November 2018 - Freeradius-Users - lists.freeradius.org

Migration -> FR3 + CiscoAPs + Multiple SSID+ EAP-TLS + Multiple Certs
by Ted Hyde (RSI) 29 Nov '18

29 Nov '18

Greetings all! I am migrating from older FR2 instances up to FR3 (finally, yes, I know) and am hoping that some could assist with some details on multiple EAP instances (base system is Debian with multiple revs of FR2, migrating to FR3 current). Currently I have a number of Cisco AP's in autonomous mode with mixed authentication - some local to the AP, but one SSID that is EAP-TLS. Other SSIDs are on other VLANs, but only the one VLAN/SSID has .1X involved. The clients have the certificate installed, and the system works. Of course that cert is not unique to any device, thus any device that has that cert can authenticate against that SSID. That is by design for this SSID and is intended to remain as such. I want to turn a separate "House" SSID that *was* strictly WPA2-PSK into one that is MAC auth based, so I don't have to worry about changing and re-issuing WPA passwords when one user has to be de-auth'd. However there are limitations on mixed config on the Cisco APs where PSK + MAC just doesn't work. (It makes sense that encryption + no encryption isn't a viable transaction concept, so I'm not too sad about it.) I have been able to get MAC + EAP-TLS to work really well, so my concession is to use a cert in EAP-TLS along with the MAC restriction. I am fine with distributing a cert to the "house" users; in this instance, the cert provides the framework for encryption, the MAC list provides the authorization. This whole exercise isn't about making it easier to turn a specific user on or off, it's about how the other users are handled when that event occurs. In test right now, I can distribute the same certificate to any client, and tell them to associate against the house ssid (the non-restricted SSID is for a special purpose, not roaming users) and it works, because eap just runs regardless. This sounds amazing at first go, however I need to retain that one SSID that has NO MAC restrictions alongside an SSID (same AP group of course) that DOES have MAC restrictions. With the ordering of auth's, if a client had the one certificate, but was de-auth'd from the house SSID, all they would have to figure out is to try and associate with the non-restricted SSID and they're back in (albeit on a different VLAN). This I know from testing. It is not the situation I am looking for. So my next trick would be to try and set up multiple EAP instances, with separate certificates and FR listening for some discerning data during the EAP request packet to limit which SSID can authenticate with which certificate. Then it wouldn't matter if a deauth'd house client had the house-only certificate; it would/must fail if they try to associate with the non-restricted SSID. This is where I am lost. I followed a couple google'd options, and they all came down to the CSID containing the SSID or Vlan tag; that only happens if you are using a WLC apparently, where I am using autonomous APs. However, with an extra vsa option in my Cisco configs, I can get an AV-pair in the request such as from a "freeradius -X" debug output: Called-Station-Id = "0021.d849.a671" Calling-Station-Id = "e458.b8d0.6455" <----- note there is no suffixed SSID here (sad) Cisco-AVPair = "ssid=MIWIFI-HSE" <----- a source of potential magic! Service-Type = Login-User Cisco-AVPair = "service-type=Login" <----- but caution, an additional AV-pair tag here, so how to handle? I have [hackingly] messed around with replicating eap instances inside mods-enabled/eap, as well as including the statements for Auth-Types in the default virtual server, but I then get lost on how to use the ssid=xxxx to make decisions for which module to use. I am testing on baseline debian stretch with FR3 (3.0.12+dfsg-5+deb9u1) and text files (clients.conf and users) as data sources. Aside from mods-enabled/eap being modified to have multiple instances and sites-enabled/default to include multiple Auth-Types, all files are default. Any thoughts? Kindest regards, Ted.

2 1

get name of authentication realm
by Zdeněk Sobotka 29 Nov '18

29 Nov '18

Hello, I'm trying to retreive name of "authentication realm" like a variable in the Freeradius v3 ("LOCAL" in variable in my case). In debug log, near suffix module i see: (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "yyyy.cz" for User-Name = "name(a)yyyy.cc" (1) suffix: Found realm "yyyy.cc" (1) suffix: Adding Stripped-User-Name = "name" (1) suffix: Adding Realm = "yyyy.cc" (1) suffix: Authentication realm is LOCAL I'm found in documentation, that the "Authentication realm" can be found in "control:Proxy-To-Realm" (https://networkradius.com/doc/3.0.10/raddb/mods-available/realm.html) At logs i have, but that variable is empty: (2) if ("%{control:Proxy-To-Realm}" != "LOCAL") { (2) ERROR: Failed retrieving values required to evaluate condition Thank you for the advice.

2 1

Migration -> FR3 + CiscoAPs + Multiple SSID+ EAP-TLS +, Multiple Certs
by Ted Hyde (RSI) 28 Nov '18

28 Nov '18

Bump; I believe my request may have been skipped over due to the holidays. Interestingly, there have been a lot of different requests on EAP, so it's great that it's a popular topic. I'm hoping the list is the right place to get some useful response. The shorter request based upon the below details will be how to choose which eap module to use (given 2 or 3 slightly different eap modules) based upon a packet entry of: << Cisco-AVPair = "ssid=MIWIFI-HSE" >>. Thanks, Ted. > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 24 Nov 2018 09:59:46 -0500 > <snip> > Greetings all! > > I am migrating from older FR2 instances up to FR3 (finally, yes, I know) and am hoping that some could assist with some details on multiple EAP instances (base system is Debian with multiple revs of FR2, migrating to FR3 current). > > Currently I have a number of Cisco AP's in autonomous mode with mixed authentication - some local to the AP, but one SSID that is EAP-TLS. Other SSIDs are on other VLANs, but only the one VLAN/SSID has .1X involved. The clients have the certificate installed, and the system works. Of course that cert is not unique to any device, thus any device that has that cert can authenticate against that SSID. That is by design for this SSID and is intended to remain as such. > > I want to turn a separate "House" SSID that *was* strictly WPA2-PSK into one that is MAC auth based, so I don't have to worry about changing and re-issuing WPA passwords when one user has to be de-auth'd. However there are limitations on mixed config on the Cisco APs where PSK + MAC just doesn't work. (It makes sense that encryption + no encryption isn't a viable transaction concept, so I'm not too sad about it.) I have been able to get MAC + EAP-TLS to work really well, so my concession is to use a cert in EAP-TLS along with the MAC restriction. I am fine with distributing a cert to the "house" users; in this instance, the cert provides the framework for encryption, the MAC list provides the authorization. This whole exercise isn't about making it easier to turn a specific user on or off, it's about how the other users are handled when that event occurs. In test right now, I can distribute the same certificate to any client, and tell them to associate against the house ssid (the non-restricted SSID is for a special purpose, not roaming users) and it works, because eap just runs regardless. > > This sounds amazing at first go, however I need to retain that one SSID that has NO MAC restrictions alongside an SSID (same AP group of course) that DOES have MAC restrictions. With the ordering of auth's, if a client had the one certificate, but was de-auth'd from the house SSID, all they would have to figure out is to try and associate with the non-restricted SSID and they're back in (albeit on a different VLAN). This I know from testing. It is not the situation I am looking for. > > So my next trick would be to try and set up multiple EAP instances, with separate certificates and FR listening for some discerning data during the EAP request packet to limit which SSID can authenticate with which certificate. Then it wouldn't matter if a deauth'd house client had the house-only certificate; it would/must fail if they try to associate with the non-restricted SSID. This is where I am lost. I followed a couple google'd options, and they all came down to the CSID containing the SSID or Vlan tag; that only happens if you are using a WLC apparently, where I am using autonomous APs. However, with an extra vsa option in my Cisco configs, I can get an AV-pair in the request such as from a "freeradius -X" debug output: > > Called-Station-Id = "0021.d849.a671" > Calling-Station-Id = "e458.b8d0.6455" <----- note there is no suffixed SSID here (sad) > Cisco-AVPair = "ssid=MIWIFI-HSE" <----- a source of potential magic! > Service-Type = Login-User > Cisco-AVPair = "service-type=Login" <----- but caution, an additional AV-pair tag here, so how to handle? > > I have [hackingly] messed around with replicating eap instances inside mods-enabled/eap, as well as including the statements for Auth-Types in the default virtual server, but I then get lost on how to use the ssid=xxxx to make decisions for which module to use. > > I am testing on baseline debian stretch with FR3 (3.0.12+dfsg-5+deb9u1) and text files (clients.conf and users) as data sources. Aside from mods-enabled/eap being modified to have multiple instances and sites-enabled/default to include multiple Auth-Types, all files are default. > > Any thoughts? > > Kindest regards, > Ted.

1 0

Re: Re: LDAP Post-Auth with computer names using eap-tls certs
by Kevin Virk 28 Nov '18

28 Nov '18

> So ill give a brief summary of everything I have done so far. I have set a freeradius server to work with certs. I orignally had the certs named by user name but my company had decided that computer names was the way the wanted to go. So i changed the certs to hand out the sam account name of the computer. Previously the LDAP I had set up in post-auth was working with the username and works with the computer name as well however my company has decided that the ldap queries are to plentiful and would like to narrow them down. Let me backtrack for a second as this is important to the problem. LDAP is to be used to identify a user in a specific group and then authorize and put them into a vlan. Like I said this was all working with usernames and computer names. However because the AD is setup in a way that certain computer groups are nested in larger vlan groups I had to manually query for the lower level groups instead of the overarching vlan group because i needed the query to return computer names not more workstation groups. So here I am I have this query that works in ldp.exe Ok... > This query returns computer names and works in ldp. Below are snippets from my conf files > ldap module conf Please don't post the config. All of the documentation say to *not* do that. Especially this: http://wiki.freeradius.org/list-help > if(LDAP-Group == "CN=vlan,OU=generalgroups,OU=Departments,DC=testDomain,DC=local"){ That's not really how the LDAP-Group check operates. See the Wiki, there's documentation on this. It's meant to check just the group name: if (LDAP-Group == "vlan") { ... > Here is a snippet from the error in the debug output. > Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): Rebinding to URL ldap://Server PLEASE follow the instructions for debug output. It really is documented *everywhere*. Use "radiusd -X", and not anything else. > Mon Nov 26 23:53:09 2018 : Debug: (5) EXPAND (|(&(objectClass=computer)(member=%{control:Ldap-UserDn}))) > Mon Nov 26 23:53:09 2018 : Debug: (5) --> (|(&(objectClass=computer)(member=CN\3dComputerNAme\2cOU\3dComputers\\3dDepartments\2cDC\3dtestDomain\2cDC\3dlocal))) Note that the "=" is escaped to "\2c". Which should be a hint that you should be using just the group name. > I am sure that my syntax is wrong somewhere, maybe the ldap-group part in the ldap query? I would like to point out that it does find the group when switch the object class to group from computer but only in the sub groups and not the larger group. Any help would be greatly appreciated LDAP group checking doesn't not search subgroups. It only checks the main groups that a user is a member of. Alan DeKok. Thank you for the help Alan and I apologize for the mistakes in posting. > Mon Nov 26 23:53:09 2018 : Debug: (5) EXPAND (|(&(objectClass=computer)(member=%{control:Ldap-UserDn}))) > Mon Nov 26 23:53:09 2018 : Debug: (5) --> (|(&(objectClass=computer)(member=CN\3dComputerNAme\2cOU\3dComputers\\3dDepartments\2cDC\3dtestDomain\2cDC\3dlocal))) >Note that the "=" is escaped to "\2c". Which should be a hint that you should be using just the group name. hmm it has been working that way with the queries but I will change that thank you. >LDAP group checking doesn't not search subgroups. It only checks the main groups that a user is a member of. So im understanding correctly if a computer is set up as so Computername-> Group membership-> computer security group and if that computer security group is part of vlan group quering that vlan group wont work because it will only return the security groups not the workstations that are part of the security groups? Is there no way then to query for the computers that belong in a group because like I said atop this query does work and does give me back all computers in the top level group (&(objectClass=computer)(memberOf:1.2.840.113556.1.4.1941:=CN=vlan,OU=generalgroups,OU=Departments,DC=testdomain,DC=local)) Is there no way for that query above to work in freeradius? ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 163, Issue 145 **************************************************

2 1

LDAP Post-Auth with computer names using eap-tls certs
by Kevin Virk 28 Nov '18

28 Nov '18

So ill give a brief summary of everything I have done so far. I have set a freeradius server to work with certs. I orignally had the certs named by user name but my company had decided that computer names was the way the wanted to go. So i changed the certs to hand out the sam account name of the computer. Previously the LDAP I had set up in post-auth was working with the username and works with the computer name as well however my company has decided that the ldap queries are to plentiful and would like to narrow them down. Let me backtrack for a second as this is important to the problem. LDAP is to be used to identify a user in a specific group and then authorize and put them into a vlan. Like I said this was all working with usernames and computer names. However because the AD is setup in a way that certain computer groups are nested in larger vlan groups I had to manually query for the lower level groups instead of the overarching vlan group because i needed the query to return computer names not more workstation groups. So here I am I have this query that works in ldp.exe (&(objectClass=computer)(memberOf:1.2.840.113556.1.4.1941:=CN=vlan,OU=generalgroups,OU=Departments,DC=testDomain,DC=local)) This query returns computer names and works in ldp. Below are snippets from my conf files ldap module conf user { # Where to start searching in the tree for users base_dn = "${..base_dn}" # Filter for user objects, should be specific enough # to identify a single user object. # # For Active Directory, you should use # "samaccountname=" instead of "uid=" # filter = "(sAMAccountname=%{%{Stripped-User-Name}:-%{User-Name}})" group { # Where to start searching in the tree for groups base_dn = "${..base_dn}" # Filter for group objects, should match all available # group objects a user might be a member of. # filter = '(objectClass=posixGroup)' # Search scope, may be 'base', 'one', sub' or 'children' # scope = 'sub' # Attribute that uniquely identifies a group. # Is used when converting group DNs to group # names. # name_attribute = cn # Filter to find group objects a user is a member of. # That is, group objects with attributes that # identify members (the inverse of membership_attribute). membership_filter = "(|(&(objectClass=computer)(member=%{control:Ldap-UserDn})))" # The attribute in user objects which contain the names # or DNs of groups a user is a member of. # # Unless a conversion between group name and group DN is # needed, there's no requirement for the group objects # referenced to actually exist. membership_attribute = 'member:1.2.840.113556.1.4.1941' Default site ldap query example ldap if(LDAP-Group == "CN=vlan,OU=generalgroups,OU=Departments,DC=testDomain,DC=local"){ update reply{ &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "6" &Tunnel-Private-Group-Id := "103" } Here is a snippet from the error in the debug output. Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): Rebinding to URL ldap://Server Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): Waiting for bind result... Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): Rebinding to URL ldap://Server Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): Waiting for bind result... Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): Bind successful Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): Bind successful Mon Nov 26 23:53:09 2018 : Debug: (5) User object found at DN "CN=ComputerName,OU=Computers,OU=Departments,DC=testDomain,DC=net" Mon Nov 26 23:53:09 2018 : Debug: (5) Checking for user in group objects Mon Nov 26 23:53:09 2018 : Debug: (|(&(objectClass=computer)(member=%{control:Ldap-UserDn}))) Mon Nov 26 23:53:09 2018 : Debug: Parsed xlat tree: Mon Nov 26 23:53:09 2018 : Debug: literal --> (|(&(objectClass=computer)(member= Mon Nov 26 23:53:09 2018 : Debug: attribute --> LDAP-UserDN Mon Nov 26 23:53:09 2018 : Debug: literal --> ))) Mon Nov 26 23:53:09 2018 : Debug: (5) EXPAND (|(&(objectClass=computer)(member=%{control:Ldap-UserDn}))) Mon Nov 26 23:53:09 2018 : Debug: (5) --> (|(&(objectClass=computer)(member=CN\3dComputerNAme\2cOU\3dComputers\\3dDepartments\2cDC\3dtestDomain\2cDC\3dlocal))) Mon Nov 26 23:53:09 2018 : Debug: (5) Waiting for bind result... Mon Nov 26 23:53:09 2018 : Debug: (5) Bind successful Mon Nov 26 23:53:09 2018 : Debug: (5) Performing search in "CN=VLAN,OU=generalgroups,OU=Departments,DC=testDomain,DC=local" with filter "(|(&(objectClass=computer)(member=CN\3dComputerNAme\2cOU\3dComputers\\3dDepartments\2cDC\3dtestDomain\2cDC\3dlocal)))", scope "sub" Mon Nov 26 23:53:09 2018 : Debug: (5) Waiting for search result... Mon Nov 26 23:53:09 2018 : Debug: (5) Search returned no results Mon Nov 26 23:53:09 2018 : Debug: (5) Checking user object's member:1.2.840.113556.1.4.1941 attributes Mon Nov 26 23:53:09 2018 : Debug: (5) Performing unfiltered search in "CN=computerName,OU=computers,OU=Departments,DC=testDomain,DC=local", scope "base" Mon Nov 26 23:53:09 2018 : Debug: (5) Waiting for search result... Mon Nov 26 23:53:09 2018 : Debug: (5) No group membership attribute(s) found in user object Mon Nov 26 23:53:09 2018 : Info: rlm_ldap (ldap): Deleting connection (5) - Was referred to a different LDAP server Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap: Closing libldap handle 0x9cc450 Mon Nov 26 23:53:09 2018 : Info: Need 3 more connections to reach min connections (3) Mon Nov 26 23:53:09 2018 : Info: rlm_ldap (ldap): Opening additional connection (6), 1 of 32 pending slots used Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): Connecting to ldap://server Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): New libldap handle 0x9cc450 Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): Waiting for bind result... Mon Nov 26 23:53:09 2018 : Debug: rlm_ldap (ldap): Bind successful Mon Nov 26 23:53:09 2018 : Debug: (5) User is not a member of "CN=vlan,OU=generalgroups,OU=Departments,DC=testDomain,DC=local" Mon Nov 26 23:53:09 2018 : Debug: (5) if (LDAP-Group == "CN=vlan,OU=generalgroups,OU=Departments,DC=testDomain,DC=local") -> FALSE I am sure that my syntax is wrong somewhere, maybe the ldap-group part in the ldap query? I would like to point out that it does find the group when switch the object class to group from computer but only in the sub groups and not the larger group. Any help would be greatly appreciated

2 1

Simultaneous-Use - on radchek
by Juliano Raymundo dos Santos 28 Nov '18

28 Nov '18

Good afternoon guys, I have configured a Simultaneous-Use on radchek table and set to 1 conection. This is making me crazy, becouse now all my users have trouble to connect over PPPoE on my NAS servers. The parameter "Simultaneos-Use := 1" recognises it alredy exists 1 connection estabilished and deny new connections. but the problem is, the same MAC address is calling over PPPoE and the server doesn' t understand and do not accept that connection. I trying to permit only one connection per user but it is not working. +-------+----------+--------------------+----+-----------+ | id | username | attribute | op | value | +-------+----------+--------------------+----+-----------+ | 2060 | 16385 | ClearText-Password | := | 8W3CC6N1E | | 13256 | 16385 | Simultaneous-Use | := | 1

2 1

Redundant LDAP servers in /etc/freeradius/modules/ldap
by Tom Yard 28 Nov '18

28 Nov '18

Dear people, I have a Freeradius servers vefrsion 2.2.5 using LDAP for authentication. I have just one LDAP server defined in /etc/freeradius/modules/ldap, but yesterday the DC went down and Freeradius was offline. Is it possible to have two redundant LDAP server scheme, defining this in /etc/freeradius/modules/ldap: ldap { server = "server1.company.com" server = "server2.company.com" identity = "CN=wifi,OU=it,DC=company,DC=com" password = xxxxx basedn = "OU=it,DC=company,DC=com" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" Thanks in advance!!!

2 3

Use 2 modules to auth together.
by luckydog xf 28 Nov '18

28 Nov '18

Probably I'm wrong, MSCHAP won't work no matter what kind of password encyption used if LDAP is as backend. MSCHAP is using ntlm_auth and winbind which is MS related, or its equivalent, Samba. On Wed, Nov 28, 2018 at 8:56 AM luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: > One more thing to add. > 1. MS AD as backend, you could choose MSchap variant, like EAP-mschapv2, > I'm NOT sure. > 2. LDAP as backend, you could use MSCHAP too, as long as you add samba > schema and add sambaSamAccount objectclass( maybe this one) in your LDAP > entry, then your user's password could stored as NThash encrypted（This is > how MS AD user's password is encrypted）. The default is SSHA512. On Wed, Nov 28, 2018 at 8:56 AM luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >* Let me complete this topic. Feel free to correct me if I'm wrong. LOL *>>* In short, *>>* 1. MS AD != OTP and MS AD != PAP. *>>* 2. MS AD = MSCHAP( and MSCHAP v2, not sure CHAP) *>>* 3. LDAP = PAP = OTP *>>* Long explaination: *>>* 1. It won't be User-Password as MS-CHAP2-Response Attribute in Access-Request packet has the password you input encoded and encrypted. In other words, MSCHAP does have password but in another form which FreeRadius cannot and won't check it either, and it's exepcted. *>>* That's the way how MSCHAP works, *>>* see https://tools.ietf.org/html/rfc2548 <https://tools.ietf.org/html/rfc2548> (page 14-15） *>>* NO user-password, no OTP, b/c there is no way to know your orginal OTP, it is in MS-CHAP2-Responsed. *>>* 2. user-password in AD schema is write-only, you cannot use Freeradius LDAP module to revitive it, and any other LDAPclient, like LDAPadmins. So this means NO known good password, which also means NO PAP. *>>* 3. MS AD is mschap only, as far as I know. Guess it's challeng and response change everytine, so it's security, just a guess. *>>* 4. LDAP means PAP and OTP, as User-Password is available. *>>* That's all. *>>* >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> *>>>* Hi, here is my access-request from radiusd -fX *>>* Only an extra State is added comparing to the 1st auth. *>>* # Access-Challenge *>* Ready to process requests *>* (6) Received Access-Request Id 13 from 172.30.240.130:7460 <http://172.30.240.130:7460> to172.16.237.52:1812 length 205 *>* (6) NAS-Identifier = "Artisan_FW" *>* (6) State = 0x654e6c7472756d474c576c6a61584b37 *>* (6) User-Name = "someone" *>* (6) MS-CHAP2-Response = *>* 0x0f003132333435363638393035398846f8ca00000000000000000ac4b98d3afb9b42a0e1a1def464b78e5f6b13033d6a6e7c *>* (6) MS-CHAP-Challenge = 0x680d6e49baa9e6f4b4f622042f0917f6 *>* (6) NAS-IP-Address = 172.30.240.130 *>* (6) NAS-Port-Type = Virtual *>* (6) Called-Station-Id = "172.30.240.130" *>* (6) Acct-Session-Id = "033ac507" *>* (6) Connect-Info = "admin-login" *>* (6) Fortinet-Vdom-Name = "root" *>* (6) session-state: No cached attributes *>* (6) # Executing section authorize from file /etc/raddb/sites-enabled/default *>>* As you can see there is NO User-Password attribute, which is OTP. It *>* seems that it's caused by mschap authentication, there is no such *>* attribute in mschap. *>>* Is there any way to input User-Password( in other words, OTP)? or my *>* own auth method would fail to auth as there is no OTP. *>>>* Thanks. *>>* On Nov 26, 2018, at 8:42 AM, luckydog xf <luckydogxf at gmail.com <http://gmail.com> *>* <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>> *>* wrote: *>>* Find a challenge-support Device and test it out. Let me answer it. *>>* 1. Not every NAS supports Access-Challenge, they may just ignore it *>* and treat it as access-reject. According to my test. *>>* 2. my way of raise challeng is correct, it's built-in way of FreeRADIUS. *>>* 3. else part seesm correct, too, though I haven't hanle my own auth *>* method, it's just a fake one. *>>* Thank Alan again. *>>>* On Nov 26, 2018, at 12:42 AM, luckydog xf <luckydogxf at gmail.com <http://gmail.com> *>* <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>> *>* wrote: *>>>* Thank, Alan, you enlighten me. *>>* Turns out NAS( my VPN) does not support Access-Challenge. Googled and *>* found that Challenge seems to be a speical access-request packet with the *>* Code field set to 11. So can I make the conclusion that it would send an *>* access-quest again? in other words, start a new authentication process *>* like another normal request with an exception that State attribute exists. *>>* Let me suppose my VPN supports Access-Challenge, so my configuation is *>* something like: *>* ------------------------------- *>>* authorize { *>* # The first auth does not have any State attribute. *>* if (!State) { *>* # MS-CHAP has no User-Password, so it's true. *>* if (!User-Password ) { *>* # If !State and User-Password is null, then *>* goes to MS-CHAP: *>* update { *>* &control:Auth-Type := MS-CHAP *>* } *>* } *>>* else { reject } *>>* # Make sure it does not contain any other attributes except State. *>>>* else { *>>* update { *>>* # IS THIS PART CORRECT ? I think so, as a new request is *>* issued by challage, so it would start over from top to buttom to walk *>* throught the entire process. *>>* &control:Auth-Type := MY_OWN_OTP_AUTH *>>* } *>* } *>>* } *>>* authentication { *>>* Auth-Type MS-CHAP { *>* mschap *>* if (ok) { *>* update reply { *>* # Create a random State attribute: *>* State := "%{randstr:XXXXXXXXXXXXX}" *>* Reply-Message := "Please type your OTP:" *>* } *>* # Return Access-Challenge, goes to the 2nd auth. *>>* # IS IT the correct way to raise a challange? *>* challenge *>>* } *>>* Please help me to take a look at configuration above, two questions: *>>* 1. Is else part correct? which will use my own python auth module *>* 2. Is it correct to raise a challenge using 'challenge' filter of *>* FreeRADIUS? *>>* Thanks again. *>>>* On Mon, Nov 26, 2018 at 8:10 PM Alan DeKok <aland atdeployingradius.com <http://atdeployingradius.com> *>* <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>> *>* wrote: *>>* >*** On Nov 26, 2018, at 2:42 AM, luckydog xf <luckydogxf at gmail.com <http://gmail.com> <http://gmail.com <http://gmail.com/>> <http://gmail.com <http://gmail.com/> <http://gmail.com/ <http://gmail.com/>>> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>>>> wrote: *>* ***>* > Our user is in AD and VPN will do an MSCHAP authentication first and *>* *>* > filter property of User-Name from access request, then call an *>* *>* > access-challenge to verify against the other module whose logic is as *>* *>* > simple as starting a http request via http://XXX/check/username= <http://xxx/check/username=> <http://xxx/check/username= <http://xxx/check/username=>> *>* <http://xxx/check/username= <http://xxx/check/username=>> *>* <http://xxx/check/username= <http://xxx/check/username=>> *>* *>* > <http://xxx/check/username= <http://xxx/check/username=> *>* <http://xxx/check/username= <http://xxx/check/username=>>><USER-NAME>&OTP=<xxxxxx>, if return 200, *>* *>* it's *>* *>* > ok. *>* *>>* That's really just more authorization. *>* *>>* > Basically, I want to auth a single login against two modules, only both *>* *>* > of them are successful, the auth could be deemed as OK. *>* *>>* That's possible, subject to certain caveats. *>* *>>* > # ### authentication ##### *>* *>* > authentication { *>* *>* > Auth-Type MS-CHAP { *>* *>* > mschap *>* *>* > if (ok) { *>* *>* > update reply { *>* *>* > # Create a random State attribute: *>* *>* > State := "%{randstr:XXXXXXXXXXXXX}" *>* *>* > Reply-Message := "Please type your OTP:" *>* *>* > } *>* *>* > # Return Access-Challenge, goes to the 2nd auth. *>* *>* > challenge *>* *>>* That's good, but it likely won't work due to the NAS. Doing OTP like *>* *>* that requires support from the NAS. Does the NAS support doing MS-CHAP and *>* *>* then receiving an Access-Challenge? *>* *>>* If it does, then your next step is to write down what you want to *>* *>* happen, like this: *>* *>>* 1) packet 1 contains MS-CHAP *>* *>* 2) it authenticates agains MS-CHAP *>* *>* 3) if MS-CHAP is successful, it returns a State, challenge, and reply *>* *>* message *>* *>* 4) when the next packet comes in with a state attribute, authenticate the *>* *>* OTP *>* *>>* Note that the packet in step 4 *should not* contain any MS-CHAP *>* *>* attributes. It should just contain the response to the OTP. *>* *>>* So your freeradius configuration is: *>* *>>* 1) run MS-CHAP like normal *>* *>* 2) do state / reply-message / challenge in "Auth-Type MS-CHAP" *>* *>>* As a *separate* item: *>* *>>* 3) if packet contains State *>* *>* 4) do OTP verification *>* *>>* The only thing tying the two packets together is the State attribute. *>* *>* They are otherwise completely independent. *>* *>>* Alan DeKok. *>* *>>>>* - *>* *>* List info/subscribe/unsubscribe? See *>* *>* http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html> *>* <http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html>>* *>>

1 0

Use 2 modules to auth together.
by luckydog xf 28 Nov '18

28 Nov '18

Let me complete this topic. Feel free to correct me if I'm wrong. LOL In short, 1. MS AD != OTP and MS AD != PAP. 2. MS AD = MSCHAP( and MSCHAP v2, not sure CHAP) 3. LDAP = PAP = OTP Long explaination: 1. It won't be User-Password as MS-CHAP2-Response Attribute in Access-Request packet has the password you input encoded and encrypted. In other words, MSCHAP does have password but in another form which FreeRadius cannot and won't check it either, and it's exepcted. That's the way how MSCHAP works, see https://tools.ietf.org/html/rfc2548 (page 14-15） NO user-password, no OTP, b/c there is no way to know your orginal OTP, it is in MS-CHAP2-Responsed. 2. user-password in AD schema is write-only, you cannot use Freeradius LDAP module to revitive it, and any other LDAPclient, like LDAPadmins. So this means NO known good password, which also means NO PAP. 3. MS AD is mschap only, as far as I know. Guess it's challeng and response change everytine, so it's security, just a guess. 4. LDAP means PAP and OTP, as User-Password is available. That's all. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Hi, here is my access-request from radiusd -fX Only an extra State is added comparing to the 1st auth. # Access-Challenge Ready to process requests (6) Received Access-Request Id 13 from 172.30.240.130:7460 to172.16.237.52:1812 length 205 (6) NAS-Identifier = "Artisan_FW" (6) State = 0x654e6c7472756d474c576c6a61584b37 (6) User-Name = "someone" (6) MS-CHAP2-Response = 0x0f003132333435363638393035398846f8ca00000000000000000ac4b98d3afb9b42a0e1a1def464b78e5f6b13033d6a6e7c (6) MS-CHAP-Challenge = 0x680d6e49baa9e6f4b4f622042f0917f6 (6) NAS-IP-Address = 172.30.240.130 (6) NAS-Port-Type = Virtual (6) Called-Station-Id = "172.30.240.130" (6) Acct-Session-Id = "033ac507" (6) Connect-Info = "admin-login" (6) Fortinet-Vdom-Name = "root" (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/raddb/sites-enabled/default As you can see there is NO User-Password attribute, which is OTP. It seems that it's caused by mschap authentication, there is no such attribute in mschap. Is there any way to input User-Password( in other words, OTP)? or my own auth method would fail to auth as there is no OTP. Thanks. On Nov 26, 2018, at 8:42 AM, luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: Find a challenge-support Device and test it out. Let me answer it. 1. Not every NAS supports Access-Challenge, they may just ignore it and treat it as access-reject. According to my test. 2. my way of raise challeng is correct, it's built-in way of FreeRADIUS. 3. else part seesm correct, too, though I haven't hanle my own auth method, it's just a fake one. Thank Alan again. On Nov 26, 2018, at 12:42 AM, luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: Thank, Alan, you enlighten me. Turns out NAS( my VPN) does not support Access-Challenge. Googled and found that Challenge seems to be a speical access-request packet with the Code field set to 11. So can I make the conclusion that it would send an access-quest again? in other words, start a new authentication process like another normal request with an exception that State attribute exists. Let me suppose my VPN supports Access-Challenge, so my configuation is something like: ------------------------------- authorize { # The first auth does not have any State attribute. if (!State) { # MS-CHAP has no User-Password, so it's true. if (!User-Password ) { # If !State and User-Password is null, then goes to MS-CHAP: update { &control:Auth-Type := MS-CHAP } } else { reject } # Make sure it does not contain any other attributes except State. else { update { # IS THIS PART CORRECT ? I think so, as a new request is issued by challage, so it would start over from top to buttom to walk throught the entire process. &control:Auth-Type := MY_OWN_OTP_AUTH } } } authentication { Auth-Type MS-CHAP { mschap if (ok) { update reply { # Create a random State attribute: State := "%{randstr:XXXXXXXXXXXXX}" Reply-Message := "Please type your OTP:" } # Return Access-Challenge, goes to the 2nd auth. # IS IT the correct way to raise a challange? challenge } Please help me to take a look at configuration above, two questions: 1. Is else part correct? which will use my own python auth module 2. Is it correct to raise a challenge using 'challenge' filter of FreeRADIUS? Thanks again. On Mon, Nov 26, 2018 at 8:10 PM Alan DeKok <aland atdeployingradius.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >*** On Nov 26, 2018, at 2:42 AM, luckydog xf <luckydogxf at gmail.com <http://gmail.com> <http://gmail.com <http://gmail.com/>> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>>> wrote: ***>* > Our user is in AD and VPN will do an MSCHAP authentication first and *>* > filter property of User-Name from access request, then call an *>* > access-challenge to verify against the other module whose logic is as *>* > simple as starting a http request via http://XXX/check/username= <http://xxx/check/username=> <http://xxx/check/username=> <http://xxx/check/username=> *>* > <http://xxx/check/username= <http://xxx/check/username=>><USER-NAME>&OTP=<xxxxxx>, if return 200, *>* it's *>* > ok. *>>* That's really just more authorization. *>>* > Basically, I want to auth a single login against two modules, only both *>* > of them are successful, the auth could be deemed as OK. *>>* That's possible, subject to certain caveats. *>>* > # ### authentication ##### *>* > authentication { *>* > Auth-Type MS-CHAP { *>* > mschap *>* > if (ok) { *>* > update reply { *>* > # Create a random State attribute: *>* > State := "%{randstr:XXXXXXXXXXXXX}" *>* > Reply-Message := "Please type your OTP:" *>* > } *>* > # Return Access-Challenge, goes to the 2nd auth. *>* > challenge *>>* That's good, but it likely won't work due to the NAS. Doing OTP like *>* that requires support from the NAS. Does the NAS support doing MS-CHAP and *>* then receiving an Access-Challenge? *>>* If it does, then your next step is to write down what you want to *>* happen, like this: *>>* 1) packet 1 contains MS-CHAP *>* 2) it authenticates agains MS-CHAP *>* 3) if MS-CHAP is successful, it returns a State, challenge, and reply *>* message *>* 4) when the next packet comes in with a state attribute, authenticate the *>* OTP *>>* Note that the packet in step 4 *should not* contain any MS-CHAP *>* attributes. It should just contain the response to the OTP. *>>* So your freeradius configuration is: *>>* 1) run MS-CHAP like normal *>* 2) do state / reply-message / challenge in "Auth-Type MS-CHAP" *>>* As a *separate* item: *>>* 3) if packet contains State *>* 4) do OTP verification *>>* The only thing tying the two packets together is the State attribute. *>* They are otherwise completely independent. *>>* Alan DeKok. *>>>>* - *>* List info/subscribe/unsubscribe? See *>* http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html>*

1 1

FreeRADIUS 3 and ldap
by Victor Cenac 27 Nov '18

27 Nov '18

Bellow is my previous interaction: The info graciously provided by Alan seem to not match my version... or I need more hand holding. My installation is on ubuntu server 18.04 and I installed freeradius with apt-get. So I have version 3.0.16+dfsg-1ubuntu3. Following some other instructions I also installed freeradius-ldap. My installation is here: /etc/freeradius/3.0 so no radb folder, but that's not a big deal, as I assume on other OS the install is in /etc/radb/ In my version the ldap module is enabled according to these instructions in mods-available/README.rst: "Modules are enabled by creating a file in the mods-enabled/ directory. You can also create a soft-link from one directory to another:: $ cd raddb/mods-enabled $ ln -s ../mods-available/foo Simplification -------------- Allowing conditional modules simplifies the default virtual servers that are shipped with FreeRADIUS. This means that if you want to enable LDAP (for example), you no longer need to edit the files in raddb/sites-available/ in order to enable it. Instead, you should edit the raddb/mods-available/ldap file to point to your local LDAP server. Then, enable the module via the soft-link method described above. Once the module is enabled, it will automatically be used in the default configuration." Which I did. According to this explanation, that's all I had to do to make the FreeRADIUS use the ldap. Now, to do the matching between the ldap attributes (group membership) and the vlan communicated by the radius server to the switch... I found this in the ldap file (in mods-available): " # Mapping of LDAP directory attributes to RADIUS dictionary attributes. # # WARNING: Although this format is almost identical to the unlang # update section format, it does *NOT* mean that you can use other # unlang constructs in module configuration files. # # Configuration items are in the format: # <radius attr> <op> <ldap attr> # # Where: # <radius attr>: Is the destination RADIUS attribute # with any valid list and request qualifiers. # <op>: Is any assignment attribute (=, :=, +=, -=). # <ldap attr>: Is the attribute associated with user or # profile objects in the LDAP directory. # If the attribute name is wrapped in double # quotes it will be xlat expanded. # # Request and list qualifiers may also be placed after the 'update' # section name to set defaults destination requests/lists # for unqualified RADIUS attributes. # # Note: LDAP attribute names should be single quoted unless you want # the name value to be derived from an xlat expansion, or an # attribute ref. update { control:Password-With-Header += 'userPassword' # control:NT-Password := 'ntPassword' # reply:Reply-Message := 'radiusReplyMessage' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' # Where only a list is specified as the RADIUS attribute, # the value of the LDAP attribute is parsed as a valuepair # in the same format as the 'valuepair_attribute' (above). control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } " Is this the right place? Which lines do I repeat for multiple group-->vlan translation? For example: ldap group Staff = vlan 1 ldap group Student = vlan 2 etc. Thank you! Victor Fri, 16 Nov 2018 17:58:39 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: MAC auth with LDAP Message-ID: <0EEDAAC5-C2DA-4ABC-B0D3-93D9A0C35483(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Nov 16, 2018, at 5:13 PM, Victor Cenac <victor(a)fuller.edu> wrote: > I have a Juniper network where we assign devices to vlans based on their > MAC. The MACS are stored in an LDAP with the MAC as username and password. > The group membership is what distinguishes the vlan needed. That should be simple enough, > I managed to configure the ldap and enable the ldap module. FreeRADIUS > starts fine with it. I also added all the switches as clients. OK. > I need help figuring out: > 1. Where do I tell FreeRADIUS to look for users in ldap (vs the users file)? raddb/sites-enabled/default Look for "ldap". And, raddb/mods-available/ldap See also http://wiki.freeradius.org/. Search for "ldap". It has lots of documentations. > 2. Where do I match the group in ldap with the vlan number that needs to be > sent to the client (switch)? For example, for group Staff value is 10 (vlan > 10). You don't map LDAP names directly to VLANs. They might be "sales", and you can't use "sales" as a VLAN number. Instead, do this: if (LDAP-Group == "staff") { update reply { Tunnel Type = VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 10 } } Alan DeKok. Victor Cenac-Mehedinti Senior Systems Administrator Fuller Theological Seminary 626 396 6060

3 2