- Freeradius-Users - lists.freeradius.org

NetworkRadius
by Alex Zetaeffesse 01 Aug '22

01 Aug '22

Hello, sorry for using the ML for business purposes. It's been days I've been trying to contact somebody from NeworkRadius but nobody replies to emails nor picks up the phone. What would be the best way to get in contact with them? Thanks, Alex

4 4

Re: EAP-TLS failure with Freeradius 3.2.0 : Failed reading from OpenSSL: ../ssl/record/rec_layer_s3.c[1528]:error:14094438
by Alan DeKok 28 Jul '22

28 Jul '22

Don't send messages to my private email address. I read the list, and that's good enough. Also read the instructions at http://wiki.freeradius.org/list-help I have no idea why so many people refuse to follow the documentation. W don't need to see "radiusd -Xxxx" or anything else. Just "radiusd -X". You get told this in the "welcome" message when you join the list. Can you explain why you're not following the documentation? i.e. the first message you post to the list tells us that you didn't read the docs, or you have no intention of following the documentation. Why is that useful? All it does is convince people that there's no point in answering your questions, because you'll just ignore any answer. And read the debug messages you post to the list. This isn't a FreeRADIUS issue. FreeRADIUS is telling you that the problem is the peer. i.e. the client machine. It's not following the specifications correctly. Go ask Google why their software is broken. No amount of poking FreeRADIUS will fix the Android phone. Alan DeKok.

1 0

EAP-TLS failure with Freeradius 3.2.0 : Failed reading from OpenSSL: ../ssl/record/rec_layer_s3.c[1528]:error:14094438
by Arvinder Singh 28 Jul '22

28 Jul '22

Hi Alan, When using FreeRadius 3.2.0, using EAP-TLS I am seeing below errors, " Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) EAP Done initial handshake Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) recv TLS 1.2 Alert, fatal internal_error Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) The client is informing us that there is a failure inside the TLS protocol exchange. Tue Jul 26 16:46:02 2022 : ERROR: (4) eap_tls: (TLS) Alert read:fatal:internal error Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) Server : Need to read more data: error Tue Jul 26 16:46:02 2022 : ERROR: (4) eap_tls: (TLS) Failed reading from OpenSSL: ../ssl/record/rec_layer_s3.c[1528]:error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) In Handshake Phase Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) Application data. Tue Jul 26 16:46:02 2022 : ERROR: (4) eap_tls: (TLS) Cannot continue, as the peer is misbehaving. Tue Jul 26 16:46:02 2022 : ERROR: (4) eap_tls: [eaptls process] = fail Tue Jul 26 16:46:02 2022 : ERROR: (4) eap: Failed continuing EAP TLS (13) session. EAP sub-module failed Tue Jul 26 16:46:02 2022 : Debug: (4) eap: Sending EAP Failure (code 4) ID 46 length 4 Tue Jul 26 16:46:02 2022 : Debug: (4) eap: Failed in EAP select Tue Jul 26 16:46:02 2022 : Debug: (4) modsingle[authenticate]: returned from eap (rlm_eap) Tue Jul 26 16:46:02 2022 : Debug: (4) [eap] = invalid Tue Jul 26 16:46:02 2022 : Debug: (4) } # authenticate = invalid Tue Jul 26 16:46:02 2022 : Debug: (4) Failed to authenticate the user Tue Jul 26 16:46:02 2022 : Debug: (4) Using Post-Auth-Type Reject " I am using Android 12 clients and Netgear WiFi Access Point. EAP-PEAP is working perfectly fine for me. I am using the default test certificates, ca.pem and user(a)example.org.pem<mailto:user@example.org.pem> I am unable to debug further as these errors seems to be OpenSSL related. Any guidance fir resolution is appreciated. Attached are the logs from the Radius server. Best regards, Arvinder Singh Nothing in this message is intended to constitute an electronic signature unless a specific statement to the contrary is included in this message. Confidentiality Note: This message is intended only for the person or entity to which it is addressed. It may contain confidential and/or privileged material. Any review, transmission, dissemination or other use, or taking of any action in reliance upon this message by persons or entities other than the intended recipient is prohibited and may be unlawful. If you received this message in error, please contact the sender and delete it from your computer.

1 0

How to make restrictions effective?
by 网络时代 27 Jul '22

27 Jul '22

Hello, My FreeRADIUS server and MariaDB are connected to authenticate customers. When I add users to the database and limit the number of simultaneous login of the same user, I must run the "systemctl restart radiusd" command to make the restriction take effect. Is this necessary? Or does FreeRADIUS itself have a refresh mechanism, but it takes a long time? System version 3.0.21,Is there a better solution? Best regards

2 1

Possible issue with UTF8 misconversion (username with umlauts)
by Herda, Martin 27 Jul '22

27 Jul '22

Hello List! We've got an issue with umlauts in usernames: We are using privacyIDEA to enroll 2FA TOTP token to users for securing login process to VMware Horizon View infrastructure. (Homeoffice use) In backend, privacyIDEA is using freeRadius (in conjunction with rlm_perl) to authenticate users against active directory. When a user with umlaut is trying to log in, it seems that there is a (double) misconversion happening: Radius.log: Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Config File /etc/privacyidea/rlm_perl.ini found! Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Debugging config: Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Default URL https://localhost/validate/check Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Looking for config for auth-type Perl Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Password encoding guessed: ascii Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Setting client IP to 192.168.0.12. Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Auth-Type: Perl Wed Jul 27 08:31:14 2022 : Info: rlm_perl: url: https://localhost/validate/check Wed Jul 27 08:31:14 2022 : Info: rlm_perl: user sent to privacyidea: G%C3%83%C2%B6the Wed Jul 27 08:31:14 2022 : Info: rlm_perl: realm sent to privacyidea: Wed Jul 27 08:31:14 2022 : Info: rlm_perl: resolver sent to privacyidea: Wed Jul 27 08:31:14 2022 : Info: rlm_perl: client sent to privacyidea: 192.168.0.12 Wed Jul 27 08:31:14 2022 : Info: rlm_perl: state sent to privacyidea: Wed Jul 27 08:31:14 2022 : Info: rlm_perl: urlparam client Wed Jul 27 08:31:14 2022 : Info: rlm_perl: urlparam pass Wed Jul 27 08:31:14 2022 : Info: rlm_perl: urlparam user Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Request timeout: 10 Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Not verifying SSL certificate! Wed Jul 27 08:31:15 2022 : Info: rlm_perl: elapsed time for privacyidea call: 0.549382 Wed Jul 27 08:31:15 2022 : Info: rlm_perl: privacyIDEA request failed: 400 BAD REQUEST Wed Jul 27 08:31:15 2022 : Info: rlm_perl: privacyIDEA Result status is false! Wed Jul 27 08:31:15 2022 : Info: rlm_perl: ERR904: The user can not be found in any resolver in this realm! Wed Jul 27 08:31:15 2022 : Info: rlm_perl: privacyIDEA failed to handle the request Wed Jul 27 08:31:15 2022 : Info: rlm_perl: return RLM_MODULE_NOTFOUND Username should be 'Göthe' but somwhere on the way it gets messed up to 'G%C3%83%C2%B6the' Users without umlauts are working fine. I don't know, in which part exactly the things gets messed up. But I think this issue should lie anywhere between freeRadius and rlm_perl, because the first instance right after the Horizon Server is freeRadius and rlm_perl. Any ideas how to solve this issue? But removing/replacing umlauts is not an option.

2 2

Configuring static MAC bypass list in RADIUS server on 802.1x leveraged Wireless LAN -Reg.
by Maneesh Kumar 27 Jul '22

27 Jul '22

Hello members, We are using Freeradius server with version "3.0.26" for enabling 802.1x leveraged Wireless LAN. However, as few WiFi clients are not supporting the required PEAP -cum- MS-CHAPv2 as the security mechanism, it is required to whitelist them so that such WiFi client can be onboarded on the Wireless LAN. We are trying to find out if such required static MAC bypass list(sometimes called the exclusion list) can be made available to the radius server so that such WiFi clients can be allowed to access the Wireless LAN without 802.1x or MAC RADIUS authentication requests to the RADIUS server. Maneesh Kumar Center for Development of Advanced Computing For assimilation and dissemination of knowledge, visit cakes.cdac.in ------------------------------------------------------------------------------------------------------------ [ C-DAC is on Social-Media too. Kindly follow us at: Facebook: https://www.facebook.com/CDACINDIA & Twitter: @cdacindia ] This e-mail is for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies and the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email is strictly prohibited and appropriate legal action will be taken. ------------------------------------------------------------------------------------------------------------

2 1

Certificates from AC AD-CS (MS active directory)
by Laurent Estevez 26 Jul '22

26 Jul '22

Hello, I'm looking for documentation to integrate the certificates of ad ds freeradius 3.0, I have problems for the integration in the file eap.conf and also reading the server certificate, Thanks in advance, L. Este --

2 1

TLS with intermediate certificate issue
by Young Yoon 26 Jul '22

26 Jul '22

Hello, We're running into an issue where EAP-TLS authentication is failing due to the 'unable to get issuer certificate' error. This is only the case when freeRADIUS certificate was issued by the intermediate CA server (signed by the Root CA) and the client certificate was also issued by the intermediate CA server but Root CA installed on it. Note that Trusted CA (ca_file ==> external_ca.pem) in freeradius does NOT include the the Root CA and it only has the CA cert that's issuing the certificate (intermediate certificate). Snippet of eap configuration is as below (no CRL involved). tls-config tls-common { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = password private_key_file = ${certdir}/external_server.pem certificate_file = ${certdir}/external_server.pem ca_file = ${cadir}/external_ca.pem dh_file = ${certdir}/dh 2022-07-25 09:02:25,557: Debug: (259) eap_tls: (TLS) EAP Continuing ... 2022-07-25 09:02:25,557: Debug: (259) eap_tls: (TLS) EAP Peer sent flags --- 2022-07-25 09:02:25,557: Debug: (259) eap_tls: (TLS) EAP Got final fragment (313 bytes) 2022-07-25 09:02:25,557: Debug: (259) eap_tls: (TLS) EAP Verification says ok 2022-07-25 09:02:25,557: Debug: (259) eap_tls: (TLS) EAP Done initial handshake 2022-07-25 09:02:25,557: Debug: (259) eap_tls: (TLS) recv TLS 1.2 Handshake, Certificate 2022-07-25 09:02:25,557: Debug: (259) eap_tls: Generating SHA-1 Fingerprint for certificate 2022-07-25 09:02:25,557: Debug: (259) eap_tls: ETS-TLS-Cert-Fingerprint := "1C0D90361737BB7B7B8EAE62FDF7E6A680042DF9" 2022-07-25 09:02:25,557: Debug: (259) eap_tls: (TLS) Creating attributes from server certificate 2022-07-25 09:02:25,557: Debug: (259) eap_tls: TLS-Cert-Serial := "3b0000000a0d548d27e286f0ca00000000000a" 2022-07-25 09:02:25,557: Debug: (259) eap_tls: TLS-Cert-Expiration := "240722144713Z" 2022-07-25 09:02:25,557: Debug: (259) eap_tls: TLS-Cert-Valid-Since := "220722143713Z" 2022-07-25 09:02:25,557: Debug: (259) eap_tls: TLS-Cert-Subject := "/DC=com/DC=extrxiq-salem/DC=extrxiq-salemC/CN=extrxiq-salemC-WIN2012-752-CA" 2022-07-25 09:02:25,557: Debug: (259) eap_tls: TLS-Cert-Issuer := "/DC=com/DC=extrxiq-salem/CN=extrxiq-salem-XIQ-SALEM-WIN12-CA" 2022-07-25 09:02:25,558: Debug: (259) eap_tls: TLS-Cert-Common-Name := "extrxiq-salemC-WIN2012-752-CA" 2022-07-25 09:02:25,558: Debug: (259) eap_tls: ETS-TLS-Verify-Error-Code := 2 2022-07-25 09:02:25,558: ERROR: (259) eap_tls: (TLS) OpenSSL says error 2 : unable to get issuer certificate 2022-07-25 09:02:25,558: Debug: (259) eap_tls: (TLS) send TLS 1.2 Alert, fatal unknown_ca 2022-07-25 09:02:25,558: ERROR: (259) eap_tls: (TLS) Alert write:fatal:unknown CA 2022-07-25 09:02:25,558: ERROR: (259) eap_tls: (TLS) Server : Error in error 2022-07-25 09:02:25,558: ERROR: (259) eap_tls: (TLS) Failed reading from OpenSSL: s3_srvr.c[3344]:error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed 2022-07-25 09:02:25,558: ERROR: (259) eap_tls: (TLS) System call (I/O) error (-1) 2022-07-25 09:02:25,558: ERROR: (259) eap_tls: (TLS) EAP Receive handshake failed during operation 2022-07-25 09:02:25,558: ERROR: (259) eap_tls: [eaptls process] = fail 2022-07-25 09:02:25,558: ERROR: (259) eap: Failed continuing EAP TLS (13) session. EAP sub-module failed The above example shows 'TLS-Cert-Issuer' is the root CA server which signed the intermediate certificate. A client was authenticating fine on freeRADIUS server running 3.0.21 but after we upgraded the freeRADIUS to 3.0.25, we're starting to see this issue (see above the debug). No configuration change in eap file between versions. If we install the 'root' certificate to 'ca_file' in 3.0.25 (no needed in 3.0.21 as it only required intermediate cert), then the client authentication started working. Is this known issue OR expected new behavior? If so, what would be the reason why it worked in 3.0.21 not in 3.0.25? Thanks for the help.

2 3

Inner tunnel - VLAN assignment
by Max Elzinga 26 Jul '22

26 Jul '22

Hello, We are currently testing with FreeRADIUS. We would like to assign different VLANs based on certificate SAN name and ethernet/wireless configuration. The configuration I have pasted below is working in the Inner Tunnel file. I would like to check if this is according to the best practices. Any suggestions? Thanks in advance. if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY } } update { &reply: += &session-state: } if (User-Name =~ /\.child\.int\.domain\.local/ || NAS-Port-Type == Ethernet){ if (<ipv4prefix>&NAS-IP-Address < 10.36.2.0/23) { update reply { &Tunnel-Type = 13, &Tunnel-Medium-Type = 6, &Tunnel-Private-Group-Id = "106" } } } if (User-Name !~ /\.child\.int\.domain\.local/ || User-Name =~ /\.int\.domain\.local/ || NAS-Port-Type == Ethernet){ if (<ipv4prefix>&NAS-IP-Address < 10.36.2.0/23) { update reply { &Tunnel-Type = 13, &Tunnel-Medium-Type = 6, &Tunnel-Private-Group-Id = "107" } } } if (User-Name =~ /\.child\.int\.domain\.local/ || NAS-Port-Type == Wireless-802.11){ if (<ipv4prefix>&NAS-IP-Address < 10.36.2.0/23) { update reply { &Tunnel-Type = 13, &Tunnel-Medium-Type = 6, &Tunnel-Private-Group-Id = "110" } } } if (User-Name !~ /\.child\.int\.domain\.local/ || User-Name =~ /\.int\.domain\.local/ || NAS-Port-Type == Wireless-802.11){ if (<ipv4prefix>&NAS-IP-Address < 10.36.2.0/23) { update reply { &Tunnel-Type = 13, &Tunnel-Medium-Type = 6, &Tunnel-Private-Group-Id = "111" } } } Kind regards, Max

2 1

proxy auth and acct to different destination
by Bill Yuan 25 Jul '22

25 Jul '22

Hi, in the proxy.conf, we can config as below to handle realm "ABC" realm ABC{ authhost = radius.example.com:1812 accthost = radius.example.com:1813 secret = testing123 } which means proxy to different destinations, but with the same secret. what if we have different shared secrets for auth and acct server? Regards, Bill Yuan

2 1