April 2021 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

RE: EAP-TLS Signature Check Failure
by nabble＠felix.world 12 Jul '22

12 Jul '22

Hi Together, we finally got the issue and for the anyone else, how will face the issue, the fix is quite simple. Update your TPM Firmware! In fact, during the authentication the client is sending a signature which only includes nulls. The packet itself is intact, sizes of the packets are valid and the signature algorithm is also well. The only thing that's not in the tls authentication is a signature. : ```` (4) eap_tls: <<< recv TLS 1.2 (type: 0016) [length 0108] handshake_type: 0f, alert_level: 00, alert_description: 00 0f000104 TLS handshake certificate_verify len 0x000104 = 260 0804 signature algorithm: rsa_pss_rsae_sha256 0100 signature size: 0x0100 = 256 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 000000000000 ```` That's also the reason why some of our clients are able to authenticate and some not, with the key, stored in TPM. Intel ships end customer TPM updater, STM as we know not. We also don't have clients with Infineon chips but they should also ship updates to the end customer. FYI: This was a team operation and thanks to all that helped here. Regards, Lineconnnect <quote author='Users mailing list'> 2 months later, a quick update on this topic (apologies, I may have broken the threading as I don't have a copy of the original e-mails any more!), just so there's an online reference here for anyone encountering the same error. Turns out I was wrong about it being Windows and OpenSSL getting muddled over TLS 1.2 vs. 1.3... To recap: Windows 10 clients, corporate WiFi network using EAP-TLS to RADIUS with machine certificate (SCEP) authentication only. Error in Freeradius logs: (6) eap_tls: ERROR: TLS Alert write:fatal:decrypt error tls: TLS_accept: Error in error (6) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read) (6) eap_tls: ERROR: error:0407E086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last octet invalid (6) eap_tls: ERROR: error:1417B07B:SSL routines:tls_process_cert_verify:bad signature (6) eap_tls: ERROR: System call (I/O) error (-1) (6) eap_tls: ERROR: TLS receive handshake failed during operation (6) eap_tls: ERROR: [eaptls process] = fail After encountering the error on a few machines again, even with "tls_max_version" set, I delved into the guts of Windows again, and found the error (which isn't helpful or descriptive) was actually caused because: * Some machine certificates had were stored/managed by the "Microsoft Platform Crypto Provider" (TPM-backed) * Built-in security measures control access to keys in that CSP, and it cannot be used non-interactively * Windows WiFi profile was set to auto-join (non-interactive) * Windows couldn't get the key, so $deity knows what signature it was sending * OpenSSL rightly got confused The solution: Ensure machine certificate keys are stored in the "Microsoft Software Key Storage Provider" (or another CSP/KSP that permits non-interactive use). All is well again, and I'm close to shutting down NPS :-) -- Peter Bance Information Security Adviser Alan DeKok wrote: > A final update on this, in case anyone here's interested (or to "wrap > up" for anyone stumbling across this thread online) - I fixed it, and > Windows clients are now happily joining WiFi. It's a beautiful thing to > behold :-) > > In the end, I had to force OpenSSL on FreeRADIUS to stop offering > TLS1.3 ciphers using the mods/eap config: > > tls_max_version = "1.2" Good to hear. > It seems there may be a bug in OpenSSL 1.1.1 such that even though the > negotiation resulted in a TLS 1.2 session, the weird back-port of TLS > 1.3 ciphers into TLS 1.2 confused things (a lot), and it tried checking > for TLS 1.3 style signatures inappropriately. Weird, but OK. It's OpenSSL :( Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </quote> Quoted from: http://freeradius.1045715.n5.nabble.com/RE-EAP-TLS-Signature-Check-Failure-… _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com

3 4

EAP-TLS PKI management
by Munroe Sollog 17 Jun '21

17 Jun '21

Has anyone deployed EAP-TLS in concert with BYOD? This Android 11 change that removes the ability for the user to "Do Not Validate" the CA certificate has forced us to re-evaluate our .1x PEAP solution. EAP-TLS seems like the best option, however the onboarding of user-brought devices seems tricky. With MDM or AD-joined devices pushing the certificates out are easy. In an environment where "bring your own device" is encouraged, I'm curious how network admins are making client certificate installations easy enough for end users to do. Android 11 change article for reference: https://www.xda-developers.com/android-11-break-enterprise-wifi-connection/ -- Munroe Sollog (He/Him/His) Senior Network Engineer munroe(a)lehigh.edu

5 7

CentOS 8 packages missing winbind support?
by Josef Vybíhal 14 Jun '21

14 Jun '21

Packages for CentOS 8 at https://networkradius.com/freeradius-packages/ appear to be compiled without winbind support. Is there a reason for that? CentOS 7 package have it - not sure about other distros. ... snip... # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting_syslog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vlanlog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap_winbind" from file /etc/raddb/mods-enabled/mschap /etc/raddb/mods-enabled/mschap[1]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/mschap[1]: Instantiation failed for module "mschap_winbind" P.

6 12

Matching multiple LDAP-groups during post-auth
by Chris Wopat 20 May '21

20 May '21

We use LDAP-groups (from AD, if that matters) to map radius-reply-items for general network access on switches, routers, optical gear, etc. Each vendor is their own special flower so needs its own thing. The way we're handling this currently is in post-auth where we specify reply-items per group using if/elseif/else per https://networkradius.com/doc/3.0.10/unlang/keywords.html. This works great if things are simple - you're a member of one group or another. However, we've not yet gotten it to work if one is a member of multiple groups, and to have each group match and get reply-items from each. Example of now: if (LDAP-Group == "network-administrators") { update reply { cisco-avpair = "shell:priv-lvl=15", Service-Type = "6", Juniper-Local-User-Name = "superuser", PaloAlto-Admin-Role = "superuser", } } elsif (LDAP-Group == "network-users") { update reply { cisco-avpair = "shell:priv-lvl=1", Juniper-Local-User-Name = "op", PaloAlto-Admin-Role = "devicereader", } } else { reject } Note that this will do a single match and bail out of the if statement. What we'd like to do is to keep matching accumulatively. The use case is per above it's layer2/3 devices, we'd like to add some other types of gear to the list where someone in the above groups shouldnt have access to, but someone in network-administrators AND $othergroup should have access to. Per Unlang, it looks like there is a case/switch statement but I believe we'd be hitting the same limitation there. tldr; how can we match multiple LDAP-groups and get reply-items from all that match? Cheers, Chris

4 14

Active Directory authenticated VPN
by Pisch Tamás 12 May '21

12 May '21

Hello, I would like to set up VPN on a Samba DC (Debian Bullseye). I could set it up with ntlm_auth, but I read that ntlm_auth may serve about 30 request per second maximum, and uses smbv1. I would like to filter users by group or msNPAllowDialin AD property. I can use: winbind_username = "%{mschap:User-Name}" winbind_domain = "%{mschap:NT-Domain}" in mschap, but how I can filter users? Regards, Tamas.

4 33

ARTICLE: What does the "unresponsive child" error message mean?
by marketing＠networkradius.com 30 Apr '21

30 Apr '21

** What does "unresponsive child" error message mean? --------------------------------------------- Like any system, FreeRADIUS provides error messages to inform administrators of problems within the FreeRADIUS server itself. Sometimes however, error messages that are logged by FreeRADIUS are actually reporting an indication that something is wrong with one of the connected systems. A common cause of some of these errors is an unexpectedly slow database. The unresponsive child message is essentially a timeout error. It means that a request was sent to the database, and the database hasn’t responded within a set time limit. Most database queries should happen instantaneously from the perspective of a human being, which means much less than one second. In contrast, the unresponsive child message is produced by FreeRADIUS after about 30 seconds! That is, FreeRADIUS is letting you know that it hasn’t heard back from the database in a very long time. This long time to respond indicates a major problem with the database. Read the full article... https://networkradius.com/articles/2021/02/10/what-does-unresponsive-child-… ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/contact/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

FreeRadius with perl, Unknown attribute: Acct-Session-ID
by Fatih Boy 30 Apr '21

30 Apr '21

Hello, I’m trying to use FreeRadius server with perl module. I've install freeradius 3.0.13 on a clean CentOS 7 with perl module. Then enabled perl module by executing following command: ln -s /etc/raddb/mods-available/perl /etc/raddb/mods-enabled/perl Without making any further changes I've run freeradius from commandline using: radiusd -X Then I got the following error; /etc/raddb/policy.d/accounting[42]: Failed parsing expanded string: /etc/raddb/policy.d/accounting[42]: %{md5:%{1},%{Acct-Session-ID}} /etc/raddb/policy.d/accounting[42]: ^ Unknown attribute Note that; After getting error, I've also add following entry to /etc/raddb/users file. Nothing changed... DEFAULT Auth-type := perl I also add entries to file /etc/raddb/sites-available/default described at https://wiki.freeradius.org/modules/Rlm_perl Any ideas on what's wrong with my configuration? Am I missing some installation/configuration steps for perl module? Best, --fatih

2 3

post-auth language for two requirements
by Jessica Cohen 30 Apr '21

30 Apr '21

I am trying to configure post-auth to require both the NAS-IP-address and a script. I don't think AND works in post-auth. At least that's my guess because it's keeps failing. That or my syntax is incorrect. Looking for suggestions or alternatives. Thanks! Example: # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { if (%{NAS-IP-Address} = 10.100.17.52) AND (`/bin/sh /etc/doscripts/get.sh %{User-Name}` =~ /foo-admin/) { update reply { Service-Type == "guest" } noop } else { reject }

3 2

EAP module will no longer accept realmless identities by default
by Arran Cudbard-Bell 29 Apr '21

29 Apr '21

# # require_identity_realm:: Require the the EAP Identity provided contains # a realm. # # If `require_identity_realm` is `nai`, the EAP identity provided must # end with `@<label0>.<label1>[.<labelN>]`, i.e. an '@' followed by at least # two DNS labels. # # If `require_identity_realm` is `yes`, the EAP identity provided must # either match the NAI format described above, or a `Stripped-User-Domain` # attribute must be present in the request list. # This validation mode is intended to be user where Windows machine # authentication is intermixed with user authentication. # # If `require_identity_realm` is `no`, no identity format checks are performed. # It is NOT recommended to use this value. Future security standards will # key off the NAI realm to validate the certificate we (the EAP server) present. # If you do not require an NAI realm be present in the EAP identity string, # your users will not be able to take advantage of this added security when # it is added by OS and device vendors. # # require_identity_realm = nai A new configuration item has been added to the EAP module, which, by default will prevent users from authenticating unless they provide an NAI style realm in the EAP identity string, e.g. foo(a)example.org. This will likely be backported to the v3.0.x branch, though the default value will likely be "no" to avoid point release breakages. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0