- Freeradius-Users - lists.freeradius.org

read_group=yes but radgroupreply doesn't work
by Zulzig 08 Oct '14

08 Oct '14

Hello, I use free radius version 2.1.12 for red hat. I set up it with mysql. In the sql.conf file, i have the read_groups settings to yes, i send you the debug from my server in my sql radgroupreply i have: mysql> select * from radgroupreply; +----+---------------------+-------------------------+----+---------------------------------------------------------------------------------------------------------------+ | id | groupname | attribute | op | value | +----+---------------------+-------------------------+----+---------------------------------------------------------------------------------------------------------------+ | 1 | XXXX-VLAN-REGIST | Tunnel-type | = | 13 | | 2 | XXXX-VLAN-REGIST | Tunnel-Medium-Type | = | 6 | | 3 | XXXX-VLAN-REGIST | Tunnel-Private-Group-ID | = | XXX | | 4 | XXXX-VLAN-REGIST | Reply-Message | = | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxXXX XXXX | | 5 | XXXX-VLAN-ISOLATION | Tunnel-type | = | 13 | | 6 | XXXX-VLAN-ISOLATION | Tunnel-Medium-Type | = | 6 | | 7 | XXXX-VLAN-ISOLATION | Tunnel-Private-Group-ID | = | XXX | | 8 | XXXX-VLAN-ISOLATION | Reply-Message | = | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxxxxXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxxxxxxxxx | | 9 | XXXX-VLAN-GUEST | Reply-Message | = | XXxxxXXXXXxxxXXXXXXxxxxxxxxxxxxxXXXXXXXXXX | +----+---------------------+-------------------------+----+---------------------------------------------------------------------------------------------------------------+ 9 rows in set (0.00 sec) mysql> select * from radusergroup; +----------------------------------+------------------+----------+ | username | groupname | priority | +----------------------------------+------------------+----------+ | host/XXXXXXXXXX.XXXXXXXXXXXXXXXX | XXXX-VLAN-REGIST | 1 | | host/XXX-XXX-test | XXXX-VLAN-REGIST | 1 | +----------------------------------+------------------+----------+ mysql> select * from radgroupcheck; +----+---------------------+-----------+----+--------+ | id | groupname | attribute | op | value | +----+---------------------+-----------+----+--------+ | 1 | XXXX-VLAN-REGIST | Auth-Type | := | EAP | | 2 | XXXX-VLAN-ISOLATION | Auth-Type | := | EAP | | 3 | XXXX-VLAN-GUEST | Auth-Type | := | reject | +----+---------------------+-----------+----+--------+ 3 rows in set (0.00 sec) Thank a lot for your help and support.

3 2

encoding of ADSL-Agent-Circuit-Id
by Pshem Kowalczyk 08 Oct '14

08 Oct '14

Hi, I've noticed that encoding of these two attributes: ADSL-Agent-Circuit-Id ADSL-Agent-Remote-Id has been changed from string to octets (from 3.0.3 to 3.0.4), when the RFC (4679) states them as strings: Vendor-Type 1 for Agent-Circuit-Id Vendor-Length <= 65 String and Vendor-Type 2 for Agent-Remote-Id Vendor-Length <= 65 String What was the reason for the change? kind regards Pshem

3 4

Git-v3.0.x FreeRADIUS assertion fails with proxy listener
by Julius Plenz 08 Oct '14

08 Oct '14

Hi, I have a section like this in my FreeRADIUS config: listen { type = "proxy" ipaddr = ... port = ... } But the server startup aborts due to a failed assertion: Listening on proxy address ... port ... ASSERT FAILED src/main/process.c[4355]: sock->home != NULL CAUGHT SIGNAL: Aborted Backtrace of last 9 frames: /server/devel/server/lib/libfreeradius-radius.so(fr_fault+0x11c)[0x7f08d91fb287] /server/devel/server/lib/libfreeradius-server.so(rad_assert_fail+0x53)[0x7f08d944e108] bin/radiusd[0x43f088] bin/radiusd(radius_update_listener+0x21)[0x43532f] bin/radiusd(listen_init+0x936)[0x41f339] bin/radiusd(radius_event_start+0x4db)[0x440092] bin/radiusd(main+0x992)[0x42c35a] /lib/libc.so.6(__libc_start_main+0xfd)[0x7f08d75e7cad] bin/radiusd[0x40e4e9] It seems that proxy_new_listener() is not being used in common_socket_parse(), and thus the rad_listen_t's ->data->home field is zero. I'm not sure what the correct fix is, though. Removing the assertion in question, the server starts just fine. I haven't tested proxying, though. Any help is appreciated, Julius P.S. I'm using the current Git v3.0.x branch, f31d0371f8fe.

2 2

encrypt_key = no in FreeRADIUS snake oil certs
by Stefan Paetow 08 Oct '14

08 Oct '14

Hi, Question to you FR gents (Arran and Alan)... would you object if we popped in a request to set encrypt_key = no in the three CNF files? If there are objections... any reason why? :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net Janet, the UK’s research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

3 3

ArcSight
by Shawn Wiley 08 Oct '14

08 Oct '14

Hello all. Has anyone connected FreeRADIUS to an HP ArcSight SEIM? I found a regex flex connector but I have no idea if it works or how it should be installed. If anyone has fed FreeRADIUS into ArcSight I would greatly appreciate any guidance you can give me. Thanks, Shawn Shawn L. Wiley, CISSP - Information and Application Security Architecture ________________________________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), Euronext or any of their subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired. ________________________________________________________

1 0

Calling eap_md5 to process EAP data in inner-tunnel
by Oleksandr Yermolenko 08 Oct '14

08 Oct '14

Hello, everyone, Environment: freeradius 3.0.4, strongswan 5.2.0. Could someone give me advices or info why it happened? stages how eap-md5 should work in innner-tunnel? I saw http://wiki.freeradius.org/guide/EAPMD5-HOWTO but it's not enough in my scenario. ..... begin cut .... (5) # Executing group from file /etc/raddb/sites-enabled/default (5) authenticate { (5) eap : Expiring EAP session with state 0xea78d7a3ea79d3c6 (5) eap : Finished EAP session with state 0x9da50fdc99a01a4f (5) eap : Previous EAP request found for state 0x9da50fdc99a01a4f, released from the list (5) eap : Peer sent method TTLS (21) (5) eap : EAP TTLS (21) (5) eap : Calling eap_ttls to process EAP data (5) eap_ttls : Authenticate (5) eap_ttls : processing EAP-TLS TLS Length 69 (5) eap_ttls : Length Included (5) eap_ttls : eaptls_verify returned 11 (5) eap_ttls : eaptls_process returned 7 (5) eap_ttls : Session established. Proceeding to decode tunneled attributes (5) eap_ttls : Got tunneled request EAP-Message = 0x020100160410521e6638c06be72697c7697d1a2289b9 (5) eap_ttls : Sending tunneled request (5) server inner-tunnel { (5) Request: EAP-Message = 0x020100160410521e6638c06be72697c7697d1a2289b9 User-Name = 'stu(a)sumix.com' State = 0xea78d7a3ea79d3c6e940fe67ef2f7464 (5) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (5) authorize { (5) [preprocess] = ok (5) [files] = noop (5) eap : Peer sent code Response (2) ID 1 length 22 (5) eap : No EAP Start, assuming it's an on-going EAP conversation (5) [eap] = updated (5) } # authorize = updated (5) Found Auth-Type = EAP (5) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (5) authenticate { (5) eap : Expiring EAP session with state 0xea78d7a3ea79d3c6 (5) eap : Finished EAP session with state 0xea78d7a3ea79d3c6 (5) eap : Previous EAP request found for state 0xea78d7a3ea79d3c6, released from the list (5) eap : Peer sent method MD5 (4) (5) eap : EAP MD5 (4) (5) eap : Calling eap_md5 to process EAP data (5) eap_md5 : Cleartext-Password is required for EAP-MD5 authentication (5) ERROR: eap : Failed continuing EAP MD5 (4) session. EAP sub-module failed (5) eap : Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Login incorrect (eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed): [stu(a)sumix.com/<via Auth-Type = EAP>] (from client aae-vm port 0 via TLS tunnel) (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject : EXPAND %{User-Name} (5) attr_filter.access_reject : --> stu(a)sumix.com (5) attr_filter.access_reject : Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) } # Post-Auth-Type REJECT = updated (5) Reply: EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 (5) } # server inner-tunnel (5) eap_ttls : Got tunneled Access-Reject SSL: Removing session adf6f0ff78ebe6faaa6f3949f499535dc8a21dfc72a066a288b3e0e0bfbc9339 from the cache (5) ERROR: eap : Failed continuing EAP TTLS (21) session. EAP sub-module failed (5) eap : Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Login incorrect (eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed): [stu(a)sumix.com/<via Auth-Type = EAP>] (from client aae-vm port 68 cli 10.20.9.8[4500]) (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject : EXPAND %{User-Name} (5) attr_filter.access_reject : --> stu(a)sumix.com (5) attr_filter.access_reject : Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) eap : Reply already contained an EAP-Message, not inserting EAP-Failure (5) [eap] = noop (5) remove_reply_message_if_eap remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else else { (5) [noop] = noop (5) } # else else = noop (5) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1 seconds ..... users file stu Cleartext-Password := "x3DdEhgN" stu(a)sumix.com Cleartext-Password := "x3DdEhgN" big thanks for your help and advices. Oleksandr

7 14

rlm_eap problem after upgrade from 2.1.12 to 2.2.5 via radsecproxy
by Thomas Boettcher 08 Oct '14

08 Oct '14

Hello community, my setup are two boxes with Freeradius and radsecproxy 1.6.5 in an eduroam environment. after upgrading from 2.1.12 to 2.2.5 without any configuration changes I register an enormous (times 31 (562:17678 per day)) amount of error messages: "rlm_eap: No EAP session matching the State variable." The following "Login incorrect:" is mainly from the radsecproxy nas clients. Users from the remote locations brought me to the Problem since they are authenticated OK and just seconds later the above error results in a "Login incorrect". These users are filling my logs with wavelike loglines (OK, incorrect, OK, incorrect). On the other hand not all remote users are affected. The users who stated to have to problem were all within the international eduroam community (not national), but this is just a guess. I do not understand why the eap state variable could be mixed up by a Software Upgrade to a "stable" version, so it looks to me that the problem resides within the freeradius programming. At the moment I do not fully understand all code differences between the two versions. I downgraded to 2.1.12 again to keep my users online, but the problem should be solved. Any ideas to debug the problem are welcome. Does anyone see similar problems with 2.2.5? Thanks for any help, Thomas Böttcher

3 4

checking Packet-Type in post-proxy
by Pshem Kowalczyk 08 Oct '14

08 Oct '14

Hi, I have a setup with a frontend server that proxies all request to a number of backend servers. Depending on the type of the reply packet it supposed to do something extra (like log it into the database and update some aspects of the reply for Access-Accept) I've tried this setup: post-proxy { if (proxy-reply:Packet-Type == Access-Accept ){ .... } but it doesn't seem to trigger: (2) if (proxy-reply:Packet-Type == Access-Accept ) (2) if (proxy-reply:Packet-Type == Access-Accept ) -> FALSE (2) } # post-proxy = noop So I decided to map it to different attribute to see what the value actually is: post-proxy { update control { Filter-Id := "%{proxy-reply:Packet-Type}" } if (proxy-reply:Packet-Type == Access-Accept ){ .... } And this seems to capture the content fine: (2) post-proxy { (2) update control { (2) EXPAND %{proxy-reply:Packet-Type} (2) --> Access-Accept (2) Filter-Id := '"Access-Accept"' (2) } # update control = noop (2) if (proxy-reply:Packet-Type == Access-Accept ) (2) if (proxy-reply:Packet-Type == Access-Accept ) -> FALSE (2) } # post-proxy = noop For now I've settled on this setup: post-proxy { update control { Filter-Id := "%{proxy-reply:Packet-Type}" } if (control:Filter-Id == 'Access-Accept'){ ... } (2) post-proxy { (2) update control { (2) EXPAND %{proxy-reply:Packet-Type} (2) --> Access-Accept (2) Filter-Id := '"Access-Accept"' (2) } # update control = noop (2) if (control:Filter-Id == 'Access-Accept') (2) if (control:Filter-Id == 'Access-Accept') -> TRUE That works fine. I just wonder if there's a simpler way of checking the type of the packet? (Freeradius 3.0.4) kind regards Pshem

3 2

Re: Beginner help (Alan DeKok)
by KAVYA PRABHAKAR 08 Oct '14

08 Oct '14

> > > > Hi, > > > to the TOP of the users file? the same file that the server is > reading...and > restarted > > the server before running the test? > > > > Yes, I have added test Cleartext-Password := "456" as the 1st line (TOP) in users file and restarted the server before running the test. But I encountered same error. (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (0) WARNING: pap : Authentication will fail unless a "known good" password is available. (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user. (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> test (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 In debug logs they say "at line 11". I checked the same in users file. That particular line is commented. Thanks, Kavya

2 1

Authentication and Authorization
by Alex Gregory 07 Oct '14

07 Oct '14

Hello- If I have both LDAP and Proxy configured will FreeRadius use both? What I am looking for is the FreeRadius server authorize a user in LDAP and if that passes forward the user to the upstream OTP radius server (via proxy.conf) for authentication. I believe its doing this now with the LDAP module, just authenticating locally, rather than proxied. Is this possible? Thanks, Alex

3 8