- Freeradius-Users - lists.freeradius.org

FreeRADIUS Audit Log Entry - Aruba IAP with Google LDAP and MS AAD - Regarding
by P.Thirunavukkarasu 01 Mar '22

01 Mar '22

Hi all, Greetings NAC (Packetfence) is configured for the authentication source - Google Secure LDAP and MS AAD I am herewith furnished the radius log for your reference *Feb 28 23:43:18 packetfence auth[2368]: (5) Rejected in post-auth: [XXXX(a)tanuvas.org.in <drthiruna(a)tanuvas.org.in>] (from client 172.16.20.210/32 <http://172.16.20.210/32> port 0 cli e0:1f:88:2a:fe:1f via TLS tunnel)* *Feb 28 23:43:18 packetfence auth[2368]: (5) Login incorrect (Config item "realm[tanuvas.org.in <http://tanuvas.org.in/>].oauth2.cache_password" does not exist): [XXX(a)tanuvas.org.in <drthiruna(a)tanuvas.org.in>] (from client 172.16.20.210/32 <http://172.16.20.210/32> port 0 cli XX:XX:XX:XX:XX:XX via TLS tunnel)Feb 28 23:43:18 packetfence auth[2368]: [mac:XX:XX:XX:XX:XX:XX] Rejected user: XXX(a)tanuvas.org.in <drthiruna(a)tanuvas.org.in>Feb 28 23:43:18 packetfence auth[2368]: (5) Login incorrect (EAP-TTLS-PAP: Failed continuing EAP TTLS (21) session. EAP sub-module failed): [XXX(a)tanuvas.org.in <drthiruna(a)tanuvas.org.in>] (from client 172.16.20.210/32 <http://172.16.20.210/32> port 0 cli XX:XX:XX:XX:XX:XX)Feb 28 23:44:25 packetfence auth[2368]: (15) Ignoring duplicate packet from client 172.16.20.210/32 <http://172.16.20.210/32> port 63112 - ID: 20 due to unfinished request in component authenticate module eap_ttlsFeb 28 23:44:26 packetfence auth[2368]: (15) Rejected in post-auth: [XXX(a)tanuvas.org.in <drthiruna(a)tanuvas.org.in>] (from client 172.16.20.210/32 <http://172.16.20.210/32> port 0 cli XX:XX:XX:XX:XX:XX via TLS tunnel)* Kindly help me to resolve the issue.. Regards, Thirunavukkarasu

2 1

Re: Using variables in unlang conditions
by Rahman Duran 28 Feb '22

28 Feb '22

I put it in the authorize section of the default virtual server, just before if conditions. So this file is not considered a "configuration file" :) I just put definitions to the end of the radiusd.conf file, try to start in debug mode with freeradius -X, getting the same error: ((&Packet-Src-IP-Address < ${etu_aruba_wlc_rektorluk}) ^ Failed to parse value for attribute bottom of radiusd.conf #### VARIABLES ############################# etu_aruba_wlc_rektorluk = 10.10.243.0/24 etu_aruba_wlc_ogrenci_merkezi = 10.10.244.0/24 I read all the documentation about using variables already. But it seems I miss something. Rahman Duran Message: 2 > Date: Thu, 24 Feb 2022 09:51:13 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Using variables in unlang conditions > Message-ID: <701442B2-1FCC-4232-BCF2-85A83572176E(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 24, 2022, at 5:50 AM, Rahman Duran <rahman.duran(a)erzurum.edu.tr> > wrote: > > I am trying to do some filtering/policing in the authorize section of the > > default virtual server. I need to check source ip matches our Wireless > > Controllers and SSID and username format etc then decide what to do with > > the request. How can I user some kind of alias/variable for our IP > address > > block so I should not need to write and update IP addresses multiple > places? > > You can edit raddb/dictionary to define local attributes. Or, if the > values don't change too often (i.e. rarely), you can out them into the > configuration files themselves. > > > Here sample of what I try to achieve: > > > > ////////////////////// > > etu_aruba_wlc_001 = 10.10.243.0/24 > > etu_aruba_wlc_002 = 10.10.244.0/24 > > etu_aruba_wlc_002 = 10.10.245.0/24 > > You can just put that at the bottom of radiusd.conf. > > Where did you put the above text? Into a configuration file? Which > one? Or some other file? If so, how is the server supposed to find it? > > > ### 001: Test Wifi Service ### > > *if ((&Packet-Src-IP-Address < ${etu_aruba_wlc_001}) \* > > Then that will work. > > There are many examples of this. > > > Well using variables (${...}) in conditions not working, Freeradius > > daemon not starting with parse error: > > > > /etc/freeradius/3.0/sites-enabled/default[40]: > > ((&Packet-Src-IP-Address < *${etu_aruba_wlc_001}) > > * && (&NAS-Port-Type == "Wireless-80... > > /etc/freeradius/3.0/sites-enabled/default[40]: > ^ > > Failed to parse value for attribute > > Because you didn't define "etu_aruba_wlc_001" anywhere. > > There are many examples of using variables defined in configuration > files. It works. You just have to define the variables in the > configuration files... > > Alan DeKok. > > > > ------------------------------ > > Message: 3 > Date: Thu, 24 Feb 2022 10:08:39 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Advice on RADIUS security and MD5 encryption? > Message-ID: <0B7CD3D0-8BD3-4773-BFDD-7700C1A01B7F(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 24, 2022, at 4:39 AM, Ole Holm Nielsen via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > > We're using the pam_radius module for SSH login authentication on a > CentOS 7 server. Our university's RADIUS server is a Microsoft Windows > server. This seems to work well. > > > > Some of my colleagues are wary about using RADIUS for authentication > because the network traffic is encrypted with the obsolete MD5 algorithm. > > The real question is: "Has anyone broken the encryption method used by > RADIUS?" > > The answer is "no". > > > I would like to understand if this is a relevant objection or not for > the present case. > > It's not relevant. > > > The Wikipedia article https://en.wikipedia.org/wiki/RADIUS does raise > some security concerns. > > Anyone can edit Wikipedia. It doesn't really mean anything. > > > Question: When the user's password hash is transmitted across the > network, how secure is the password from decryption by eavesdroppers? > > If you have a shared secret of "hello", it's easy to crack. > > If the shared secret of "284nv82fskljhfw9yf2hfjb3fjgf8gb83bg", then no > one will be able to crack it. > > > Are there any good articles on RADIUS security? > > Not really. > > In short, it's fine. > > Alan DeKok. > > > > ------------------------------ > > Message: 4 > Date: Fri, 25 Feb 2022 09:06:36 +0100 > From: Ole Holm Nielsen <Ole.H.Nielsen(a)fysik.dtu.dk> > To: <freeradius-users(a)lists.freeradius.org> > Subject: Re: Advice on RADIUS security and MD5 encryption? > Message-ID: <11d65956-d0b7-8ccd-791b-e605539ce21b(a)fysik.dtu.dk> > Content-Type: text/plain; charset="UTF-8"; format=flowed > > Hi Alan, > > Thanks very much for your definitive answers, it's much appreciated! Such > clear messages are almost impossible to find elsewhere. So we should be > good to go with RADIUS, provided that we use hard-to-crack shared secrets. > > Best regards, > Ole > > -- > Ole Holm Nielsen > PhD, Senior HPC Officer > Department of Physics, Technical University of Denmark > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 202, Issue 34 > ************************************************* >

2 3

EAP configuration: Importing the root CA
by Network RADIUS 28 Feb '22

28 Feb '22

** EAP configuration: Importing the root CA --------------------------------------------- The final step to configuring EAP for FreeRADIUS is to add the CA (Certificate Authority) to every client machine that performs EAP authentication. Before proceeding with this step, make sure that you have already done the following: - Configured and tested PAP - Tested EAP configuration with dummy certificates - Troubleshooted any problems with your EAP configuration - Created production certificates and tested them If you have done all of these steps, you are ready to go ahead with adding the CA certificate to all the client machines. This article is the last of the the EAP configuration series. Read the full article… https://networkradius.com/articles/2021/10/25/importing-root-CA.html <https://networkradius.com/articles/2021/10/25/importing-root-CA.html> ** Previous EAP Configuration articles --------------------------------------------- Configuring EAP - getting started: https://networkradius.com/articles/2021/10/18/configuring-EAP.html <https://networkradius.com/articles/2021/10/18/configuring-EAP.html> Command line testing for EAP configuration: https://networkradius.com/articles/2021/10/25/command-line-EAP-testing.html <https://networkradius.com/articles/2021/10/25/command-line-EAP-testing.html> Common EAP configuration problems: https://networkradius.com/articles/2021/10/20/common-EAP-problems.html <https://networkradius.com/articles/2021/10/20/common-EAP-problems.html> Create production EAP certificates: https://networkradius.com/articles/2021/10/25/EAP-production-certificates.h… <https://networkradius.com/articles/2021/10/25/EAP-production-certificates.h…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/request/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Advice on RADIUS security and MD5 encryption?
by Ole Holm Nielsen 25 Feb '22

25 Feb '22

We're using the pam_radius module for SSH login authentication on a CentOS 7 server. Our university's RADIUS server is a Microsoft Windows server. This seems to work well. Some of my colleagues are wary about using RADIUS for authentication because the network traffic is encrypted with the obsolete MD5 algorithm. I would like to understand if this is a relevant objection or not for the present case. The Wikipedia article https://en.wikipedia.org/wiki/RADIUS does raise some security concerns. Question: When the user's password hash is transmitted across the network, how secure is the password from decryption by eavesdroppers? Are there any good articles on RADIUS security? Thanks for sharing any insights. Ole -- Ole Holm Nielsen PhD, Senior HPC Officer Department of Physics, Technical University of Denmark

2 2

Using variables in unlang conditions
by Rahman Duran 24 Feb '22

24 Feb '22

Hi, I am trying to do some filtering/policing in the authorize section of the default virtual server. I need to check source ip matches our Wireless Controllers and SSID and username format etc then decide what to do with the request. How can I user some kind of alias/variable for our IP address block so I should not need to write and update IP addresses multiple places? Here sample of what I try to achieve: ////////////////////// etu_aruba_wlc_001 = 10.10.243.0/24 etu_aruba_wlc_002 = 10.10.244.0/24 etu_aruba_wlc_002 = 10.10.245.0/24 ### 001: Test Wifi Service ### *if ((&Packet-Src-IP-Address < ${etu_aruba_wlc_001}) \* && (&NAS-Port-Type == "Wireless-802.11") \ && (&Called-Station-SSID == "bidb-test") \ && (&User-Name =~ /[0-9a-fA-F]{12}/)) { update request { &ETU-Radius-Service-Name := "BIDB_Test" } # Authentication source files_bidb_test_mac_list # Authentication modules pap # If this service match, do not continue to check rest of the section return } ### 002: Simulation Lab Service ### * if ((&Packet-Src-IP-Address < ${etu_aruba_wlc_001}) \* && (&NAS-Port-Type == "Wireless-802.11") \ && (&Called-Station-SSID == "saglik_bilimleri-sim-lab") \ && (&User-Name =~ /[0-9a-fA-F]{12}/)) { update request { &ETU-Radius-Service-Name := "Saglik_Bilimleri_Sim_Lab" } # Authentication source files_saglik_bilimleri_sim_lab_mac_list # Authentication modules pap # If this service match, do not continue to check rest of the section return } ### DEFAULT REJECT: If no service matched reject undefined request directly here ### update session-state { Module-Failure-Message := "No matching service found for this request!" } reject ///////////////////// Well using variables (${...}) in conditions not working, Freeradius daemon not starting with parse error: /etc/freeradius/3.0/sites-enabled/default[40]: ((&Packet-Src-IP-Address < *${etu_aruba_wlc_001}) * && (&NAS-Port-Type == "Wireless-80... /etc/freeradius/3.0/sites-enabled/default[40]: ^ Failed to parse value for attribute Any hint on this? If it is possible I want to define IP blocks and groups of IP blocks if possible and use them in unlang conditions. Regards, Rahman Duran Bilgi İşlem Daire Başkanlığı Erzurum Teknik Üniversitesi

3 2

pam_radius module: How to reject authentication immediately when RADIUS fails?
by Ole Holm Nielsen 23 Feb '22

23 Feb '22

I could not find this question as an FAQ or by google searches, so can anyone help? We have a CentOS 7 server setup where user SSH logins require RADIUS authentication from our university's central RADIUS server. Local password authentication must be prohibited. This is sort of working, yet is not 100% satisfactory. Question: If the user fails RADIUS authentication, how can we reject the SSH login immediately without proceeding to other authentication methods? Our setup: I have installed the pam_radius RPM package from EPEL and added this line near the top of /etc/pam.d/sshd: auth sufficient pam_radius_auth.so debug While this works correctly when the user authenticates successfully with the central RADIUS server, failed authentications just makes PAM proceed to succeeding modules in /etc/pam.d/sshd (see below) which permit local password logins. This is what we want to prohibit! So I replaced the above line by a more strict rule: auth [success=done default=die] pam_radius_auth.so debug This sort of works: Failed authentications keep asking the user for a password 5 times and eventually fails as desired: Password: Password: Password: <user@server>'s password: Permission denied, please try again. <user@server>'s password: Received disconnect from <IP> port 22:2: Too many authentication failures Authentication failed. Question: Does anyone have a method for /etc/pam.d/sshd which will skip the superfluous password questions and reject the user immediately if RADIUS fails? FYI, the /etc/pam.d/sshd file distributed by the EPEL RPM is: #%PAM-1.0 auth required pam_sepermit.so auth substack password-auth auth include postlogin # Used with polkit to reauthorize users in remote sessions -auth optional pam_reauthorize.so prepare account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth session include postlogin # Used with polkit to reauthorize users in remote sessions -session optional pam_reauthorize.so prepare Thanks, Ole -- Ole Holm Nielsen PhD, Senior HPC Officer Department of Physics, Technical University of Denmark

3 7

Understanding dynamic radiusClients in openldap
by Dave Macias 22 Feb '22

22 Feb '22

Hello, Looking here: https://github.com/FreeRADIUS/freeradius-server/blob/master/doc/schemas/lda… And here: https://github.com/FreeRADIUS/freeradius-server/blob/9e6d1e60aa2e829a186b87… Im trying to create a client for a NAS in my ldap service dn: cn=xx:xx:xx:xxff:fe57:cd00,ou=clients,ou=radius,dc=datacom,dc=net objectClass: radiusClient cn: xx:xx:xx:xxff:fe57:cd00 radiusClientShortname: location1 radiusClientIdentifier: name-of-nas radiusClientSecret: asdfasdfasdfasdf123123asdf But I get: ldap_add: Object class violation (65) additional info: attribute 'cn' not allowed Which makes sense since the schema does not have `cn` .... so trying to understand how to add a radiusClient. I've also tried instead of cn, ou but same output. Does anyone have a sample ldif? Looking at the dynamic-clients file, it says about setting the "location" attribute but I don't see it... Any input is much appreciated! Thank you, Dave

4 17

AD group and Reply Attribute
by ReZa Esfahani 22 Feb '22

22 Feb '22

Hello, I have Microsoft Active Directory as a users database in my company. i have 10 Different Group in my AD and i want to send specific attributes for each group to NAS, I also integrate my AD with freeradius, but i don't know how to send these attribute to nas and i dont know where i made mistake? users file ....................................... DEFAULT Ldap-Group == "CN=student,OU=IT,OU=FDM,DC=test,DC=com", Service-Type = Framed-User, Framed-Protocol = PPP, Tunnel-Medium-Type = 802 (includes all 802 media plus Ethernet "canonical format"), Tunnel-Private-Group-ID = 15 Tunnel-Type = Virtual Lans (VLAN) ........................................................... mods-enabled > ldap module .......................................................... ldap { server = 'active.test.com' identity = 'CN=std,OU=IT,OU=FDM,DC=test,DC=com' password = 1 base_dn = 'dc=test,dc=com' } ........................................................................................... site-enabled > default ......................................................... in authorize section uncomment ldap

4 4

Creating EAP certificates
by Network RADIUS 21 Feb '22

21 Feb '22

** Creating EAP certificates --------------------------------------------- If you have followed our guides on configuring and testing EAP for FreeRADIUS (as outlined in earlier articles), you should have already created some dummy certificates to test your configuration. Now it’s time to create the real certificates to use in your production network. These certificates will be configured on the end hosts that will be doing PEAP, TTLS, or EAP-TLS authentication. This article provides detailed instructions on how to create these certificates, as well as some sample configuration file text that you can customize for your needs. Read the full article… https://networkradius.com/articles/2021/10/25/EAP-production-certificates.h… ** Previous EAP Configuration articles --------------------------------------------- Configuring EAP - getting started: https://networkradius.com/articles/2021/10/18/configuring-EAP.html Command line testing for EAP configuration: https://networkradius.com/articles/2021/10/25/command-line-EAP-testing.html Common EAP configuration problems: https://networkradius.com/articles/2021/10/20/common-EAP-problems.html ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

truncate the attribute
by Can Paçacı 21 Feb '22

21 Feb '22

Hi, It truncates the attribute "Calling-Station-Id" value after the # sign while writing the radacct table. Why it trancates? Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

2 1