July 2020 - Freeradius-Users - lists.freeradius.org

EAP-PWD Authentication with Username and MAC
by psuet 27 Jul '20

27 Jul '20

Hi, I want to authenticate users with EAP-PWD with ./mods-config/files/authorize and check the used Calling-Station-ID in the process. A example for an entry in the authorize file: > username Calling-Station-Id == "A1-B2-C3-D4-E5-F6" Cleartext-Password > := "password" Authentication works fine for PEAP, but it looks like Calling-Station-ID is not available when the file is checked against when using EAP-PWD. Is there a method to make Calling-Station-Id available to the files mod when using EAP-PWD? (Freeradius 3.0.21) Thanks for any answer! Paul

4 5

help on REST HTTP-headers
by Mark Grayson (mgrayson) 24 Jul '20

24 Jul '20

Hi All Very new to freeRADIUS and trying to set up a post-auth rest POST to a 3rd party system that is expecting an API-key. So I set up rest config as post-auth { uri = "{$..connect_uri}/post" method = 'post' body = 'json' REST-HTTP-Header = "x-api-key: 94332cabcdef57456582e5af2bfa123456789" data = '{"end-user":"radius-test"}' tls = ${..tls} } But the debug I see from the POST server is Headers ------- Forwarded: for="<IP@>";proto=https X-Cloud-Trace-Context: 0edff73713fcbb7dd9741ac6e8ca6436/18102608228808296760 X-Forwarded-For: <IP@>, 169.254.1.1 Content-Length: 26 Content-Type: application/json X-Forwarded-Proto: https X-Freeradius-Section: post-auth X-Freeradius-Server: default Accept: */* User-Agent: FreeRADIUS 3.0.22 Body ---- {"end-user":"radius-test"} Any idea what I'm doing wrong when trying to configure the x-api-key header? Cheers, Mark

3 4

Expansion of acct-unique-session-id query
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 23 Jul '20

23 Jul '20

Hi all, Me again ☺ I’m having an issue with the creation of the Acct-Unique-Session-Id control attribute in v4. In v3, the policy did something like the following : (545) else { (545) update request { (545) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (545) --> 0a28ca134cc4f141e97cacdf91f7551f (545) Acct-Unique-Session-Id := "0a28ca134cc4f141e97cacdf91f7551f" If I do something like : echo -n "00c0b7869f20,001E00000002,192.168.105.142,IT-2530-2,,5" | md5sum I get the same md5 hash, good: 0a28ca134cc4f141e97cacdf91f7551f - In v4, (I’ve altered the attributes used in the calculation to match the v3 calculation, to try and demonstrate the issue). The output should in theory be the same? I get: (0) else { (0) update request { (0) EXPAND %{User-Name} (0) --> 00c0b7869f20 (0) EXPAND %{Acct-Session-ID} (0) --> 001E00000002 (0) EXPAND %{NAS-IP-Address} (0) --> 192.168.105.142 (0) EXPAND %{NAS-Identifier} (0) --> IT-2530-2 (0) EXPAND %{NAS-Port-ID} (0) --> , (0) EXPAND %{NAS-Port} (0) --> 5 (0) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (0) (%{md5:00c0b7869f20,001E00000002,192.168.105.142,IT-2530-2,,5}) (0) --> 0xa5850401f8c9f7ffdd43a04100ca8190 (0) &Acct-Unique-Session-Id := "\245\205\004\001\370\311\367\377\335C\240A\000ʁ\220" Everything expands ok, and it says it’s doing an md5 on the correct resulting “string”, but the output looks pretty odd. Should the md5 come out in hex format? I guess it’s maybe that part at fault, instead of the hex->string conversion? Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 3

Official plugin for Freeradius + OpenVPN?
by Houman 22 Jul '20

22 Jul '20

Hello, I have been using Freeradius and Strongswan (eap-radius) for a few years now and for the first time I'm trying to achieve the same thing with OpenVPN instead. Based on my research it seems that the recommended plugin is a decade old. http://www.nongnu.org/radiusplugin/ It's hard to imagine that this wasn't updated for so long. Am I missing something? Is there any official Freeradius plugin for OpenVPN? I found this tutorial to be very promising https://www.vpsserver.com/community/tutorials/17/authenticate-openvpn-clien… but I thought I ask here first if someone has experience with this topic, and I'm on the right path. Many Thanks, Houman

3 9

chap authentication with v4
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 22 Jul '20

22 Jul '20

Hi all, Sorry this is embarrassingly simple, but I'm struggling a bit with it. Profuse apologies if I missed something obvious. We use MAC authentication with some stuff, and update the control Cleartext-Password to match the user-name field, as mac auth on the NASes here always use that as the password. Authorisation does all our useful accept/reject stuff, not authentication. Having said that I'd prefer not to "hack" it to bypass auth. My test NAS is an HP/Aruba 2530 with v15.17.0009 firmware Before the chap auth runs: Update control { &Cleartext-Password = &User-Name } Works on v3: >From the access request : Wed Jul 22 08:33:57 2020 : Debug: (0) User-Name = "08000f510d1e" Wed Jul 22 08:33:57 2020 : Debug: (0) CHAP-Password = 0x9fdc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) Message-Authenticator = 0x978dc5f6ccbcd916950b3d76190039dc .. .. and then the chap auth debug: .. Wed Jul 22 08:46:46 2020 : Debug: (0) chap: Comparing with "known good" &control:Cleartext-Password value "08000f510d1e" Wed Jul 22 08:46:46 2020 : Debug: (0) chap: Using challenge from &request:CHAP-Challenge Wed Jul 22 08:33:57 2020 : Debug: (0) chap: CHAP challenge : e7714b9a5d8463e7947041bdbf399c17 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: Client sent : dc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: We calculated : dc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: CHAP user "08000f510d1e" authenticated successfully But on v4, it doesn't like it, and I can't figure out why, says the password is incorrect. I've checked and double checked the client.conf secret is correct. Wed Jul 22 07:59:01 2020: (1) User-Name = "08000f510d1e" Wed Jul 22 07:59:01 2020: (1) CHAP-Password = 0xa1526f5b6d5cc40d3d87df334515befc07 Wed Jul 22 07:59:01 2020: (1) Message-Authenticator = 0x5433e862ac2ab58c19866ff8bb05863f .. Wed Jul 22 07:59:01 2020: (1) chap - Using "known good" cleartext password Cleartext-Password = "08000f510d1e" Wed Jul 22 07:59:01 2020: (1) chap - Using challenge from &request:CHAP-Challenge Wed Jul 22 07:59:01 2020: (1) chap - CHAP challenge : bf61a943b98f4d1b9e9885677705a6b8 Wed Jul 22 07:59:01 2020: (1) chap - Client sent : 526f5b6d5cc40d3d87df334515befc07 Wed Jul 22 07:59:01 2020: (1) chap - We calculated : 72ca08cb516acb819b0ff9d7cc5988c4 Wed Jul 22 07:59:01 2020: ERROR : (1) chap - Password comparison failed: password is incorrect Testing chap with radtest DOES work ok with v4 though, really confusing. Can anyone spot the issue? I've a feeling I've missed something obvious.. :( Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 3

NAS-Port-Type
by Darren Ward (darrward) 22 Jul '20

22 Jul '20

Hi All, Quick question - is it possible to add to the descriptive for the NAS-Port-Type field? For example beyond the RFC there's additional ones defined by consortium or vendor such as IPoE over PW etc In this case I would like to see the descriptive for NAS-Port-Type = 43 appear in the accounting logs as the name rather than integer value Cheers Darren

2 1

Configuration conflict
by Olivier 22 Jul '20

22 Jul '20

Hello, I am facing the following problem and I don't know how to configure FreeRadius for that. I have one WiFi Access point serving 2 SSID with 802.1x enabled. One SSID takes authentication in the form of username(a)domain.example and the other is just username. As it is a single AP, it communicates to FreeRadius with a single IP and is being seen as a single Radius client. Is there a way for me to declare different virtual servers. Is there a way to sort that elegantly beaside using the value of Stripped_User_Domain (and equivalent)? What would be the solution if I add to add a 3rd SSID, with authentication that does not use a domain (but has a different list of users of course)? Best regards, Olivier --

2 1

MSCHAP using multiple domains
by Klemen forneci 21 Jul '20

21 Jul '20

Hello. I know this may not be strictly radius related, but my google-fu is all used up (not much on the subject). Now to the problem: I'm using freeradius 3.13 on centos7 (Upgrading from v2 on centos6). In the modules i have 2 mschap configuration based on user domain (windows domain): mschap mschap_thor { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-THOR} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" } mschap mschap_loki { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-LOKI} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" } In the sitens-enabled/default: Auth-Type MS-CHAP { if(Realm == "um.si") { mschap_thor } elsif(Realm == "guest.um.si") { mschap_thor } elsif(Realm == "student.um.si") { mschap_loki } } When I use mschap_thor everything works. When I try mschap_loki, I get the following error: (2) mschap_loki: ERROR: Program returned code (1) and output 'Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. (0xc0000413)' (2) mschap_loki: External script failed (2) mschap_loki: ERROR: External script says: Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. (0xc0000413) (2) mschap_loki: ERROR: MS-CHAP2-Response is incorrect I've tried adding the radiusd server to the LOKI domain (net ads join), but the error remains. Are there any more settings in freeradius that i've missed or anywhere else. The whole project is on a standstill because of this :/ Thank you and best regards, Klemen

2 2

pam_radius relases
by Adrian Tschira 21 Jul '20

21 Jul '20

Hey there, we recently ran into some trouble on a v6-only migration when we discovered pam_radius did not support IPv6. While the master branch supports IPv6 the latest release, 1.4.0 from 2014, does not include those patches. There is an open issue asking about a new release[1], but it hasn't gotten any attention for a while. Has anyone been working towards a new release and are there any obstacles I could help with? Adrian Tschira [1] https://github.com/FreeRADIUS/pam_radius/issues/42

3 2

Load balancing and ldap group cache
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 21 Jul '20

21 Jul '20

Hi all, Interesting one with v4 migration. With 3.1 and previous we used to load balance over site-based ldap servers closest to the radius box authenticating the user (we've got a few sites, slow links between), e.g. switch &control:Sitename { case site1 { redundant-load-balance { site1_ldap1_authorize site1_ldap2_authorize site2_ldap3_authorize } } Case site2 { .. We then call a later reference to a user group cache in a policy e.g : if (&control:Cached-Ldap-Group && &control:Cached-Ldap-Group[*] =~ /${policy.groupdn-utvid-regexp}/) { Which has also worked fine (NB we've used a custom group cache name "Cached-Ldap-Group") The problem is previous versions used to let you have each ldap instance with the same cache name each time, e.g. ldap site1_ldap1 .. group { .. cache_attribute = "Cached-Ldap-Group" } ldap site1_ldap2 .. group { .. cache_attribute = "Cached-Ldap-Group" } etc .. .. but v4 doesn't seem to: Creating attribute site1_ldap2-LDAP-Group Error creating cache attribute /etc/freeradius/mods-enabled/ldap[94]: Bootstrap failed for module "site1_ldap2". If I rename the cache names to be unique it's ok. Guess I either "find out" which ldap module was called in the redundant-load-balance section and then reference the specific ldap instance cache name later, or somehow getting around having to check the group cache, probably doing another ldap lookup I suppose. Any ideas? Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 2