February 2022 - Freeradius-Users - lists.freeradius.org

Advice on RADIUS security and MD5 encryption?
by Ole Holm Nielsen 25 Feb '22

25 Feb '22

We're using the pam_radius module for SSH login authentication on a CentOS 7 server. Our university's RADIUS server is a Microsoft Windows server. This seems to work well. Some of my colleagues are wary about using RADIUS for authentication because the network traffic is encrypted with the obsolete MD5 algorithm. I would like to understand if this is a relevant objection or not for the present case. The Wikipedia article https://en.wikipedia.org/wiki/RADIUS does raise some security concerns. Question: When the user's password hash is transmitted across the network, how secure is the password from decryption by eavesdroppers? Are there any good articles on RADIUS security? Thanks for sharing any insights. Ole -- Ole Holm Nielsen PhD, Senior HPC Officer Department of Physics, Technical University of Denmark

2 2

Using variables in unlang conditions
by Rahman Duran 24 Feb '22

24 Feb '22

Hi, I am trying to do some filtering/policing in the authorize section of the default virtual server. I need to check source ip matches our Wireless Controllers and SSID and username format etc then decide what to do with the request. How can I user some kind of alias/variable for our IP address block so I should not need to write and update IP addresses multiple places? Here sample of what I try to achieve: ////////////////////// etu_aruba_wlc_001 = 10.10.243.0/24 etu_aruba_wlc_002 = 10.10.244.0/24 etu_aruba_wlc_002 = 10.10.245.0/24 ### 001: Test Wifi Service ### *if ((&Packet-Src-IP-Address < ${etu_aruba_wlc_001}) \* && (&NAS-Port-Type == "Wireless-802.11") \ && (&Called-Station-SSID == "bidb-test") \ && (&User-Name =~ /[0-9a-fA-F]{12}/)) { update request { &ETU-Radius-Service-Name := "BIDB_Test" } # Authentication source files_bidb_test_mac_list # Authentication modules pap # If this service match, do not continue to check rest of the section return } ### 002: Simulation Lab Service ### * if ((&Packet-Src-IP-Address < ${etu_aruba_wlc_001}) \* && (&NAS-Port-Type == "Wireless-802.11") \ && (&Called-Station-SSID == "saglik_bilimleri-sim-lab") \ && (&User-Name =~ /[0-9a-fA-F]{12}/)) { update request { &ETU-Radius-Service-Name := "Saglik_Bilimleri_Sim_Lab" } # Authentication source files_saglik_bilimleri_sim_lab_mac_list # Authentication modules pap # If this service match, do not continue to check rest of the section return } ### DEFAULT REJECT: If no service matched reject undefined request directly here ### update session-state { Module-Failure-Message := "No matching service found for this request!" } reject ///////////////////// Well using variables (${...}) in conditions not working, Freeradius daemon not starting with parse error: /etc/freeradius/3.0/sites-enabled/default[40]: ((&Packet-Src-IP-Address < *${etu_aruba_wlc_001}) * && (&NAS-Port-Type == "Wireless-80... /etc/freeradius/3.0/sites-enabled/default[40]: ^ Failed to parse value for attribute Any hint on this? If it is possible I want to define IP blocks and groups of IP blocks if possible and use them in unlang conditions. Regards, Rahman Duran Bilgi İşlem Daire Başkanlığı Erzurum Teknik Üniversitesi

3 2

pam_radius module: How to reject authentication immediately when RADIUS fails?
by Ole Holm Nielsen 23 Feb '22

23 Feb '22

I could not find this question as an FAQ or by google searches, so can anyone help? We have a CentOS 7 server setup where user SSH logins require RADIUS authentication from our university's central RADIUS server. Local password authentication must be prohibited. This is sort of working, yet is not 100% satisfactory. Question: If the user fails RADIUS authentication, how can we reject the SSH login immediately without proceeding to other authentication methods? Our setup: I have installed the pam_radius RPM package from EPEL and added this line near the top of /etc/pam.d/sshd: auth sufficient pam_radius_auth.so debug While this works correctly when the user authenticates successfully with the central RADIUS server, failed authentications just makes PAM proceed to succeeding modules in /etc/pam.d/sshd (see below) which permit local password logins. This is what we want to prohibit! So I replaced the above line by a more strict rule: auth [success=done default=die] pam_radius_auth.so debug This sort of works: Failed authentications keep asking the user for a password 5 times and eventually fails as desired: Password: Password: Password: <user@server>'s password: Permission denied, please try again. <user@server>'s password: Received disconnect from <IP> port 22:2: Too many authentication failures Authentication failed. Question: Does anyone have a method for /etc/pam.d/sshd which will skip the superfluous password questions and reject the user immediately if RADIUS fails? FYI, the /etc/pam.d/sshd file distributed by the EPEL RPM is: #%PAM-1.0 auth required pam_sepermit.so auth substack password-auth auth include postlogin # Used with polkit to reauthorize users in remote sessions -auth optional pam_reauthorize.so prepare account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth session include postlogin # Used with polkit to reauthorize users in remote sessions -session optional pam_reauthorize.so prepare Thanks, Ole -- Ole Holm Nielsen PhD, Senior HPC Officer Department of Physics, Technical University of Denmark

3 7

Understanding dynamic radiusClients in openldap
by Dave Macias 22 Feb '22

22 Feb '22

Hello, Looking here: https://github.com/FreeRADIUS/freeradius-server/blob/master/doc/schemas/lda… And here: https://github.com/FreeRADIUS/freeradius-server/blob/9e6d1e60aa2e829a186b87… Im trying to create a client for a NAS in my ldap service dn: cn=xx:xx:xx:xxff:fe57:cd00,ou=clients,ou=radius,dc=datacom,dc=net objectClass: radiusClient cn: xx:xx:xx:xxff:fe57:cd00 radiusClientShortname: location1 radiusClientIdentifier: name-of-nas radiusClientSecret: asdfasdfasdfasdf123123asdf But I get: ldap_add: Object class violation (65) additional info: attribute 'cn' not allowed Which makes sense since the schema does not have `cn` .... so trying to understand how to add a radiusClient. I've also tried instead of cn, ou but same output. Does anyone have a sample ldif? Looking at the dynamic-clients file, it says about setting the "location" attribute but I don't see it... Any input is much appreciated! Thank you, Dave

4 17

AD group and Reply Attribute
by ReZa Esfahani 22 Feb '22

22 Feb '22

Hello, I have Microsoft Active Directory as a users database in my company. i have 10 Different Group in my AD and i want to send specific attributes for each group to NAS, I also integrate my AD with freeradius, but i don't know how to send these attribute to nas and i dont know where i made mistake? users file ....................................... DEFAULT Ldap-Group == "CN=student,OU=IT,OU=FDM,DC=test,DC=com", Service-Type = Framed-User, Framed-Protocol = PPP, Tunnel-Medium-Type = 802 (includes all 802 media plus Ethernet "canonical format"), Tunnel-Private-Group-ID = 15 Tunnel-Type = Virtual Lans (VLAN) ........................................................... mods-enabled > ldap module .......................................................... ldap { server = 'active.test.com' identity = 'CN=std,OU=IT,OU=FDM,DC=test,DC=com' password = 1 base_dn = 'dc=test,dc=com' } ........................................................................................... site-enabled > default ......................................................... in authorize section uncomment ldap

4 4

Creating EAP certificates
by Network RADIUS 21 Feb '22

21 Feb '22

** Creating EAP certificates --------------------------------------------- If you have followed our guides on configuring and testing EAP for FreeRADIUS (as outlined in earlier articles), you should have already created some dummy certificates to test your configuration. Now it’s time to create the real certificates to use in your production network. These certificates will be configured on the end hosts that will be doing PEAP, TTLS, or EAP-TLS authentication. This article provides detailed instructions on how to create these certificates, as well as some sample configuration file text that you can customize for your needs. Read the full article… https://networkradius.com/articles/2021/10/25/EAP-production-certificates.h… ** Previous EAP Configuration articles --------------------------------------------- Configuring EAP - getting started: https://networkradius.com/articles/2021/10/18/configuring-EAP.html Command line testing for EAP configuration: https://networkradius.com/articles/2021/10/25/command-line-EAP-testing.html Common EAP configuration problems: https://networkradius.com/articles/2021/10/20/common-EAP-problems.html ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

truncate the attribute
by Can Paçacı 21 Feb '22

21 Feb '22

Hi, It truncates the attribute "Calling-Station-Id" value after the # sign while writing the radacct table. Why it trancates? Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

2 1

unlang modify attribute
by Москалев Артем Сергеевич 18 Feb '22

18 Feb '22

Hi team, I have some question about unlang. How can I modify attribute? Example: I have attribute (&User-Name = "94de80658a92") its mac address, I will check this mac address in DB, but format must be like (&User-Name = "94:de:80:65:8a:92"), how format existing attribute or create new with needed format? Sincerely, Artem Moskalev.

3 2

LineLog
by Angelo Corsaro 18 Feb '22

18 Feb '22

Hi all, I need to log more detail in the log file of radius during the auth process, but I cannot find any clear direction how to use the module linelog: can someone give me the direction? Thanks, Angelo

3 4

split an accounting attribute in two and write two new attributes to MySQL
by xaled＠web.de 16 Feb '22

16 Feb '22

Hi I'm struggling with an apparently simple task of splitting an accounting stop attribute Acct-Session-Id in two and writing two new values to MySQL In preacct section of default config from sites enabled I added Split-Session-ID = "%{explode:%{Acct-Session-Id} /}" And immediately get error: /etc/freeradius/3.0/sites-enabled/default[558]: Unknown action '%{explode:%{Acct-Session-Id}/}'. Expr module in enabled in mods-enabled expr -> ../mods-available/expr In mysql mapping config I added '{%Split-Session-ID:1}', \ '{%Split-Session-ID:2}', \ As variables to be written to MySQL table. Any help appreciated, Xaled

2 4