: (8) User-Name = 'root' > Wed Oct 22 19:47:17 2014 : Debug: (8) CHAP-Password = > 0xdb78dddafe77d7bb8d5d554b24d26ba2bb > Wed Oct 22 19:47:17 2014 : Debug: (8) NAS-IP-Address = 127.0.1.1 > Wed Oct 22 19:47:17 2014 : Debug: (8) NAS-Port = 1812 > Wed Oct 22 19:47:17 2014 : Debug: (8) Message-Authenticator = > 0x073f6b50abd71b3fd8e9b12b4eeb18e4 > Wed Oct 22 19:47:17 2014 : Debug: (8) # Executing section authorize > from file /usr/local/etc/raddb/sites-enabled/default > Wed Oct 22 19:47:17 2014 : Debug: (8) authorize { > Wed Oct 22 19:47:17 2014 : Debug: (8) filter_username filter_username { > Wed Oct 22 19:47:17 2014 : Debug: (8) if (!&User-Name) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (!&User-Name) -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ / /) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ / /) -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /@.*@/ ) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /@.*@/ ) > -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /\\.\\./ ) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /\\.\\./ > ) -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if ((&User-Name =~ /@/) && > (&User-Name !~ /(a)(.+)\\.(.+)$/)) > Wed Oct 22 19:47:17 2014 : Debug: (8) if ((&User-Name =~ /@/) && > (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /\\.$/) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /\\.$/) > -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /(a)\\./) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /(a)\\./) > -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) } # filter_username > filter_username = notfound > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > preprocess (rlm_preprocess) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from preprocess (rlm_preprocess) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [preprocess] = ok > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > chap (rlm_chap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : Setting 'Auth-Type := CHAP' > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from chap (rlm_chap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [chap] = ok > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > mschap (rlm_mschap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from mschap (rlm_mschap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [mschap] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > digest (rlm_digest) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from digest (rlm_digest) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [digest] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > suffix (rlm_realm) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) suffix : Checking for suffix > after "@" > Wed Oct 22 19:47:17 2014 : Debug: (8) suffix : No '@' in User-Name = > "root", looking up realm NULL > Wed Oct 22 19:47:17 2014 : Debug: (8) suffix : No such realm "NULL" > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from suffix (rlm_realm) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [suffix] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > eap (rlm_eap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) eap : No EAP-Message, not doing EAP > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from eap (rlm_eap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [eap] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > files (rlm_files) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) files : users: Matched entry > root at line 91 > Wed Oct 22 19:47:17 2014 : Debug: (8) files : ::: FROM 1 TO 0 MAX 1 > Wed Oct 22 19:47:17 2014 : Debug: (8) files : ::: Examining Reply-Message > Wed Oct 22 19:47:17 2014 : Debug: Hello, %{User-Name} > Wed Oct 22 19:47:17 2014 : Debug: Parsed xlat tree: > Wed Oct 22 19:47:17 2014 : Debug: literal --> Hello, > Wed Oct 22 19:47:17 2014 : Debug: attribute --> User-Name > Wed Oct 22 19:47:17 2014 : Debug: (8) files : EXPAND Hello, %{User-Name} > Wed Oct 22 19:47:17 2014 : Debug: (8) files : --> Hello, root > Wed Oct 22 19:47:17 2014 : Debug: (8) files : ::: APPENDING > Reply-Message FROM 0 TO 0 > Wed Oct 22 19:47:17 2014 : Debug: (8) files : ::: TO in 0 out 1 > Wed Oct 22 19:47:17 2014 : Debug: (8) files : ::: to[0] = Reply-Message > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from files (rlm_files) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [files] = ok > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > expiration (rlm_expiration) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from expiration (rlm_expiration) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [expiration] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > logintime (rlm_logintime) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from logintime (rlm_logintime) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [logintime] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > pap (rlm_pap) for request 8 > Wed Oct 22 19:47:17 2014 : WARNING: (8) pap : Auth-Type already set. > Not setting to PAP > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from pap (rlm_pap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [pap] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) } # authorize = ok > Wed Oct 22 19:47:17 2014 : Debug: (8) Found Auth-Type = CHAP > Wed Oct 22 19:47:17 2014 : Debug: (8) # Executing group from file > /usr/local/etc/raddb/sites-enabled/default > Wed Oct 22 19:47:17 2014 : Debug: (8) Auth-Type CHAP { > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authenticate]: calling > chap (rlm_chap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : Login attempt by "root" > with CHAP password > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : Comparing with "known > good" Cleartext-Password "root1234" > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : CHAP challenge : > ad6c2dc312713a327a8aedae47a7344f > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : Client sent : > 78dddafe77d7bb8d5d554b24d26ba2bb > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : We calculated : > 8b672ba8589f7d0658b3b3e8e2002b09 > Wed Oct 22 19:47:17 2014 : ERROR: (8) chap : Password is comparison > failed: password is incorrect > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authenticate]: > returned from chap (rlm_chap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [chap] = reject > Wed Oct 22 19:47:17 2014 : Debug: (8) } # Auth-Type CHAP = reject > Wed Oct 22 19:47:17 2014 : Debug: (8) Failed to authenticate the user > Wed Oct 22 19:47:17 2014 : Debug: (8) Using Post-Auth-Type Reject > Wed Oct 22 19:47:17 2014 : Debug: (8) # Executing group from file > /usr/local/etc/raddb/sites-enabled/default > Wed Oct 22 19:47:17 2014 : Debug: (8) Post-Auth-Type REJECT { > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: calling > attr_filter.access_reject (rlm_attr_filter) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: %{User-Name} > Wed Oct 22 19:47:17 2014 : Debug: Parsed xlat tree: > Wed Oct 22 19:47:17 2014 : Debug: attribute --> User-Name > Wed Oct 22 19:47:17 2014 : Debug: (8) attr_filter.access_reject : > EXPAND %{User-Name} > Wed Oct 22 19:47:17 2014 : Debug: (8) attr_filter.access_reject : > --> root > Wed Oct 22 19:47:17 2014 : Debug: (8) attr_filter.access_reject : > Matched entry DEFAULT at line 11 > Wed Oct 22 19:47:17 2014 : Debug: (8) attr_filter.access_reject : > Reply-Message = 'Hello, root' allowed by Reply-Message =* '' > Wed Oct 22 19:47:17 2014 : Debug: (8) attr_filter.access_reject : > Attribute "Reply-Message" allowed by 1 rules, disallowed by 0 rules > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: returned > from attr_filter.access_reject (rlm_attr_filter) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [attr_filter.access_reject] = > updated > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: calling > eap (rlm_eap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) eap : Request didn't contain an > EAP-Message, not inserting EAP-Failure > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: returned > from eap (rlm_eap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [eap] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) remove_reply_message_if_eap > remove_reply_message_if_eap { > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&reply:EAP-Message && > &reply:Reply-Message) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&reply:EAP-Message && > &reply:Reply-Message) -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) else else { > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: calling > noop (rlm_always) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: returned > from noop (rlm_always) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [noop] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) } # else else = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) } # > remove_reply_message_if_eap remove_reply_message_if_eap = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) } # Post-Auth-Type REJECT = updated > Wed Oct 22 19:47:17 2014 : Debug: (8) Delaying response for 1 seconds > Wed Oct 22 19:47:17 2014 : Debug: Thread 1 waiting to be assigned a > request > Wed Oct 22 19:47:18 2014 : Debug: Waking up in 0.6 seconds. > Wed Oct 22 19:47:18 2014 : Debug: (8) Sending delayed response > Wed Oct 22 19:47:18 2014 : Debug: (8) Sending Access-Reject packet to > host 192.168.14.56 port 2083, id=1, length=0 > Wed Oct 22 19:47:18 2014 : Debug: (8) Reply-Message = 'Hello, root' > Sending Access-Reject Id 1 from 0.0.0.0:2083 to 192.168.14.56:2083 > Reply-Message = 'Hello, root' > TUNNELED DATA < 33 > 00: 03 01 00 21 76 36 57 24 bd 97 0d 4a 15 a5 f2 4d > 10: 13 5f 61 fd 12 0d 48 65 6c 6c 6f 2c 20 72 6f 6f > 20: 74 > WRITE TO SSL 69 > 00: 17 03 01 00 40 bb e3 13 b9 34 ff 57 aa 32 38 19 > 10: ad da 7c aa 29 76 bf 04 ff 5a b1 64 00 5d 3c ff > 20: 2c a1 4f 5f 76 31 63 04 d3 93 f9 a1 41 b8 1f 23 > 30: c9 c6 7e 59 da 1a 46 ff a7 e0 eb 7d f1 a2 0a 56 > 40: f3 d4 c4 dd de > Wed Oct 22 19:47:18 2014 : Debug: (8) Writing to socket 14 > Wed Oct 22 19:47:18 2014 : Debug: Waking up in 3.9 seconds. > Wed Oct 22 19:47:23 2014 : Debug: (8) Cleaning up request packet ID 1 > with timestamp +397 > Wed Oct 22 19:47:23 2014 : Debug: Waking up in 5.4 seconds. > Wed Oct 22 19:47:28 2014 : Debug: Waking up in 18.9 seconds. > > > > Thanks and Regards, > Anoop

2 1

Daily counter and options to extend
by Matej Žerovnik 22 Oct '14

22 Oct '14

Hello! I'm trying to achieve something, but not sure for to do it... What I want is to have a fixed daily limit for all users set to 1h. That is no problem, since I set Max-Daily-Session for all users via group check. But sometimes I would like to extend that limit to 2 or more hours for certain users. I could set Max-Daily-Session for that certain user, but that setting would not get reset at the end of the way. I would have to run a cronjob to purge settings in sql... Is there a nicer/proper way of achieving that? Matej -- --- Matej Zerovnik

2 3

PAM: change user's passwords in the Freeradius server
by Roberto Carna 22 Oct '14

22 Oct '14

Dear, I have a Freeradius/Mysql server that authenticates SSH logins from Debian machines. In the Freeradius I add the user and password basically, and in each Debian machine I have installed the libpam-radius-auth package in order to execute SSH and SUDO, all authenticating against the Freeradius server. But now I want the Debian machines' users to change their passwords with the "passwd" command in the MySQL database from Freeradius, but after editing the file /etc/pam.d/passwd as follow: password sufficient pam_radius_auth.so debug @include common-password the users can't change their passwords at all in the Freeradius server. As I said, the SSH login and SUDO command work perfectly authenticating against Freeradius, this is my /etc/pam.d/sudo file: auth required pam_radius_auth.so debug account required pam_radius_auth.so debug password required pam_radius_auth.so debug How can I edit the /etc/pam.d/passwd file in order to let users to change Freeradius passwords??? Thanks a lot, Roberto

3 6

Quick way of finding out which EAP outer was used?
by Stefan Paetow 21 Oct '14

21 Oct '14

Hi, I have a quick question again: I know the EAP type is passed along in the EAP message in the outer request and FR figures it out (obviously). Now I want to do some bits depending on whether PEAP was used or whether EAP-TTLS was used... What would arguably be the quickest way be to discover either was used? For TLS that's easier, but TTLS/PEAP? Is there a virtual attribute for it or do I need to pick apart the packet? :-) Any hints where to start would be very much appreciated :-) Thanks in advance Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet Janet, the UK’s research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

3 3

EAP-TLS error message
by Ben Tucker 21 Oct '14

21 Oct '14

New Freeradius user here. I am setting up a ported version of Freeradius to work on Windows, which is version 1.1.7-r0.0.2 (I realize this is old but unsure how to port over a newer version to windows). No unix/linux server is available to me to do the testing I need done right now. Below is the debug output when trying to start freeradius. it is getting hung up under the EAP section. Any assistance would be greatly appreciated. Please let me know if you need any other information to assist! Thanks Starting - reading configuration files ...reread_config: reading radiusd.confConfig: including file: ../etc/raddb/proxy.confConfig: including file: ../etc/raddb/clients.confConfig: including file: ../etc/raddb/snmp.confConfig: including file: ../etc/raddb/eap.confConfig: including file: ../etc/raddb/sql.conf main: prefix = ".." main: localstatedir = "../var" main: logdir = "../var/log/radius" main: libdir = "../lib" main: radacctdir = "../var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "../var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "../var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "../bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0read_config_files: reading dictionaryread_config_files: reading naslistUsing deprecated naslist file. Support for this will go away soon.read_config_files: reading clientsread_config_files: reading realmsradiusd: entering modules setupModule: Library search path is ../libModule: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)"rlm_exec: Wait=yes but no output defined. Did you mean output=none?Module: Instantiated exec (exec)Module: Loaded exprModule: Instantiated expr (expr)Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = noModule: Instantiated pap (pap)Module: Loaded CHAPModule: Instantiated chap (chap)Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)"Module: Instantiated mschap (mschap)Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "../var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600Module: Instantiated unix (unix)Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = norlm_eap: Loaded and initialized type md5rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP"rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/radius-srv-pri-key.pem" tls: certificate_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/radius-srv-pri-cert.pem" tls: CA_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/cacert.pem" tls: private_key_password = "mercury" tls: dh_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/dh" tls: random_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)"rlm_eap_tls: Loading the certificate file as a chainrlm_eap: SSL error error:06074079:digital envelope routines:EVP_PBE_CipherInit:unknown pbe algorithmrlm_eap_tls: Error reading private key filerlm_eap: Failed to initialize type tls

2 2

Arbitrary attributes for dynamic clients
by Arran Cudbard-Bell 20 Oct '14

20 Oct '14

In latest v3.0.x HEAD the server will now process all attributes in the control list when creating dynamic clients. Attributes that are not consumed filling in the fields of the client, will be added as config items which can be accessed using the "%{client:}" xlat. For example: (0) # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/dynamic-clients (0) authorize { (0) update control { (0) &FreeRADIUS-Client-IP-Prefix = 127.0.0.0/8 (0) &FreeRADIUS-Client-Require-MA = no (0) &FreeRADIUS-Client-Secret = 'testing123' (0) EXPAND %{Packet-Src-IP-Address} (0) --> 127.0.0.1 (0) &FreeRADIUS-Client-Shortname = "127.0.0.1" (0) &Tmp-String-0 = 'foooooo' (0) } # update control = noop (0) [ok] = ok (0) } # authorize = ok } # server dynamic_clients (0) Converting control list to client fields (0) ipaddr = 127.0.0.0/8 (0) require_message_authenticator = no (0) secret = 'testing123' (0) shortname = '127.0.0.1' (0) Tmp-String-0 = 'foooooo' Adding client 127.0.0.0/8 with shared secret "testing123" (0) EXPAND %{client:Tmp-String-0} (0) --> foooooo (0) Tmp-String-1 := "foooooo" This allows easy caching of any information related to the NAS, such as its capabilities and any information required for policy decisions. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 2

Poodle and EAP?
by Stefan Winter 20 Oct '14

20 Oct '14

Hi, catching up after being out of office when "Poodle" arrived. I'm wondering if FreeRADIUS is strictly enforcing TLS 1.0+ when negotiating a PEAP/TTLS tunnel. And if not, how to make it so :-) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

5 7

radius server stopped receiving request
by Khapare Joshi 20 Oct '14

20 Oct '14

Hi, I have two freeradius server. Both of them were working well until. But one the server stopped receiving auth request. I stopped the radius server and run in debug mode, radiusd -X then all I get is below: Request are coming but looks it is expanding the detail file then sends the Sending Accounting-Response of id 26 to 192.168.1.1 port 32770 and nothing else. How do I fix this so my second server start processing users request and authenticate them :? # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok expand: %{Acct-Session-Time} -> 8 expand: %{Acct-Delay-Time} -> 0 expand: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0} -> 1413805547 - 8 - 0 expand: %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} -> 1413805539 ++[request] returns ok [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 192.168.1.1,NAS-IP-Address = 192.168.1.1,Acct-Session-Id = "5444f5e2/dc:86:d8:23:03:0d/290270",User-Name = "carpæ"' [acct_unique] Acct-Unique-Session-ID = "f1f7ece2e5e57147". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "carlol", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "carol" [suffix] Adding Realm = "NULL" [suffix] Accounting realm is LOCAL. ++[suffix] returns ok [files] acct_users: Matched entry DEFAULT at line 22 [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: %{Framed-IP-Address:-%{NAS-IP-Address}} -> 192.168.5.2 ++[files] returns ok # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> 192.168.1.1 [detail] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.1/detail-20141020 [detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.1/detail-20141020 [detail] expand: %t -> Mon Oct 20 11:45:47 2014 ++[detail] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> carol attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 26 to 192.168.1.1 port 32770 Finished request 62. Cleaning up request 62 ID 26 with timestamp +5 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.1.1 port 32770, id=27, length=264 User-Name = "jebish" NAS-Port = 1 NAS-IP-Address = 192.168.1.1 Framed-IP-Address = 192.168.5.9 NAS-Identifier = "hinet-wlc00-hbio" Airespace-Wlan-Id = 300 Acct-Session-Id = "5444f5ca/88:1f:a1:1b:f8:44/290236" NAS-Port-Type = Wireless-802.11 Cisco-AVPair = "audit-session-id=82d0a5f800051d5a5444f5c7" Acct-Authentic = RADIUS Event-Timestamp = "Oct 20 2014 11:45:47 GMT" Acct-Status-Type = Interim-Update Acct-Input-Octets = 41102 Acct-Input-Gigawords = 0 Acct-Output-Octets = 55255 Acct-Output-Gigawords = 0 Acct-Input-Packets = 213 Acct-Output-Packets = 191 Acct-Session-Time = 32 Acct-Delay-Time = 0 Calling-Station-Id = "192.168.2.71" Called-Station-Id = "192.168.1.1" # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok expand: %{Acct-Session-Time} -> 32 expand: %{Acct-Delay-Time} -> 0 expand: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0} -> 1413805547 - 32 - 0 expand: %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} -> 1413805515 ++[request] returns ok [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 192.168.1.1,NAS-IP-Address = 192.168.1.1,Acct-Session-Id = "5444f5ca/88:1f:a1:1b:f8:44/290236",User-Name = "jebish"' [acct_unique] Acct-Unique-Session-ID = "ae16dee06152c99c". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "jebish", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "jebish" [suffix] Adding Realm = "NULL" [suffix] Accounting realm is LOCAL. ++[suffix] returns ok [files] acct_users: Matched entry DEFAULT at line 22 [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: %{Framed-IP-Address:-%{NAS-IP-Address}} -> 192.168.3.74 ++[files] returns ok # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> 192.168.1.1 [detail] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.1/detail-20141020 [detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.1/detail-20141020 [detail] expand: %t -> Mon Oct 20 11:45:47 2014 ++[detail] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> jenny attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 27 to 192.168.1.1 port 32770 Finished request 63. Cleaning up request 63 ID 27 with timestamp +5 Going to the next request Ready to process requests

2 2