June 2014 - Freeradius-Users - lists.freeradius.org

[ANN] FreeRADIUS officially webscale
by Arran Cudbard-Bell 06 Jun '14

06 Jun '14

https://twitter.com/arr2036 twitter { oauth_consumer_key = '' oauth_consumer_secret = '' oauth_access_token = '' oauth_access_token_secret = '' api_uri = 'https://api.twitter.com/1.1/statuses/update.json' } server { ... authorize { # Stage 1.0 - Generating the signature # Stage 1.1 - What are we tweeting about? update request { Tmp-String-0 := "User %{User-Name} connected to %{NAS-Identifier} #WatchingYou #NoPrivacy #FreeRADIUS #Winning" } # Stage 1.2 - Generate the nonce (base64 encoding of 32 bytes of random data) update request { Tmp-Octets-0 := "0x%{randstr:hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh}" Tmp-String-1 := "%{base64:&Tmp-Octets-0}" Tmp-Integer-0 := "%l" } # Stage 1.3 - Build the paramter string update request { Tmp-String-2 := "\ oauth_consumer_key=%{urlquote:${twitter.oauth_consumer_key}}&\ oauth_nonce=%{urlquote:%{Tmp-String-1}}&\ oauth_signature_method=HMAC-SHA1&\ oauth_timestamp=%{Tmp-Integer-0}&\ oauth_token=%{urlquote:${twitter.oauth_access_token}}&\ oauth_version=1.0&\ status=%{urlquote:%{Tmp-String-0}}" } # Stage 1.4 - Create the signature base string update request { Tmp-String-3 := "POST&%{urlquote:${twitter.api_uri}}&%{urlquote:%{Tmp-String-2}}" } # Stage 1.5 - Create the signing key update request { Tmp-String-4 := "%{urlquote:${twitter.oauth_consumer_secret}}&%{urlquote:${twitter.oauth_access_token_secret}}" } # Stage 1.6 - Create the oAuth signature update request { Tmp-Octets-1 := "0x%{hmacsha1:&Tmp-String-3 &Tmp-String-4}" } update request { Tmp-String-5 := "%{base64:&Tmp-Octets-1}" } # Stage 2.0 - Building the request # Stage 2.1 - Adding the authorization header update control { REST-HTTP-Header := "Connection: close" REST-HTTP-Header += "\ Authorization: OAuth \ oauth_consumer_key=\"%{urlquote:${twitter.oauth_consumer_key}}\", \ oauth_nonce=\"%{urlquote:%{Tmp-String-1}}\", \ oauth_signature=\"%{urlquote:%{Tmp-String-5}}\", \ oauth_signature_method=\"HMAC-SHA1\", \ oauth_timestamp=\"%{Tmp-Integer-0}\", \ oauth_token=\"%{urlquote:${twitter.oauth_access_token}}\", \ oauth_version=\"1.0\"" } # Stage 3.0 - Sending the request update request { Tmp-String-6 := "%{rest:POST ${twitter.api_uri} status=%{Tmp-String-0}}" } } } v3.0.x HEAD only. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

HMAC expansions in v3.0.x HEAD
by Arran Cudbard-Bell 06 Jun '14

06 Jun '14

Hi All, Two new xlats available in v3.0.x head. %{hmacsha1:&data &key} %{hmacsha1:&data supersecret} and %{hmacmd5:&data &key} %{hmacmd5:&data supersecret} Potentially useful for doing signing of requests for Web APIs and other security stuff. Let me know if anyone has an immediate need for other flavours. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Cisco Hack
by Chuck 06 Jun '14

06 Jun '14

Hi, I’m running freeRadius 3.0.3 with an oracle database. I enabled the cisco hack in preprocess module and it appears to be working for start records, however, for stop records I get an error 'Unknown attribute’ for the dsp-id. Here is a debug snip from a stop record: Received Accounting-Request Id 125 Cisco-AVPair = 'dsp-id=1/1:1' Acct-Status-Type = Stop ….. (6) ERROR: sql : ... isconnect-cause}', DSPID = '%{dsp-id}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL (6) ERROR: sql : ... ^ Unknown attribute Here is a debug snip from the start record that works: Received Accounting-Request Id 120 Cisco-AVPair = 'call-id=DA889581-EC2611E3-8C62BC7B-A853074F(a)172.17.8.11' Acct-Status-Type = Start …… (1) sql : EXPAND INSERT INTO radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey, CallID) VALUES('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '%{Acct-Authentic}', '%{h323-setup-time}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{X-Ascend-Session-Svr-Key}', '%{call-id}’) Here is the update query from my queries file: UPDATE ${....acct_table2} \ SET \ AcctStopTime = TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Octets}' + \ ('%{%{Acct-Input-Gigawords}:-0}' * 4294967296), \ AcctOutputOctets = '%{Acct-Output-Octets}' + \ ('%{%{Acct-Output-Gigawords}:-0}' * 4294967296), \ AcctTerminateCause = '%{Acct-Terminate-Cause}', \ AcctStopDelay = '%{%{Acct-Delay-Time}:-0}', \ ConnectInfo_stop = '%{h323-disconnect-time}', \ ACCTTERMINATECAUSE = '%{h323-disconnect-cause}', \ DSPID = '%{dsp-id}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress = '%{NAS-IP-Address}' \ AND AcctStopTime IS NULL" Is there another place I need to enable the cisco hack? Thanks! Chuck

3 5

FreeRADIUS 2.X.X small functionality extensions
by Kostas Zorbadelos 06 Jun '14

06 Jun '14

Greetings to all, in our company (a big commercial telecom/ISP) we run a project to completely migrate our AAA infrastructure to FreeRADIUS (we use FreeRADIUS in parts of it for many years). One of our requirements in authentication/authorization is DSLAM port checking. The port info comes in NAS-Port-Id in our case and can be extracted in a normalized form with a regular expression. The problem was that FreeRADIUS provided in variables only the first 8 matching groups in %{0}..%{8}, whereas in our setup we needed up until %{12} to get the port information. So I developed a relevant patch which I communicated through GitHub as a pull request (following procedure described in http://wiki.freeradius.org/contributing/GitHub) The patch is against 2.X.X (tested with 2.2.5) and provides two functions: - make available %{0}..%{16} in regex matches - make available a new xlat function tonumber() to translate strings as numbers In our case the port info coming from the regular expression is a string of the form 15243:1/1/02/04 and we want to transform it to 15243:1/1/2/4. I would really like to see the functionality included upstream and hopefully it can benefit others as well. Let me know what you think (and bear with me since it's my first patch to FreeRADIUS). Regards, Kostas -- Kostas Zorbadelos twitter:@kzorbadelos http://gr.linkedin.com/in/kzorba ---------------------------------------------------------------------------- () www.asciiribbon.org - against HTML e-mail & proprietary attachments /\

4 12

freeradius+ chillispot + facebook login
by Osman Hirgiz 06 Jun '14

06 Jun '14

Hi Everyone, Has anyone implemented an oAuth authentication to chillispot using freeradius? I have been doing research over the internet and came across nothing. I would like the user to select the authentication method on the captive login page. The user would choose AD/LDAP, Facebook or normal user/password method. Is this possible? How can I achieve this? Thanks in advance.

2 1

tls tunnel stability fr 3.0.x git
by Polish 05 Jun '14

05 Jun '14

Hello, tls tunnel break after day of running FR. Wed Jun 4 13:58:15 2014 : Auth: (23774) Login OK: [pokuston(a)mendelu.cz] (from client ermon port 0 cli 70-6F-6C-69-73-68) Wed Jun 4 13:58:24 2014 : Info: ... shutting down socket auth from client (195.113.187.22, 40442) -> (*, 2083, virtual-server=default) Wed Jun 4 13:58:29 2014 : Info: ... adding new socket auth from client (195.113.187.22, 48832) -> (*, 2083, virtual-server=default) Wed Jun 4 13:58:33 2014 : Info: ... shutting down socket proxy (195.113.136.14, 56948) -> home_server (195.113.187.22, 2083) Wed Jun 4 13:58:33 2014 : Info: ... shutting down socket auth from client (195.113.187.22, 48832) -> (*, 2083, virtual-server=default) Wed Jun 4 13:58:35 2014 : Info: ... adding new socket auth from client (195.113.187.22, 57602) -> (*, 2083, virtual-server=default) Wed Jun 4 13:58:40 2014 : Info: ... shutting down socket auth from client (195.113.187.22, 57602) -> (*, 2083, virtual-server=default) Wed Jun 4 13:58:40 2014 : Info: ... adding new socket auth from client (195.113.187.22, 33406) -> (*, 2083, virtual-server=default) Wed Jun 4 13:59:03 2014 : Info: Home server tls has too many open connections (16) Wed Jun 4 13:59:03 2014 : Error: Failed to insert request into the proxy list Pavel Polacek

2 1

VMPS only
by Edik Mkoyan 04 Jun '14

04 Jun '14

Hi, I have multivlan wide l2 network and need to implement vmps. I made server work for single vlan, but I need to make it work with many vlans and mac2vlan file(I have about 300 hosts). Tell me how to enable mac2vlan module(if that is a module), when I remove the # sign from the mapping example line, server crashes with parse error, after the mac address. Here is the debug output that works for a single vlan Waking up in 4.9 seconds. Cleaning up request 19 ID 10529 with timestamp +1165 Ready to process requests. VMPS-Packet-Type = VMPS-Reconfirm-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 10545 VMPS-Client-IP-Address = 192.168.10.218 VMPS-Port-Name = "Fa0/16" VMPS-VLAN-Name = "default" VMPS-Domain-Name = "vivaro" VMPS-Unknown = 0x01 VMPS-Cookie = f4:6d:04:48:36:5f Doing VMPS +- entering group vmps {...} expand: %{VMPS-Mac} -> ++[reply] returns noop Done VMPS VMPS-VLAN-Name = "default" VMPS-Cookie = 00:00:00:00:00:00 Finished request 20. Going to the next request Waking up in 4.9 seconds. Cleaning up request 20 ID 10545 with timestamp +1225 Ready to process requests. and here is the configuration prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct log_file = /var/log/radius/vmpsd.log log_destination = files libdir = @libdir@ pidfile = ${localstatedir}/run/vmps.pid max_request_time = 30 cleanup_delay = 5 listen { ipaddr = * port = 1589 type = vmps interface = eth1 } hostname_lookups = no allow_core_dumps = no log { syslog_facility = daemon } thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } $INCLUDE clients.conf vmps { update reply { VMPS-Packet-Type = VMPS-Join-Response VMPS-VLAN-Name = "default" VMPS-Cookie = "%{VMPS-Mac}" } } Best, Edik.

2 1

FreeRADIUS v2.2.5 and v3.0.3 packages updated
by Nikolai Kondrashov 04 Jun '14

04 Jun '14

Hi everyone, I've updated Fedora 19 [1] and 20 [2] FreeRADIUS packages to explicitly require the OpenSSL version with fixed Heartbleed bug and to have OpenSSL vulnerabilities marked as fixed in radiusd.conf. So, the upgraded server will continue to start. Thanks to Fedora Updates user westford for the suggestion! The updated packages are now available via corresponding updates-testing repos. Please test and leave karma feedback [3]. Nick [1] https://admin.fedoraproject.org/updates/freeradius-2.2.5-2.fc19 [2] https://admin.fedoraproject.org/updates/FEDORA-2014-6698/freeradius-3.0.3-2… [3] http://fedoraproject.org/wiki/How_to_test_updates

1 1

OT, but relevant: Managing Certs
by Brendan Kearney 04 Jun '14

04 Jun '14

i am starting to read up on implementing .1x, and want some feedback on how others are managing certs. my questions are not specific to freeradius, but being that many of the .1x auth methods use certificates, i am hoping to find a pool of folks that manage certificates, pki and / or ca's, to enlighten me. i have an openvpn instance that leverages certs. i will adding certs to openldap for client connections over tls, and certs for replication between masters. then there is www and proxy. even dns can get in the certificate game. with all of these services leveraging certificates, how do folks avoid "cross pollination"? i dont want an openvpn client certificate used to authenticate a .1x session, for example. i dont want my ldap replication to be subject to interception by a client that has a cert signed by the same ca, thereby allowing unintended access or the ability to decrypt the traffic because the same trust structure is in place for all of the services. i am wondering if using a separate intermediate ca for each infrastructure service is worth the effort, and if it would provide the means to isolate the different technologies from each other so the encrypted communications are not trivially intercepted because the same ca signed all the certs. aside from the isolation of signing, what can be done to prevent unintended cross authentication when certs are leveraged? thanks in advance, brendan kearney

3 2

Re: Android 2.3.5 supplicants failing after upgrade to FreeRADIUS 2.2.5 from 2.2.0
by Rui Ribeiro 03 Jun '14

03 Jun '14

Hi, About this issue, I remember we having problems in the past with some Android and Linux devices where in the configuration you had to fill up the anonymous login field, or else it would not authenticate if that field was blank. At that time, I instructed our helpdesk to fill it up with the login of the user. I just mention this, because could be due to some configuration in the inner/outer tunnel, or a change of the default protocols. For instance, I already helped in a case where the FreeRadius admin was telling me he only used PEAP, but after an upgrade the Apple devices starting using the default TTLS configuration. Regards, Rui Ribeiro > Message: 7 > Date: Mon, 2 Jun 2014 10:47:48 +0100 > From: Robert Franklin <rcf34(a)cam.ac.uk> > To: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Android 2.3.5 supplicants failing after upgrade to > FreeRADIUS 2.2.5 from 2.2.0 > Message-ID: <25867EE6-3519-4698-97B7-7B174A8AB152(a)cam.ac.uk> > Content-Type: text/plain; charset=us-ascii > > On 31 May 2014, at 10:35, Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> wrote: > > > So not just FR update but also the OS updated too...so possible eg samba > upgrade too > > I don't think anything majorly -- nothing like OpenSSL changing beyond > some patches SuSE would have backported. Our password backend is a > PostgreSQL server with Cleartext-Password being store; there is no Samba > involved. > > > > If the RPM blatted your config like that then it may also have done > something to your EAP config too - eg certificates (especially if the debug > shows the clients failing at that point) . Did your windows client have > correct/secure EAP settings or was it just 'user/password don't care about > cert details' mode? > > I think the certs are all the same and being referenced the same -- we use > a signed cert from the Janet Certificate Service and the chain all looks to > be there (checking 'radiusd -X' output to see which files are read). > > My Windows 7 PC to test the same credentials is configured with the full > 802.1X security setup - it only has the 'AddTrust External CA root' ticked, > as well as the server name for the certificate as ' > network.tokens.csx.cam.ac.uk'. If I change these settings on the PC to > deliberately break them (such as ticket a different CA, or change the > server name to 'network2.tokens.csx.cam.ac.uk') then the authentication > fails (I do re-enter the credentials following this). So I think > everything is being checked correctly. > > > Also, that all the users of other platforms (>13,000 last week) are > getting on without issue makes me think there's something odd here, like a > chain certificate issue. > > I'm trying to lay my hands on a 2.3.5 device I can muck about with but > it's proving tricky. > > > Is there anything that can be determined from the raddebug output I sent > (in terms of which end is stopping the EAP dialogue) or do I need to get > more or a different type of output? > > - Bob > > > -- > Bob Franklin rcf34(a)cam.ac.uk / +44 1223 748479 > Networks, University Information Services, University of Cambridge >

7 12