- Freeradius-Users - lists.freeradius.org

Freeradius giving certificate error
by Dhanushka Parakrama 29 Mar '23

29 Mar '23

Hi All . We are running freeradius 2.1.10 with WPA Enterprise authentication with EAP-TTLS and setup is working is fine Then we have regenerated the new certificates via .*/bootstrap *command Then we tried to login to WIFI . but our freeradius stared to throw the below error Wed Mar 29 20:26:02 2023 : Error: TLS Alert read:fatal:bad certificate Wed Mar 29 20:26:02 2023 : Error: TLS_accept: failed in SSLv3 read client certificate A Wed Mar 29 20:26:02 2023 : Error: rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Wed Mar 29 20:26:02 2023 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. Wed Mar 29 20:26:02 2023 : Auth: Login incorrect (TLS Alert read:fatal:bad certificate): [user(a)email.com] (from client ManagementAPs port 1 cli e8-84-a5-e0-49-d0) Is there any reason for the above error ? How can I fix it ? , Please advice Thank You Dhanushka

3 2

Is there a XLAT IF(..) like expansion?
by g4-lisz＠tonarchiv.ch 29 Mar '23

29 Mar '23

Hello again I'm trying to accomplish the following (pseudo code): In rlm_rest module config: authenticate { body = "json" data = '{ "token" : "xxxxxxx", "states": [ "x", "y" ], "resourceIds: PSEUDO_CODE>> IF(%{control:Cust-Resource-Uuid}, [ "%{control:Cust-Resource-Uuid}" ], null) <<PSEUDO_CODE , }' } I.e. when the custom attribute is set, the JSON's "resourcesIds" property should be an array containing the attribute's string content, otherwise "null". Your help is much appreciated! Cheers, Till

2 2

EAP tunnel username problem
by ST Wong (ITSC) 29 Mar '23

29 Mar '23

Hi all, We're running freeRADIUS 3.0.21 for 802.1x authentication. It works all the time. However, we note that occasionally in log entries for successful login, the username logged by default site is different from the real username,e.g. 1. Username changed to "user" while domain part remains unchanged: Wed Mar 22 17:28:20 2023 : Auth: (23249490) Login OK: [skywalker(a)mydomain.hk] (from client ctrl01 port 0 via TLS tunnel) Wed Mar 22 17:28:20 2023 : Auth: (23249491) Login OK: [user(a)mydomain.hk] (from client ctrl01 port 0 cli 67A2ED8ECBAF) 1. First character in username is stripped: Wed Mar 22 15:39:12 2023 : Auth: (23080299) Login OK: [s1234567890(a)mydomain.hk] (from client ctrl01 port 0 via TLS tunnel) Wed Mar 22 15:39:12 2023 : Auth: (23080300) Login OK: [1234567890(a)mydomain.hk] (from client ctrl01 port 0 cli 73D2ED9CABEB) I've no idea as over 99% of the logs look good. Would anyone please help? Thanks a lot. Best Rgds /st wong

2 2

Re: RE: Edit User-Name based on regex
by Hermann.Lauer＠uni-heidelberg.de 28 Mar '23

28 Mar '23

On Mon, Mar 27, 2023 at 12:10:26PM +0000, ANGEL LUIS MATEO MARTINEZ wrote: > I'm stuck trying to remove the ":" chars from the string. try something like: if ( &Calling-Station-Id =~ /^([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})$/i ) newusername = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" > The example in the docs for regex is a username comparison (first google hit), and there are many examples all over stackexchange of mac address regexes. And yes, it's often used. Greetings Hermann > Are you stuck on where to do the username comparison, or how to remove the :'s from > the string or ? > > > On Mar 27, 2023, at 6:20 AM, ANGEL LUIS MATEO MARTINEZ <amateo(a)um.es> wrote: > > > > Hello, > > > > I have a scenario where I need to modify User-Name, before any AAA operation, based on a regex substitution. To be precise, the users are sending a MAC as the username, in the form "00:11:22:33:44:55" and I need to transform this to "001122334455". > > > > This may be a silly question, but I haven't found how to do it. Is there any way to do it? Thank you. > > > > -- > > Angel L. Mateo Martínez > > Sección de Telemática > > Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) > > http://www.um.es/atica > > Tfo: 868889150 > > Fax: 868888337 > > - > > List info/subscribe/unsubscribe? See https://urldefense.com/v3/__http://www.freeradius.org/list/users.html__;!!D… > > - > List info/subscribe/unsubscribe? See https://urldefense.com/v3/__http://www.freeradius.org/list/users.html__;!!D… -- Administration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 205; 69120 Heidelberg; Tel: (06221)54-14405 Fax: -14427 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

1 0

Questions about FreeRadius and unsupported characters for secret...
by Tammy Dore 28 Mar '23

28 Mar '23

Hi, We have received a number of issues reported by our customers in regards to the secret authentication does not support certain characters in our software released based on FreeRadius v3.0.19. As a result of this, we had done some of our own comparison testing of a bunch of different special characters against both the v3.0.19 and the v2.2.9 releases. We found the following discrepancies, where it appears that there are bugs introduced into v3.0.19. 1. We would like to understand what explanation there is for why they are no longer supported or if a bug was introduced, so we can offer an explanation to our customers. 2. If there is a work-around, would you kindly let us know? 3. Do you know if these issues have been corrected in one of your newer releases? Secret value 8.4 Results (3.0.19) 8.3 Results (2.2.9) Comments testing123, Failed Passed (no quote) Supported in 2.2.9. Not Supported at All in 3.0.19.; not even with correct_escapes = false. radiusd:121302:1679518016.577067:Wed Mar 22 15:46:56 2023: Wed Mar 22 15:46:56 2023 : Info: Dropping packet without response because of error: Received packet from 10.16.167.194 with invalid Message-Authenticator! (Shared secret is incorrect.) testing123; Failed Passed (in single or double quotes or with testing123\;) Supported in 2.2.9. Not Supported at All in 3.0.19. radiusd:121302:1679518016.577067:Wed Mar 22 15:46:56 2023: Wed Mar 22 15:46:56 2023 : Info: Dropping packet without response because of error: Received packet from 10.16.167.194 with invalid Message-Authenticator! (Shared secret is incorrect.) "testing123\054" Failed Passed Supported in 2.2.9. Not Supported at All in 3.0.19. radiusd:151163:1679691163.765497:Fri Mar 24 15:52:43 2023: Fri Mar 24 15:52:43 2023 : Error: /usr/local/forescout/plugin/dot1x/fs_radius/etc/raddb/sites-enabled/default[116]: Invalid regular expression: radiusd:151163:1679691163.765522:Fri Mar 24 15:52:43 2023: Fri Mar 24 15:52:43 2023 : Error: /usr/local/forescout/plugin/dot1x/fs_radius/etc/raddb/sites-enabled/default[116]: ^(.*)\(.*) radiusd:151163:1679691163.765546:Fri Mar 24 15:52:43 2023: Fri Mar 24 15:52:43 2023 : Error: /usr/local/forescout/plugin/dot1x/fs_radius/etc/raddb/sites-enabled/default[116]: ^ Pattern compilation failed: unmatched parentheses ^*B%9vÑStNfx9H Failed Passed Supported in 2.2.9. Not Supported at All in 3.0.19. radiusd:151392:1679933409.952848:Mon Mar 27 11:10:09 2023: Mon Mar 27 11:10:08 2023 : Error: /usr/local/forescout/plugin/dot1x/fs_radius/etc/raddb/fs_clients.conf[19]: Syntax error: Expected comma after '^*B%9v': ÑStNfx9H radiusd:1 Note: The last one seems to be an issue with the accent mark over the N. Thank you in advance for your help! Tammy Dore Sr. Software Engineer Forescout Technologies, Inc. Email: tammy.dore(a)forescout.com<mailto:tammy.dore@forescout.com> Text: +1-214-403-2010 LinkedIn: https://www.linkedin.com/in/TammyDore/ [cid:image001.png@01D960F9.56EA0200] WARNING - CONFIDENTIAL INFORMATION: ________________________________ This message may contain confidential and privileged information. If it has been sent to you in error, please reply to advise the sender of the error and then immediately delete it. If you are not the intended recipient, do not read, copy, disclose or otherwise use this message. The sender disclaims any liability for such unauthorized use. NOTE that all incoming emails sent to Forescout email accounts will be archived and may be scanned by us and/or by external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails ("spam"). If you have any concerns about this process, please contact us privacy(a)forescout.com.

2 1

LDAPS Unknown error from LDAP module
by Grosjean Cyril 27 Mar '23

27 Mar '23

Hello, I’m using Freeradius 3.2.1 and with a standard config connected to an LDAPS server, some requests (bind as admin, search/bind as user/…) are currently finishing with those kind of errors : Tue Mar 14 03:08:56 2023 : Auth: (43138) Login incorrect (ldap: Failed performing search: Unknown error): [user@domain] (from client XXX port 0 via TLS tunnel) Tue Mar 14 03:30:24 2023 : Auth: (43714) Login incorrect (ldap: Bind with uid=serviceaccount,dc=subdomain,dc=com to ldaps://server:636 <mimestream://server:636> failed: Unknown error): [user@domain] (from client XXX port 0 via TLS tunnel) I can see something like 3 to 5% of requests being made and finishing as “Unknown error”. 1/ Can you confirm that the “Unknown error” is from the LDAP response and not Freeradius ? Can we have more information about status code of the response ? I’m seeing here two occurences of “Unknown error” in the ldap module (ldap.c) but I can’t get more information, and it is hard for me to activate debug that show Radius attribute in stdout (as some of them are sensitive). 2/ Can I activate more debug on thoses errors to get the bottom of it ? Do you have any insight to help me get more information ? Here is my LDAP config : ldap { server = 'ldaps://serverldap.com' port = 636 identity = 'uid=serviceaccount,dc=subdomain,dc=com' password = ‘password' base_dn = 'dc=subdomain,dc=com' update { control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user_dn = "LDAP-UserDn" user { base_dn = "ou=users,${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" } group { base_dn = "ou=groups,${..base_dn}" filter = '(objectClass=posixGroup)' name_attribute = cn membership_attribute = 'memberOf' cacheable_name = 'no' cacheable_db = 'no' } profile { } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = no rebind = yes res_timeout = 20 srv_timelimit = 3 net_timeout = 10 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0000 } tls { require_cert = 'allow' tls_min_version = "1.2" } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } Thanks, Cyril

2 1

Edit User-Name based on regex
by ANGEL LUIS MATEO MARTINEZ 27 Mar '23

27 Mar '23

Hello, I have a scenario where I need to modify User-Name, before any AAA operation, based on a regex substitution. To be precise, the users are sending a MAC as the username, in the form "00:11:22:33:44:55" and I need to transform this to "001122334455". This may be a silly question, but I haven't found how to do it. Is there any way to do it? Thank you. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

3 3

Freeradius authentication for VSP VOSS Switch
by shamsher singh 24 Mar '23

24 Mar '23

Hello List, I have been trying to authenticate using radius with Extreme VSP switch, the radius seems to accept the authentication, but the switch still fails Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 131.232.33.8 port 44016, id=243, length=68 User-Name = "test" User-Password = "test" NAS-IP-Address = 131.232.33.8 NAS-Port = 1 NAS-Port-Type = Async Service-Type = Administrative-User # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop [files] users: Matched entry test at line 2 ++[files] = ok ++[expiration] = noop ++[logintime] = noop ++[pap] = updated +} # group authorize = updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +group PAP { [pap] login attempt with password "test" [pap] Using clear text password "test" [pap] User authenticated successfully ++[pap] = ok +} # group PAP = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 243 to 131.232.33.8 port 44016 Service-Type = Administrative-User Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 243 with timestamp +73 Ready to process requests. ------------- ssh test(a)131.232.33.8 Using security software from Mocana Corporation. Please visit https://www.mocana.com/ for more information Copyright(c) 2010-2022 Extreme Networks. All Rights Reserved. Virtual Services Platform 7200 VSP Operating System Software Build 8.8.0.0 General Availability Released Software, Fully supported This product is protected by one or more US patents listed at http://www.extremenetworks.com/patents along with their foreign counterparts. EXTREME NETWORKS VOSS COMMAND LINE INTERFACE test(a)131.232.33.8's password: Permission denied, please try again. test(a)131.232.33.8's password: ------ 1 2023-03-02T17:00:37.225-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH session closed by server for user test on host 131.232.90.103, session_id = 2 1 2023-03-02T17:00:37.225-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH authentication time expired for user test on host 131.232.90.103, session_id = 2 1 2023-03-02T17:00:23.615-07:00 LAB7K902 CP1 - 0x0004060b - 00000000 GlobalRouter WEB INFO SSL session with client 131.232.90.103 closed. 1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH invalid username/password for user test on host 131.232.90.103, session_id = 2 1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45fc - 00000000 GlobalRouter RADIUS INFO Radius message: 1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45c0 - 00000000 GlobalRouter RADIUS INFO RADIUS authentication failed on server 131.232.33.170 1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45fc - 00000000 GlobalRouter RADIUS INFO Radius message: Thank you, Shamsher

6 11

Re: Auth failed accounts and write to SQL database
by Steven Walters 24 Mar '23

24 Mar '23

Thanks for the information provided Matthew. I got it working. I have however a slight challenge when trying to set the Class attribute instead of updating the database, as suggested. In the Access-Accept I set the Class attribute equal to reject which works fine in the case where we have our own BNGs. The value I set is the value I receive from the BNG in the Accounting-Start message. However, where we consume network services where we don't use our own BNG, the PPPoE gets proxied to us by the access provider's RADIUS. Whatever value we set in the Class they will encode to hex, add IXX and then encode to hex again. For example, if I set Class = reject, I receive: 0x4958583078373236353661363536333734 When I do string:Class I get: IXX0x72656a656374 Using a calculator, if I convert 0x72656a656374 from hex to string I get the value reject. Using the below I am trying to extract 0x72656a656374 from IXX0x72656a656374 which I write to Tmp-String-2 and then apply string to Tmp-String-3. However I end up with Tmp-String-3 = 0x72656a656374 but would like the original value (reject) I set in the Access-Accept message. if ("%{string:Class}" =~ /(IXX)(0x[0-9a-f]{12})/) { update request { &Tmp-String-2 := "%{2}" &Tmp-String-3 := "%{string:Tmp-String-2}" } }

3 2

Questions on Free Radius with Shared Secret and special characters
by Tammy Dore 23 Mar '23

23 Mar '23

Hi, We upgraded from a previous version of Free Radius v3.0.19. Recently we have had some complains that some special characters which used to work in our previous release, no longer work. So far I have discovered that these special characters do not work: , ; ' So which known special characters are not supported? Do I need to use an escape sequence in front of the special character to make it work? I saw a blog that mentioned the correct_escapes setting in radiusd.conf can be used to correct the problem with special characters. So does setting correct_escapes = false, will that allow a secret with "testing123\," to work? Thank you! -Tammy Dore WARNING - CONFIDENTIAL INFORMATION: ________________________________ This message may contain confidential and privileged information. If it has been sent to you in error, please reply to advise the sender of the error and then immediately delete it. If you are not the intended recipient, do not read, copy, disclose or otherwise use this message. The sender disclaims any liability for such unauthorized use. NOTE that all incoming emails sent to Forescout email accounts will be archived and may be scanned by us and/or by external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails ("spam"). If you have any concerns about this process, please contact us privacy(a)forescout.com.

3 4