- Freeradius-Users - lists.freeradius.org

Does FreeRadius support TACACS+
by Rob Hughes 03 Mar '22

03 Mar '22

Hi, we have migrated a number of devices away from a RADIATOR server to FreeRadius. The RADIATOR also has a TACACS+ proxy which I'd like to replace with FreeRadius. My aim is to move over completely to use FreeRadius. Does FreeRadius currently support TACACS+? Regards Rob *Rob Hughes* | *Linux System Administrator* *|* *euNetworks* 5 Churchill Place *|* London *|* E14 5HU *+44 7740 098955* mobile For more information about euNetworks visit eunetworks.com <http://www.eunetworks.com/> or for details of our companies including euNetworks Fiber UK Ltd visit eunetworks.com/companies <http://www.eunetworks.com/companies>. Subscribe to receive updates from euNetworks eunetworks.com/subscribe/ <https://www.eunetworks.com/subscribe/> This email and any attachments may contain confidential and/or legally privileged information. If you are not the intended recipient, please delete the email without reading it and notify the sender.

2 1

Proxy - Home Server Management
by Mucci Andrea 02 Mar '22

02 Mar '22

Hi all, first of all I'm using version 3.0.25. I would like to have a clarification on the logic of Proxy. We have a configuration like this: Home Server: home_server "RAD-ROUTEDW3-1" { type = "auth+acct" ipaddr = "IpAddress1" port = 1812 secret = "********" response_window = 6 response_timeouts = 10 zombie_period = 30 status_check = "request" username = "radtest" password = "***" check_interval = 6 check_timeout = 6 num_answers_to_alive = 5 } home_server "RAD-ROUTEDW3-2" { type = "auth+acct" ipaddr = "IpAddress2" port = 1812 secret = "*********" response_window = 6 response_timeouts = 10 zombie_period = 30 status_check = "request" username = "radtest" password = "***" check_interval = 6 check_timeout = 6 num_answers_to_alive = 5 } Home Server Pool: home_server_pool "[AR] roamer.routedw3" { type = "fail-over" home_server = "RAD-ROUTEDW3-1" home_server = "RAD-ROUTEDW3-2" } Realm realm "~(?i)roamer.routedw3$" { pool = "[AR] roamer.routedw3" } We have seen that the change of state from live to dead is independent between the auth port and the acct port. If Home Server "RAD-ROUTEDW3-1" is unreachable, I will have to wait ten Access-Requests before sending an Access-Request to "RAD-ROUTEDW3-2". Now the Accounting-Request packet with Acct-Status-Type = 1 is not sent to the "RAD-ROUTEDW3-2"(The live Home Server), but again to the "RAD-ROUTEDW3-1" which however is unreachable. So I'll have to wait another ten Accounting-Request before sending the request to the live Home Server. Maybe it was better to handle the change of state live, zombie, dead by Home Server and not by port. Is there a way to force the sending of the Accounting-Request to the same Home Server to which the Access-Request was sent? Best Regards Andrea

2 1

Re: rlm_rest: Adding additional parameters
by Alan DeKok 02 Mar '22

02 Mar '22

On Mar 2, 2022, at 8:11 AM, Rens Houben <rhouben(a)systemec.nl> wrote: > > %{client:vendor} > > > There's no "vendor" field in the "client" definition? Meh. Just add one: > > >client foo { > > ipaddr = 1.2.3.4 > > secret = woo > > vendor = juniper > >} > > > You can put pretty much anything you want into the "client" definition, so long as it doesn't conflict with an existing config item. > > Unfortunately, this doesn't seem to have worked like I assumed it would. I'm attaching the full freeradius -X debug log below, but the short of it is that for some reason freeRADIUS didn't seem to expand the vendor variable into the request. > > Adding > > update request { > Vendor := 'ERX' > } That is absolutely not what I said to do. I didn't say to use an "update" section. I said to add a "Local-Vendor-Name" in raddb/dictionary. I didn't say to use "Vendor". Add the "vendor" line to the *client* definition, in the "clients.conf" file. Then, you can dynamically expand it via a %{client:vendor}. i.e. update request { Local-Vendor-Name := "%{client:vendor}" } > to the authorize stanza worked fine, but {%client:vendor} didn't get expanded. Since you didn't actually put the %{client:vendor} text anywhere, there's no surprise that it doesn't get expanded. Alan DeKok.

1 0

Getting remote proxy details in unlang
by Mark Donnelly 01 Mar '22

01 Mar '22

Hey all: I have a setup where I'm working with multiple partners for authentication. I have the proxying set up, and authentication is working great. The next step is that we want to do some reporting based on various factors, including which partner receives the proxied requests. The way I currently have it structured, this corresponds to a home_server_pool (but could be open to change if needed). I've spent a good part of yesterday looking for what I can write in Unlang to give me that information, but I can't figure out if it's exposed via any variable, list, or attribute. Does FreeRADIUS expose the home_server or home_server_pool of a proxy request anyplace where I could incorporate it into an expression to throw into a filename or log line? Thanks in advance!, --Mark Donnelly Painless Security

2 2

rlm_rest: Adding additional parameters
by Rens Houben 01 Mar '22

01 Mar '22

Hello all, I'm going to elaborate a bit on my current situation just in case I'm hitting an XY problem. I'll try to be succinct; please bear with me. I've got a FreeRADIUS setup that's working well - the RADIUS server calls a REST API to handle access requests, which connects to a database that's administered via a web frontend. Smooth sailing, and has been for several years. However, due to circumstances involving the company that supplied (and supplies the support for) our core routers going out of the router biz we've had to acquire new core routers from a different vendor... And, perhaps unsurprisingly, said vendor's hardware speaks a different dialect. The good news, such as it is, is that with some judicious parallel naming the actual /values/ can stay the same, but the /attribute names/ will change. Worse (from my perspective), my manager would very much like it if, while both sets of core routers are connected to our network, a connection attempt could be handled by either type of router while only being a single "Connection" entry in the frontend. Thankfully, I'm - if I say so myself - a fairly decent programmer and I've been able to rewrite the code logic so that the getAttributes() call (which creates the json dictionary that is then sent back by the REST API as the response) takes a 'vendor' parameter which pertinent parts use to determine how to respond -- IE, for a certain part, getAttributes('Ericsson') will yield '{'Qos-Metering-Profile-Name': 'test-down', 'Qos-Policing-Profile-Name': 'test-up'}' whereas getAttributes('ERX') yields '{'ERX-Ingress-Policy-Name': 'test-up', 'ERX-Egress-Policy-Name': 'test-down'}' This part works and has been tested, but what I now need is to find a good way to /supply/ that 'Vendor' parameter to the function. I've already restructured the FreeRADIUS config to use virtual servers so that I'll be able to use a different processing path depending on which client is asking, but I'm currently blanking on how best to add a 'Vendor=<...>' attribute to the REST request. I'd prefer to do that in the authorize{} function but I'm not 100% sure if I can just use update{} to add an arbitrary variable to the request. Worst case, which I'd prefer to avoid, I could just create two different copies of rlm_rest, one for the Ericssons and one for the ERXen and send them to different entry points in the REST API, but that'd require a whole lot more code duplication than I'm comfortable with. I'd welcome any suggestions or recommendations or "You're overthinking it, just use <Z>". --Rens Houben

3 2

FreeRADIUS Audit Log Entry - Aruba IAP with Google LDAP and MS AAD - Regarding
by P.Thirunavukkarasu 01 Mar '22

01 Mar '22

Hi all, Greetings NAC (Packetfence) is configured for the authentication source - Google Secure LDAP and MS AAD I am herewith furnished the radius log for your reference *Feb 28 23:43:18 packetfence auth[2368]: (5) Rejected in post-auth: [XXXX(a)tanuvas.org.in <drthiruna(a)tanuvas.org.in>] (from client 172.16.20.210/32 <http://172.16.20.210/32> port 0 cli e0:1f:88:2a:fe:1f via TLS tunnel)* *Feb 28 23:43:18 packetfence auth[2368]: (5) Login incorrect (Config item "realm[tanuvas.org.in <http://tanuvas.org.in/>].oauth2.cache_password" does not exist): [XXX(a)tanuvas.org.in <drthiruna(a)tanuvas.org.in>] (from client 172.16.20.210/32 <http://172.16.20.210/32> port 0 cli XX:XX:XX:XX:XX:XX via TLS tunnel)Feb 28 23:43:18 packetfence auth[2368]: [mac:XX:XX:XX:XX:XX:XX] Rejected user: XXX(a)tanuvas.org.in <drthiruna(a)tanuvas.org.in>Feb 28 23:43:18 packetfence auth[2368]: (5) Login incorrect (EAP-TTLS-PAP: Failed continuing EAP TTLS (21) session. EAP sub-module failed): [XXX(a)tanuvas.org.in <drthiruna(a)tanuvas.org.in>] (from client 172.16.20.210/32 <http://172.16.20.210/32> port 0 cli XX:XX:XX:XX:XX:XX)Feb 28 23:44:25 packetfence auth[2368]: (15) Ignoring duplicate packet from client 172.16.20.210/32 <http://172.16.20.210/32> port 63112 - ID: 20 due to unfinished request in component authenticate module eap_ttlsFeb 28 23:44:26 packetfence auth[2368]: (15) Rejected in post-auth: [XXX(a)tanuvas.org.in <drthiruna(a)tanuvas.org.in>] (from client 172.16.20.210/32 <http://172.16.20.210/32> port 0 cli XX:XX:XX:XX:XX:XX via TLS tunnel)* Kindly help me to resolve the issue.. Regards, Thirunavukkarasu

2 1

Re: Using variables in unlang conditions
by Rahman Duran 28 Feb '22

28 Feb '22

I put it in the authorize section of the default virtual server, just before if conditions. So this file is not considered a "configuration file" :) I just put definitions to the end of the radiusd.conf file, try to start in debug mode with freeradius -X, getting the same error: ((&Packet-Src-IP-Address < ${etu_aruba_wlc_rektorluk}) ^ Failed to parse value for attribute bottom of radiusd.conf #### VARIABLES ############################# etu_aruba_wlc_rektorluk = 10.10.243.0/24 etu_aruba_wlc_ogrenci_merkezi = 10.10.244.0/24 I read all the documentation about using variables already. But it seems I miss something. Rahman Duran Message: 2 > Date: Thu, 24 Feb 2022 09:51:13 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Using variables in unlang conditions > Message-ID: <701442B2-1FCC-4232-BCF2-85A83572176E(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 24, 2022, at 5:50 AM, Rahman Duran <rahman.duran(a)erzurum.edu.tr> > wrote: > > I am trying to do some filtering/policing in the authorize section of the > > default virtual server. I need to check source ip matches our Wireless > > Controllers and SSID and username format etc then decide what to do with > > the request. How can I user some kind of alias/variable for our IP > address > > block so I should not need to write and update IP addresses multiple > places? > > You can edit raddb/dictionary to define local attributes. Or, if the > values don't change too often (i.e. rarely), you can out them into the > configuration files themselves. > > > Here sample of what I try to achieve: > > > > ////////////////////// > > etu_aruba_wlc_001 = 10.10.243.0/24 > > etu_aruba_wlc_002 = 10.10.244.0/24 > > etu_aruba_wlc_002 = 10.10.245.0/24 > > You can just put that at the bottom of radiusd.conf. > > Where did you put the above text? Into a configuration file? Which > one? Or some other file? If so, how is the server supposed to find it? > > > ### 001: Test Wifi Service ### > > *if ((&Packet-Src-IP-Address < ${etu_aruba_wlc_001}) \* > > Then that will work. > > There are many examples of this. > > > Well using variables (${...}) in conditions not working, Freeradius > > daemon not starting with parse error: > > > > /etc/freeradius/3.0/sites-enabled/default[40]: > > ((&Packet-Src-IP-Address < *${etu_aruba_wlc_001}) > > * && (&NAS-Port-Type == "Wireless-80... > > /etc/freeradius/3.0/sites-enabled/default[40]: > ^ > > Failed to parse value for attribute > > Because you didn't define "etu_aruba_wlc_001" anywhere. > > There are many examples of using variables defined in configuration > files. It works. You just have to define the variables in the > configuration files... > > Alan DeKok. > > > > ------------------------------ > > Message: 3 > Date: Thu, 24 Feb 2022 10:08:39 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Advice on RADIUS security and MD5 encryption? > Message-ID: <0B7CD3D0-8BD3-4773-BFDD-7700C1A01B7F(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 24, 2022, at 4:39 AM, Ole Holm Nielsen via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > > We're using the pam_radius module for SSH login authentication on a > CentOS 7 server. Our university's RADIUS server is a Microsoft Windows > server. This seems to work well. > > > > Some of my colleagues are wary about using RADIUS for authentication > because the network traffic is encrypted with the obsolete MD5 algorithm. > > The real question is: "Has anyone broken the encryption method used by > RADIUS?" > > The answer is "no". > > > I would like to understand if this is a relevant objection or not for > the present case. > > It's not relevant. > > > The Wikipedia article https://en.wikipedia.org/wiki/RADIUS does raise > some security concerns. > > Anyone can edit Wikipedia. It doesn't really mean anything. > > > Question: When the user's password hash is transmitted across the > network, how secure is the password from decryption by eavesdroppers? > > If you have a shared secret of "hello", it's easy to crack. > > If the shared secret of "284nv82fskljhfw9yf2hfjb3fjgf8gb83bg", then no > one will be able to crack it. > > > Are there any good articles on RADIUS security? > > Not really. > > In short, it's fine. > > Alan DeKok. > > > > ------------------------------ > > Message: 4 > Date: Fri, 25 Feb 2022 09:06:36 +0100 > From: Ole Holm Nielsen <Ole.H.Nielsen(a)fysik.dtu.dk> > To: <freeradius-users(a)lists.freeradius.org> > Subject: Re: Advice on RADIUS security and MD5 encryption? > Message-ID: <11d65956-d0b7-8ccd-791b-e605539ce21b(a)fysik.dtu.dk> > Content-Type: text/plain; charset="UTF-8"; format=flowed > > Hi Alan, > > Thanks very much for your definitive answers, it's much appreciated! Such > clear messages are almost impossible to find elsewhere. So we should be > good to go with RADIUS, provided that we use hard-to-crack shared secrets. > > Best regards, > Ole > > -- > Ole Holm Nielsen > PhD, Senior HPC Officer > Department of Physics, Technical University of Denmark > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 202, Issue 34 > ************************************************* >

2 3

EAP configuration: Importing the root CA
by Network RADIUS 28 Feb '22

28 Feb '22

** EAP configuration: Importing the root CA --------------------------------------------- The final step to configuring EAP for FreeRADIUS is to add the CA (Certificate Authority) to every client machine that performs EAP authentication. Before proceeding with this step, make sure that you have already done the following: - Configured and tested PAP - Tested EAP configuration with dummy certificates - Troubleshooted any problems with your EAP configuration - Created production certificates and tested them If you have done all of these steps, you are ready to go ahead with adding the CA certificate to all the client machines. This article is the last of the the EAP configuration series. Read the full article… https://networkradius.com/articles/2021/10/25/importing-root-CA.html <https://networkradius.com/articles/2021/10/25/importing-root-CA.html> ** Previous EAP Configuration articles --------------------------------------------- Configuring EAP - getting started: https://networkradius.com/articles/2021/10/18/configuring-EAP.html <https://networkradius.com/articles/2021/10/18/configuring-EAP.html> Command line testing for EAP configuration: https://networkradius.com/articles/2021/10/25/command-line-EAP-testing.html <https://networkradius.com/articles/2021/10/25/command-line-EAP-testing.html> Common EAP configuration problems: https://networkradius.com/articles/2021/10/20/common-EAP-problems.html <https://networkradius.com/articles/2021/10/20/common-EAP-problems.html> Create production EAP certificates: https://networkradius.com/articles/2021/10/25/EAP-production-certificates.h… <https://networkradius.com/articles/2021/10/25/EAP-production-certificates.h…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/request/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Advice on RADIUS security and MD5 encryption?
by Ole Holm Nielsen 25 Feb '22

25 Feb '22

We're using the pam_radius module for SSH login authentication on a CentOS 7 server. Our university's RADIUS server is a Microsoft Windows server. This seems to work well. Some of my colleagues are wary about using RADIUS for authentication because the network traffic is encrypted with the obsolete MD5 algorithm. I would like to understand if this is a relevant objection or not for the present case. The Wikipedia article https://en.wikipedia.org/wiki/RADIUS does raise some security concerns. Question: When the user's password hash is transmitted across the network, how secure is the password from decryption by eavesdroppers? Are there any good articles on RADIUS security? Thanks for sharing any insights. Ole -- Ole Holm Nielsen PhD, Senior HPC Officer Department of Physics, Technical University of Denmark

2 2

Using variables in unlang conditions
by Rahman Duran 24 Feb '22

24 Feb '22

Hi, I am trying to do some filtering/policing in the authorize section of the default virtual server. I need to check source ip matches our Wireless Controllers and SSID and username format etc then decide what to do with the request. How can I user some kind of alias/variable for our IP address block so I should not need to write and update IP addresses multiple places? Here sample of what I try to achieve: ////////////////////// etu_aruba_wlc_001 = 10.10.243.0/24 etu_aruba_wlc_002 = 10.10.244.0/24 etu_aruba_wlc_002 = 10.10.245.0/24 ### 001: Test Wifi Service ### *if ((&Packet-Src-IP-Address < ${etu_aruba_wlc_001}) \* && (&NAS-Port-Type == "Wireless-802.11") \ && (&Called-Station-SSID == "bidb-test") \ && (&User-Name =~ /[0-9a-fA-F]{12}/)) { update request { &ETU-Radius-Service-Name := "BIDB_Test" } # Authentication source files_bidb_test_mac_list # Authentication modules pap # If this service match, do not continue to check rest of the section return } ### 002: Simulation Lab Service ### * if ((&Packet-Src-IP-Address < ${etu_aruba_wlc_001}) \* && (&NAS-Port-Type == "Wireless-802.11") \ && (&Called-Station-SSID == "saglik_bilimleri-sim-lab") \ && (&User-Name =~ /[0-9a-fA-F]{12}/)) { update request { &ETU-Radius-Service-Name := "Saglik_Bilimleri_Sim_Lab" } # Authentication source files_saglik_bilimleri_sim_lab_mac_list # Authentication modules pap # If this service match, do not continue to check rest of the section return } ### DEFAULT REJECT: If no service matched reject undefined request directly here ### update session-state { Module-Failure-Message := "No matching service found for this request!" } reject ///////////////////// Well using variables (${...}) in conditions not working, Freeradius daemon not starting with parse error: /etc/freeradius/3.0/sites-enabled/default[40]: ((&Packet-Src-IP-Address < *${etu_aruba_wlc_001}) * && (&NAS-Port-Type == "Wireless-80... /etc/freeradius/3.0/sites-enabled/default[40]: ^ Failed to parse value for attribute Any hint on this? If it is possible I want to define IP blocks and groups of IP blocks if possible and use them in unlang conditions. Regards, Rahman Duran Bilgi İşlem Daire Başkanlığı Erzurum Teknik Üniversitesi

3 2