- Freeradius-Users - lists.freeradius.org

Realm
by Miha 24 Jan '13

24 Jan '13

Hi, my radius client is sending with user-name and password aslo realm. I can not disable sending realm, is it possible to configure radius that will not user realm with user-name (user-name@realm)? [digest] Digest-Attributes look OK. Converting them to something more usful. *Digest-User-Name = "018108500"* *Digest-Realm = "test1.opensips.softnet.si"* Digest-Nonce = "510001fb00000006c9cc728438be21e324f917a5ea234380" Digest-URI = "sip:+38588888882@test1.opensips.test.si" Digest-Method = "INVITE" [digest] Adding Auth-Type = DIGEST ++[digest] returns ok [suffix] Looking up realm "test1.opensips.softnet.si" for User-Name = *"018108500(a)test1.opensips.**test.si*" [suffix] No such realm "test1.opensips.softnet.si" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> *018108500(a)test1.opensips.**test.si* Radius will need to chack only user-name (*018108500*). Thanks! Miha

3 3

suddenly problem with certificates / error in SSLv3 read client certificate B
by Stephan Manske 24 Jan '13

24 Jan '13

Hello! I have a huge problem with freeradius 2.2.0 on my eisfair server (www.eisfair.org) and users using certificates to authenticate. first of all: this should not be a "how must I config my freeradius to work?" problem. These installation with these certificates and these config worked for over 8 month very well. And suddenly I got the problem. Every client with user/pass works still fine. The problem is about the users with certificates (windows xp and android). the certificates are not outdated: list of active certificates: V 13-01-28 13:16:17 Z 01 unknown /C=DE/ST=Somewhere/O=Manske EIS/OU=Radius_Managment/CN=Manske Radius/emailAddress=xxx (the server certificate) V 14-02-17 13:16:54 Z 02 unknown /C=DE/ST=Somewhere/O=Manske EIS/OU=Radius_Managment/CN=User Name/emailAddress=xxx (one of the problematic user certificates) I tried it with check_crl = yes and no changes before the problem occurs: I updated openssl-packages from Internal Program Version: OpenSSL 1.0.0j also included the old version 0.9.7m also included the old version 0.9.8x to Internal Program Version: OpenSSL 1.0.1c also included the old version 0.9.8x But I did this over three days before the errors occured. In the meantime freeradius worked well. So, here is a shorten output of radiusd -X (I hope I do not shorten important things - btw, are there parts of such an debug output I should keep secret?) Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.x.x port 2049, id=2, length=141 User-Name = "User Name" NAS-IP-Address = 192.168.x.x # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "User Name", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry User Name at line 8 [files] expand: Hello, %{User-Name} -> Hello, User Name ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/tls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.x.x port 2049 Reply-Message = "Hello, User Name" EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000xx State = 0x7d1f9f227c1d92c8e39xxxxxxxxx Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.x.x port 2049, id=2, length=227 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry User Name at line 8 [files] expand: Hello, %{User-Name} -> Hello, User Name ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 77 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0048], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 08bb], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00b8], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 77 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0048], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 08bb], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00b8], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.x.x port 2049 Reply-Message = "Hello, User Name" EAP-Message = 0x010304000dc0000009b316030100310200002d030150e4ae0ed21d8 EAP-Message = 0x3017060355040313104d616e736b6520526164697573204341301e1 EAP-Message = 0xce7ab5f8c7edc84656371d677436108b21313e1ea308f55566b8684 EAP-Message = 0x25040c300a06082b06010505070301300d06092a864886f70d01010 EAP-Message = 0xb12f24c809d9d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7d1f9f227f1c92c8e3xxxxxx Finished request 2. Going to the next request [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Sending Access-Challenge of id 2 to 192.168.x.x port 2049 Reply-Message = "Hello, User Name" EAP-Message = 0x010404000dc0000009b3301 EAP-Message = 0x3130323136313231325a17: Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.x.x port 2049 Reply-Message = "Hello, User Name" EAP-Message = 0x010404000dc0000009bxxxxxx EAP-Message = 0xfdf4cec951566e50d17 EAP-Message = 0xca21c0f495c75a3a13d EAP-Message = 0x01ff300d06092a86488 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7d1f9f227e1b92c8e39 Finished request 3. Going to the next request and so on ... but here it might be important: # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03de], Certificate [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = User Name [tls] --> BUF-Name = Radius CA [tls] --> subject = /C=DE/ST=Somewhere/L=Somewhere/O=Manske EIS/OU=Radius_Managment/emailAddress=radius@xxxx [tls] --> issuer = /C=DE/ST=Somewhere/L=Somewhere/O=Manske EIS/OU=Radius_Managment/emailAddress=radius@xxxx [tls] --> verify return:1 --> verify error:num=7:certificate signature failure [tls] >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:04067084:rsa routines:RSA_EAY_PUBLIC_DECRYPT:data too large for modulus SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect (certificate signature failure): [User Name/<via Auth-Type = EAP>] (from client xxxx Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> User Name attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 2 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 2 to 192.168.x.x port 2049 TIIA, Stephan

4 14

freeradius 2.2.0 stop authorization
by Wedel Blake 23 Jan '13

23 Jan '13

I setup a centos 6.2 server that has freeradius 2.2.0 running on it. I have the mysql module running. Based on simple mac authentication with the username and password the mac address of the computer it appears to be working fine. What I want to do is setup ldap to authenticate against our Windows 2010 server where the computers are a part of the domain. I would like for it to query mysql first and then query ldap if it didn't find the computer in mysql. If I remove ldap for the defaults file I get an Access-Accept reply as expected. It just that if there is anything after sql in the defaults file then it will continue on to try and authenticate against another module. Below you can see a simple query with 'blake' being sent as both the user-name and password. It queries the db and finds it (as expected). However it continues to go to ldap and tries to find it to which I get an error. I understand that I don't have ldap working properly right now. However, first I just want to get the logic setup to where after finding a name in mysql it will stop and reply back with an Access-Accept and not query ldap. Is there a setting you have to put in a conf file? rad_recv: Access-Request packet from host 10.220.1.107 port 52258, id=10, length=45 User-Name = "blake" User-Password = "blake" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "blake", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> blake [sql] expand: %{%{User-Name}:-DEFAULT} -> blake [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> blake [sql] sql_set_user escaped user --> 'blake' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'blake' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'blake' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'blake' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'blakegroup' ORDER BY id [sql] User found in group blakegroup [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'blakegroup' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [ldap] performing user authorization for blake [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> blake [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=blake) [ldap] expand: o=My Org,c=UA -> o=My Org,c=UA [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.193.0.90:389, authentication 0 [ldap] bind as CN=srvacct,OU=misc,OU=TechAdmin,OU=District,OU=Staff,DC=crcsd,DC=abc/ to 10.193.0.90:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in o=My Org,c=UA, with filter (uid=blake) [ldap] ldap_search() failed: Operations error [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> blake attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.7 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 10 to 10.220.1.107 port 52258 Waking up in 4.9 seconds. Cleaning up request 0 ID 10 with timestamp +3 Ready to process requests. Thanks in advance! -b

2 2

Freeradius and EAP_TLS Problem:
by Armin Maier 23 Jan '13

23 Jan '13

Hello! I have been using Windows 7, Freeradius 2.1.10 from Debian Squeeze, HP MSM710 WLAN controller and EAP_TLS Computer Certificate Authentication for a log time and worked perfect. I used Certificates created on the Debian server by openssl including the extensions for Client Authentication and Server Authentication. Now we want to activate port security on our physical switches and use the same radius server, so we installed a Windows Enterprise Root CA for autoenrollment of the Client and server certificates. I also created an RAS IAS Certificate for the Radius Server and installed them, they are loaded without any problems, but authentication of the Windows 7 client do not work anymore. I searched the internet for a compareable setup but i cannot find any hints for using Microsoft Enterprise CA with freeradius server, may everywhere else it works like a charm :) , but cannot believe it! So my first question, does someone use Microsoft Enterprise CA Certificates with freeradius in a working environment, and o i have to regard something special? Running "freeradius -X" gives me the following errors: ... Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 95 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 005a], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 08d7], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0062], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled ... I updated to Debian wheezy to get a newer freeradius version, but nothing changed. The Radius Server Certificate include the following Attribute (output of "openssl x509 -text -in <cert> -noout"): X509v3 extensions: X509v3 Key Usage: Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Subject Key Identifier: 1D:22:6F:1B:8B:F9:DE:C7:D2:FC:8A:17:97:87:EA:8B:D0:0D:27:31 X509v3 Authority Key Identifier: keyid:0F:BB:BB:14:63:C3:07:52:CE:D9:74:94:6A:83:83:45:A4:94:2A:5B Authority Information Access: CA Issuers - URI:ldap:///CN=xxx%20Certificate%20Services%20A,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=xxx,DC=xx?cACertificate?base?objectClass=certificationAuthority 1.3.6.1.4.1.311.21.7: 0..&+.....7.....c..;.......^...S.*..........d... 1.3.6.1.4.1.311.21.10: 0.0 ..+.......0 ..+....... The Client Certificates include the following Attributes: Key usage: Digital Signature, Key Encipherment (a0) Enhanded Key Usage: Client Authentication (1.3.6.1.5.5.7.3.2) The client attributes also include - Authority Information Access - CRL Distribution Points - Certificate Template Information which have very long values with special caracters like _%/=:?, may this be a problem?

2 2

Re: Freeradius and EAP_TLS Problem:
by Alan Buxey 23 Jan '13

23 Jan '13

So you went from a working system and then changed everything for the switch authentication. Why? Why didn't you just keep the same AAA backend? Either way, if you want to use 2 different certs and CAs then you'll need 2 instances.... or proxy the other ones off to eg microsd NPS server..but again, why? alan

1 0

Override Proxy Reject
by Dale Lloyd 22 Jan '13

22 Jan '13

I would like FreeRADIUS to never reject, always allow. Is there a way to override every proxy reject with an accept? I tried adding the following in the sites-enabled\default file, but it does not override the proxies reject message: post-proxy { update proxy-reply { Auth-Type := Accept } Thanks.

3 2

Log format
by Emmanuel BILLOT 22 Jan '13

22 Jan '13

Hi, Is there anyway to have log format (radius.log) with any date for eah line or section ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

3 2

Usage Limit and Accounting Plan
by Sokphak TOUCH 22 Jan '13

22 Jan '13

Dear Team, I just done installation and configure FreeRadius for PPPoE users. And I need more feature to meet user requirement. Currently, it already work for bandwidth limit by use CISCO-AVpair attr to return to CISCO LNS. 1. I need to limit the user monthly usage, for example bandwidth 2Mbps with 5GB monthly usage. 2. After the monthly usage exceed, I want the user change their plan to 512Kbps for example. It would related to scripting, but I has no idea about scripting. If anyone already done with that, I really appreciate for your sharing. Thanks for helping from everyone in community. Regards, -- Sokphak

2 3

accounting question
by Tzvika Gelber 22 Jan '13

22 Jan '13

i'm looking to focus a problem i have - i think the main issue is not freeradius but it's a good place to ask. I have a server that's do both Radius and accounting for Wifi random users (web redirected system). now i just discovered that to authenticate the users i have to use the server "secret" password on the accounting side i can use whatever i want and it will still work. (if the secret for the server is 12345 i can use abcde for the accounting and i'll get the accounting files). The question is this, if we stick to the AAA protocol do you really need the "radius secret" to use accounting? or can i just drop it? -- ____ Sometimes you just glow in the dark...

3 2

how do you limit users connection?
by Tzvika Gelber 21 Jan '13

21 Jan '13

one of my sites has a web-redirect portal and freeradius is the way they authenticate. now i want to take it to the next level and use my web-redirect portal to allow 15min connections. Aradial has an Enforcmant switch that you can set those limitations. but how do i do the same with Freeradius? Thanks. -- ____ Sometimes you just glow in the dark...

1 0