- Freeradius-Users - lists.freeradius.org

Re: FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 10 May '22

10 May '22

I am trying to replace a Cistron RADIUS service running on a dinosaur of a Sparc Solaris 9 server before it explodes. This RADIUS service is only used to access network devices (switches, routers, etc.) We are moving to a centralized credentials setup with usernames/passwords in Active Directory. We followed this document to connect RHEL servers. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… Now we need a new RADIUS service that uses the AD credentials. On 5/10/22, 08:42, "Alan DeKok" <aland(a)deployingradius.com> wrote: > On May 10, 2022, at 8:21 AM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > Approaching the problem from a different direction: > Rather than "integrating" FR with Active Directory, could I set it up to use LDAP as the Auth-Type ? It depends. PAP? Yes. MS-CHAP? No. The documentation has endless examples of using Samba for AD integration, because in many cases it's required. e.g. for MS-CHAP. Perhaps instead of asking what's possible, describe what you want to do. We can then say how to do it. FreeRADIUS can do almost anything. The main limitations are external. i.e. certain EAP methods don't work with Active Directory, or with certain password storage methods. But if it's possible to do in RADIUS, FreeRADIUS can do it. Alan DeKok.

3 2

Re: FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 10 May '22

10 May '22

Approaching the problem from a different direction: Rather than "integrating" FR with Active Directory, could I set it up to use LDAP as the Auth-Type ? On 5/9/22, 16:09, "Freeradius-Users on behalf of Alan DeKok" <freeradius-users-bounces+daniel.e.white=nasa.gov(a)lists.freeradius.org on behalf of aland(a)deployingradius.com> wrote: On May 9, 2022, at 3:33 PM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > An observation: > The instructions seem to only cover winbind. > As an example, it says to use the "ntlm_auth" command. That command is not part of sssd. See the sssd documentation for other commands to test user name / password authentication with sssd. We didn't write sssd, and we don't know much about it. > Is there a newer version of that guide page that uses sssd instead of winbind ? There is no secret documentation. All of the documentation is public, and is publicly accessible. The Wiki can be edited. If you figure things out, please document them so that other people don't run into the same issues. Waiting for the FR developers to do everything may very well be a lost cause in some cases. Alan DeKok.

3 2

Freeradius V.3.2.0 performance issue
by Bassem Mettichi 10 May '22

10 May '22

Hello, i have tested freeradius V.3.0.22 and freeradius V.3.2.0 with the same configuration on centos 7 using redis as database backend and i have seen that v.3.0.22 is more performant than v.3.2.0, for a test of 25k acct/sec runned for 1hour with V.3.0.22 i didn't registered any packet lost however with V.3.2.0 i have more than 600K packet lost, i confirm that i have the same configuration and the two versions are running on the same machine with 16VCPU and 16GB RAM with localhost redis database. Thanks Bassem

5 9

FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 09 May '22

09 May '22

RHEL 8 server Joined to AD domain using sssd for credentials The file /etc/nsswitch.conf contains: passwd: sss files systemd group: sss files systemd netgroup: sss files automount: sss files services: sss files shadow: files sss hosts: files dns myhostname aliases: files ethers: files gshadow: files networks: files dns protocols: files publickey: files rpc: files This guide https://wiki.freeradius.org/guide/freeradius-active-directory-integration-h… says to append "winbind" to passwd, shadow, group, protocols, services, netgroup, automount Is this going to break things ?

2 3

Re: FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 09 May '22

09 May '22

Thanks, Alan The users are connecting to network devices (Cisco, Juniper switches and routers) The network devices connect to RADIUS to verify the user's credentials which redide in AD. From your response, it sounds like the existing configuration will work without the need to add winbind. Is this accurate ? On 5/9/22, 07:52, "Freeradius-Users on behalf of Alan DeKok" <freeradius-users-bounces+daniel.e.white=nasa.gov(a)lists.freeradius.org on behalf of aland(a)deployingradius.com> wrote: On May 9, 2022, at 7:31 AM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > RHEL 8 server > Joined to AD domain using sssd for credentials > > The file /etc/nsswitch.conf contains: > > passwd: sss files systemd > group: sss files systemd > netgroup: sss files > automount: sss files > services: sss files > > shadow: files sss > hosts: files dns myhostname > > aliases: files > ethers: files > gshadow: files > networks: files dns > protocols: files > publickey: files > rpc: files > > This guide > https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.free… > says to append "winbind" to passwd, shadow, group, protocols, services, netgroup, automount > > Is this going to break things ? If you want users to come directly from AD, then you can add winbind. If instead you use sssd for users, and it connects to AD, then just list "sss". Alan DeKok.

1 0

PEAP-MSCHAPv2 and anonymous outer identity - can't understand passing inner username to outer tunnel
by Samuel Walker-Kierluk 05 May '22

05 May '22

Hi all, I’ve got FreeRADIUS handling our “eduroam” needs at my university. Users from outside our realms are proxied to the national eduroam proxies, and users matching our realms are handled locally: -Authentication: PEAP-MSCHAPv2 authentication (using ntlm_auth) against our Active Directory domain controllers -Post-Auth in outer server file: for users of our own realm and on our own campus’s network, I use a few “if” statements (one based on a username pattern, another based on an LDAP-Group lookup of Stripped-User-Name) to send the VLAN ID to the access point. This works wonderfully when using the same inner and outer identity, but after I set up anonymous outer identities on my clients, the VLAN ID assignment in the post-auth section doesn’t work properly, as it uses the outer identity “anonymous” instead of the username from the inner tunnel. I’ve spent about a day and a half working on this, going through old mailing list posts and the documentation, inserting and removing sections, with no progress being made. It’s clear that I’ve missed some piece of information or misunderstood a critical concept, regarding how to pass the inner identity (hopefully both User-Name and Stripped-User-Name) to the outer post-auth section. (I don’t need the actual Access-Accept message to contain the inner identity, I just need to be able to use it for the VLAN assignment.) I thought that the “copy_request_to_tunnel” and “use_tunneled_reply” would update at least the User-Name attribute (though not the Stripped-User-Name attribute of the outer tunnel), but even my first “if” statement in my outer-tunnel post-auth section, which uses the User-Name attribute, always receives “anonymous” as the User-Name attribute. I also tried making a dictionary Attribute for local use (ID between 3000 and 4000, type string), along the lines of “Username-to-use-for-VLAN-assignment”, and having it be set in the inner-tunnel server and accessible to the outer-tunnel server, but I think I’ve misunderstood how this works. Given the trouble I’m having, I think I’ve missed something that should have been obvious (with more sleep? or more coffee?) and would really appreciate any pointers that might come to mind! I’ve included below: —outer-tunnel configuration —inner-tunnel configuration —eap module configuration Does anyone have any advice on what I might have missed, or where to look? Happy to provide a debug. Apologies for anything incomprehensible in the configs… they are put together from a number of different tutorials from GEANT and other online resources, and I am relatively new to RADIUS. Best, Samuel server eduroam { listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } authorize { if ("%{client:shortname}" !~ /rad[1-2]\.eduroam\.fr/) { update request { Operator-Name := "1MYDOMAIN.FR" } } auth_log suffix if (Realm == "NULL") { update request { &Module-Failure-Message += 'Rejected: Realm is NULL' } reject } eap } authenticate { # Uniquement le module eap eap } preacct { suffix } accounting { } post-auth { if ("%{client:shortname}" == "campus-wifi") { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-ID := 6 # Unless a user-group check below indicates a different VLAN, user will get VLAN 6, the guest VLAN. } if (Realm == "MYDOMAIN.FR") || (Realm == "SECONDARYDOMAIN.FR") { if (&User-Name =~ /[aA][1234567890][1234567890]*/) { # for User-Name starting with a[1-9].... update reply { Tunnel-Private-Group-ID := 17 # Set to student VLAN. } } elsif (LDAP-Group == "CN=Employees,OU=Groups,DC=mydomain,DC=local") { # For staff and faculty... update reply { Tunnel-Private-Group-ID := 15 # Set to staff VLAN } } else { update reply { Tunnel-Private-Group-ID := 6 # For all users not covered above, set to guest VLAN } } } } reply_log Post-Auth-Type REJECT { reply_log } } pre-proxy { pre_proxy_log if("%{Packet-Type}" != "Accounting-Request") { attr_filter.pre-proxy } } post-proxy { post_proxy_log attr_filter.post-proxy } } server eduroam-inner-tunnel { authorize { auth_log files # for the eduroam test account eap mschap pap } authenticate { Auth-Type ntlm_auth { ntlm_auth } Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } post-auth { reply_log Post-Auth-Type REJECT { reply_log update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } } eap { # General EAP information default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} tls-config tls-common { private_key_file = ${certdir}/myCert.key certificate_file = ${certdir}/myCert.cer ca_file = ${cadir}/myCertCA.cer dh_file = ${certdir}/dh random_file = /dev/urandom ca_path = ${cadir} cipher_list = "DEFAULT@SECLEVEL=1" ecdh_curve = "prime256v1" tls_min_version = "1.0" tls_max_version = "1.2" cache { enable = yes name = example-cache-name # NAME OF CACHE persist_dir = ${logdir}/tlscache } verify { } ocsp { enable = no } } # Declare the EAP methods being used. ttls { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } mschapv2 { } }

3 2

freeradius_server_release_3_0_25 was changed
by Andrei Katsuk 04 May '22

04 May '22

I used https://github.com/FreeRADIUS/freeradius-server/archive/release_3_0_25.zip link to download and build freeradius-server. But after some time the archive was changed and there were no any comments about it. Attached you can find the diff (seems it related to rlm_couchbase module). Please comment this, should I use the newest archive or previous one? and why this changes disappeared ? Andrei

3 2

Re: Freeradius-Users Digest, Vol 205, Issue 1
by thyde rndstudio.com 01 May '22

01 May '22

Alan - thank you; that was the same path I was (kind of) working down (although I didn't show the explicit example), and it was giving me the unable to load module errors. From your example it dawned on me since I had used hyphens in the file and module names, perhaps the interpreter was being confused, so I used the "eap2" example to start more simply, but still get the same error: /etc/freeradius/3.0/mods-enabled/eap2[2]: Failed to link to module 'rlm_eap2': /usr/lib/freeradius/rlm_eap2.so: cannot open shared object file: No such file or directory (TL/DR: it's not the hyphens, it was contradictory information on how to replicate module sections from the documentation and past list info; additionally, avoid the use of the word "replicate" when searching documentation - that's a whole different beast. I will admit to the fact that putting "copy module" into the wiki for FR does return a single result and that information is relevant, but only AFTER you already know the solution; it's for OTP specifically, not generic.) I did get this going with the nudge given by Alan, but for those watching: It took a little more digging to get details, these helped me get more insight: https://lists.freeradius.org/pipermail/freeradius-users/2017-April/087371.h… and https://fossies.org/linux/freeradius-server/raddb/mods-available/README.rst If you find some search results that illustrate to copy the eap "module" and rename sections of it - don't copy the FILE as those instructions infer! Copy the eap SECTION inside of mods-available/eap while still INSIDE of eap file, with renaming. such as in mods-available/eap: eap { ... } eap SSID-A { ...} And as the posts above indicate, in your sites-enabled/default (or whatever your actual server is) be sure to place a reference in the authenticate section as well as your actual call (Remember I'm doing EAP-TLS, so): if(Eap-Message) { # EAP-TLS with certificate, no u/p, no mac filter if (Aruba-Essid-Name == "mySSID-A") { SSID-A } ...etc... and further on: authenticate { ... Auth-Type eap { eap { ...} } Auth-Type SSID-A { SSID-A { ...} } ... } Noting also that the hyphens in file and module names do not currently upset the interpreter. Many thanks, Ted. ________________________________ From: Freeradius-Users <freeradius-users-bounces+thyde=rndstudio.com(a)lists.freeradius.org> on behalf of freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> Sent: Sunday, May 1, 2022 8:00 AM To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Subject: Freeradius-Users Digest, Vol 205, Issue 1 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. EAP-TLS separate client cert per ssid FR v3.0.17 (thyde rndstudio.com) 2. Re: EAP-TLS separate client cert per ssid FR v3.0.17 (Alan Buxey) ---------------------------------------------------------------------- Message: 1 Date: Sat, 30 Apr 2022 14:02:36 +0000 From: thyde rndstudio.com <thyde(a)rndstudio.com> To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: EAP-TLS separate client cert per ssid FR v3.0.17 Message-ID: <SJ0PR19MB442956C3357B75B8EDD1D809B9FF9(a)SJ0PR19MB4429.namprd19.prod.outlook.com> Content-Type: text/plain; charset="utf-8" Good morning, I've been using FR for a number of years, with some "approved" and some "less than approved" configuration edits, but mostly with straightforward single CA, single client cert, EAP-TLS configuration, which has been outstanding. I have other configs where I add in EAP-TTLS or do mac auth, however what I would like to try next is EAP-TLS with multiple SSIDs, where there is a single separate cert per SSID. Please note that the certs will have different issue dates, and may change per freeradius instance, so chaining client certs into a single file and trying to attack some cert property is not the preferred path, unless it is the ONLY path. It would make cert management difficult to say the least. I have reviewed documentation to the best of my ability, however a lot of the searching (including on netrad) turned up solutions that were for prior versions of FR, with results for FR2 being most popular. I also see a number of posts/responses that ask if it can be done, where the response is "yes lot of people do it" - but there is no actual instruction on how to do so. There are also snippets of earlier versions of FR3 prior the "tls-common" update, which attempting those breaks my current version, as one would expect. (As noted in subject, my FR version is 3.0.17) So far, I have tried to replicate the eap module (mods-enabled/eap -> renaming both file and module) with no success as FR complains about my copied eap modules not being compiled (cannot fine {name}.so) - which I fully understand where that is coming from as a dev myself I'm not really interested in re-writing the eap module source just to accommodate this particular forced practice, of which I'm sure Alan would agree (just getting that taken care of early in the conversation). Is there an example doc that could illustrate how to "properly" instruct the eap module to test only ClientCertA against SSID-A and only ClientCertB against ClientCertB? A test of ClientCertB attempting to associate on SSID-A must? fail. I would like to retain the ability to also pre-test mac auth on some SSIDs before eap as I currently do in my default site (ie in sites-enabled/default) Currently I test against SSID and mac in my site/server: (inside authorize) if(Eap-Message) { # EAP-TLS with certificate, no u/p, no mac filter. if (Aruba-Essid-Name == "ALANSFREEWIFI") { eap } # EAP-TLS with certificate, no u/p, WITH mac filter. elsif (Aruba-Essid-Name == "ALANSPROTECTEDNETWORK") { if (Calling-Station-Id == "aabbccddeeff") { eap } } etc... and the eap module is currently stock aside from the certificate details; however in the above version, the same cert is on all clients - and that's not my optimal deployment choice. Moving forward, should this test happen in the virt-server (ie in sites-enabled/default), or does the (mods-enabled/eap) get extended to test against the ssid and mac? Kindest regards, Ted. ------------------------------ Message: 2 Date: Sun, 1 May 2022 09:03:35 +0100 From: Alan Buxey <alan.buxey(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: EAP-TLS separate client cert per ssid FR v3.0.17 Message-ID: <CAOVYXj_wfJzffbXooqK_C4yG1ym5s_dqMPVP8tkuEKZ_B26-9g(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hi, The easiest way is to just use inland, change whichever ssid you want to to call eg 'eap2' instead 'eap' and copy current eap module configuration file to a new eap2 configuration file and edit it so that it's known as eap2 . Then edit eap2 to provide/use new CA/cert/whatever alan On Sat, 30 Apr 2022, 15:02 thyde rndstudio.com, <thyde(a)rndstudio.com> wrote: > Good morning, > I've been using FR for a number of years, with some "approved" and some > "less than approved" configuration edits, but mostly with straightforward > single CA, single client cert, EAP-TLS configuration, which has been > outstanding. I have other configs where I add in EAP-TTLS or do mac auth, > however what I would like to try next is EAP-TLS with multiple SSIDs, where > there is a single separate cert per SSID. > > Please note that the certs will have different issue dates, and may change > per freeradius instance, so chaining client certs into a single file and > trying to attack some cert property is not the preferred path, unless it is > the ONLY path. It would make cert management difficult to say the least. > > I have reviewed documentation to the best of my ability, however a lot of > the searching (including on netrad) turned up solutions that were for prior > versions of FR, with results for FR2 being most popular. I also see a > number of posts/responses that ask if it can be done, where the response is > "yes lot of people do it" - but there is no actual instruction on how to > do so. There are also snippets of earlier versions of FR3 prior the > "tls-common" update, which attempting those breaks my current version, as > one would expect. (As noted in subject, my FR version is 3.0.17) > > So far, I have tried to replicate the eap module (mods-enabled/eap -> > renaming both file and module) with no success as FR complains about my > copied eap modules not being compiled (cannot fine {name}.so) - which I > fully understand where that is coming from as a dev myself I'm not really > interested in re-writing the eap module source just to accommodate this > particular forced practice, of which I'm sure Alan would agree (just > getting that taken care of early in the conversation). > > Is there an example doc that could illustrate how to "properly" instruct > the eap module to test only ClientCertA against SSID-A and only ClientCertB > against ClientCertB? A test of ClientCertB attempting to associate on > SSID-A must? fail. > > I would like to retain the ability to also pre-test mac auth on some SSIDs > before eap as I currently do in my default site (ie in > sites-enabled/default) Currently I test against SSID and mac in my > site/server: (inside authorize) > > if(Eap-Message) { > > # EAP-TLS with certificate, no u/p, no mac filter. > if (Aruba-Essid-Name == "ALANSFREEWIFI") { > eap > } > # EAP-TLS with certificate, no u/p, WITH mac filter. > elsif (Aruba-Essid-Name == "ALANSPROTECTEDNETWORK") { > if (Calling-Station-Id == "aabbccddeeff") { > eap > } > > } > etc... > > and the eap module is currently stock aside from the certificate details; > however in the above version, the same cert is on all clients - and that's > not my optimal deployment choice. > > Moving forward, should this test happen in the virt-server (ie in > sites-enabled/default), or does the (mods-enabled/eap) get extended to test > against the ssid and mac? > > Kindest regards, > Ted. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 205, Issue 1 ************************************************

2 1

EAP-TLS separate client cert per ssid FR v3.0.17
by thyde rndstudio.com 01 May '22

01 May '22

Good morning, I've been using FR for a number of years, with some "approved" and some "less than approved" configuration edits, but mostly with straightforward single CA, single client cert, EAP-TLS configuration, which has been outstanding. I have other configs where I add in EAP-TTLS or do mac auth, however what I would like to try next is EAP-TLS with multiple SSIDs, where there is a single separate cert per SSID. Please note that the certs will have different issue dates, and may change per freeradius instance, so chaining client certs into a single file and trying to attack some cert property is not the preferred path, unless it is the ONLY path. It would make cert management difficult to say the least. I have reviewed documentation to the best of my ability, however a lot of the searching (including on netrad) turned up solutions that were for prior versions of FR, with results for FR2 being most popular. I also see a number of posts/responses that ask if it can be done, where the response is "yes lot of people do it" - but there is no actual instruction on how to do so. There are also snippets of earlier versions of FR3 prior the "tls-common" update, which attempting those breaks my current version, as one would expect. (As noted in subject, my FR version is 3.0.17) So far, I have tried to replicate the eap module (mods-enabled/eap -> renaming both file and module) with no success as FR complains about my copied eap modules not being compiled (cannot fine {name}.so) - which I fully understand where that is coming from as a dev myself I'm not really interested in re-writing the eap module source just to accommodate this particular forced practice, of which I'm sure Alan would agree (just getting that taken care of early in the conversation). Is there an example doc that could illustrate how to "properly" instruct the eap module to test only ClientCertA against SSID-A and only ClientCertB against ClientCertB? A test of ClientCertB attempting to associate on SSID-A must fail. I would like to retain the ability to also pre-test mac auth on some SSIDs before eap as I currently do in my default site (ie in sites-enabled/default) Currently I test against SSID and mac in my site/server: (inside authorize) if(Eap-Message) { # EAP-TLS with certificate, no u/p, no mac filter. if (Aruba-Essid-Name == "ALANSFREEWIFI") { eap } # EAP-TLS with certificate, no u/p, WITH mac filter. elsif (Aruba-Essid-Name == "ALANSPROTECTEDNETWORK") { if (Calling-Station-Id == "aabbccddeeff") { eap } } etc... and the eap module is currently stock aside from the certificate details; however in the above version, the same cert is on all clients - and that's not my optimal deployment choice. Moving forward, should this test happen in the virt-server (ie in sites-enabled/default), or does the (mods-enabled/eap) get extended to test against the ssid and mac? Kindest regards, Ted.

3 2

warning and ignore radius log messages
by Can Paçacı 29 Apr '22

29 Apr '22

Hi Too many the following logs started to come from our radius servers (version 3.0.20). db is external and PostgreSql-12. What does this mean? Is it database problem or anything else? What can we do? There is no auth. and acct. problem on the FR server observed. WARNING: Module rlm_sql became unblocked Ignoring duplicate packet from client 34Acibh01 port 1812 - ID: 129 due to unfinished request in component session module sql Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

3 3