January 2017 - Freeradius-Users - lists.freeradius.org

v3.0.12 SSL session resumption
by Chris Howley 31 Jan '17

31 Jan '17

Hi, Configuring the internal "name" of the session cache and persist_dir doesn't appear to have fixed the problem. The second and third auths continued to the second stage of authentication (mschapv2). Should the session id be the same for all three authentication? Thanks, Chris Howley (9) eap_peap: caching Stripped-User-Name = "XXXXXX" (9) eap_peap: Saving session d5ba8c1a8e0357803e77dfd11a8a2d91f128b6fb06863ac6350e718044bc0146 in the disk cache (19) eap_peap: caching Stripped-User-Name = "XXXXXX" (19) eap_peap: Saving session 62328b2e7d89b02745f1df1fb176ec2c77194f0a0621c0179e9d68ac6d203ae3 in the disk cache (29) eap_peap: caching Stripped-User-Name = "XXXXXX" (29) eap_peap: Saving session 14c5d93b36da008e5ad05edaf082cf2a86aeac255bee040345b397dc7d598777 in the disk cache

2 1

Header files goes missing after installation
by Anjali Gupta 31 Jan '17

31 Jan '17

Hi team, I downloaded freeradius-server-3.0.12.tar.gz from the given link http://freeradius.org/download.html <ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.12.tar.gz> When I untar this package, I could see various header files under /src/include. But when I try to install the given package, I could not figure out some of the header files that were originally there in the package. I followed below steps for installation: tar -zxvf freeradius-server-3.0.12.tar.gz cd freeradius-server-3.0.12 ./configure --prefix=/etc/freeradius make make install Once it is complete, some of the header files are missing from the include path /etc/freeradius/include/freeradius: viz. freeradius/autoconf.h freeradius/regex.h freeradius/process.h freeradius/xlat.h etc.. I am working on "openSUSE Leap 42.2". Any help is greatly appreciated. Thanks Anjali Gupta

2 3

v3.0.12 build error on RHEL6
by Chris Taylor (chtaylo2) 31 Jan '17

31 Jan '17

Hi, I’m trying to build FreeRadius v.3.0.12 on a RHEL6.4 patched to a 6.8 kernel. make has been erroring at: CC src/modules/rlm_eap/radeapclient.c gcc.orig: ": No such file or directory gcc.orig: ": No such file or directory <command-line>: warning: missing terminating " character <command-line>: warning: missing terminating " character <command-line>: warning: "IS_MODULE" redefined <command-line>: warning: this is the location of the previous definition <command-line>: warning: missing terminating " character <command-line>: warning: missing terminating " character make: *** [build/objs/src/modules/rlm_eap/radeapclient.lo] Error 1 GCC Builds: [tmp]# gcc -v gcc version 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC) [tmp]# ls -al /usr/bin/gcc -rwxr-xr-x 1 root root 535 Jun 27 2013 /usr/bin/gcc [tmp]# cc -v gcc version 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC) [tmp]# ls -al /usr/bin/cc lrwxrwxrwx 1 root root 3 Nov 7 09:01 /usr/bin/cc -> gcc Attached is my configure output and make output. Any ideas on what might be the issue?

4 4

v3.0.12 SSL session resumption
by Chris Howley 31 Jan '17

31 Jan '17

Hi, I'm configuring FR 3.0.12 and I'm unable to get SSL session resumption / fast reauthentication to work. The first authentication caches the Stripped-User-Name. (9) eap_peap: Received EAP-TLV response (9) eap_peap: Success (9) eap_peap: caching Stripped-User-Name = "XXXXXX" (9) eap_peap: Failed to find 'persist_dir' in TLS configuration. Session will not be cached on disk. (9) eap: Sending EAP Success (code 3) ID 9 length 4 (9) eap: Freeing handler (9) [eap] = ok (9) } # authenticate = ok (9) # Executing section post-auth from file /etc/raddb/sites-enabled/default The second auth doesn't appear to use the cache but continues to phase 2 auth protocol. I'm I failing to return the relevant attributes required for session resumption / fast reauthentication to work? Thanks, Chris Howley In the post-auth section of site-enabled/inner-tunnel # # Instead of "use_tunneled_reply", uncomment the # next two "update" blocks. # update { &outer.session-state: += &reply: } # # These attributes are for the inner session only. # They MUST NOT be sent in the outer reply. # # If you uncomment the previous block and leave # this one commented out, WiFi WILL NOT WORK, # because the client will get two MS-MPPE-keys # update outer.session-state { MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY } In eap.conf cache { enable = yes lifetime = 24 # hours max_entries = 255 #name = "EAP module" #persist_dir = "${logdir}/tlscache" }

2 1

wifi users + NAS users auth against AD
by 3＠D4rkn3ss DuMb 31 Jan '17

31 Jan '17

Dear List, I have a working setup of 5 FreeRadius servers for my WIFI users. Since the NAS number is increasing in monthly basis, I am wondering what is the best practice (security) when it comes NAS user authentication: - would it be better to have a separate server for the NAS user (cisco users) authentication ? or could I have both the WiFi user auth and NAS user auth on the same server? - The WiFi auth is based on MSCHAP module (against the AD), and since MSCHAP is not possible with the NAS user authentication, I assume that I have to use NTLM with PAP to authenticate the NAS user to the AD; These setup can't be on the same server (at least binding on same ports). Am I correct? or do I have it wrong? Thank you, Regards

3 2

NAS administration
by 3＠D4rkn3ss DuMb 30 Jan '17

30 Jan '17

Dear List, I have a working setup of 5 FreeRadius servers for my WIFI users. Since the NAS number is increasing in monthly basis, I am wondering what is the best practice (security) when it comes NAS user authentication: - would it be better to have a separate server for the NAS user (cisco users) authentication ? or could I have both the WiFi user auth and NAS user auth on the same server? - The WiFi auth is based on MSCHAP module (against the AD), and since MSCHAP is not possible with the NAS user authentication, I assume that I have to use NTLM with PAP to authenticate the NAS user to the AD; These setup can't be on the same server (at least binding on same ports). Am I correct? or do I have it wrong? Thank you, Regards

1 0

MS-CHAP modules
by Chris Howley 30 Jan '17

30 Jan '17

Hi, Thank you for your advice on the use of multiple MSCHAP modules. I made the changes that were suggested but I'm still unable to authenticate users in different realms. Thanks Chris In the authorize section of inner-tunnel server. # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. mschap I have defined two mschap modules (mschap_ds and mschap_admin) and made the following changes in the inner-tunnel authenticate section. # # MSCHAP authentication. Auth-Type MS-CHAP { if ("%{outer.request:User-Name}" =~ /@realm$/i){ mschap-ds { ok = return } } else { mschap-admin { ok = return } } } # # For old names, too. #mschap < -- I commented out this entry The authentication of a user in either realm failed with the following error message. (9) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (9) authenticate { (9) eap: Expiring EAP session with state 0x93ae5ad093a740b0 (9) eap: Finished EAP session with state 0x93ae5ad093a740b0 (9) eap: Previous EAP request found for state 0x93ae5ad093a740b0, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap_mschapv2: Auth-Type sub-section not found. Ignoring. (9) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (9) eap: Sending EAP Failure (code 4) ID 9 length 4 (9) eap: Freeing handler (9) [eap] = reject (9) } # authenticate = reject (9) Failed to authenticate the user (9) Login incorrect: [user_a] (from client localhost port 0 via TLS tunnel) (9) Using Post-Auth-Type Reject If I uncomment the following # For old names, too. mschap I'm able to authenticate a user in one realm but not the other. 21) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (21) authenticate { (21) eap: Expiring EAP session with state 0xf0a763cef0ae799b (21) eap: Finished EAP session with state 0xf0a763cef0ae799b (21) eap: Previous EAP request found for state 0xf0a763cef0ae799b, released from the list (21) eap: Peer sent packet with method EAP MSCHAPv2 (26) (21) eap: Calling submodule eap_mschapv2 to process data (21) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (21) eap_mschapv2: authenticate { (21) mschap: Creating challenge hash with username: XXXXXX (21) mschap: Client is using MS-CHAPv2 (21) mschap: EXPAND %{Stripped-User-Name} (21) mschap: --> XXXXXX rlm_mschap (mschap): Reserved connection (1) (21) mschap: sending authentication request user='XXXXXX' domain='ADMIN' rlm_mschap (mschap): Released connection (1) rlm_mschap (mschap): Need 9 more connections to reach 20 spares rlm_mschap (mschap): Opening additional connection (11), 1 of 53 pending slots used (21) mschap: ERROR: No such user [0xC0000064] (21) mschap: ERROR: Password has expired. User should retry authentication (21) [mschap] = reject (21) } # authenticate = reject (21) eap: Sending EAP Failure (code 4) ID 9 length 4 (21) eap: Freeing handler (21) [eap] = reject (21) } # authenticate = reject (21) Failed to authenticate the user I

2 1

Fwd: Request-Authenticator attribute removed from accounting log
by Tom Carly 30 Jan '17

30 Jan '17

Hi, I'm using a 3.1.x build of a few days ago. In previous versions (don't know exactly when it changed), the accounting log contained "Request-Authenticator = verified" for each received message. It seems that this was removed recently. When parsing the log, I check whether this field is present. My questions: * Is there still a way to include this in the log? * if not, why was it removed? thanks in advance! Best regards, Tom Carly

2 1

Max length for User-Name
by Joe Friedeggs 30 Jan '17

30 Jan '17

Pertaining to User-Name, RFC2865 states in section 5.1: 0 1 2 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- | Type | Length | String ... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Type 1 for User-Name. Length >= 3 String The String field is one or more octets. The NAS may limit the maximum length of the User-Name but the ability to handle at least 63 octets is recommended. which recommends 'at least' 63 octets, but I see the sql (ver 2.2.6 with postgresql) set the limits the UserName to 'at most' 64 characters: CREATE TABLE radcheck ( id SERIAL PRIMARY KEY, UserName VARCHAR(64) NOT NULL DEFAULT '', ... It seems to me the limiting factor of the User-Name here should only the 'length' field, which is one octet, therefore limiting the User-Name string to 255 charaters (minus overhead?). Why is the UserName in the table limited to 64 characters? What is the reasoning behind this? Is there some other limiting factor? I have a case where we need to use longer user names. Thanks, Joe

6 6

AD Group Check - multi SSID - Pass "Require-membership-of" to NTLM_AUTH as variable.
by Pierre de Jong 30 Jan '17

30 Jan '17

Hi all, I am trying to set up a FreeRadius (v3.12 on debian8) to authenticate against MS Active Directory, with AD group membership requierement for "multiple SSID". So, for exemple, SSID-Corp-Employee is only accessible to a certain users, member of ADgroupA , and SSID-Corp-Direction, only accessible to users, member of ADgroupB When only authenticating with 1 single AD group, there is no problem, the : > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --require-membership-of=GALAXY\rad01 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} > --domain=%{%{mschap:NT-Domain}:-GALAXY.PRIV} > --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Re > sponse}:-00}" does the trick... So, what I thaught could be the easiest way, is to pass the "--require-membership-of=" as parameter... and even more, that AD group would be the same as the SSID ... So, when a new SSID is created, no need to change any in the freeradius, just create the AD group according to the SSID, and ... that's it. i put this in the Authorize section of "DEFAULT" and "inner-tunnel", just after the "filter_username" ############################################################ ############################# rewrite_called_station_id if (&Called-Station-SSID == "rad01") { update request { NTLM-Group-Required := "GALAXY\rad01" User-Name := "pierre" } } elsif (%Called-Station-SSID == "RAD02") { update request { NTLM-Group-Required := "GALAXY\RAD02" } } ############################################################ ############################# It seems that it's parsed correct: # policy rewrite_called_station_id = updated (76) if (&Called-Station-SSID == "rad01") { (76) if (&Called-Station-SSID == "rad01") -> TRUE (76) if (&Called-Station-SSID == "rad01") { (76) update request { (76) NTLM-Group-Required := "GALAXY\rad01" and my "NTLM_Auth" is the: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --require-membership-of=%NTLM-Group-Required > --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} > --domain=%{%{mschap:NT-Domain}:-GALAXY.PRIV} > --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Re > sponse}:-00}" but it does not work... for information, if I replace %NTLM-Group-Required by GALAXY\rad01 it does work correct. Is there any way someone could give me advice on how to achieve this... or any other way to achieve this ? Of course, needless to say, I am no expert in "FreeRadius", so, please, excuses me if it's not the way to go, or if my assomption are wrond Thanks in advance for your reading and your time. I have join to the mail a attached file with "a radiusd -X" session.... (No idea if "attached files pass... sorry, not used the mailling list much so fare :-D ) Pierre de Jong

3 2