March 2021 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

RE: EAP-TLS Signature Check Failure
by nabble＠felix.world 12 Jul '22

12 Jul '22

Hi Together, we finally got the issue and for the anyone else, how will face the issue, the fix is quite simple. Update your TPM Firmware! In fact, during the authentication the client is sending a signature which only includes nulls. The packet itself is intact, sizes of the packets are valid and the signature algorithm is also well. The only thing that's not in the tls authentication is a signature. : ```` (4) eap_tls: <<< recv TLS 1.2 (type: 0016) [length 0108] handshake_type: 0f, alert_level: 00, alert_description: 00 0f000104 TLS handshake certificate_verify len 0x000104 = 260 0804 signature algorithm: rsa_pss_rsae_sha256 0100 signature size: 0x0100 = 256 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 000000000000 ```` That's also the reason why some of our clients are able to authenticate and some not, with the key, stored in TPM. Intel ships end customer TPM updater, STM as we know not. We also don't have clients with Infineon chips but they should also ship updates to the end customer. FYI: This was a team operation and thanks to all that helped here. Regards, Lineconnnect <quote author='Users mailing list'> 2 months later, a quick update on this topic (apologies, I may have broken the threading as I don't have a copy of the original e-mails any more!), just so there's an online reference here for anyone encountering the same error. Turns out I was wrong about it being Windows and OpenSSL getting muddled over TLS 1.2 vs. 1.3... To recap: Windows 10 clients, corporate WiFi network using EAP-TLS to RADIUS with machine certificate (SCEP) authentication only. Error in Freeradius logs: (6) eap_tls: ERROR: TLS Alert write:fatal:decrypt error tls: TLS_accept: Error in error (6) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read) (6) eap_tls: ERROR: error:0407E086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last octet invalid (6) eap_tls: ERROR: error:1417B07B:SSL routines:tls_process_cert_verify:bad signature (6) eap_tls: ERROR: System call (I/O) error (-1) (6) eap_tls: ERROR: TLS receive handshake failed during operation (6) eap_tls: ERROR: [eaptls process] = fail After encountering the error on a few machines again, even with "tls_max_version" set, I delved into the guts of Windows again, and found the error (which isn't helpful or descriptive) was actually caused because: * Some machine certificates had were stored/managed by the "Microsoft Platform Crypto Provider" (TPM-backed) * Built-in security measures control access to keys in that CSP, and it cannot be used non-interactively * Windows WiFi profile was set to auto-join (non-interactive) * Windows couldn't get the key, so $deity knows what signature it was sending * OpenSSL rightly got confused The solution: Ensure machine certificate keys are stored in the "Microsoft Software Key Storage Provider" (or another CSP/KSP that permits non-interactive use). All is well again, and I'm close to shutting down NPS :-) -- Peter Bance Information Security Adviser Alan DeKok wrote: > A final update on this, in case anyone here's interested (or to "wrap > up" for anyone stumbling across this thread online) - I fixed it, and > Windows clients are now happily joining WiFi. It's a beautiful thing to > behold :-) > > In the end, I had to force OpenSSL on FreeRADIUS to stop offering > TLS1.3 ciphers using the mods/eap config: > > tls_max_version = "1.2" Good to hear. > It seems there may be a bug in OpenSSL 1.1.1 such that even though the > negotiation resulted in a TLS 1.2 session, the weird back-port of TLS > 1.3 ciphers into TLS 1.2 confused things (a lot), and it tried checking > for TLS 1.3 style signatures inappropriately. Weird, but OK. It's OpenSSL :( Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </quote> Quoted from: http://freeradius.1045715.n5.nabble.com/RE-EAP-TLS-Signature-Check-Failure-… _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com

3 4

EAP-TLS PKI management
by Munroe Sollog 17 Jun '21

17 Jun '21

Has anyone deployed EAP-TLS in concert with BYOD? This Android 11 change that removes the ability for the user to "Do Not Validate" the CA certificate has forced us to re-evaluate our .1x PEAP solution. EAP-TLS seems like the best option, however the onboarding of user-brought devices seems tricky. With MDM or AD-joined devices pushing the certificates out are easy. In an environment where "bring your own device" is encouraged, I'm curious how network admins are making client certificate installations easy enough for end users to do. Android 11 change article for reference: https://www.xda-developers.com/android-11-break-enterprise-wifi-connection/ -- Munroe Sollog (He/Him/His) Senior Network Engineer munroe(a)lehigh.edu

5 7

CentOS 8 packages missing winbind support?
by Josef Vybíhal 14 Jun '21

14 Jun '21

Packages for CentOS 8 at https://networkradius.com/freeradius-packages/ appear to be compiled without winbind support. Is there a reason for that? CentOS 7 package have it - not sure about other distros. ... snip... # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting_syslog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vlanlog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap_winbind" from file /etc/raddb/mods-enabled/mschap /etc/raddb/mods-enabled/mschap[1]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/mschap[1]: Instantiation failed for module "mschap_winbind" P.

6 12

Matching multiple LDAP-groups during post-auth
by Chris Wopat 20 May '21

20 May '21

We use LDAP-groups (from AD, if that matters) to map radius-reply-items for general network access on switches, routers, optical gear, etc. Each vendor is their own special flower so needs its own thing. The way we're handling this currently is in post-auth where we specify reply-items per group using if/elseif/else per https://networkradius.com/doc/3.0.10/unlang/keywords.html. This works great if things are simple - you're a member of one group or another. However, we've not yet gotten it to work if one is a member of multiple groups, and to have each group match and get reply-items from each. Example of now: if (LDAP-Group == "network-administrators") { update reply { cisco-avpair = "shell:priv-lvl=15", Service-Type = "6", Juniper-Local-User-Name = "superuser", PaloAlto-Admin-Role = "superuser", } } elsif (LDAP-Group == "network-users") { update reply { cisco-avpair = "shell:priv-lvl=1", Juniper-Local-User-Name = "op", PaloAlto-Admin-Role = "devicereader", } } else { reject } Note that this will do a single match and bail out of the if statement. What we'd like to do is to keep matching accumulatively. The use case is per above it's layer2/3 devices, we'd like to add some other types of gear to the list where someone in the above groups shouldnt have access to, but someone in network-administrators AND $othergroup should have access to. Per Unlang, it looks like there is a case/switch statement but I believe we'd be hitting the same limitation there. tldr; how can we match multiple LDAP-groups and get reply-items from all that match? Cheers, Chris

4 14

Massaging the behavior of LDAP-Group caching?
by Braden McGrath 07 Apr '21

07 Apr '21

All, I ran into a problem with LDAP-Group and a DN that it was not able to find a friendly name for. I have a function called "group_authz" (loaded from a file in policy.d) that gets called in the post-auth{} section of my site. The function just does a few if comparisons against &LDAP-Group[*] and then updates the reply to the NAS with attributes. I ran into a situation where one of the groups it pulled from a user's memberOf list "did not resolve to an object," which then causes rlm_ldap to return "invalid" and thus rejects the whole attempt. The group it choked on is something used internally by FreeIPA. It's not a group I care about, and not user-created (it's not even visible inside the standard FreeIPA interface). There are actually multiple groups like this that I presume it will complain about, if it wasn't failing at the first one. I was able to work around the problem by trying to match on the full DN instead of the friendly name, but this is obviously a bit harder to read in the config, and I'd prefer to use the friendly names if I can find a way to make it work. Is there a way to tell LDAP-Group to ignore any DN that it finds that it can't "resolve", instead of throwing an "invalid"? Or, is there a way to get the LDAP-Group lookup process to only attempt to resolve DNs that match a specified base/filter? The base_dn in the group{} stanza of the ldap module is already set to the portion of the tree I care about, but LDAP-Group seems to still try to resolve the DNs that aren't in that base (presumably because it's just reading them from "memberOf"). If I have to just stick to matching on full DNs, I will... was just trying to learn if there was a way to deal with this lookup failure gracefully. :-) Snippet of log output in the failure state is below... In this case, I had cacheable_names=yes enabled, but I disabled caching later to test further (caching itself isn't the problem, it's just the unresoveable DN). (0) ldap: Performing search in "cn=users,cn=accounts,dc=foobar,dc=org" with filter "(uid=admin-person)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=admin-person,cn=users,cn=accounts,dc=foobar,dc=org" (0) ldap: Resolving group DN "cn=admins,cn=groups,cn=accounts,dc=foobar,dc=org" to group name (0) ldap: Performing unfiltered search in "cn=admins,cn=groups,cn=accounts,dc=foobar,dc=org", scope "base" (0) ldap: Waiting for search result... (0) ldap: Group DN "cn=admins,cn=groups,cn=accounts,dc=foobar,dc=org" resolves to name "admins" (0) ldap: Resolving group DN "cn=Replication Administrators,cn=privileges,cn=pbac,dc=foobar,dc=org" to group name (0) ldap: Performing unfiltered search in "cn=Replication Administrators,cn=privileges,cn=pbac,dc=foobar,dc=org", scope "base" (0) ldap: Waiting for search result... (0) ldap: Search returned no results (0) ldap: ERROR: Group DN "cn=Replication Administrators,cn=privileges,cn=pbac,dc=foobar,dc=org" did not resolve to an object rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ipa1.foobar.org:389 ldap://ipa2.foobar.org:389 ldap://ipa3.foobar.org:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = invalid (0) } # authorize = invalid (0) Invalid user (ldap: Group DN "cn=Replication Administrators,cn=privileges,cn=pbac,dc=foobar,dc=org" did not resolve to an object): [admin-person] (from client dc-srv- sw01 port 11526) (0) Using Post-Auth-Type Reject I appreciate any suggestions! Cheers, Braden

2 4

Fwd: Duplicate module "sql sql", in file /etc/freeradius/mods-enabled/sql
by rajabu kitindi 06 Apr '21

06 Apr '21

Folks I have no idea what's going on here, this is version 3.0.21 latest version. How do we solve this? I am running freeradius -X Raj -- MOTD: When we stop to think, we often miss our opportunity -- MOTD: When we stop to think, we often miss our opportunity

2 6

COA NAK simulation from server using radclient
by tejeswi 05 Apr '21

05 Apr '21

Hi Team, We are in need of your support to generate COA NAK message from server. Attached is the output of radiusd server output. Please help us in resolving this issue. Please note that we tried almost all possible ways to simulate COA NAk form server POV but no luck. -- ------------------------ Regards Tejeswi K -----------------------

2 6

Authorization problem in wireless networks in windows 10 for eduroam
by Vahap Can Dulkadiroğlu 31 Mar '21

31 Mar '21

Hello, For our university, we want to do Eduroam verification over FreeRadius (using version 3 and LDAP) using EAP-TTLS / PAP in Microsoft Windows 10 operating systems, but the password cannot be verified (access-challenge) because FreeRadius does not receive clear text. The same protocols (EAP-TTLS / PAP) are performed successfully for the Android operating system and ubuntu operating systems. As Freeradius stated in the directory settings, we think that the answer to this challenge is because there is no windows certificate compatibility. How can we solve this problem ? We look forward to your help. I share the relevant photos with you Vahap Can DULKADİROĞLU *Bilgi İşlem Daire Başkanlığı **/ Elektronik ve Haberleşme Mühendisi* *can.dulkadiroglu(a)samsun.edu.tr <can.dulkadiroglu(a)samsun.edu.tr>* 0(362) 313 00 55 - 1454 Canik Yerleşkesi Gürgenyatak Mahallesi Merkez Sokak No:40-2/1 CANİK/SAMSUN www.samsun.edu.tr *SAMSUN ÜNİVERSİTESİ* *‘‘Nitelikli Toplum İçin, Nitelikli Üniversite’’*

2 1

802.1x issues with different NAS' types
by Marco Miglietta 31 Mar '21

31 Mar '21

Hi. In order to solve the problem in passing VLAN related attribute during 802.1x authentication with Aruba AP, I found the post below useful. But this caused problems with VLAN assignment on Junipers switches during the 802.1x authentication process. What is a way to solve the problem? The solutions seem to be mutually exclusive. Thanks. Marco. ______________________________________________________________________________________________ Sending an attribute with the Access-Accept instead of Access-Challenge Phil Mayers p.mayers at imperial.ac.uk Wed Jan 12 18:00:05 CET 2011 Previous message: Sending an attribute with the Access-Accept instead of Access-Challenge Next message: Sending an attribute with the Access-Accept instead of Access-Challenge Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] On 12/01/11 16:33, Vivek Umasuthan wrote: > Hi All, > I am testing 802.1x support on our platform and I'm having trouble > figuring out how to include some attributes with Access-Accept. I read > the 'users' file man page but could not get the answer. You need to add the attribute in the "inner-tunnel" virtual server, and ensure you've set: use_tunneled_reply = yes ...in the "peap {}" section of "eap.conf" Previous message: Sending an attribute with the Access-Accept instead of Access-Challenge Next message: Sending an attribute with the Access-Accept instead of Access-Challenge Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] More information about the Freeradius-Users mailing list --

4 6