- Freeradius-Devel - lists.freeradius.org

Monitoring; export metrics in prometheus style
by Andrey Grigorian 25 Jun '24

25 Jun '24

Hi team, Great product! Thanks a lot. Is there a chance to get all the monitoring metrics available via cat <<EOF | radclient -x localhost:18121 status adminsecret also available through Prometheus like http://<freeradius-ip>:8428/metric to let the Prometheus server scrape them? -- Andrey Grigorian

2 1

PAP: adding support for OpenLDAP and 389ds PBKDF2 passwords
by Oliver Lorenz 03 Jun '24

03 Jun '24

Hi, while testing LDAP authentication with FreeIPA, I noticed PAP complained about no "known good" password found for the user. After looking into it, I saw that the Password.With-Header attribute has an unknown header. PAP rewrote it to Cleartext and obviously failed to verify it. Below is a patch to make authentication work. The additional password type was necessary because password_process_header in password.c always strips the header it finds, which sucks for OpenLDAP and 389ds passwords because they encode the hash algorithm there. I would really appreciate it if somebody could provide some feedback. Since it's such a massive codebase, chances are that I'm doing it (very) wrong. Thanks, Oliver --- .../dictionary.freeradius.internal.password | 2 + src/lib/server/password.c | 18 ++++++- src/modules/rlm_pap/rlm_pap.c | 49 +++++++++++++++++++ src/tests/modules/pap/pbkdf2_389ds_sha1.attrs | 11 +++++ .../modules/pap/pbkdf2_389ds_sha1.unlang | 17 +++++++ .../modules/pap/pbkdf2_389ds_sha256.attrs | 11 +++++ .../modules/pap/pbkdf2_389ds_sha256.unlang | 17 +++++++ .../modules/pap/pbkdf2_389ds_sha512.attrs | 11 +++++ .../modules/pap/pbkdf2_389ds_sha512.unlang | 17 +++++++ 9 files changed, 151 insertions(+), 2 deletions(-) create mode 100644 src/tests/modules/pap/pbkdf2_389ds_sha1.attrs create mode 100644 src/tests/modules/pap/pbkdf2_389ds_sha1.unlang create mode 100644 src/tests/modules/pap/pbkdf2_389ds_sha256.attrs create mode 100644 src/tests/modules/pap/pbkdf2_389ds_sha256.unlang create mode 100644 src/tests/modules/pap/pbkdf2_389ds_sha512.attrs create mode 100644 src/tests/modules/pap/pbkdf2_389ds_sha512.unlang diff --git a/share/dictionary/freeradius/dictionary.freeradius.internal.password b/share/dictionary/freeradius/dictionary.freeradius.internal.password index 2d184710ae..4e9ed86539 100644 --- a/share/dictionary/freeradius/dictionary.freeradius.internal.password +++ b/share/dictionary/freeradius/dictionary.freeradius.internal.password @@ -64,6 +64,8 @@ ATTRIBUTE SSHA3-256 28 octets ATTRIBUTE SSHA3-384 29 octets ATTRIBUTE SSHA3-512 30 octets +ATTRIBUTE PBKDF2-389DS 31 octets + END-TLV Password # TOTP passwords and secrets diff --git a/src/lib/server/password.c b/src/lib/server/password.c index 669c815efe..fe42a76890 100644 --- a/src/lib/server/password.c +++ b/src/lib/server/password.c @@ -73,6 +73,8 @@ typedef struct { ///< attribute using the hex/base64 decoders. bool always_allow; //!< Always allow processing of this attribute, irrespective ///< of what the caller says. + bool retain_header; //!< Do not strip header from password string before + ///< passing it to the authentication module } password_info_t; static fr_dict_t const *dict_freeradius = NULL; @@ -112,6 +114,7 @@ static fr_dict_attr_t const *attr_ssha3_384; static fr_dict_attr_t const *attr_ssha3_512; static fr_dict_attr_t const *attr_pbkdf2; +static fr_dict_attr_t const *attr_pbkdf2_389ds; static fr_dict_attr_t const *attr_lm; static fr_dict_attr_t const *attr_nt; static fr_dict_attr_t const *attr_ns_mta_md5; @@ -160,6 +163,7 @@ fr_dict_attr_autoload_t password_dict_attr[] = { { .out = &attr_ssha3_512, .name = "Password.SSHA3-512", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, { .out = &attr_pbkdf2, .name = "Password.PBKDF2", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, + { .out = &attr_pbkdf2_389ds, .name = "Password.PBKDF2-389DS", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, { .out = &attr_lm, .name = "Password.LM", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, { .out = &attr_nt, .name = "Password.NT", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, { .out = &attr_ns_mta_md5, .name = "Password.NS-MTA-MD5", .type = FR_TYPE_STRING, .dict = &dict_freeradius }, @@ -205,6 +209,9 @@ static fr_table_num_sorted_t const password_header_table[] = { { L("{ns-mta-md5}"), FR_NS_MTA_MD5 }, { L("{nt}"), FR_NT }, { L("{nthash}"), FR_NT }, + { L("{pbkdf2-sha1}"), FR_PBKDF2_389DS }, + { L("{pbkdf2-sha256}"), FR_PBKDF2_389DS }, + { L("{pbkdf2-sha512}"), FR_PBKDF2_389DS }, #ifdef HAVE_OPENSSL_EVP_H { L("{sha224}"), FR_SHA2 }, @@ -285,6 +292,11 @@ static password_info_t password_info[] = { .type = PASSWORD_HASH_VARIABLE, .da = &attr_pbkdf2 }, + [FR_PBKDF2_389DS] = { + .type = PASSWORD_HASH_VARIABLE, + .da = &attr_pbkdf2_389ds, + .retain_header = true + }, [FR_SHA1] = { .type = PASSWORD_HASH, .da = &attr_sha1, @@ -681,11 +693,13 @@ do_header: goto bad_header; } - p = q + 1; - if (!fr_cond_assert(known_good->da->attr < NUM_ELEMENTS(password_info))) return NULL; info = &password_info[attr]; + if (!info->retain_header) { + p = q + 1; + } + MEM(new = fr_pair_afrom_da(ctx, *(info->da))); switch ((*(info->da))->type) { case FR_TYPE_OCTETS: diff --git a/src/modules/rlm_pap/rlm_pap.c b/src/modules/rlm_pap/rlm_pap.c index 67a363fb7d..216c68ddf5 100644 --- a/src/modules/rlm_pap/rlm_pap.c +++ b/src/modules/rlm_pap/rlm_pap.c @@ -682,6 +682,54 @@ finish: RETURN_MODULE_RCODE(rcode); } +static inline unlang_action_t CC_HINT(nonnull) pap_auth_pbkdf2_389ds(rlm_rcode_t *p_result, + UNUSED rlm_pap_t const *inst, + request_t *request, + fr_pair_t const *known_good, + fr_value_box_t const *password) +{ + uint8_t const *p = known_good->vp_octets, *q, *end = p + known_good->vp_length; + + /* + * OpenLDAP and 389ds carry algorithm information in + * the userPassword header, so make sure it's there. + * + * Message format: + * OpenLDAP: {PBKDF2-<digest>}<rounds>$<alt_b64_salt>$<alt_b64_hash> + * 389ds: {PBKDF2-<digest>}<rounds>$<b64_salt>$<b64_hash> + * + * The format is almost identical to Python's passlib. + * If we advance the pointer a bit and use '}' as scheme separator, + * pap_auth_pbkdf2_parse will do the rest for us + */ + + if (end - p < 2) { + REDEBUG("Password.PBKDF2-389DS too short"); + RETURN_MODULE_INVALID; + } + + if (*p != '{') { + REDEBUG("Password.PBKDF2-389DS has invalid header"); + RETURN_MODULE_INVALID; + } + + q = memchr(p, '}', end - p); + if (!q || q - p < 2) { + REDEBUG("Password.PBKDF2-389DS has invalid header"); + RETURN_MODULE_INVALID; + } + + if ((size_t)(q - p) > sizeof("{PBKDF2-") && strncasecmp((char const *) p, "{PBKDF2-", 8) == 0) { + p += sizeof("{PBKDF2-") - 1; + return pap_auth_pbkdf2_parse(p_result, request, p, end - p, + pbkdf2_passlib_names, pbkdf2_passlib_names_len, + '}', '$', '$', false, password); + } + + REDEBUG("Can't determine format of Password.PBKDF2-389DS"); + RETURN_MODULE_INVALID; +} + static inline unlang_action_t CC_HINT(nonnull) pap_auth_pbkdf2(rlm_rcode_t *p_result, UNUSED rlm_pap_t const *inst, request_t *request, @@ -870,6 +918,7 @@ static const pap_auth_func_t auth_func_table[] = { #ifdef HAVE_OPENSSL_EVP_H [FR_PBKDF2] = pap_auth_pbkdf2, + [FR_PBKDF2_389DS] = pap_auth_pbkdf2_389ds, [FR_SHA2] = pap_auth_dummy, [FR_SHA2_224] = pap_auth_sha2_224, [FR_SHA2_256] = pap_auth_sha2_256, diff --git a/src/tests/modules/pap/pbkdf2_389ds_sha1.attrs b/src/tests/modules/pap/pbkdf2_389ds_sha1.attrs new file mode 100644 index 0000000000..74119f6a78 --- /dev/null +++ b/src/tests/modules/pap/pbkdf2_389ds_sha1.attrs @@ -0,0 +1,11 @@ +# +# Input packet +# +Packet-Type = Access-Request +User-Name = 'pbkdf2_389ds_sha1' +User-Password = 'password' + +# +# Expected answer +# +Packet-Type == Access-Accept diff --git a/src/tests/modules/pap/pbkdf2_389ds_sha1.unlang b/src/tests/modules/pap/pbkdf2_389ds_sha1.unlang new file mode 100644 index 0000000000..22fd74c7bc --- /dev/null +++ b/src/tests/modules/pap/pbkdf2_389ds_sha1.unlang @@ -0,0 +1,17 @@ +if ("${feature.tls}" == no) { + test_pass + return +} + +if (&User-Name == 'pbkdf2_389ds_sha1') { + &control.Password.With-Header := '{PBKDF2-SHA1}10000$kX7ZFznyliHoBZ+7ZIIAI1yH+V9yZg6j$35n7xsdaw763OdDgKGSMsJUWz8s=' + + pap.authorize + pap.authenticate + + if (ok) { + test_pass + } else { + test_fail + } +} diff --git a/src/tests/modules/pap/pbkdf2_389ds_sha256.attrs b/src/tests/modules/pap/pbkdf2_389ds_sha256.attrs new file mode 100644 index 0000000000..f1a566a94c --- /dev/null +++ b/src/tests/modules/pap/pbkdf2_389ds_sha256.attrs @@ -0,0 +1,11 @@ +# +# Input packet +# +Packet-Type = Access-Request +User-Name = 'pbkdf2_389ds_sha256' +User-Password = 'password' + +# +# Expected answer +# +Packet-Type == Access-Accept diff --git a/src/tests/modules/pap/pbkdf2_389ds_sha256.unlang b/src/tests/modules/pap/pbkdf2_389ds_sha256.unlang new file mode 100644 index 0000000000..b9cf455ad9 --- /dev/null +++ b/src/tests/modules/pap/pbkdf2_389ds_sha256.unlang @@ -0,0 +1,17 @@ +if ("${feature.tls}" == no) { + test_pass + return +} + +if (&User-Name == 'pbkdf2_389ds_sha256') { + &control.Password.With-Header := '{PBKDF2-SHA256}10000$kX7ZFznyliHoBZ+7ZIIAI1yH+V9yZg6j$kH2xGFdC+rS5+tjPnTXj/pGK0eFXTez2QqF2QZhunBM=' + + pap.authorize + pap.authenticate + + if (ok) { + test_pass + } else { + test_fail + } +} diff --git a/src/tests/modules/pap/pbkdf2_389ds_sha512.attrs b/src/tests/modules/pap/pbkdf2_389ds_sha512.attrs new file mode 100644 index 0000000000..15cbd64dc3 --- /dev/null +++ b/src/tests/modules/pap/pbkdf2_389ds_sha512.attrs @@ -0,0 +1,11 @@ +# +# Input packet +# +Packet-Type = Access-Request +User-Name = 'pbkdf2_389ds_sha512' +User-Password = 'password' + +# +# Expected answer +# +Packet-Type == Access-Accept diff --git a/src/tests/modules/pap/pbkdf2_389ds_sha512.unlang b/src/tests/modules/pap/pbkdf2_389ds_sha512.unlang new file mode 100644 index 0000000000..9444d690ea --- /dev/null +++ b/src/tests/modules/pap/pbkdf2_389ds_sha512.unlang @@ -0,0 +1,17 @@ +if ("${feature.tls}" == no) { + test_pass + return +} + +if (&User-Name == 'pbkdf2_389ds_sha512') { + &control.Password.With-Header := '{PBKDF2-SHA512}10000$kX7ZFznyliHoBZ+7ZIIAI1yH+V9yZg6j$kyzz433C/pdvdkzPTjwi8wr6cHNTFD0dCKuUkKVMmSgilGBDQjNxfDQwZzFBiPgChQJTFAm8oThm65xrLGFnAg==' + + pap.authorize + pap.authenticate + + if (ok) { + test_pass + } else { + test_fail + } +} --

2 1

rlm_kafka accounting module for Freeradius 3.x
by The Binary 20 May '24

20 May '24

Hello Community, The repo URL: https://github.com/thebinary/rlm_kafka I had created a FreeRADIUS 3.x module a year ago, for pushing Accounting Records to Kafka (uses librdkafka). I created a separate repo outside of FreeRADIUS project, which I used to compile separately by cloning inside the FreeRADIUS source 'src/modules' path. I would like to submit the module if considered useful by the community.

4 3

Regarding providing Custom TOTP MFA in freeradius
by Dineshkumar pachamuthu 02 May '24

02 May '24

Hi Team, I have recently been working and developing with the freeradius EAP protocol. I need to send access-challenge request with state and Reply-Message "Enter TOTP" inside of inner-tunnel of EAP-TTLS/PAP Protocol which will prompt the user to enter TOTP and send the access request again and will process and authenticate the user for MFA. I have gone through this solution <https://lists.freeradius.org/pipermail/freeradius-users/2019-February/09447…> inside the authorize section of inner-tunnel but the EAP module sends access-reject when doing this change, Please guide me in the proper direction on how to achieve this in our environment. Regards Dineshkumar

3 9

FreeRadius with Tomcat/Java Server
by Dineshkumar pachamuthu 07 Feb '24

07 Feb '24

Hi Team, I am currently building a freeradius server along withTomcat server. My main goal is to use tomcat server as UI for Radius client configuration and to authenticate the user for password (datastore). I have seen the JRadius module but currently it is deprecated. Is there any way for FreeRadius to communicate with Tomcat server? Please let me know your suggestions. Thanks and Regards Dineshkumar

2 1

Update User-Name AVP on Post Auth module
by Suriya Shankar 20 Oct '23

20 Oct '23

Hello Everyone, I am aware that It's not good to alter the User-Name but I have a requirement. I am authenticating an EAP_TTLS request and during the Post-Auth section every module in the Unlang is being called by *modcall_recurse*, one such is the policy module where I update the User-Name along with other standard AVP in reply just to verify. As soon as the control came back to the modcall.c *User-Name* value alone kept intact. Is there some sort of callback or method handle that reverts back the User-Name to its original. Thanks, Suriya

2 1

EAP-TEAP Compound MAC calculation
by Suriya Shankar 14 Sep '23

14 Sep '23

Hi, I am trying to calculate the Compound MAC for EAP-TEAP. But the description in the rfc 7170 is bit confusing Section 4.2.13 mentions both the MSK and EMSK Compound MAC is either Server MAC or Client MAC (not sure what exactly are those). Section 5.3 gives the calculation where we have to zero out both MSK and EMSK Compound MAC and apply the MAC function to calculate the Compound MAC. - What's the resultant Compound MAC we get from trying section 5.3 (MSK or EMSK Compound MAC) - What algorithm should we use? The document adds to consider TLS 1.2 rfc 5246 where the recommended algorithm is HMAC 256 that results in 32 octet digest instead of the expected 20 octet one. Could any please help me in understanding the Compound MAC calculation or guide me in the right direction Thanks, Suriya

2 8

custom user lookup - how to
by Felix Nielsen 03 Sep '23

03 Sep '23

Hi I am looking for a way to integrate my own username/password validation - I need to authenticate with Okta using their proxy. Is there a way to implement this or where should I look for this in the source code? My initial quick-fix, was to modify the current implementation using the /usr/local/etc/raddb/users file database "myusername" Cleartext-Password := "mypassword" So basically if I can find the correct function to modify it would be great Thanks Felix

2 1

CoA over inbound radsec session
by Natarajan M 17 Jul '23

17 Jul '23

Seeing from an old thread that currently CoA over radsec is possible for outbound radsec sessions from Freeradius, in order to do the same using existing inbound radsec tunnel, required some testing? By any chance, did that change, if it still requires testing, I can pick up the PR for testing and bring it back for review with tested results? Thanks Natarajan On 9/14/20, 4:06 PM, "Alan DeKok" <aland at deployingradius.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: On Sep 14, 2020, at 8:58 AM, Vadim Cargatser (vcargats) via Freeradius-Users <freeradius-users at lists.freeradius.org <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: > We'd like to trigger a CoA based on an external event. Is this possible? Not really. > There was a mail thread back in 2010 I was just wondering if something has been changed so far: > http://freeradius.1045715.n5.nabble.com/Freeradius-COA-trigger-td3204376.ht… FreeRADIUS isn't a web server, so it doesn't know that the admin clicked on something in a web UI. The only way to do this is via RADIUS. > I know the basic approach is to use radclient for that scenario. Unfortunately, radclient does not support TLS/RADSEC which is critical for us. > > In case this is not currently possible, can we just implement that? Say to allow getting external events for example from RabbitMQ? FreeRADIUS doesn't listen for events from RabbitMQ. That's hard to add. (Though in v4 it's likely a lot easier) The solution here is to use v3.0.x from GitHub, because earlier versions don't support CoA over TLS (oops). Then, use radclient to send packets to FreeRADIUS. FreeRADIUS can receive the packets from radclient, and then forward them over TLS to another server. See sites-available/coa-relay for an example. You just have to define a home_server which uses TLS for CoA. Note that the server can only send CoA packets over connections to home servers. i.e. connections where FreeRADIUS creates the outbound connection. CoA packets *cannot* be sent in the "reverse" path over TLS connections which the client made to FreeRADIUS. There is no standard for how this should work. I have patches, but they need testing. Alan DeKok.

2 1

Fwd: Accessing the "Authenticator" value from within a perl script
by Lannar Dean 28 Jun '23

28 Jun '23

When using the perl module to process access-requests, is it possible to get the "Authenticator" value (NOT the Message-Authenticator)? There is a VSA which contains encoded data, which is using the encoding mechanism specified in RFC2865, which requires the Authenticator to decrypt. It does not decode properly when the dictionary specifies RFC2865 (encrypt=1) or RFC2868 (encrypt=2), because the encrypted data is sometimes larger than 192 bytes which is not supported in the Password attribute. For example, I need access to the following value, visible in a packet capture, from within my perl script: Authenticator value <https://i.stack.imgur.com/p6LTq.png> (not the Message-Authenticator AVP <https://i.stack.imgur.com/dB4q4.png>) The text to be decrypted is present in a VSA that is defined in a dictionary, such as ATTRIBUTE MyVendors-Special-Passphrase 44 string encrypt=1 (also tried encrypt=2) An example of the payload of the value is 21caa32fea486d9baf414610ea46510e9706a476812d02e21b956e35aa47501040b445702c6ff7e1f7f839480c1a26458f710af77aeae6e592b6e6910a6d93bbf31fe803d05799bcdec86b6b5c70c85fd92ad63449773ec1500069688280cfce0da532e0ece9e504fffef1cd381b69b981ac1b17a4a5ea672154dbea8d61823bb0644669f5f367b28fe6431d8a11d109ec4a8d19e6be46eca4c8085cd01c1b02fd0fc0bff7719432d8445b2cf39a0e66 I would like to decrypt the data manually inside a perl module, but in order to do that I need the Authenticator value to use as a vector to the decryption algorithm, which I haven't been able to access from my perl script. Since neither encrypt=1 nor encrypt=2 results in the correct data, I would like to do the decryption myself within perl. If I obtain the Authenticator value manually from a packet capture, I am able to complete the process, but I would like to automate this. Does anyone know of a way to get that value? Thank you in advance!

2 3