August 2014 - Freeradius-Users - lists.freeradius.org

Not able to receive inner identity in Access-Accept in EAP-TTLS.
by Bhavesh Kamani 04 Sep '14

04 Sep '14

Hi Team, I am using freeradius version 2.1.12. I have configured following in the eap.conf file in the ttls section : copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" and in the inner-tunnel file i have configured following : post-auth { .... update outer.reply { User-Name := "%{Stripped-User-Name}" } I am able to get the inner identity in Access-Accept if I use PEAP with MS-CHAPv2, but I am not getting inner identity in Access-Accept if I use EAP-TTLS. Please find the eap.conf, inner-tunnel and free_radius.log files in the attachment. File free_radius.log has logs of EAP-TTLS method only. I am using 'testuser' as inner identity and 'anonymous' as outer identity(anonymous identity). Please provide your inputs on this. Thanks, Bhavesh.

4 33

Active Directory group check via winbind + rlm_unix, not LDAP
by Eloy Paris 01 Sep '14

01 Sep '14

Hello, I have a pretty common requirement: authenticate wireless users against Active Directory and prevent SSID cross-connections, i.e. users in group A can only connect to SSID A and users in group B can only connect to SSID B. I have seen plenty of messages in the archives about how to accomplish this. The authentication part is easy and has excellent documentation, e.g. http://deployingradius.com/documents/configuration/active_directory.html The group checking part is also well understood and documented (rlm_ldap), and whoever asks apparently gets told to use LDAP. At least I could not find anything on the alternate approach described here (apologies if this is old news). I decided to look into a different approach, which does not involve LDAP -- since the machine already has winbind running (for ntlm_auth), why not to use the Name Service Switch and rlm_unix to check for group membership and avoid usind LDAP altogether? Group membership information is already available if one has added "winbind" to "passwd" and "group" in /etc/nsswitch.conf. I apparently got this to work and wanted to share the solution in the hope that it will be helpful to someone, but also to ask if anyone sees any issues with the approach: First, I configured winbind for ntlm_auth use by FreeRADIUS, as explained elsewhere. Then, I verified that the system can see Active Directory users and groups as if they were Unix users and groups: shell$ id DOMAIN\\username uid=10017(DOMAIN\username) gid=10002(DOMAIN\domain users) groups=10002(DOMAIN\domain users),10024(DOMAIN\computer-lab-monitoring),10008(DOMAIN\domain admins),10034(DOMAIN\vdi teachers),10010(DOMAIN\teachers),10026(DOMAIN\vdi users),10011(DOMAIN\teacher assistants),10074(DOMAIN\schema admins) Then, I put this logic, which is similar to what one would normally use if LDAP and Ldap-Groups were in use, in the post-authentication section of my sites-enabled/default: if (NAS-Port-Type == Wireless-802.11) { if (Called-Station-Id =~ /.*:SSID-A/i) { # Can't do 'if (Group != "xxxxx")' because != # operator doesn't work for group checking. Careful # with the number of backslashes. if (!(Group == "DOMAIN\\\\group A") ) { update reply { Reply-Message = "User not allowed to join this wireless network" } reject } } elsif (Called-Station-Id =~ /.*:SSID-B/i) { if (!(Group == "DOMAIN\\\\group B") ) { update reply { Reply-Message = "User not allowed to join this wireless network" } reject } } } This works if the EAP identity is "DOMAIN\username". However, I don't want to make things unnecessarily complicated for my users so I want them to be able to enter just "username" when they configure their devices. The main issue to address, however, is that if the identity is entered as "username" (not "DOMAIN\username"), the group check will fail because the Unix user ID for users that are known to the system via winbind is "DOMAIN\username", not "username" (see output from the "id" command above). "Not a problem", I thought, "I'll just manipulate User-Name before anything happens and prefix it with "DOMAIN\". Turns out that was a bad idea because that made User-Name different than the EAP identity hidden in the EAP message, which caused the "rlm_eap: identity does not match User-Name, setting from EAP identity" message that has bitten so many people before. The solution I came up with was to still manipulate the User-Name but towards the end, in the post-auth section, instead of at the beginning. This way EAP uses the right identity, but the rlm_unix Group check uses the correct "DOMAIN\username" User-Name. The final configuration looks like this: if (NAS-Port-Type == Wireless-802.11) { # If User-Name doesn't contain our domain then add it. # It's needed for the Group check to use the correct # username. if (User-Name !~ /DOMAIN\\\\/i) { update request { User-Name := "DOMAIN\\\\%{User-Name}" } } if (Called-Station-Id =~ /.*:SSID-A/i) { # Can't do 'if (Group != "xxxxx")' because != # operator doesn't work for group checking. Careful # with the number of backslashes. if (!(Group == "DOMAIN\\\\group A") ) { update reply { Reply-Message = "User not allowed to join this wireless network" } reject } } elsif (Called-Station-Id =~ /.*:SSID-B/i) { if (!(Group == "DOMAIN\\\\group B") ) { update reply { Reply-Message = "User not allowed to join this wireless network" } reject } } } I do not know about the performance impact but this should not require additional network traffic to check for group membership because winbind caches this information. Another possible advantage is redundancy -- I understand the LDAP method does not allow for multiple LDAP servers. Using winbindd (I theorize, I am not sure about this) provides redundancy because the group membership comes from the domain controller, which is found using DNS lookups -- if a controller goes down then another (hopefully) takes its place and winbindd will be able to find it with no configuration changes. This approach seemed simple to me -- no additional configuration other than manipulating the User-Name in the post-authentication phase. Things can also be made to work if the user chooses to configure the supplicant with "DOMAIN\user" as the identity -- in this case one needs to configure "with_ntdomain_hack = yes" in modules/mschap, create an empty "DOMAIN" realm in proxy.conf, and enable the ntdomain realm in the authorize section of sites-enabled/inner-tunnel. Doing this will allow both "DOMAIN\user" and just "user" to work. Any thoughts, gotchas or hidden traps with this approach? I have tested this in pre-deployment and it works. I will start testing this in production to see if users have any issues. Cheers, Eloy Paris.-

5 5

There is no "Calling-Station-Id" attribute in access-requests sent in response to radius challenge from pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5)
by Dmitry Saratsky 01 Sep '14

01 Sep '14

Hi all, I'm using freeradius for custom 2-factor OTP authentication as below: RADIUS_CLIENT > Access-Request(User/Pass) > FreeRADIUS(check user pass and if ok -> generates state) > Access-Challenge > RADIUS_CLIENT> Access-Request(User/OTP/state) > FreeRADIUS In first Access-Request (before Access-Challenge) RADIUS_CLIENT is sending all required attributes well My problem is on the second Access-Request (after Access-Challenge). There is no "Calling-Station-Id" attribute on this state for some reason... I have checked this on the following radius client: pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5) Anyone can suggest some work around for above? Maybe it is configuration issue I'm missing? Thanks a lot, Dmitry!

4 9

Oddity in regex
by Stefan Paetow 01 Sep '14

01 Sep '14

Hi, I have two servers, one here (in my office, with CentOS 6.5) and one at another facility (with RHEL 6.5). Both are running FreeRADIUS 3.0.4 rc 1 from what I can establish. I have these attributes in my reply: MS-MPPE-Encryption-Policy = Encryption-Required MS-MPPE-Encryption-Types = 4 MS-MPPE-Send-Key = 0xf1ad6cfa6e603b2bdb8480bd7ac84239 MS-MPPE-Recv-Key = 0x6cfc74047d13c6efa111a66fd9e360f4 EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 SAML-AAA-Assertion = '<saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" IssueInstant=\"2014-08-22T13:48:00\" ID=\"e9e79e59-9fb5-4b4e-b8c6-a4ef77559516\" Version=\"2.0\">' SAML-AAA-Assertion = '<saml:Issuer>urn:mace:ac.uk:diamond.ac.uk</saml:Issuer>' SAML-AAA-Assertion = '<saml:AttributeStatement><saml:Attribute NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" Name=\"urn:oid:1.3.6.1.4.1.5923.1.1.1.7\">' SAML-AAA-Assertion = '<saml:AttributeValue>sysdev</saml:AttributeValue>' SAML-AAA-Assertion = '</saml:Attribute></saml:AttributeStatement></saml:Assertion>' In the server config in my office, I can use the below expression: if ("%{reply:SAML-AAA-Assertion[*]}" =~ /("urn:oid:1\.3\.6\.1\.4\.1\.5923\.1\.1\.1\.7")((\n|.)*?)(<saml:AttributeValue>)(\n*)(.*?)(\n*)(<\/saml:AttributeValue>)/) { : } This happily resolves to TRUE on the local server. However, on the second server, it resolves to FALSE, and I have to use the below there: if ("%{reply:SAML-AAA-Assertion[*]}" =~ /(urn\:oid\:1\.3\.6\.1\.4\.1\.5923\.1\.1\.1\.7)((\n|.)*?)(\<saml\:AttributeValue>)(\n*)(.*?)(\n*)(\<\/saml\:AttributeValue>)/) { : } The two regular expressions are the same with the following exceptions: All colons are escaped, all greater-as and smaller-as signs are escaped, and apparently the other server does not like having the quotes in the first regex group, even when escaped, or when using the \Q and \E modifiers before and after. According to several regex tests, the above should be ok, so... question to you regular expression whizzes and to Arran and Alan is: Why does the former not work on the second server? It seems the un-escaped colons and the quotes trip the regex up even though it should be ok? Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

5 6

Some new dictionaries for FR users
by Fred 01 Sep '14

01 Sep '14

Hi all, Here is some dictionaries currently not fount in freeradius 2.2.5 for following vendors : * Bluecoat (tested OK) * Citrix (tested OK) * Riverbed (not yet) Please note : I don't know if those vendors agree to publish their dictionary with freeradius, but I made this only by googleing, with no particular login. Hope this will be usefull to freeradius users ! # -oat-Group # dictionary.bluecoat # # Blue Coat Vendor Specific Attribute dictionary file for freeradius # # VENDOR BlueCoat 14501 BEGIN-VENDOR BlueCoat ATTRIBUTE Blue-Coat-Group 1 string ATTRIBUTE Blue-Coat-Authorization 2 integer VALUE Blue-Coat-Authorization No-Access 0 VALUE Blue-Coat-Authorization Read-Only-Access 1 VALUE Blue-Coat-Authorization Read-Write-Access 2 END-VENDOR BlueCoat # dictionary.citrix # Created for Citrix Use # # currently only using attribute 14 in this setup. VENDOR Citrix 66 BEGIN-VENDOR Citrix ATTRIBUTE UID 10 integer ATTRIBUTE GID 11 integer ATTRIBUTE Home 12 string ATTRIBUTE Shell 13 string ATTRIBUTE Group-Names 14 string ATTRIBUTE Group-Ids 15 string ATTRIBUTE CTXSUserGroups 16 string END-VENDOR Citrix # dictionary.riverbed # from https://support.riverbed.com/bin/support/static/doc/steelhead/8.5.2/html/sh… VENDOR Riverbed 17163 BEGIN-VENDOR Riverbed ATTRIBUTE Local-User 1 string END-VENDOR Riverbed

4 5

3.x behaviour w.r.t. unused modules
by Phil Mayers 01 Sep '14

01 Sep '14

I've just noticed something odd. If I have a module in mods-enabled but it's not referenced anywhere, FreeRADIUS still seems to load it and perform module instantiation including e.g. setting up connection pools. I don't think 2.x used to do that, or am I imagining it? For us that's undesirable as we use "radiusd -n" and start several processes up, and I don't really want to have multiple mods-enabled just to avoid instantiating e.g. SQL/redis/LDAP connections in server processes that don't reference the module. I can work around it, but am wondering if this is expected?

2 2

Unsubscribe
by Ciprian ARSENIE 31 Aug '14

31 Aug '14

Uns Sent from my iPhone > On 31 Aug 2014, at 13:00, freeradius-users-request(a)lists.freeradius.org wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Not able to receive inner identity in Access-Accept in > EAP-TTLS. (Axel Luttgens) > 2. EAP-MD5: Access-Accept packet in debug log messages > (Axel Luttgens) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 31 Aug 2014 11:23:03 +0200 > From: Axel Luttgens <axel.luttgens(a)skynet.be> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Not able to receive inner identity in Access-Accept in > EAP-TTLS. > Message-ID: <049C2F78-6B5A-46FC-BFC5-8C1E8295B251(a)skynet.be> > Content-Type: text/plain; charset=iso-8859-1 > > Le 30 ao?t 2014 ? 18:28, Axel Luttgens a ?crit : > >> Le 30 ao?t 2014 ? 16:38, Alan DeKok a ?crit : >> >>> Alan DeKok wrote: >>>> Unfortunately, that is how it works. If you read the debug output, >>> >>> I've updated the example inner-tunnel example, >> >> Yes, I noticed that this morning. :-) > > More exactly, I only had seen the next to last change while writing the above. > But the current comment appears to be exactly the one I would have dreamed to write myself. ;-) > > Perhaps could it be worth to enhance the description of use_tunneled_reply as well? > With the current comment, use_tunneled_reply could be understood as a way to convey the inner User-Name only; but, unless I'm wrong, any attribute, even a private one, is liable to be brought to the outer session. > Moreover, the mechanism activated by that setting probably deserves a better emphasis; in particular, I'm thinking at its protocol-awareness you have described in a previous message. > > Regards, > Axel > > > > ------------------------------ > > Message: 2 > Date: Sun, 31 Aug 2014 11:56:28 +0200 > From: Axel Luttgens <axel.luttgens(a)skynet.be> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: EAP-MD5: Access-Accept packet in debug log messages > Message-ID: <97A82F0C-B772-4AD0-AF0C-286603F962D2(a)skynet.be> > Content-Type: text/plain; charset=us-ascii > > Hello, > > While confronting my config attempts with various scenarios, I noticed that the Message-Authenticator seems to always be displayed as a sequence of null bytes: > > (1) Sending Access-Accept packet to host 127.0.0.1 port 60546, id=174, length=0 > (1) EAP-Message = 0x03ad0004 > (1) Message-Authenticator = 0x00000000000000000000000000000000 > (1) User-Name = 'bob' > Sending Access-Accept Id 174 from 127.0.0.1:1812 to 127.0.0.1:60546 > EAP-Message = 0x03ad0004 > Message-Authenticator = 0x00000000000000000000000000000000 > User-Name = 'bob' > > BTW, out of curiosity, attribute User-Name appears to be unconditionally added to the Acces-Accept packet; is this common practice? > > Axel > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 112, Issue 84 > *************************************************

1 0

EAP-MD5: Access-Accept packet in debug log messages
by Axel Luttgens 31 Aug '14

31 Aug '14

Hello, While confronting my config attempts with various scenarios, I noticed that the Message-Authenticator seems to always be displayed as a sequence of null bytes: (1) Sending Access-Accept packet to host 127.0.0.1 port 60546, id=174, length=0 (1) EAP-Message = 0x03ad0004 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) User-Name = 'bob' Sending Access-Accept Id 174 from 127.0.0.1:1812 to 127.0.0.1:60546 EAP-Message = 0x03ad0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'bob' BTW, out of curiosity, attribute User-Name appears to be unconditionally added to the Acces-Accept packet; is this common practice? Axel

2 1

EAP-MD5: Access-Accept packet in debug log message
by Axel Luttgens 31 Aug '14

31 Aug '14

Hello, While confronting my config attempts with various scenarios, I noticed that the Message-Authenticator seems to always be displayed as a sequence of null bytes: (1) Sending Access-Accept packet to host 127.0.0.1 port 60546, id=174, length=0 (1) EAP-Message = 0x03ad0004 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) User-Name = 'bob' Sending Access-Accept Id 174 from 127.0.0.1:1812 to 127.0.0.1:60546 EAP-Message = 0x03ad0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'bob' BTW, out of curiosity, attribute User-Name appears to be unconditionally added to the Acces-Accept packet; is this common practice? Axel

1 0

daloradius issue
by Bassem Sossan 30 Aug '14

30 Aug '14

Hi guys, *online users* shows blank green page, it was working smoothly, no changes on configurations, what is the matter?? is there any troubleshoot?? thanks in advanced

1 0