November 2019 - Freeradius-Users - lists.freeradius.org

post_auth step conditional process
by 류경석 05 Nov '19

05 Nov '19

Dear all. I created a collectd plugin that uses the eapol_test tool to monitor the performance of the Freeradius server. I am using the mysql module to handle logging and accounting, but there is a problem with this collectd plugin logging the success log every 10 seconds in the post_auth module. I don't know how to do this when I don't want to write this eapol_test record to the radpostauth table. Any suggestion will be appreciated.

2 1

EAP-TLS and IOS 13
by Ted Hyde (RSI) 04 Nov '19

04 Nov '19

I love *pple. And by love I mean exactly the opposite.....Regardless, my many thanks to all that assisted with my tribulations and blatherings regarding getting ipads and Win10 machines working with an EAP-TLS environment. As of this morning I had everything migrated, wiped, re-tested, full bare-metal automation tested and ready to deploy to the minions. I had a very happy moment. Until someone walked in with an ipad that they just upgraded to IOS 13. tl/dr: IOS13 introduces more stringent compliance for certificates (https://support.apple.com/en-us/HT210176) and that means certificates that used to work for EAP, now do not install - well that's not true. They install, they say they're verified, but the ipad does not recognize them as useful, and ONLY presents a TTLS-like connection interface (username and password, instead of certificate and identity). They simply sit there all happy and useless. (BTW, manual cert install is now an 8 page document in my library, including download, allow,accept, enable Cert Trust Settings, install, validate and....then watch do nothing.) Since the ipad does not present a tls transaction, FR3 doesn't participate. I am not using EAP-TTLS, so that module does exactly what is it supposed to do - find no verified username and reject. I've used my google-fu to get the basic idea of modifying the openssl commands to include the EKU, and sha2, but some of the other requirements I'm not sure about implementing. The "no longer than 2 years" is also a PITA. Either way, has anyone worked out a magic bullet for this yet? Amazingly, M$ is no longer on my hated list - the Win10 machines are now in the "it simply works" category! Longing to learn from the masters, yet again! Thanks, Ted. On 11/1/2019 6:56 PM, freeradius-users-request(a)lists.freeradius.org wrote: > Message: 6 > Date: Fri, 1 Nov 2019 16:22:30 -0400 > From: "Ted Hyde (RSI)"<thyde(a)rndstudio.com> > To:freeradius-users@lists.freeradius.org > Subject: Migrating FR3 instance --

3 2

Re:EAP-TLS and IOS 13 (Updated)
by Ted Hyde (RSI) 04 Nov '19

04 Nov '19

Quick update - IOS versioning strikes again; my *pple guru who lives bleeding-edge had a 13.2 pre-release in his kit and what struck me strange was that the Mode option in Wifi Security settings was available if using the "Other..." wifi setup option, wherein my test ipad (a 13.1.2 version) it was not. Short story shorter, we did get ios13 working again, but only on 13.2. any prior version newer than 12.3.2 (June?) has the missing EAP-TLS syndrome on our ipads. Unfortunately, looking at my MDM, a lot of my fleet is exactly in that range. Is it OS update season again already? This doesn't make the certificates compatible with *pple's newly released constraints; I'm still interested in available knowledge where it may exist. Thanks, Ted.

2 1

Granting/denying access according auth-method
by dump＠gmx.info 02 Nov '19

02 Nov '19

Dear list, I'm using freeradius 3 almost in standard config with mysql as storing facility. I have PEAP an EAP active. Usually EAP via TLS or TTLS/PAP is used, because the passphrases could be stored in SHA-1 encryption. PEAP is sometimes necessary for me too but it uses MS-CHAPv2 which needs cleartext-PW. Due to this I would like to restrict authentication vis MS-CHAPv2 and reactivate it when needed. I would prefer to do it via the radcheck-table for quickly activating and deactivate is easily. I read that it's possible via users-file, but I can't find any useful information/manual to me what to fill into the radcheck tables. May somebody have the idea or manual I need to follow/read? Many thanks in advance and best regards Jens

2 1

Migrating FR3 instance
by Ted Hyde (RSI) 01 Nov '19

01 Nov '19

Greets - I would like to migrate a test platform I have in a VM (FR3 3.0.12 on Debian 9) to a bare-metal deployment of same, but keep the client certificates as used in the VM instance. The bare-metal version already has other things installed, including a clean copy of FR3, so it's not as easy as simply imaging the appliance back to bare-metal. I am using eap-tls auth for a NAS, and wireless clients already have both the ca certificate and client certificates installed on them and functional. Given that this is a bare-metal install target that still has the snakeoil/testing certificates installed, is there a preferred/working method to copy the existing certs across and not destroy the entire system in the process? I expect I will have to copy the .cnf files for some items, but how does the ca structure (since I *think* I am also using CA validation in my eap module) get copied over? Thanks, Ted.

2 1

What does 'rlm' stand for in FreeRADIUS modules?
by Kamran Khan 01 Nov '19

01 Nov '19

i.e., what does 'rlm' mean in modules like rlm_perl, rlm_python etc. Thanks, Kamran.

2 2

Variable passing question between modules
by Adam Taylor 01 Nov '19

01 Nov '19

Hey all, I have been trying for a week and I have everything working on a setup I am doing except for one thing. Setting Tmp-String-0 to a string and using that string in the LDAP module. I'm trying to make the config as simple as possible so if I am doing something wrong, please let me know. I have the following in my authorize section: authorize { if (User-Name =~ /(a)ulm\.edu$$/i){ update request { Tmp-String-0 = "Employees" } preprocess mschap eap { ok = return } ldap } if (User-Name =~ /(a)warhawks\.ulm\.edu$$/i) { update request { Tmp-String-0 = "Students" } preprocess mschap eap { ok = return } ldap } } Basically if the login is XXX(a)ulm.edu<mailto:XXX@ulm.edu> set TMP-String-0 to "Employees" or if XXX(a)warhawks.ulm.edu<mailto:XXX@warhawks.ulm.edu> set to "Students" I then have the following in my ldap config: base_dn = 'ou=%{request:Tmp-String-0},ou=People,dc=ulm,dc=edu' The problem is ${request:Tmp-String-0} is always null and I get this in debug: (6) ldap: EXPAND ou=%{request:Tmp-String-0},ou=People,dc=ulm,dc=edu (6) ldap: --> ou=,ou=People,dc=ulm,dc=edu (6) ldap: Performing search in "ou=,ou=People,dc=ulm,dc=edu" with filter "(uid=pp)", scope "sub" I went to verify that it was actually setting the variable and see this: (6) update request { (6) Tmp-String-0 = "Students" (6) } # update request = noop I have tried every different way I can think of and it just will not set Tmp-String-0. I have tried both = and := as well. What am I doing wrong? Thanks, Adam Taylor

3 4