May 2021 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

RE: EAP-TLS Signature Check Failure
by nabble＠felix.world 12 Jul '22

12 Jul '22

Hi Together, we finally got the issue and for the anyone else, how will face the issue, the fix is quite simple. Update your TPM Firmware! In fact, during the authentication the client is sending a signature which only includes nulls. The packet itself is intact, sizes of the packets are valid and the signature algorithm is also well. The only thing that's not in the tls authentication is a signature. : ```` (4) eap_tls: <<< recv TLS 1.2 (type: 0016) [length 0108] handshake_type: 0f, alert_level: 00, alert_description: 00 0f000104 TLS handshake certificate_verify len 0x000104 = 260 0804 signature algorithm: rsa_pss_rsae_sha256 0100 signature size: 0x0100 = 256 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 000000000000 ```` That's also the reason why some of our clients are able to authenticate and some not, with the key, stored in TPM. Intel ships end customer TPM updater, STM as we know not. We also don't have clients with Infineon chips but they should also ship updates to the end customer. FYI: This was a team operation and thanks to all that helped here. Regards, Lineconnnect <quote author='Users mailing list'> 2 months later, a quick update on this topic (apologies, I may have broken the threading as I don't have a copy of the original e-mails any more!), just so there's an online reference here for anyone encountering the same error. Turns out I was wrong about it being Windows and OpenSSL getting muddled over TLS 1.2 vs. 1.3... To recap: Windows 10 clients, corporate WiFi network using EAP-TLS to RADIUS with machine certificate (SCEP) authentication only. Error in Freeradius logs: (6) eap_tls: ERROR: TLS Alert write:fatal:decrypt error tls: TLS_accept: Error in error (6) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read) (6) eap_tls: ERROR: error:0407E086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last octet invalid (6) eap_tls: ERROR: error:1417B07B:SSL routines:tls_process_cert_verify:bad signature (6) eap_tls: ERROR: System call (I/O) error (-1) (6) eap_tls: ERROR: TLS receive handshake failed during operation (6) eap_tls: ERROR: [eaptls process] = fail After encountering the error on a few machines again, even with "tls_max_version" set, I delved into the guts of Windows again, and found the error (which isn't helpful or descriptive) was actually caused because: * Some machine certificates had were stored/managed by the "Microsoft Platform Crypto Provider" (TPM-backed) * Built-in security measures control access to keys in that CSP, and it cannot be used non-interactively * Windows WiFi profile was set to auto-join (non-interactive) * Windows couldn't get the key, so $deity knows what signature it was sending * OpenSSL rightly got confused The solution: Ensure machine certificate keys are stored in the "Microsoft Software Key Storage Provider" (or another CSP/KSP that permits non-interactive use). All is well again, and I'm close to shutting down NPS :-) -- Peter Bance Information Security Adviser Alan DeKok wrote: > A final update on this, in case anyone here's interested (or to "wrap > up" for anyone stumbling across this thread online) - I fixed it, and > Windows clients are now happily joining WiFi. It's a beautiful thing to > behold :-) > > In the end, I had to force OpenSSL on FreeRADIUS to stop offering > TLS1.3 ciphers using the mods/eap config: > > tls_max_version = "1.2" Good to hear. > It seems there may be a bug in OpenSSL 1.1.1 such that even though the > negotiation resulted in a TLS 1.2 session, the weird back-port of TLS > 1.3 ciphers into TLS 1.2 confused things (a lot), and it tried checking > for TLS 1.3 style signatures inappropriately. Weird, but OK. It's OpenSSL :( Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </quote> Quoted from: http://freeradius.1045715.n5.nabble.com/RE-EAP-TLS-Signature-Check-Failure-… _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com

3 4

FreeRADIUS Authentication with AD Without Joining AD
by Vertigo Altair 18 Jun '21

18 Jun '21

Hi! I'm trying to use FreeRADIUS with an Active Directory Server. I've read the documentations but the server that FreeRADIUS runs has to join the Active Directory as a client. Is there any way to authenticate users with AD without joining the AD server? P.S.: I'm using MSCHAP protocol.

4 5

EAP-TLS PKI management
by Munroe Sollog 17 Jun '21

17 Jun '21

Has anyone deployed EAP-TLS in concert with BYOD? This Android 11 change that removes the ability for the user to "Do Not Validate" the CA certificate has forced us to re-evaluate our .1x PEAP solution. EAP-TLS seems like the best option, however the onboarding of user-brought devices seems tricky. With MDM or AD-joined devices pushing the certificates out are easy. In an environment where "bring your own device" is encouraged, I'm curious how network admins are making client certificate installations easy enough for end users to do. Android 11 change article for reference: https://www.xda-developers.com/android-11-break-enterprise-wifi-connection/ -- Munroe Sollog (He/Him/His) Senior Network Engineer munroe(a)lehigh.edu

5 7

CentOS 8 packages missing winbind support?
by Josef Vybíhal 14 Jun '21

14 Jun '21

Packages for CentOS 8 at https://networkradius.com/freeradius-packages/ appear to be compiled without winbind support. Is there a reason for that? CentOS 7 package have it - not sure about other distros. ... snip... # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting_syslog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vlanlog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap_winbind" from file /etc/raddb/mods-enabled/mschap /etc/raddb/mods-enabled/mschap[1]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/mschap[1]: Instantiation failed for module "mschap_winbind" P.

6 12

TLS 1.3
by HERCEK, Marián 09 Jun '21

09 Jun '21

Hello, after upgrading to 3.0.22 I can see many authentication problems with old devices (e.g. Android 4.4) Using EAP + MSCHAPv2. I configured tls_min_version to 1.0 and tls_max_version to 1.3. Debug log: (32) eap_peap: (TLS) EAP Got all data (198 bytes) (32) eap_peap: (TLS) Handshake state - before SSL initialization (0) (32) eap_peap: (TLS) Handshake state - Server before SSL initialization (0) (32) eap_peap: (TLS) Handshake state - Server before SSL initialization (0) (32) eap_peap: (TLS) recv TLS 1.3 Handshake, ClientHello (32) eap_peap: (TLS) send TLS 1.0 Alert, fatal protocol_version (32) eap_peap: ERROR: (TLS) Alert write:fatal:protocol version (32) eap_peap: ERROR: (TLS) Server : Error in error (32) eap_peap: ERROR: (TLS) Failed reading from OpenSSL: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (32) eap_peap: ERROR: (TLS) System call (I/O) error (-1) (32) eap_peap: ERROR: (TLS) EAP Receive handshake failed during operation freeradius -Xxv Mon May 31 12:00:32 2021 : Info: radiusd: FreeRADIUS Version 3.0.22 (git #7c658e1c0), for host x86_64-pc-linux-gnu Mon May 31 12:00:32 2021 : Debug: Server was built with: Mon May 31 12:00:32 2021 : Debug: accounting : yes Mon May 31 12:00:32 2021 : Debug: authentication : yes Mon May 31 12:00:32 2021 : Debug: ascend-binary-attributes : yes Mon May 31 12:00:32 2021 : Debug: coa : yes Mon May 31 12:00:32 2021 : Debug: control-socket : yes Mon May 31 12:00:32 2021 : Debug: detail : yes Mon May 31 12:00:32 2021 : Debug: dhcp : yes Mon May 31 12:00:32 2021 : Debug: dynamic-clients : yes Mon May 31 12:00:32 2021 : Debug: osfc2 : no Mon May 31 12:00:32 2021 : Debug: proxy : yes Mon May 31 12:00:32 2021 : Debug: regex-pcre : no Mon May 31 12:00:32 2021 : Debug: regex-posix : yes Mon May 31 12:00:32 2021 : Debug: regex-posix-extended : yes Mon May 31 12:00:32 2021 : Debug: session-management : yes Mon May 31 12:00:32 2021 : Debug: stats : yes Mon May 31 12:00:32 2021 : Debug: systemd : yes Mon May 31 12:00:32 2021 : Debug: tcp : yes Mon May 31 12:00:32 2021 : Debug: threads : yes Mon May 31 12:00:32 2021 : Debug: tls : yes Mon May 31 12:00:32 2021 : Debug: unlang : yes Mon May 31 12:00:32 2021 : Debug: vmps : yes Mon May 31 12:00:32 2021 : Debug: developer : no Mon May 31 12:00:32 2021 : Debug: Server core libs: Mon May 31 12:00:32 2021 : Debug: freeradius-server : 3.0.22 Mon May 31 12:00:32 2021 : Debug: talloc : 2.1.* Mon May 31 12:00:32 2021 : Debug: ssl : 1.1.1d release openssl ciphers -s -v -tls1 ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 openssl ciphers -s -v -tls1_2 ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384 ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256 ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256 ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256 ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256 AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 openssl ciphers -s -v -tls1_3 TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD

4 8

Changing format for $RAD_REQUEST{'Event-Timestamp'} in Perl module
by Юрий Иванов 04 Jun '21

04 Jun '21

Hi, I need to change $RAD_REQUEST{'Event-Timestamp'} format before inserting to database. Looks like $RAD_REQUEST{'date:Event-Timestamp'}, $RAD_REQUEST{'integer:Event-Timestamp'} are not working. Is there any method to use date module or standard keywords in perl code or I should do it manually.

3 4

Problems with Samba
by Klemen forneci 04 Jun '21

04 Jun '21

Hello. I hope someone can shine a light on my problem with Freeradius 3 and mschap (running on centos7 with samba/winbind) So long story short, I notice that every ~5 minutes there is a problem with NTLM_AUTH. Even with testing with radtest -t mscahp at the same time, I get: (10) Auth-Type MS-CHAP { (10) if (Realm == "um.si") { (10) if (Realm == "um.si") -> TRUE (10) if (Realm == "um.si") { (10) mschap_thor: Client is using MS-CHAPv1 with NT-Password (10) mschap_thor: Executing: /usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-THOR} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (10) mschap_thor: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (10) mschap_thor: --> --username=****** (10) mschap_thor: ERROR: No NT-Domain was found in the User-Name (10) mschap_thor: EXPAND --domain=%{%{mschap:NT-Domain}:-THOR} (10) mschap_thor: --> --domain=THOR (10) mschap_thor: mschap1: 31 (10) mschap_thor: EXPAND --challenge=%{%{mschap:Challenge}:-00} (10) mschap_thor: --> --challenge=316c3b72847b74c7 (10) mschap_thor: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (10) mschap_thor: --> --nt-response=273c482ad6ee3eeb8c21239368764a42d66c1b6ca8f0e98e Child PID 5238 is taking too much time: forcing failure and killing child. (10) mschap_thor: ERROR: Failed to read from child output (10) mschap_thor: External script failed (10) mschap_thor: ERROR: External script says: (10) mschap_thor: ERROR: MS-CHAP2-Response is incorrect I know this may not be a radius issue, beause of the fact that in-between the system works as expected and the line: Child PID 5238 is taking too much time: forcing failure and killing child, but I have my hopes up someone can point me in the right direction. On the backend there is a Windows AD, multiple DC (tried setting only 1 in samba, same issue), the server is domain joined. I have multiple servers with the same issue (in the same environment) What allso puzzles me, are the logs: Server 1: Fri May 28 14:35:27 2021 : ERROR: (59476) mschap_thor: ERROR: Failed to read from child output Fri May 28 14:35:31 2021 : ERROR: (59508) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:35:35 2021 : ERROR: (59534) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:03 2021 : ERROR: (60960) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:08 2021 : ERROR: (60993) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:12 2021 : ERROR: (61017) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:14 2021 : ERROR: (61030) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:15 2021 : ERROR: (61040) mschap_loki: ERROR: Failed to read from child output Server 2: Fri May 28 14:38:29 2021 : ERROR: (4) mschap_thor: ERROR: Failed to read from child output Fri May 28 14:38:44 2021 : ERROR: (5) mschap_thor: ERROR: Failed to read from child output It's like a blinker. One works, the other doesnt. Thank you for any tips. Klemen

4 4

eduroam howto log failure mschapv2
by Francesco Malvezzi 02 Jun '21

02 Jun '21

> Fix the samba parts to this and you should be good. > > Read : > https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_D… > > Might help. > > Greetz, > > Louis > > Yes, it would definitely work to log the event on the Directory (it's OpenLDAP here, I wouldn't be able to log anything more than the authentication attempt, but I get it). But it is a lot friendlier to be able to collect all radius logs on radius server, isn'it? Thank you for the hint, Francesco

2 1

TLS Alert read:fatal:internal error
by Piotr Rudzki 30 May '21

30 May '21

I've strange problem with freeradius. It was working as expected and suddenly stopped authenticate wpa2-eap users to active directory. I've recreated whole VM with freeradius server without success. Same credentials work for ikev2 mschapv2 authentication but not for wireless wpa2-eap (android and windows clients). Am I missing something? Below debug log with error: (9) eap: Expiring EAP session with state 0x977b062a947f1f7c (9) eap: Finished EAP session with state 0x977b062a947f1f7c (9) eap: Previous EAP request found for state 0x977b062a947f1f7c, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: Peer indicated complete TLS record size will be 7 bytes (9) eap_peap: Got complete TLS record (7 bytes) (9) eap_peap: [eaptls verify] = length included (9) eap_peap: <<< recv TLS 1.2 [length 0002] (9) eap_peap: ERROR: TLS Alert read:fatal:internal error (9) eap_peap: TLS_accept: Need to read more data: error (9) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error (9) eap_peap: TLS - In Handshake Phase (9) eap_peap: TLS - Application data. (9) eap_peap: ERROR: TLS failed during operation (9) eap_peap: ERROR: [eaptls process] = fail (9) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (9) eap: Sending EAP Failure (code 4) ID 4 length 4 (9) eap: Failed in EAP select (9) [eap] = invalid (9) } # authenticate = invalid (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (9) Post-Auth-Type REJECT { (9) attr_filter.access_reject: EXPAND %{User-Name} (9) attr_filter.access_reject: --> some_domain\\some_user (9) attr_filter.access_reject: Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # Post-Auth-Type REJECT = updated

2 3