- Freeradius-Users - lists.freeradius.org

hacks needed
by mohamed almeshal 08 Aug '22

08 Aug '22

dear savers ... I have to apply these needed configuration to my exist radius box First ... I need to implement module that check if this box is can work and accept users via call php script I think this can be achieved any advice from you Second .... my box accept radsec TLS users , I need to implement acceptance from nas table via 1812 , 1813 UDP and let them work together , how I can achieve that Your's Mohammed

2 1

EAP-TLS failure with Freeradius 3.2.0 : Failed reading
by Arvinder Singh 05 Aug '22

05 Aug '22

Hi Alan, Are we sure it is the Google Adroid phone which is the culprit. If that then this issue should be seen with most Android phones. Also, the Radius client would be Access Point, in this case Netgear RAX200 which I am using. Any support on resoling this will be helpful. Thanks. Regards, Arvinder. -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+arvinder.singh=gm.com(a)lists.freeradius.org> On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Thursday, July 28, 2022 8:00 AM To: freeradius-users(a)lists.freeradius.org Subject: [EXTERNAL] Freeradius-Users Digest, Vol 207, Issue 47 ATTENTION: This email originated from outside of GM. Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: EAP-TLS failure with Freeradius 3.2.0 : Failed reading from OpenSSL: ../ssl/record/rec_layer_s3.c[1528]:error:14094438 (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Thu, 28 Jul 2022 07:23:49 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: EAP-TLS failure with Freeradius 3.2.0 : Failed reading from OpenSSL: ../ssl/record/rec_layer_s3.c[1528]:error:14094438 Message-ID: <890B6D01-D871-46C7-880C-AC000F3F457E(a)deployingradius.com> Content-Type: text/plain;charset=us-ascii Don't send messages to my private email address. I read the list, and that's good enough. Also read the instructions at http://wiki.freeradius.org/list-help I have no idea why so many people refuse to follow the documentation. W don't need to see "radiusd -Xxxx" or anything else. Just "radiusd -X". You get told this in the "welcome" message when you join the list. Can you explain why you're not following the documentation? i.e. the first message you post to the list tells us that you didn't read the docs, or you have no intention of following the documentation. Why is that useful? All it does is convince people that there's no point in answering your questions, because you'll just ignore any answer. And read the debug messages you post to the list. This isn't a FreeRADIUS issue. FreeRADIUS is telling you that the problem is the peer. i.e. the client machine. It's not following the specifications correctly. Go ask Google why their software is broken. No amount of poking FreeRADIUS will fix the Android phone. Alan DeKok. ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 207, Issue 47 ************************************************* Nothing in this message is intended to constitute an electronic signature unless a specific statement to the contrary is included in this message. Confidentiality Note: This message is intended only for the person or entity to which it is addressed. It may contain confidential and/or privileged material. Any review, transmission, dissemination or other use, or taking of any action in reliance upon this message by persons or entities other than the intended recipient is prohibited and may be unlawful. If you received this message in error, please contact the sender and delete it from your computer.

2 1

Providing dynamic DHCP leases for multiple routers on multiple interfaces
by Matthew McTague 04 Aug '22

04 Aug '22

Hi, I want to use FreeRADIUS to provide DHCP, using a MySQL database to store information. I have multiple MikroTik routers that each have DHCP Relay configured for multiple interfaces, with unique local / source addresses. I want to configure an IP pool per interface, and authenticate client devices by mac address. I see I can configure clients in sites-available/dhcp using their IPv4 addresses, and I think this will allow me to set IP-Pool.Name for each client. In my scenario, these clients would each represent a DHCP Relay configured for a specific interface on a MikroTik router). I understand that I can use mods-available/sqlippool to configure IP pools using an SQL table. I like this, it's ideal for my needs. Rather than storing these clients in sites-available/dhcp, I would like to store these in MySQL. Is this possible? For authenticating by mac address, I understand that I can include sql.authorize in sites-available/dhcp and this will allow me to authenticate using the radcheck and radreply tables. Would this plan work, and is this the correct way to achieve my goal? Many thanks, .[cid:vg-email_e752d47f-182a-48d0-8808-3796b2df8d4a.png]<https://www.vetta.nz> .[cid:058_line_9bae9502-1e3a-48a3-ba5e-34ed9cd44185.png] Matthew McTague Head of Infrastructure [cid:bea-finalist-email_2ddba0ed-b9bb-4ab9-b680-84aa7f54077f.png] [cid:bea-winner-banner-email_590096c3-05a6-4c98-b071-1c4d748c3534.png] . D +64 3 222 6013<tel:+64%203%20222%206013> | P +64 3 684 5770 E matthew.mctague(a)vetta.nz<mailto:matthew.mctague@vetta.nz> | W www.vetta.nz<https://www.vetta.nz> Vetta Group Ltd and its subsidiaries accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company, its subsidiaries, partners or contractors. .

2 1

How I can properly send error reasons for EAP requests Access-Reject?
by work vlpl 03 Aug '22

03 Aug '22

I have a requirement to provide the reason why authentication failed. For non-EAP clients, it is easy just include Reply-Message in Access-Reject packet. But for EAP clients RFC says Reply-Message should not be sent with EAP-Message together. First I've tried to include the second EAP-Message attribute with a reason using `EAP-Message+= "error code"`. I.e. supplicant will receive first EAP-Message with reply from some "eap" module and then my custom message. At least eapol_test tool sees both attributes, but I didn't test it with end-user devices. And I've read RFC 3579 more. In §2.6.5 Displayable Messages the RFC saying "An EAP-Message/EAP-Request/Notification SHOULD NOT be included within an Access-Accept or Access-Reject packet." First question why it saying this? I am confused because in real life I see EAP-Message attribute in Access-Reject response EAPOL: SUPP_BE entering state RECEIVE Received 44 bytes from RADIUS server Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=8 length=44 Attribute 79 (EAP-Message) length=6 Value: 046a0004 Attribute 80 (Message-Authenticator) length=18 Value: 9f3224d1705f2e3cb32708dbea4cc348 STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 1.05 sec But ok, assuming this is fine, there is § 2.6.3. Conflicting Messages saying " Access-Reject packets SHOULD have only one EAP-Message attribute in them, containing EAP Failure." I bet this forbids me from using this hack EAP-Message+= "error code" I didn't find the exact wording that says if you want to include "error code" in Access-Reject reply use only EAP Notification. §2.6.5 saying "When sending a displayable message to a NAS during an EAP conversation, the RADIUS server MUST encapsulate displayable messages within EAP-Message/EAP-Request/Notification attribute(s)" But I guess this is the proper way to do it. The second question - am I, right about it? Or there is another proper way to send an error reason? If I am right about the EAP-Notification attribute can I ask to provide an example of how to do it properly? Since RFC says to use Access-Challenge for notification and then disconnect probably I can try to adapt the example site "challenge". But maybe it is overkill. All I need as I imagine is to send "Access-Challenge " from Post-Auth-Type REJECT section the first time and when the supplicant will repeat the request, send Access-Reject for the second time. -- Vladimir

3 5

SSID check
by Benoit RAYNIER 01 Aug '22

01 Aug '22

Hello, I want to Allow an user to connect freeradius only if the SSID match, with the ssid stored in the database. I tried to add the Check Attibute « Called-Station-id » == « SSID name » to the user profile but this is not working. I also tried to add the attribue Allow-called-station-id but this is not working. What is the right check attribute to add to the user profile please, for a check on the SSID name ? Thanks for your help 😉

3 5

NetworkRadius
by Alex Zetaeffesse 01 Aug '22

01 Aug '22

Hello, sorry for using the ML for business purposes. It's been days I've been trying to contact somebody from NeworkRadius but nobody replies to emails nor picks up the phone. What would be the best way to get in contact with them? Thanks, Alex

4 4

Re: EAP-TLS failure with Freeradius 3.2.0 : Failed reading from OpenSSL: ../ssl/record/rec_layer_s3.c[1528]:error:14094438
by Alan DeKok 28 Jul '22

28 Jul '22

Don't send messages to my private email address. I read the list, and that's good enough. Also read the instructions at http://wiki.freeradius.org/list-help I have no idea why so many people refuse to follow the documentation. W don't need to see "radiusd -Xxxx" or anything else. Just "radiusd -X". You get told this in the "welcome" message when you join the list. Can you explain why you're not following the documentation? i.e. the first message you post to the list tells us that you didn't read the docs, or you have no intention of following the documentation. Why is that useful? All it does is convince people that there's no point in answering your questions, because you'll just ignore any answer. And read the debug messages you post to the list. This isn't a FreeRADIUS issue. FreeRADIUS is telling you that the problem is the peer. i.e. the client machine. It's not following the specifications correctly. Go ask Google why their software is broken. No amount of poking FreeRADIUS will fix the Android phone. Alan DeKok.

1 0

EAP-TLS failure with Freeradius 3.2.0 : Failed reading from OpenSSL: ../ssl/record/rec_layer_s3.c[1528]:error:14094438
by Arvinder Singh 28 Jul '22

28 Jul '22

Hi Alan, When using FreeRadius 3.2.0, using EAP-TLS I am seeing below errors, " Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) EAP Done initial handshake Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) recv TLS 1.2 Alert, fatal internal_error Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) The client is informing us that there is a failure inside the TLS protocol exchange. Tue Jul 26 16:46:02 2022 : ERROR: (4) eap_tls: (TLS) Alert read:fatal:internal error Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) Server : Need to read more data: error Tue Jul 26 16:46:02 2022 : ERROR: (4) eap_tls: (TLS) Failed reading from OpenSSL: ../ssl/record/rec_layer_s3.c[1528]:error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) In Handshake Phase Tue Jul 26 16:46:02 2022 : Debug: (4) eap_tls: (TLS) Application data. Tue Jul 26 16:46:02 2022 : ERROR: (4) eap_tls: (TLS) Cannot continue, as the peer is misbehaving. Tue Jul 26 16:46:02 2022 : ERROR: (4) eap_tls: [eaptls process] = fail Tue Jul 26 16:46:02 2022 : ERROR: (4) eap: Failed continuing EAP TLS (13) session. EAP sub-module failed Tue Jul 26 16:46:02 2022 : Debug: (4) eap: Sending EAP Failure (code 4) ID 46 length 4 Tue Jul 26 16:46:02 2022 : Debug: (4) eap: Failed in EAP select Tue Jul 26 16:46:02 2022 : Debug: (4) modsingle[authenticate]: returned from eap (rlm_eap) Tue Jul 26 16:46:02 2022 : Debug: (4) [eap] = invalid Tue Jul 26 16:46:02 2022 : Debug: (4) } # authenticate = invalid Tue Jul 26 16:46:02 2022 : Debug: (4) Failed to authenticate the user Tue Jul 26 16:46:02 2022 : Debug: (4) Using Post-Auth-Type Reject " I am using Android 12 clients and Netgear WiFi Access Point. EAP-PEAP is working perfectly fine for me. I am using the default test certificates, ca.pem and user(a)example.org.pem<mailto:user@example.org.pem> I am unable to debug further as these errors seems to be OpenSSL related. Any guidance fir resolution is appreciated. Attached are the logs from the Radius server. Best regards, Arvinder Singh Nothing in this message is intended to constitute an electronic signature unless a specific statement to the contrary is included in this message. Confidentiality Note: This message is intended only for the person or entity to which it is addressed. It may contain confidential and/or privileged material. Any review, transmission, dissemination or other use, or taking of any action in reliance upon this message by persons or entities other than the intended recipient is prohibited and may be unlawful. If you received this message in error, please contact the sender and delete it from your computer.

1 0

How to make restrictions effective?
by 网络时代 27 Jul '22

27 Jul '22

Hello, My FreeRADIUS server and MariaDB are connected to authenticate customers. When I add users to the database and limit the number of simultaneous login of the same user, I must run the "systemctl restart radiusd" command to make the restriction take effect. Is this necessary? Or does FreeRADIUS itself have a refresh mechanism, but it takes a long time? System version 3.0.21,Is there a better solution? Best regards

2 1

Possible issue with UTF8 misconversion (username with umlauts)
by Herda, Martin 27 Jul '22

27 Jul '22

Hello List! We've got an issue with umlauts in usernames: We are using privacyIDEA to enroll 2FA TOTP token to users for securing login process to VMware Horizon View infrastructure. (Homeoffice use) In backend, privacyIDEA is using freeRadius (in conjunction with rlm_perl) to authenticate users against active directory. When a user with umlaut is trying to log in, it seems that there is a (double) misconversion happening: Radius.log: Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Config File /etc/privacyidea/rlm_perl.ini found! Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Debugging config: Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Default URL https://localhost/validate/check Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Looking for config for auth-type Perl Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Password encoding guessed: ascii Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Setting client IP to 192.168.0.12. Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Auth-Type: Perl Wed Jul 27 08:31:14 2022 : Info: rlm_perl: url: https://localhost/validate/check Wed Jul 27 08:31:14 2022 : Info: rlm_perl: user sent to privacyidea: G%C3%83%C2%B6the Wed Jul 27 08:31:14 2022 : Info: rlm_perl: realm sent to privacyidea: Wed Jul 27 08:31:14 2022 : Info: rlm_perl: resolver sent to privacyidea: Wed Jul 27 08:31:14 2022 : Info: rlm_perl: client sent to privacyidea: 192.168.0.12 Wed Jul 27 08:31:14 2022 : Info: rlm_perl: state sent to privacyidea: Wed Jul 27 08:31:14 2022 : Info: rlm_perl: urlparam client Wed Jul 27 08:31:14 2022 : Info: rlm_perl: urlparam pass Wed Jul 27 08:31:14 2022 : Info: rlm_perl: urlparam user Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Request timeout: 10 Wed Jul 27 08:31:14 2022 : Info: rlm_perl: Not verifying SSL certificate! Wed Jul 27 08:31:15 2022 : Info: rlm_perl: elapsed time for privacyidea call: 0.549382 Wed Jul 27 08:31:15 2022 : Info: rlm_perl: privacyIDEA request failed: 400 BAD REQUEST Wed Jul 27 08:31:15 2022 : Info: rlm_perl: privacyIDEA Result status is false! Wed Jul 27 08:31:15 2022 : Info: rlm_perl: ERR904: The user can not be found in any resolver in this realm! Wed Jul 27 08:31:15 2022 : Info: rlm_perl: privacyIDEA failed to handle the request Wed Jul 27 08:31:15 2022 : Info: rlm_perl: return RLM_MODULE_NOTFOUND Username should be 'Göthe' but somwhere on the way it gets messed up to 'G%C3%83%C2%B6the' Users without umlauts are working fine. I don't know, in which part exactly the things gets messed up. But I think this issue should lie anywhere between freeRadius and rlm_perl, because the first instance right after the Horizon Server is freeRadius and rlm_perl. Any ideas how to solve this issue? But removing/replacing umlauts is not an option.

2 2