May 2020 - Freeradius-Users - lists.freeradius.org

Wifi + Active Directory without ntlm
by Клеусов Владимир Сергее вич 28 May '20

28 May '20

Hi, Source data: Active directory freeradius 3.0.21 In /etc/freeradius/mods-enabled/mschap ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key —domain=DOMAIN.COM<http://domain.com/> --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" Freeradius ldap module installed and configured Question: Is it possible to configure freeradius with Active Directory without ntlm ? If possible, how ? )

5 15

SQL SELECT statement
by Charly 19 May '20

19 May '20

Hello, I would like to update Cisco-AVPair attribute using a SQL request : update reply { Cisco-AVPair += "%{sql:SELECT value FROM radreply WHERE username = '%{User-Name}' AND attribute = 'Cisco-AVPair' ORDER BY id}" } But only the first row is returned. Charlye

2 7

Is it possible? CoA disconnect packet communication between radius 3 and Unifi AP Clients
by Luis Gutierrez 18 May '20

18 May '20

Hello, I am new to this mailing list. I will be brief, I need an AAA server over a network of Ubiquiti AP Unifi, I have to say that it was not difficult for me to install a freeradius 3.0.x server. My problem: But I can't disconnect devices, using CoA packets: echo User-Name = 'user' radclient 127.0.0.1:3799 disconnect testing123 I consult them: Someone managed to use the CoA disconnect packets between a freeradius 3.0.X server and AP's ubuquiti Unifi AP. I have read the ubiquiti forums without clear results. Greetings and thanks. -- Luis Gutierrez Cruz Movil: 71255832 Twitter: @LuisBPS

2 1

CHAP Authentication with rlm_perl module
by Imdad Hasan 16 May '20

16 May '20

So, if i want to make the framed-ip with dynamic value than how can i do that.? And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module. Is that possible?

2 7

Remove my email from liste free radius
by rafik.benchemekh＠sofrecom.com 16 May '20

16 May '20

Hello Would you please remove my email from freeradius_user@list Thank you Rafik

2 1

SSL: SSL3 alert: write (local SSL3 detected an error):fatal:bad record mac
by Jim Shi 15 May '20

15 May '20

Hi, When I run eapol_test with PEAP/MSCHAPv2, I got the following error: SSL: (where=0x4008 ret=0x214) SSL: SSL3 alert: write (local SSL3 detected an error):fatal:bad record mac EAP: Status notification: local TLS alert (param=bad record mac) OpenSSL: tls_connection_decrypt - Decryption failed - SSL_read error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac SSL: Failed to decrypt Phase 2 data Any idea why I am getting this error? Thanks Jim

2 1

Accounting Data to Multiple Servers
by J. Russell Woodman 15 May '20

15 May '20

Hi, I'd like to send RADIUS accounting data to three separate accounting servers. I believe most of the configuration I need can be borrowed from robust-proxy-accounting from the default sites-available. However, I don't think "type = load-balancing" in the pool declaration is the option I need. Could someone point me in the right direction to make sure all three servers get all accounting data? Thanks, Russ Woodman russ(a)natcotech.com

2 1

looking for test client for PEAP/MSCHAPv2
by Jim Shi 15 May '20

15 May '20

Hi, I am looking for a test client that I can use to test PEAP/MSCHAPv2 Seems radtest does not support PEAP/MSCHAPv2? Any help is appreciated. Thanks a lot. Jim

4 4

Re: Freeradius-Users Digest, Vol 181, Issue 21
by Imdad Hasan 15 May '20

15 May '20

So, if i want to make the framed-ip with dynamic value than how can i do that.? And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module. Is that possible? On Fri, May 15, 2020 at 3:30 PM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Wifi + Active Directory without ntlm (Alan DeKok) > 2. Re: Wifi + Active Directory without ntlm (Fabrice Durand) > 3. looking for test client for PEAP/MSCHAPv2 (Jim Shi) > 4. Re: looking for test client for PEAP/MSCHAPv2 (Matthew Newton) > 5. Re: looking for test client for PEAP/MSCHAPv2 (Jorge Pereira) > 6. CHAP Authentication with rlm_perl module (Imdad Hasan) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 14 May 2020 10:59:13 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Wifi + Active Directory without ntlm > Message-ID: <8A61A9A6-900D-41D6-9F33-3174FCFCF6D9(a)deployingradius.com> > Content-Type: text/plain; charset=utf-8 > > On May 14, 2020, at 10:56 AM, Клеусов Владимир Сергеевич via > Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > > > The idea was to link freeradius and ad via an ldap module. That is, do > not install samba and windbind. To authentifizierte using the ldap module. > That is, it will not work like this. Right ? > > That question has been asked and answered about 4 times now. The answer > won't change if you keep asking the same question. The only thing you'll > do is annoy the people who are trying to help you. > > > So the ldap module is it for other LDAP implementations, such as > openldap ? > > The LDAP module is for any server which implements LDAP. Like AD. > > But as you were already told, the issue isn't LDAP. It's AD. > > Alan DeKok. > > > > > ------------------------------ > > Message: 2 > Date: Thu, 14 May 2020 12:53:24 -0400 > From: Fabrice Durand <fdurand(a)inverse.ca> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Wifi + Active Directory without ntlm > Message-ID: <4d796e43-502b-b71f-4c6e-d4394ee70176(a)inverse.ca> > Content-Type: text/plain; charset=utf-8; format=flowed > > I did this kind of configuration a long time ago and most of the work > needs to be done on the AD side. > > The idea is to mimic what a Edirectory server do (universal password) > and create a ldap attribute where you will store the NTHASH of the > user/computer. > > > https://github.com/inverse-inc/packetfence/tree/devel/addons/nthash_AD_attr… > > > The other way is to extract the NTHASH for each users, store it > somewhere (sql per example) and configure FreeRADIUS to fetch the NTHASH > based on the username. > > > https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump… > > > Regards > > Fabrice > > Le 20-05-14 à 10 h 56, Клеусов Владимир Сергеевич via Freeradius-Users a > écrit : > > The idea was to link freeradius and ad via an ldap module. That is, do > not install samba and windbind. To authentifizierte using the ldap module. > That is, it will not work like this. Right ? So the ldap module is it for > other LDAP implementations, such as openldap ? > > > >> 14 мая 2020 г., в 16:40, Josef Vybíhal <josef.vybihal(a)gmail.com> > написал(а): > >> > >> Is it possible, that you mean that you just don't want to use ntlm_auth > >> command? If yes, then read the winbind comment section in the mschap > module > >> config. > >> # winbind_username = "%{mschap:User-Name}" > >> # winbind_domain = "%{mschap:NT-Domain}" > >> > >> or this > >> https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind > >> > >> On Thu, May 14, 2020 at 3:32 PM Клеусов Владимир Сергеевич via > >> Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > >> > >>> Ideally, I want to authenticate the domain user and if he is in the > >>> domain, check his group. If not in the group, do not connect to wifi. > Is > >>> this possible without ntlm ? > >>> > >>> 14 мая 2020 г., в 16:07, Matthew Newton <mcn(a)freeradius.org<mailto: > >>> mcn(a)freeradius.org>> написал(а): > >>> > >>> o do what? Just get policy information/groups etc, or to authenticate? > >>> > >>> FreeRADIUS can use LDAP to query AD to get group information etc just > >>> fine. However, AD won't give you a password over LDAP. So in the vast > >>> majority of cases if you want to authenticate you need to use mschap. > >>> > >>> - > >>> List info/subscribe/unsubscribe? See > >>> http://www.freeradius.org/list/users.html > >> - > >> List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- > Fabrice Durand > fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca > Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence ( > http://packetfence.org) > > > > ------------------------------ > > Message: 3 > Date: Thu, 14 May 2020 18:04:10 +0000 (UTC) > From: Jim Shi <hjshi(a)yahoo.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: looking for test client for PEAP/MSCHAPv2 > Message-ID: <1191804016.213541.1589479450003(a)mail.yahoo.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > I am looking for a test client that I can use to test PEAP/MSCHAPv2 > Seems radtest does not support PEAP/MSCHAPv2? > Any help is appreciated. > Thanks a lot. > Jim > > > > ------------------------------ > > Message: 4 > Date: Thu, 14 May 2020 19:07:50 +0100 > From: Matthew Newton <mcn(a)freeradius.org> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: looking for test client for PEAP/MSCHAPv2 > Message-ID: <a71f17df-a2f0-da95-9b20-4980b93e2956(a)freeradius.org> > Content-Type: text/plain; charset=utf-8; format=flowed > > > On 14/05/2020 19:04, Jim Shi via Freeradius-Users wrote: > > I am looking for a test client that I can use to test PEAP/MSCHAPv2 > > Seems radtest does not support PEAP/MSCHAPv2? > > eapol_test from wpa_supplicant: > > https://w1.fi/wpa_supplicant/ > > There are example configs in the FreeRADIUS source (see "make test"). > > -- > Matthew > > > ------------------------------ > > Message: 5 > Date: Thu, 14 May 2020 15:12:15 -0300 > From: Jorge Pereira <jpereira(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: looking for test client for PEAP/MSCHAPv2 > Message-ID: <47565E26-014E-4114-B3BC-186CDD7E113B(a)freeradius.org> > Content-Type: text/plain; charset=utf-8 > > Hi Jimm > > Take a look at “eapol_test” tool. We have some config samples in our repo. > > e.g: > > [jpereira@jorge-sugarloaf freeradius-server-v3.0.x.git]$ grep eapol_test > -r src/ > src//tests/eap-md5.conf:# eapol_test -c eap-md5.conf -s testing123 -n > src//tests/Makefile:EAPOL_TEST = $(shell which eapol_test) > src//tests/Makefile:# Run eapol_test if it exists. Otherwise do nothing > src//tests/eap-mschapv2.conf:# eapol_test -c eap-mschapv2.conf -s > testing123 > src//tests/eap-ttls-eap-mschapv2.conf:# eapol_test -c > eap-ttls-eap-mschapv2.conf -s testing123 > src//tests/peap-mschapv2.conf:# ./eapol_test -c peap-mschapv2.conf -s > testing123 > src//tests/eap-ttls-mschapv2.conf:# eapol_test -c eap-ttls-mschapv2.conf > -s testing123 > src//tests/peap-client-mschapv2.conf:# ./eapol_test -c > peap-mschapv2.conf -s testing123 > src//tests/.gitignore:eapol_test > src//tests/eap-tls.conf:# eapol_test -c eap-tls.conf -s testing123 > src//tests/eap-ttls-pap.conf:# eapol_test -c eap-ttls-pap.conf -s > testing123 > [jpereira@jorge-sugarloaf freeradius-server-v3.0.x.git]$ > > --- > Jorge Pereira > jpereira(a)freeradius.org <mailto:jpereira@freeradius.org> > > > > > > On 14 May 2020, at 15:04, Jim Shi via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > > Hi, > > I am looking for a test client that I can use to test PEAP/MSCHAPv2 > > Seems radtest does not support PEAP/MSCHAPv2? > > Any help is appreciated. > > Thanks a lot. > > Jim > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Message: 6 > Date: Fri, 15 May 2020 04:30:52 +0530 > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: CHAP Authentication with rlm_perl module > Message-ID: > < > CAPidyMXKC+6zXm1sCNpHiSfaJKddrbNM7D7Ayd2JWM0hXjpfkQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Dear all, > > i am using perl module, its working all like exec module but no doubt its > increased the performance on high load. But i have some queries when i use > CHAP authentication method with perl module. > > > In CHAP authentication i can't verify the password with Cleartext-Password, > right? > That's why i set RADCHECK attribute Cleartext-Password="password" and after > that freeradius verify them with authenticator and all. and if password > doesn't matched than its return Reject. > > But if i want to accept those user ( who have wrong password ) with special > disabled framed-ip than how can i?? > > > Thanks all, > > Imdad > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 181, Issue 21 > ************************************************* >

1 0

CHAP Authentication with rlm_perl module
by Imdad Hasan 15 May '20

15 May '20

Dear all, i am using perl module, its working all like exec module but no doubt its increased the performance on high load. But i have some queries when i use CHAP authentication method with perl module. In CHAP authentication i can't verify the password with Cleartext-Password, right? That's why i set RADCHECK attribute Cleartext-Password="password" and after that freeradius verify them with authenticator and all. and if password doesn't matched than its return Reject. But if i want to accept those user ( who have wrong password ) with special disabled framed-ip than how can i?? Thanks all, Imdad

2 1