December 2021 - Freeradius-Users - lists.freeradius.org

FreeRADIUS 3.0.25 with a singe backslash in user's password
by Burn Zero 03 Dec '21

03 Dec '21

Hi, I noticed some authentication issues recently and saw that it is due to people using backslash \ in their passwords. If there is a single backslash in the password, then FreeRADIUS adds another backslash to it and hence the authentication is rejected. I have: In LDAP module, update { control:My-Raw-Password += 'User-Password' } Then in authorize, ntlm_auth.authorize { if (!control:Auth-Type && User-Password) { update control { User-Password := "%{string:control:My-Raw-Password}" Auth-Type := ntlm_auth } } } I searched several posts in this mailing list but I couldn't get it. Could you please let me know how to parse the backslash as backslash and not to add any extra backslash? Thank you. Regards, BurnZero

2 1

Freeradius, BYOD and certs
by Chris Bradley 03 Dec '21

03 Dec '21

Hi everyone! We're trying to update our freeradius so that it will work with Android 11+ clients without using the "do not validate" option. What we want to do is allow BYOD devices to connect to our freeradius server (using LDAP authentication) and connect by putting the domain entry in for connecting with an android. Freeradius is working fine with LDAP. Ultimately, I'm trying to put a certificate on the freeradius server so that BYOD clients (android 11+ specifically) can authenticate using LDAP *without* them having to download a certificate from somewhere before attempting the connection to freeradius. >From what I understand, I can't do that with a wildcard certificate or a self-signed one. So, if that's possible, I need some guidance on how to get it accomplished and what kind of cert I need to procure. Thanks! -- This message originated from Bartholomew Consolidated School Corporation, Columbus, Indiana. The message and any attachments may be confidential or privileged and are intended only for the individual or entity identified above as the addressee. This email should not be disseminated, distributed, or copied. If you are not the addressee, or if this message has been addressed to you in error, you are not authorized to read, copy or distribute this message or any attachments; and we ask that you please delete it and notify the sender by return e-mail. Delivery of this message and any attachments to any person other than the intended recipient(s) is not intended in any way to waive confidentiality or a privilege. All personal messages express views only of the sender, which are not to be attributed to Bartholomew Consolidated School Corporation, and may not be copied or distributed without this statement.

5 4

HTTP headers
by Stjepan Roić 02 Dec '21

02 Dec '21

Hi, I'm trying to set up EAP-TTLS wifi auth to REST API endpoint. I started with basic config and have local auth working but stuck on getting Access-Accept from the API. I have set up rest module but struggling to insert HTTP headers into the request. Can't find it in the docs and only previous topic I found is this one: http://lists.freeradius.org/pipermail/freeradius-users/2020-July/098472.html where you suggested how to insert headers in post auth methods. I tried the same in my authenticate just before "rest" but this doesn't work. update control { &REST-HTTP-Header :="secret: 1f215f4a27653bd17ddc54e320a1c61e37949fe5" &REST-HTTP-Header :="uuid: 84ce0574-5074-4b53-9ddc-fcb2c935a1b1" &REST-HTTP-Header :="Content-Type: application/json" } rest What is the correct way to insert HTTP header in the request for authentication sent to external REST server and what syntax should be used for multiple headers (I just multiplied rows here but not sure it should be like that)? Thank you

4 15

R: Re: FREERADIUS WITH MULTIPLE LDAP AUTHENTICATION SOURCES
by Diego Forcella 01 Dec '21

01 Dec '21

> Because you listed both modules in the authorization section as: > > authorize { > ... > domain1 > domain2 > ... > } > > The server doesn't know that the "domain1" module is for domain1.com. You have to tell it. You are right, i've listed both , not in authorize section but under authenticate section > You can do regular expression matches on the User-Name: > > if (User-Name =~ /(a)domain1.com/) { > domain1 > } > elsif (User-Name =~ /(a)domain2.com/) { > domain2 > } With your suggestion I tried radtest and works correctly, I then modified using (Realm == domain1) elseif (Realm ==domain2) and it works also in this way, thank you very much for your help I've another problem now, I need to use this with a captive portal that support only chap or ms-chapv2 and when a user try to login to captive portal configured with chap in freeradius log I have the error chap: ERROR: &control:Cleartext-Password is required for authentication or, if I set ms-chapv2 in captive portal, the error is (1) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (1) mschap: Creating challenge hash with username: xxx(a)xxx.com (1) mschap: Client is using MS-CHAPv2 (1) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (1) mschap: ERROR: MS-CHAP2-Response is incorrect It's possible to have chap (or ms-chapv2) and ldap working in freeradius? Thank's again for the support ------------------------------ INFORMATIVA PRIVACY (Reg.UE 2016/679 e D.Lgs.196/2003) Questa email ed i suoi eventuali allegati sono da considerarsi materiale riservato e di proprietà della scrivente società. Nel caso venisse ricevuta per errore non deve essere divulgata, copiata o distribuita per alcuna ragione. Le comunicazioni che transitano attraverso il presente indirizzo di posta elettronica hanno carattere e finalità prettamente lavorative, pertanto potranno essere conosciute all’interno dell’organizzazione aziendale. Qualsiasi dato personale sarà comunque trattato in conformità alle vigenti normative in materia di privacy e protezione dei dati personali. A tale riguardo potete esercitare tutti i diritti previsti dalla legge semplicemente rispondendo alla presente ed esplicitando la vostra richiesta. Maggiori info in materia di privacy: https://www.c2group.it/policy-privacy

2 5

Separating RADIUS Authentication and Accounting functionality
by Network RADIUS 01 Dec '21

01 Dec '21

** Why you should separate RADIUS Authentication and Accounting functionality (sometimes) --------------------------------------- Many ISP networks have Authentication and Accounting handled by the same databases. This configuration works for many situations, especially small and low-load systems. There are times, however, when it is beneficial to separate the functions of Authentication and Accounting. Doing so can increase performance, and scalability. Accounting requests can slow down authentication ISP customers expect to be able to access the network quickly and reliably. To provide a good customer experience, ISPs need the Authentication and Authorization functions to be extremely responsive to user requests. However, Accounting queries to do monthly billing statements can have an enormous impact if they are competing for resources with the Authentication queries. The solution here is to split the functionality in two. We recommend that ISPs deploy at least two separate RADIUS servers at each site. There should be a clear division of responsibilities between the servers. Read the full article… https://networkradius.com/articles/2021/02/10/separate-authentication-and-a… <https://networkradius.com/articles/2021/02/10/separate-authentication-and-a…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/request/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Re: Problem with limiting users to group in Active Directory
by Erik Frangež 01 Dec '21

01 Dec '21

Hi guys, I am still having problems to check if user is member of group... here is cut from logs where is comparison: (31) ldap1-vpn-student: EXPAND (sAMAccountName=%{User-Name}) (31) ldap1-vpn-student: --> (sAMAccountName=erik.frangez1) (31) ldap1-vpn-student: Performing search in "ou=um,dc=loki,dc=um,dc=si" with filter "(sAMAccountName=erik.frangez1)", scope "sub" (31) ldap1-vpn-student: Waiting for search result... (31) ldap1-vpn-student: User object found at DN "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" rlm_ldap (ldap1-vpn-student): Released connection (0) (31) [ldap1-vpn-student] = ok (31) } # redundant = ok (31) policy check_ldap_group_vpn { (31) if (&ldap1-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") { (31) Searching for user in group "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" rlm_ldap (ldap1-student-um): Reserved connection (0) (31) Using user DN from request "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" rlm_ldap (ldap1-student-um): Released connection (0) (31) User is not a member of "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" (31) if (&ldap1-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") -> FALSE (31) elsif (&ldap2-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") { (31) Searching for user in group "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" rlm_ldap (ldap2-student-um): Reserved connection (0) (31) Using user DN from request "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" rlm_ldap (ldap2-student-um): Released connection (0) (31) User is not a member of "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" (31) elsif (&ldap2-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") -> FALSE (31) else { (31) [reject] = reject (31) } # else = reject (31) } # policy check_ldap_group_vpn = reject (31) } # Autz-Type LDAPS-VPN-STUDENT = reject If I run ldapsearch we could see that user is member of group, here: # IDM_VPN, Groups, QUEST, UM, loki.um.si dn: CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si objectClass: top objectClass: group cn: IDM_VPN description:: U2t1cGluYSBqZSBuYW1lbmplbmEgZG9zdG9wdSDFoXR1ZGVudG92IGRvIHN0b3Jp dGV2IFZQTi4gWiBuam8gdXByYXZsamEgSURNLg== member: CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si distinguishedName: CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si instanceType: 4 whenCreated: 20211118102555.0Z Please help me! Best, Erik On 11/29/21 9:38 PM, Alan DeKok wrote: > And I didn't notice in my last reply... > > don't email me off-list. The purpose of the list is to let everyone ELSE see what problems are being solved. Email the list. > > Any further emails sent directly to me will be ignored. > >> On Nov 29, 2021, at 3:07 PM, Erik Frangež <erik(a)frangez.net> wrote: >> >> Can you please help me? Thank you! >> >> >> >> -------- Posredovano sporočilo -------- >> Zadeva: Re: Problem with limiting users to group in Active Directory >> Datum: Sun, 28 Nov 2021 21:45:47 +0100 >> Od: Erik Frangež <erik(a)frangez.net> >> Za: Alan DeKok <aland(a)deployingradius.com> >> >> >> Hi Alan, >> >> here is whole log for one attempt: >> >> (74) Received Access-Request Id 42 from 164.8.15.42:54972 to 164.8.100.71:21812 length 71 >> (74) User-Name = "erik.frangez1" >> (74) User-Password = "*******" >> (74) Service-Type = Authenticate-Only >> (74) NAS-Port = 0 >> (74) NAS-IP-Address = 164.8.15.40 >> (74) # Executing section authorize from file /etc/raddb/sites-enabled/guard_vpn_student >> (74) authorize { >> (74) suffix: Checking for suffix after "@" >> (74) suffix: No '@' in User-Name = "erik.frangez1", looking up realm NULL >> (74) suffix: Found realm "NULL" >> (74) suffix: Adding Stripped-User-Name = "erik.frangez1" >> (74) suffix: Adding Realm = "NULL" >> (74) suffix: Authentication realm is LOCAL >> (74) [suffix] = ok >> (74) guard_vpn_student_file: users: Matched entry DEFAULT at line 1 >> (74) [guard_vpn_student_file] = ok >> (74) } # authorize = ok >> (74) Using Autz-Type LDAPS-VPN-STUDENT >> (74) # Executing group from file /etc/raddb/sites-enabled/guard_vpn_student >> (74) Autz-Type LDAPS-VPN-STUDENT { >> (74) redundant { >> (74) ldap1-vpn-student: EXPAND (sAMAccountName=%{User-Name}) >> (74) ldap1-vpn-student: --> (sAMAccountName=erik.frangez1) >> (74) ldap1-vpn-student: Performing search in "ou=um,dc=loki,dc=um,dc=si" with filter "(sAMAccountName=erik.frangez1)", scope "sub" >> (74) ldap1-vpn-student: Waiting for search result... >> (74) ldap1-vpn-student: User object found at DN "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" >> (74) [ldap1-vpn-student] = ok >> (74) } # redundant = ok >> (74) policy check_ldap_group_vpn_test { >> (74) if (ldap1-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") { >> (74) if (ldap1-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") -> FALSE >> (74) elsif (ldap2-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") { >> (74) elsif (ldap2-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") -> FALSE >> (74) else { >> (74) [reject] = reject >> (74) } # else = reject >> (74) } # policy check_ldap_group_vpn_test = reject >> (74) } # Autz-Type LDAPS-VPN-STUDENT = reject >> (74) Invalid user: [erik.frangez1] (from client guard port 0) >> (74) Using Post-Auth-Type Reject >> (74) Post-Auth-Type sub-section not found. Ignoring. >> (74) Delaying response for 1.000000 seconds >> (74) Sending delayed response >> (74) Sent Access-Reject Id 42 from 164.8.100.71:21812 to 164.8.15.42:54972 length 20 >> (74) Cleaning up request packet ID 42 with timestamp +19 >> >> >> >> User is part of group IDM_VPN on domain LOKI... >> >> Thank you for help! >> >> Best, Erik >> >> On 11/28/21 7:33 PM, Alan DeKok wrote: >>> On Nov 28, 2021, at 12:32 PM, Erik Frangež via Freeradius-Users <freeradius-users(a)lists.freeradius.org> >>> wrote: >>> >>>> I am having problems with configuring Radius authentication limiting users to group in Active directory. >>>> >>>> Here is configuration of LDAP: >>>> >>> We don't need to see that. >>> >>> Read >>> http://wiki.freeradius.org/list-help >>> >>> >>> >>> >>>> In sites-enabled for radius, I have specify this: >>>> >>> We don't need to see that, either. >>> >>> >>>> Authentication is not working. Here are logs: >>>> >>> Part of the logs. But whatever... >>> >>> >>>> rlm_ldap (ldap1): Reserved connection (0) >>>> (392) ldap1: EXPAND (sAMAccountName=%{User-Name}) >>>> (392) ldap1: --> (sAMAccountName=user) >>>> (392) ldap1: Performing search in "ou=ou,dc=domain,dc=dc,dc=dc" with filter "(sAMAccountName=user)", scope "sub" >>>> (392) ldap1: Waiting for search result... >>>> (392) ldap1: User object found at DN "..." >>>> rlm_ldap (ldap1): Released connection (0) >>>> (392) [ldap1] = ok >>>> (392) } # redundant = ok >>>> (392) policy check_ldap_group_vpn { >>>> (392) if (&ldap1-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") { >>>> (392) Searching for user in group "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" >>>> >>> That seems wrong. "ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" ? Why the repetition? >>> >>> The default configuration works. The file mods-available/ldap has detailed instructions for getting it working with Active Directory. >>> >>> Follow the instructions, and it should work. >>> >>> >>>> User is member of group. Same configuration we are having for other domain and its working. >>>> >>> Is it *exactly* the same? i.e. with the same "ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" repetition? >>> >>> Alan DeKok. >>> >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html

2 1