February 2021 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

RE: EAP-TLS Signature Check Failure
by nabble＠felix.world 12 Jul '22

12 Jul '22

Hi Together, we finally got the issue and for the anyone else, how will face the issue, the fix is quite simple. Update your TPM Firmware! In fact, during the authentication the client is sending a signature which only includes nulls. The packet itself is intact, sizes of the packets are valid and the signature algorithm is also well. The only thing that's not in the tls authentication is a signature. : ```` (4) eap_tls: <<< recv TLS 1.2 (type: 0016) [length 0108] handshake_type: 0f, alert_level: 00, alert_description: 00 0f000104 TLS handshake certificate_verify len 0x000104 = 260 0804 signature algorithm: rsa_pss_rsae_sha256 0100 signature size: 0x0100 = 256 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 000000000000 ```` That's also the reason why some of our clients are able to authenticate and some not, with the key, stored in TPM. Intel ships end customer TPM updater, STM as we know not. We also don't have clients with Infineon chips but they should also ship updates to the end customer. FYI: This was a team operation and thanks to all that helped here. Regards, Lineconnnect <quote author='Users mailing list'> 2 months later, a quick update on this topic (apologies, I may have broken the threading as I don't have a copy of the original e-mails any more!), just so there's an online reference here for anyone encountering the same error. Turns out I was wrong about it being Windows and OpenSSL getting muddled over TLS 1.2 vs. 1.3... To recap: Windows 10 clients, corporate WiFi network using EAP-TLS to RADIUS with machine certificate (SCEP) authentication only. Error in Freeradius logs: (6) eap_tls: ERROR: TLS Alert write:fatal:decrypt error tls: TLS_accept: Error in error (6) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read) (6) eap_tls: ERROR: error:0407E086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last octet invalid (6) eap_tls: ERROR: error:1417B07B:SSL routines:tls_process_cert_verify:bad signature (6) eap_tls: ERROR: System call (I/O) error (-1) (6) eap_tls: ERROR: TLS receive handshake failed during operation (6) eap_tls: ERROR: [eaptls process] = fail After encountering the error on a few machines again, even with "tls_max_version" set, I delved into the guts of Windows again, and found the error (which isn't helpful or descriptive) was actually caused because: * Some machine certificates had were stored/managed by the "Microsoft Platform Crypto Provider" (TPM-backed) * Built-in security measures control access to keys in that CSP, and it cannot be used non-interactively * Windows WiFi profile was set to auto-join (non-interactive) * Windows couldn't get the key, so $deity knows what signature it was sending * OpenSSL rightly got confused The solution: Ensure machine certificate keys are stored in the "Microsoft Software Key Storage Provider" (or another CSP/KSP that permits non-interactive use). All is well again, and I'm close to shutting down NPS :-) -- Peter Bance Information Security Adviser Alan DeKok wrote: > A final update on this, in case anyone here's interested (or to "wrap > up" for anyone stumbling across this thread online) - I fixed it, and > Windows clients are now happily joining WiFi. It's a beautiful thing to > behold :-) > > In the end, I had to force OpenSSL on FreeRADIUS to stop offering > TLS1.3 ciphers using the mods/eap config: > > tls_max_version = "1.2" Good to hear. > It seems there may be a bug in OpenSSL 1.1.1 such that even though the > negotiation resulted in a TLS 1.2 session, the weird back-port of TLS > 1.3 ciphers into TLS 1.2 confused things (a lot), and it tried checking > for TLS 1.3 style signatures inappropriately. Weird, but OK. It's OpenSSL :( Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </quote> Quoted from: http://freeradius.1045715.n5.nabble.com/RE-EAP-TLS-Signature-Check-Failure-… _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com

3 4

EAP-TLS PKI management
by Munroe Sollog 17 Jun '21

17 Jun '21

Has anyone deployed EAP-TLS in concert with BYOD? This Android 11 change that removes the ability for the user to "Do Not Validate" the CA certificate has forced us to re-evaluate our .1x PEAP solution. EAP-TLS seems like the best option, however the onboarding of user-brought devices seems tricky. With MDM or AD-joined devices pushing the certificates out are easy. In an environment where "bring your own device" is encouraged, I'm curious how network admins are making client certificate installations easy enough for end users to do. Android 11 change article for reference: https://www.xda-developers.com/android-11-break-enterprise-wifi-connection/ -- Munroe Sollog (He/Him/His) Senior Network Engineer munroe(a)lehigh.edu

5 7

CentOS 8 packages missing winbind support?
by Josef Vybíhal 14 Jun '21

14 Jun '21

Packages for CentOS 8 at https://networkradius.com/freeradius-packages/ appear to be compiled without winbind support. Is there a reason for that? CentOS 7 package have it - not sure about other distros. ... snip... # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting_syslog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vlanlog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap_winbind" from file /etc/raddb/mods-enabled/mschap /etc/raddb/mods-enabled/mschap[1]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/mschap[1]: Instantiation failed for module "mschap_winbind" P.

6 12

Fwd: Question regarding the direction of eap_tls: <<< recv and eap_tls: >>> send
by Eric Nguyen 17 Mar '21

17 Mar '21

Hi, I'd like to ask a question regarding the direction of the exchanges in the radius log (radiusd -X). I used eapol_test as a client/authenticator against FreeRADIUS 3.0.21. - If I set the following parameters in the FreeRADIUS eap file, espol_test will results in a failure. In this case, "eap_tls: <<< recv TLS 1.3" looks like an exchange from FreeRADIUS to eapol_test (SERVER -> CLIENT): tls_min_version = "1.3" tls_max_version = "1.3" The FREERADIUS log shows: (2) eap_tls: <<< recv TLS 1.3 [length 00b9] (2) eap_tls: >>> send TLS 1.2 [length 0002] (2) eap_tls: ERROR: TLS Alert write:fatal:protocol version - If I set the following parameters in the FreeRADIUS eap file, espol_test will results in a success. In this case, "eap_tls: <<< recv TLS 1.2" looks like an exchange from eapol_test to FreeRADIUS (CLIENT TO SERVER): tls_min_version = "1.2" tls_max_version = "1.3" (6) eap_tls: <<< recv TLS 1.2 [length 08de] (6) eap_tls: TLS - Creating attributes from certificate OIDs Could you please clarify the meaning of these "eap_tls: <<< recv" log messages? Thanks, Eric ------------------------------------------------------------------------------------------------------------------------------------------- FULL LOG tls_min_version = "1.3" tls_max_version = "1.3" (2) eap: Calling submodule eap_tls to process data (2) eap_tls: Continuing EAP-TLS (2) eap_tls: [eaptls verify] = ok (2) eap_tls: Done initial handshake (2) eap_tls: (other): before SSL initialization (2) eap_tls: TLS_accept: before SSL initialization (2) eap_tls: TLS_accept: before SSL initialization (2) eap_tls: <<< recv TLS 1.3 [length 00b9] (2) eap_tls: >>> send TLS 1.2 [length 0002] (2) eap_tls: ERROR: TLS Alert write:fatal:protocol version tls: TLS_accept: Error in error (2) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (2) eap_tls: ERROR: System call (I/O) error (-1) (2) eap_tls: ERROR: TLS receive handshake failed during operation (2) eap_tls: ERROR: [eaptls process] = fail (2) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (2) eap: Sending EAP Failure (code 4) ID 54 length 4 (2) eap: Failed in EAP select (2) [eap] = invalid (2) } # authenticate = invalid ------------------------------------------------------------------------------------------------------------------------------------------- tls_min_version = "1.2" tls_max_version = "1.3" (6) eap: Calling submodule eap_tls to process data (6) eap_tls: Continuing EAP-TLS (6) eap_tls: Got final TLS record fragment (1272 bytes) (6) eap_tls: [eaptls verify] = ok (6) eap_tls: Done initial handshake (6) eap_tls: TLS_accept: SSLv3/TLS write server done (6) eap_tls: <<< recv TLS 1.2 [length 08de] (6) eap_tls: TLS - Creating attributes from certificate OIDs (6) eap_tls: TLS-Cert-Serial := "315fa3c827cb5c44e13222c88ff80369d1a176f1" (6) eap_tls: TLS-Cert-Expiration := "210113170058Z" (6) eap_tls: TLS-Cert-Valid-Since := "201114170058Z" (6) eap_tls: TLS-Cert-Subject := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Cert-Issuer := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Cert-Common-Name := "Example Certificate Authority" (6) eap_tls: TLS - Creating attributes from certificate OIDs (6) eap_tls: TLS-Client-Cert-Serial := "02" (6) eap_tls: TLS-Client-Cert-Expiration := "210113170058Z" (6) eap_tls: TLS-Client-Cert-Valid-Since := "201114170058Z" (6) eap_tls: TLS-Client-Cert-Subject := "/C=FR/ST=Radius/O=Example Inc./CN=user@example.org/emailAddress=user@example.org" (6) eap_tls: TLS-Client-Cert-Issuer := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress= admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Client-Cert-Common-Name := "user(a)example.org" (6) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" (6) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (6) eap_tls: TLS_accept: SSLv3/TLS read client certificate (6) eap_tls: <<< recv TLS 1.2 [length 0046] (6) eap_tls: TLS_accept: SSLv3/TLS read client key exchange (6) eap_tls: <<< recv TLS 1.2 [length 0108] (6) eap_tls: TLS_accept: SSLv3/TLS read certificate verify (6) eap_tls: TLS_accept: SSLv3/TLS read change cipher spec (6) eap_tls: <<< recv TLS 1.2 [length 0010] (6) eap_tls: TLS_accept: SSLv3/TLS read finished (6) eap_tls: >>> send TLS 1.2 [length 0001] (6) eap_tls: TLS_accept: SSLv3/TLS write change cipher spec (6) eap_tls: >>> send TLS 1.2 [length 0010] (6) eap_tls: TLS_accept: SSLv3/TLS write finished (6) eap_tls: (other): SSL negotiation finished successfully (6) eap_tls: TLS - Connection Established (6) eap_tls: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) eap_tls: TLS-Session-Version = "TLS 1.2" (6) eap_tls: TLS - got 51 bytes of data (6) eap_tls: [eaptls process] = handled

3 3

Standard & Realm Authentication
by Richard J Palmer 02 Mar '21

02 Mar '21

Hello All We have been using FreeRadius for quite a long time to authenticate PPPoE and L2TP sessions and hotspots. So far everything works. However I'd like to add an extra function and wondered if you could provide a pointers, Generally Users send their username - we look in SQL and return Data from radreply / ip pools etc. We have no problem there. On our LNS / LAC Devices we also have a small number of sessions that we forward to other ISPs. With these we don't have the username - but forward based on realm On our LNS We have: --- <match name="EXAMPLE-FWD" graph="EXAMPLE-FWD" username="*myexample.co.uk @example.ws" payload-table="0" relay-pick="true" relay-ip="1.2.3.4 1.2.3.5" relay-secret="test123" relay-hostname="test-hostname"/> --- As an alternative the LNS can get this data from Radius - and given the growing number of LNS devices - rather than keeping the sync up to date on multiple devices it makes sence to run this as part of the radius. NOTE this is not a radius proxy - where we pass on the radius request if it's a matching realm - BUT a radius reply to the LNS telling it to forward the connection on to the customers LNS. What I am trying to achieve in FreeRadius is 1) If there's an exact username (as now) continue as now 2) IF there's not a match either run a second SQL which will find the realm - and return accept. And then pass back the necessary attributes back to allow the session to forward. Pretty happy to do most of the work here but some pointers would be perfect. I could I suppose do this by replacing the SQL query with a stored procedure - but open to any better ideas? Thanks in advance Richard

3 6

sqlippool, same username, give different pool IP addresses
by Alberio Mirko 26 Feb '21

26 Feb '21

hello there, I am using a freeradius instance for assigning PPPoE public ip addresses to our customers. Also I created a different ip pool for service purpose, we have a service PPPoE single username for the management of the routers and it is always the same, the goal is that when the router is connected to our network it gets a private management IP so we can access and configure it. The management IP should be took from the aforemented pool, dynamically, and freed when the router is configured. So for example pool is: 172.16.0.1 172.16.0.2 172.16.0.3 172.16.0.4 routerA authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 routerB authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.2 ... etc. Could this can be done using freeradius and its modules? At the moment using sqlippool I can only get the same user to get always the same ip, example: routerA authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 routerB authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 ... etc. can somebody help me? Thanks-a-lot! I attach the debugfile as intended. -- Mirko Alberio mirko.alberio(a)telemar.it

2 1

Freeradius3.x with Openldap Authorization
by Srijan 26 Feb '21

26 Feb '21

Hello, greetings.. I got some queries related to openldap authentication and authorization, followed ldap_howto.rst. Able to Authenticate via ldap but for authorization not working according to userwise's profiles.. how can i obtain user's profile. if i put default profile then it works and reply same to all users, Here's my ldap config: ldap { server = 'localhost' identity = 'cn=adm,dc=xyx,dc=com.' base_dn = 'ou=radius,dc=xyz,dc=com' update { control:Password-With-Header += 'userPassword' control:Expiration := 'radiusExpiration' control:Calling-Station-Id := 'radiusCallingStationId' control:NAS-Identifier := 'radiusNASIdentifier' control:Simultaneous-Use := 'radiusSimultaneousUse' reply:Reply-Message := 'radiusReplyMessage' control:NT-Password := 'ntPassword' reply:Idle-Timeout := 'radiusIdleTimeout' reply:Session-Timeout := 'radiusSessionTimeout' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" sasl { } } profile { filter = '(objectclass=radiusprofile)' default = 'uid=planx,ou=profiles,ou=radius,dc=xyz,dc=com' attribute = 'radiusProfileDn' } Result with Default profile config: Sent Access-Request Id 188 from 0.0.0.0:60201 to 127.0.0.1:1812 length 77 User-Name = "user1" User-Password = "user123" NAS-IP-Address = 10.21.8.10 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "user123" Received Access-Accept Id 188 from 127.0.0.1:1812 to 127.0.0.1:60201 length 104 Idle-Timeout = 600 Session-Timeout = 86400 Acct-Interim-Interval = 10800 ERX-Egress-Policy-Name = "20MD" ERX-Ingress-Policy-Name = "20MU" MS-Primary-DNS-Server = 1.1.1.1 MS-Secondary-DNS-Server = 9.9.9.9 Framed-Pool = "staff-pool" Openldap: # planx, profiles, radius, xyz.com dn: uid=planx,ou=profiles,ou=radius,dc=xyz,dc=com cn: planx radiusIdleTimeout: 600 radiusSessionTimeout: 86400 radiusServiceType: Framed-User radiusFramedProtocol: PPP uid: planx objectClass: radiusObjectProfile objectClass: radiusprofile radiusReplyAttribute: Acct-Interim-Interval := 10800 radiusReplyAttribute: ERX-Egress-Policy-Name := 10MD radiusReplyAttribute: ERX-Ingress-Policy-Name := 20MU radiusReplyAttribute: MS-Primary-DNS-Server := 1.1.1.1 radiusReplyAttribute: MS-Secondary-DNS-Server := 9.9.9.9 radiusReplyAttribute: Framed-Pool := staff-pool # plany, profiles, radius, xyz.com dn: uid=plany,ou=profiles,ou=radius,dc=xyz,dc=com cn: plany objectClass: radiusObjectProfile objectClass: radiusprofile objectClass: top radiusFramedProtocol: PPP radiusIdleTimeout: 600 radiusServiceType: Framed-User radiusSessionTimeout: 86400 uid: plany radiusReplyAttribute: Acct-Interim-Interval := 10800 radiusReplyAttribute: ERX-Egress-Policy-Name := 10MD radiusReplyAttribute: ERX-Ingress-Policy-Name := 10MU radiusReplyAttribute: MS-Primary-DNS-Server := 1.1.1.1 radiusReplyAttribute: MS-Secondary-DNS-Server := 9.9.9.9 radiusReplyAttribute: Framed-Pool := default-pool # users, radius, xyz.com dn: ou=users,ou=radius,dc=xyz,dc=com objectClass: organizationalUnit objectClass: top ou: users dn: uid=user1,ou=users,ou=radius,dc=xyz,dc=com radiusGroupName: planx uid: user1 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: radiusprofile *is " radiusGroupName:" obsolete in Freeradius3 ?* dn: uid=user2,ou=users,ou=radius,dc=xyz,dc=com radiusGroupName: plany uid: user2 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: radiusprofile ----- How can I obtain a user's profile, please suggest.. Regards, Srijan

2 1

Change Of Authorization
by Hassan, Hazem (Nokia - EG/Cairo) 26 Feb '21

26 Feb '21

Hi , Is it possible to do COA via FreeRadius ? If yes how? Thanks, Hazem

3 2

Upgrade freeradius from version 3.0.16 to 3.0.21
by Brahim Bouchaiba 24 Feb '21

24 Feb '21

Hi, I'm new to freeradius and was tasked with upgrading Freeradius on ubuntu . Right now we are on version 3.0.16 and we would like to upgrade to version 3.018. I have searched around and can't seem to find any article or link on that process. Do we just run apt update and apt --list upgradable then apt--only-upgrade install freeradius, I have already backed up all the files in /etc/freeradius Please help. Thanks.

3 2