December 2019 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Memory leak in FR 3.0.19 ?
by Arnaud LAURIOU 30 Jun '20

30 Jun '20

Hi, We are suspecting memory leak in FR 3.0.19 : process memory status show VmData always keep increasing leading to VmSwap use after a few days which also keep increasing. I have 2 questions : - What are the compile options to use valgrind ? only flag --enable-developper ?|| - In the changelog for version 3.0.20 : some memories problems seems to be solved, do you know when this version will be released ? (if the release date is close, we can wait to test this release rather than 3.0.19) Regards, Arnaud Lauriou

3 5

pam_radius_auth with Framed-IP-Address
by António Silva 24 Mar '20

24 Mar '20

Hi, How to get the "Framed-IP-Address" attribute from the Access-Accept replay from the radius server? Is it possible? Thanks. note: not sure if this is the right mailing to ask this question, sorry if is not.. -- Saludos / Regards / Cumprimentos António Silva

2 6

eap-tls with valid and fake certificates.
by codythejack 17 Jan '20

17 Jan '20

Hello ! The Idea is to authenticate users with eap-tls with certficates. People without any certificate should use different vlan provided by Radius. Only supported authentication should be eap-tls. Is it possible to make authentication with eap-tls with certficates for valid users and some "guest vlan" for users which hasnt any or unknown certificates ? I'tried many things like default authenticate , post-auth-type (with update control Auth-Type :=Accept). Allways i had reject or stuck with no network configuration. Radius should provide attributes for valid users: Tunnel-Type � = 13 Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 2111 and Tunnel-Type � = 13 Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 2211 for invalid users. How i do it ? thanks for help Marcin

4 6

Enterprise Wi-Fi: improving user device security
by Stefan Winter 06 Jan '20

06 Jan '20

Hello, I'm happy to be able to talk about an enhancement for Enterprise Wi-Fi made recently in the Wi-Fi Alliance, with "code" for 3.0.x that implements this. Please see my pull request at https://github.com/FreeRADIUS/freeradius-server/pull/3230 The problem that this is trying to solve is the following: as a RADIUS administrator, you can configure your EAP type for Enterprise Wi-Fi and have a server certificate from a specific CA. You tell your users that they should send their username/password ONLY to your server, which can be validated by looking at the CA chain and server name. You create configuration instructions, either in form of a PDF file or by using configuration generators such as on https://enterprise-wifi.net. And then your users ignore all those instructions and simply type their username and password at the prompt, not validating any server identity, possibly sending it to a rogue attacker. Academic field studies suggest that some 50% of end users are that lazy, leading to an easy attack vector to grab credentials from Wi-Fi logins. Bespoke additions by Wi-Fi Alliance allow you as the admin to limit how ignorant your users can be when connecting to your network. By including a certain policy OID field in your server certificate, you can apply validation policy directly at the supplicant level: if the user has not properly configured the network with CA/servername/cert fingerprint, then you can tell the supplicant to not even attempt the authentication, and tell the user to get a proper configuration first. Only if the configuration is sufficient to actually identify the server correctly will the authentication be attempted. This comes in two flavours a) "Trust Override Disabled - Strict": There are no exceptions. Have a proper configuration, or the supplicant won't try to authenticate you. b) "Trust Override Disabled- Trust On First Use": If this is the very first time you connect to a network, and the configuration is insufficient, take the incoming server certificate, ask user to confirm that this is okay, and take that one as the one trusted certificate. If the certificate changes at any point in the future, the supplicant will not ask the user again; it will unconditionally stop the authentication attempt prior to sending username/password. b) is actually extremely similar to SSH and its reaction to your first connection to a new host. That first time asks you a question of trust, and any subsequent change of server-side identity will raise all alarm bells. Thinking this through, here's a few considerations: 1. What happens if your very first connection is directly to an attacker? The supplicant will not be told to be picky, will prompt for trust, and will send the username/password to the attacker. Since you have never ever contacted your proper authentication server, it can't tell your supplicant to be picky, so this is a hard problem that can't be solved. It can be compared to your first SSH connection attempt, and you immediately end up at an impostor, and trust its SSH key. 2. With TOD-TOFU, the server certificate is pinned "forever". Now what happens if you feel the need to change the server cert? It is possible to delete the entire Wi-Fi config - this will also delete the stickiness to the old cert. While that's possible, it is best to do everything you can to let your server cert live very very long. E.g. have a CA cert with 30 years validity, and a server cert *with the same 30 years validity*. The TOD-TOFU configuration is then good for a very long time, and the only reasons to exchange the cert are an actual key compromise or crypto algorithms decaying over time. Using a root CA with the same lifetime has the additional plus that those clients who configured the (CA,name) tuple, instead of relying on the ad-hoc first use trust, will even accept the new server certificate without needing any change. The new policies are now part of raddb/certs/xpextensions and default to enabling "TOD-TOFU". This should be part of the next 3.0.x release. But of course it will only start having an effect once you have created a certificate with the respective scripts; and its effect will only be on "new" supplicants that have the latest Wi-Fi Alliance WPA3 Security Dec 2019 Release certification. There will be a slow phase-in of such supplicants over time. This has the advantage that turning it on *today* won't all of a sudden break all your deployed base. Which is good. Greetings, Stefan -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 3

Freeradius second auth factor
by Anton Kiryushkin 30 Dec '19

30 Dec '19

Hello. I want to configure the second authorisation factor with EAP-type, and md5 hashed password saved in MySQL. I found several modules and services like MultiOTP and Smsotp, but I can't understand how to provide the SMS before the authorisation or how to ask FreeRadius to wait for the process sends SMS? Could you please explain this to me? -- Best regards, Anton Kiryushkin

3 9

How to grant some (!) devices access to network but all others have to provide passwords
by uj2.hahn＠posteo.de 27 Dec '19

27 Dec '19

Hi, all! I'm pretty sure this is a very basic question which might have been discussed in the past already. But I'm new in this area so you might apologize this silly question.... In a school all devices (students laptops, mobiles, tablets) have to use username/password via Freeradius to get access to WLAN. But there are some well-defined school-owned devices (laptops, tablets) which should connect to WLAN immediately w/o any credentials. Which options do I have to realize that? MAC checks? Certificates? Thanks for your help Uwe

3 5

/usr/sbin/radiusd -C failed
by Changqing Li 27 Dec '19

27 Dec '19

Hi, I met below error when run "/usr/sbin/radiusd -C -X", Could someone experts at this help to give me some hint what configuration maybe wrong? Thanks # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } tls: Failed reading private key file "/etc/raddb/certs/server.pem" tls: error:0607606B:digital envelope routines:PKCS5_v2_PBE_keyivgen:unsupported cipher tls: error:06074078:digital envelope routines:EVP_PBE_CipherInit:keygen failure tls: error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error tls: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error tls: error:0907B00D:PEM routines:PEM_read_bio_PrivateKey:ASN1 lib tls: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to initialise rlm_eap_tls /etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap"

3 3

FreeRadius fault by exec
by Anton Kiryushkin 23 Dec '19

23 Dec '19

Hello. I am trying to use exec and I am receiving the next log on version 3.0.15: Mon Dec 23 18:54:42 2019 : Debug: (1) multiotp: Program returned code (0) and output 'Auth-Type = Accept' Mon Dec 23 18:54:42 2019 : Debug: (1) multiotp: Program executed successfully Mon Dec 23 18:54:42 2019 : Debug: (1) modsingle[authenticate]: returned from multiotp (rlm_exec) Mon Dec 23 18:54:42 2019 : Debug: (1) [multiotp] = ok Mon Dec 23 18:54:42 2019 : Debug: (1) } # Auth-Type multiotp = ok CONSISTENCY CHECK FAILED src/main/process.c[2800]: Expected VALUE_PAIR "Auth-Type" to be parented by 0x555d99f0afc0 (RADIUS_PACKET), instead parented by 0x555d99f0ae10 (REQUEST) Talloc chunk lineage: 0x555d99f0afc0 (RADIUS_PACKET) < 0x555d99f0ae10 (REQUEST) < 0x555d99f0aba0 (auth_listener_pool) Talloc context level 0: Talloc chunk lineage: 0x555d99f0ae10 (REQUEST) < 0x555d99f0aba0 (auth_listener_pool) Talloc context level 0: SOFT ASSERT FAILED src/lib/pair.c[2437]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 16 frames: /usr/lib64/freeradius/libfreeradius-radius.so(fr_fault+0x115)[0x7fac5bb3defc] /usr/lib64/freeradius/libfreeradius-radius.so(fr_assert_cond+0x4c)[0x7fac5bb3e98f] /usr/lib64/freeradius/libfreeradius-radius.so(fr_pair_list_verify+0x117)[0x7fac5bb4fb48] /usr/lib64/freeradius/libfreeradius-server.so(+0x249c7)[0x7fac5bda09c7] /usr/lib64/freeradius/libfreeradius-server.so(verify_request+0x124)[0x7fac5bda0af1] radiusd(+0x4664a)[0x555d98c2b64a] radiusd(+0x43b5a)[0x555d98c28b5a] radiusd(+0x428a5)[0x555d98c278a5] radiusd(request_receive+0x7c8)[0x555d98c293d0] radiusd(+0x1e888)[0x555d98c03888] radiusd(+0x4b373)[0x555d98c30373] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_loop+0x5a6)[0x7fac5bb65f9c] radiusd(radius_event_process+0x26)[0x555d98c3215a] radiusd(main+0xc80)[0x555d98c1c426] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7fac5a22b765] radiusd(_start+0x29)[0x555d98bf9e69] Calling: gdb radiusd 14119 (gdb) bt #0 0x00007fac5a2c6eba in waitpid () from /lib64/libc.so.6 #1 0x00007fac5a24bdab in do_system () from /lib64/libc.so.6 #2 0x00007fac5bb3e0b8 in fr_fault () from /usr/lib64/freeradius/libfreeradius-radius.so #3 0x00007fac5bb3e98f in fr_assert_cond () from /usr/lib64/freeradius/libfreeradius-radius.so #4 0x00007fac5bb4fb48 in fr_pair_list_verify () from /usr/lib64/freeradius/libfreeradius-radius.so #5 0x00007fac5bda09c7 in verify_packet () from /usr/lib64/freeradius/libfreeradius-server.so #6 0x00007fac5bda0af1 in verify_request () from /usr/lib64/freeradius/libfreeradius-server.so #7 0x0000555d98c2b64a in request_will_proxy () #8 0x0000555d98c28b5a in request_running () #9 0x0000555d98c278a5 in request_queue_or_run () #10 0x0000555d98c293d0 in request_receive () #11 0x0000555d98c03888 in auth_socket_recv () #12 0x0000555d98c30373 in event_socket_handler () #13 0x00007fac5bb65f9c in fr_event_loop () from /usr/lib64/freeradius/libfreeradius-radius.so #14 0x0000555d98c3215a in radius_event_process () #15 0x0000555d98c1c426 in main () Could you please where am I wrong? The exec is simple: exec py-exec { wait = yes input_pairs = request output_pairs = reply program = "/local/pyexec/pyexec.py --user=%{User-Name} --key=%{User-Password}" shell_escape = yes } -- Best regards, Anton Kiryushkin

2 1

strange behavior when EAP is enabled?
by Coy Hile 23 Dec '19

23 Dec '19

I’ve seen a strange one… I’ve created the test certs, etc, that enable the EAP configuration to work. Running radiusd -X, one sees (in relevant part): # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/opt/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/opt/local/etc/raddb/certs/server.pem" certificate_file = "/opt/local/etc/raddb/certs/server.pem" ca_file = "/opt/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/opt/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } […] However, if I try to start radiusd as normal (not via -X), I end up with this behavior in the logs: Fri Dec 20 20:46:38 2019 : Error: tls: Failed reading certificate file "/opt/local/etc/raddb/certs/server.pem": error:0906D06C:PEM routines:PEM_read_bio:no start line Fri Dec 20 20:46:38 2019 : Error: rlm_eap_tls: Failed initializing SSL context Fri Dec 20 20:46:38 2019 : Error: rlm_eap (EAP): Failed to initialise rlm_eap_tls Fri Dec 20 20:46:38 2019 : Error: /opt/local/etc/raddb/mods-enabled/eap[14]: Instantiation failed for module “eap" Clearly, I can disable EAP (as I don’t use it at the moment) and get things working; however, I’m trying to disable as little of the default configs as possible. Is there something different in the code path when debugging is enabled vs not that is making OpenSSL libraries do something weird? -- Coy Hile coy.hile(a)coyhile.com

2 7