- Freeradius-Users - lists.freeradius.org

TLS 1.3
by HERCEK, Marián 09 Jun '21

09 Jun '21

Hello, after upgrading to 3.0.22 I can see many authentication problems with old devices (e.g. Android 4.4) Using EAP + MSCHAPv2. I configured tls_min_version to 1.0 and tls_max_version to 1.3. Debug log: (32) eap_peap: (TLS) EAP Got all data (198 bytes) (32) eap_peap: (TLS) Handshake state - before SSL initialization (0) (32) eap_peap: (TLS) Handshake state - Server before SSL initialization (0) (32) eap_peap: (TLS) Handshake state - Server before SSL initialization (0) (32) eap_peap: (TLS) recv TLS 1.3 Handshake, ClientHello (32) eap_peap: (TLS) send TLS 1.0 Alert, fatal protocol_version (32) eap_peap: ERROR: (TLS) Alert write:fatal:protocol version (32) eap_peap: ERROR: (TLS) Server : Error in error (32) eap_peap: ERROR: (TLS) Failed reading from OpenSSL: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (32) eap_peap: ERROR: (TLS) System call (I/O) error (-1) (32) eap_peap: ERROR: (TLS) EAP Receive handshake failed during operation freeradius -Xxv Mon May 31 12:00:32 2021 : Info: radiusd: FreeRADIUS Version 3.0.22 (git #7c658e1c0), for host x86_64-pc-linux-gnu Mon May 31 12:00:32 2021 : Debug: Server was built with: Mon May 31 12:00:32 2021 : Debug: accounting : yes Mon May 31 12:00:32 2021 : Debug: authentication : yes Mon May 31 12:00:32 2021 : Debug: ascend-binary-attributes : yes Mon May 31 12:00:32 2021 : Debug: coa : yes Mon May 31 12:00:32 2021 : Debug: control-socket : yes Mon May 31 12:00:32 2021 : Debug: detail : yes Mon May 31 12:00:32 2021 : Debug: dhcp : yes Mon May 31 12:00:32 2021 : Debug: dynamic-clients : yes Mon May 31 12:00:32 2021 : Debug: osfc2 : no Mon May 31 12:00:32 2021 : Debug: proxy : yes Mon May 31 12:00:32 2021 : Debug: regex-pcre : no Mon May 31 12:00:32 2021 : Debug: regex-posix : yes Mon May 31 12:00:32 2021 : Debug: regex-posix-extended : yes Mon May 31 12:00:32 2021 : Debug: session-management : yes Mon May 31 12:00:32 2021 : Debug: stats : yes Mon May 31 12:00:32 2021 : Debug: systemd : yes Mon May 31 12:00:32 2021 : Debug: tcp : yes Mon May 31 12:00:32 2021 : Debug: threads : yes Mon May 31 12:00:32 2021 : Debug: tls : yes Mon May 31 12:00:32 2021 : Debug: unlang : yes Mon May 31 12:00:32 2021 : Debug: vmps : yes Mon May 31 12:00:32 2021 : Debug: developer : no Mon May 31 12:00:32 2021 : Debug: Server core libs: Mon May 31 12:00:32 2021 : Debug: freeradius-server : 3.0.22 Mon May 31 12:00:32 2021 : Debug: talloc : 2.1.* Mon May 31 12:00:32 2021 : Debug: ssl : 1.1.1d release openssl ciphers -s -v -tls1 ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 openssl ciphers -s -v -tls1_2 ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384 ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256 ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256 ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256 ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256 AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 openssl ciphers -s -v -tls1_3 TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD

4 8

Freeradius, Eduroam, AzureAD ldaps authentication
by Tanya Stawicki 09 Jun '21

09 Jun '21

Hello, We have a Freeradius server two years long successfully providing EduRoam connectivity for our customer. Local Identity provider is Microsoft Server 2016 AD. WiFi clients are most Windows 10 clients and phones. However the customer wants to switch to Azure AD and ( in time) get rid of their Windows servers. They want to authenticate with Azure AADDS Ldaps I doubt if it is possible with (Free)Radius, I guess the combination is not in the compatibility matrix, but I’m not sure: It’s not 100% clear to me, which encryption method Azure uses for storing passwords in LDAPs. Question 1. is it possible FreeRadius for wifi-auth. with Azure AD as IP? I have set up an other EduRoam FreeRadius server anyway: What works: - ldapsearch -H ldaps.mydomain.nl -x -b “dc=mydomain,dc=nl” - radtest abba.king@mydomain <userpassword> 127.0.0.1 -1 testing123 - "Received Access-Accept" What doesnt work: - Authentication with WiFi (on windows 10 PC with native eap-peap / mschapv2 ) error: eap_mschapv2: authenticate { (8) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (8) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (8) mschap: Creating challenge hash with username: abba.king(a)mydomain.nl (8) mschap: Client is using MS-CHAPv2 (8) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (8) mschap: ERROR: MS-CHAP2-Response is incorrect (8) [mschap] = reject Did I make a mistake? Or is it not possible? Greetings and thanks for FreeRadius, Tanya

3 4

rlm_peap.so Error
by Tal Nur 09 Jun '21

09 Jun '21

Hi All, I installed FR 3.0.22 on Ubuntu 20.04 from package and edit eap file because default_eap_type was md5, I changed it to peap. But when I run FR in debug mode: #sudo freeradius -X I got the error message: Failed to link to module 'rlm_peap': /usr/lib/freeradius/rlm_peap.so: cannot open shared object file: No such file or directory I checked /usr/lib/freeradius directory and really didn’t find rlm_peap.so file, but I found rlm_eap_peap.so instead. Please, help me to fix the problem! Thank you in advance

2 1

ARTICLE: Designing multi-site RADIUS systems
by Network RADIUS 08 Jun '21

08 Jun '21

** Designing multi-site RADIUS systems —————————————————————————————— Some organizations and ISPs can use a central RADIUS service for all of their RADIUS needs. This configuration is possible when there are a small number of users, or system load is low. However, when there are a large number of users spread across a wide geographic region, it may be beneficial to use a multi-site approach. As with all solutions, this approach has benefits and costs. ** Recommendation: Allocate more than one primary directory service instance —————————————————————————————— It is already common practice to set up a primary directory service instance at the main data center for storing usernames and passwords. Additional data centers will usually have a secondary instance of this identity store that is simply a “clone” of the primary. Any changes to user information are made on the primary instance, and then copied to all the secondary ones. Read the full article… https://networkradius.com/articles/2021/02/10/designing-RADIUS-multi-site-s… ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/contact/ <https://networkradius.com/contact/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Hard coding number of radius process.
by Юрий Иванов 08 Jun '21

08 Jun '21

Hi, I've written rlm_perl module which works. I have some thoughts and want to ask what do you think. My perl module using threads (for sharing variables) and threaded perl is more slower as we all know (Maybe its better idea to use IPC pipes btw). FreeRadius has thread pool section where number of processes can be controlled What do you think if I set start_servers = 64 and max_servers = 64? As I understand now radius will start 64 process at start time and in this case all my rlm_perl processes will not share state but looks like it will not needed because overall number of processes will be eq to 64 and not die and will not lost data. FreeRADIUS because tries will not to maintain servers to handle the current load. Thanks for your thoughts

2 3

How to catch Ldap-Group fail state
by Sergey Nikitin 08 Jun '21

08 Jun '21

Hi! Could you help me please: is there a way to catch Ldap-Group failed state? I have the following construct for ldap group check in the post-auth section: if Ldap-Group == "test-group" { update reply { cisco-avpair :="shell:priv-lvl=15" } } else { reject } Problem is when ldap server becomes unreachable from radius server, radius client receive reject and I would like not to send reply in such case. Is there a way to implement something like this: if Ldap-Group == "test-group" { update reply { cisco-avpair :="shell:priv-lvl=15" } } elsif (fail) { do_not_respond } else { reject } where (fail) is the state of Ldap-Group check. Thank you. -- Best Regards. Sergey

2 1

Re: Re: ntlm_auth not being invoked
by Shaun donovan 07 Jun '21

07 Jun '21

Sorry Alan. Here is the full log: (0) Received Access-Request Id 124 from 127.0.0.1:45676 to 127.0.0.1:1812 length 74 (0) User-Name = "piet" (0) User-Password = "P0mp!es" (0) NAS-IP-Address = 192.168.7.203 (0) NAS-Port = 0 (0) Message-Authenticator = 0xb574f29bb2356cb5b1aa5f3b5625ae39 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "piet", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> piet (0) sql: SQL-User-Name set to 'piet' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'piet' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'piet' ORDER BY id (0) sql: WARNING: User not found in radcheck table. rlm_sql (sql): Reserved connection (2) rlm_sql (sql): Released connection (2) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.3.28-MariaDB, protocol version 10 (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'piet' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'piet' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (3) (0) sql: EXPAND %{User-Name} (0) sql: --> piet (0) sql: SQL-User-Name set to 'piet' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'piet', 'P0mp=3D21es', 'Access-Reject', '2021-06-07 07:13:41') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'piet', 'P0mp=3D21es', 'Access-Reject', '2021-06-07 07:13:41') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (3) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> piet (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 124 from 127.0.0.1:1812 to 127.0.0.1:45676 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 124 with timestamp +38 Ready to process requests > Message: 2 > Date: Fri, 4 Jun 2021 08:53:39 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: ntlm_auth not being invoked > Message-ID: <FADA674B-6BA4-4C28-AAFA-33DCD569C193(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Jun 4, 2021, at 8:02 AM, Shaun donovan via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: >> I have configured FreeRADIUS Version 3.0.20 on a CentOS Linux release 8.3.2011 machine with daloRadius. I have then followed the instructions at http://deployingradius.com/documents/configuration/active_directory.html to allow FreeRADIUS to authenticate against an Active Directory. >> >> Everything works up to the point that I must remove the "testing entry" in raddb/mods-config/files/authorize, namely the "DEFAULT Auth-Type = ntlm_auth" and uncomment the "ntlm_auth =" line in raddb/modules/mschap. Once I do this and test using radtest, I get: >> >> (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type >> (0) pap: WARNING: Authentication will fail unless a "known good" password is available >> (0) [pap] = noop >> (0) } # authorize = ok >> (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject >> >> from Radius -X. > There's a lot more output available. Post ALL of it. > >> I can see that it is trying to do PAP authentication, but does not "Fall Through" to try ntlm_auth. I have tried to google this extensively, but cannot find where I should configure FreeRADIUS to first try PAP and the try ntlm_auth. >> >> Any help appreciated. > Follow the instructions here: http://wiki.freeradius.org/list-help > > Alan DeKok.

1 1

EAP-TLS
by Henrik Schack 06 Jun '21

06 Jun '21

Hi Is it possible to configure Freeradius to require only a valid TLS client cert created by own CA, in order to get an ACCEPT ? /Henrik

3 8

Naming collision on CN in CA certificates (EAP-TLS)
by Ash Wilson 05 Jun '21

05 Jun '21

Hi there, Before I open a bug report in Github, I'm hoping that someone else has seen this issue and can advise on a work-around. What I'm trying to do: Use multiple CA certificates for authentication of EAP-TLS supplicants. The CNs in these CA certificates may be identical. What I'm expecting: FreeRADIUS (via SSL library) should use the authorityKeyID in the supplicant's certificate to locate the CA certificate (matching against the subjectKeyID) to validate the supplicant's presented certificate. What I'm observing: FreeRADIUS fails to authenticate client certificates if multiple CA certificates exist with the same CN. The CN appears to be the key which FreeRADIUS uses to locate the CA certificate. More about the test scenario: Attempted with two CA certificates as separate certs in cert_dir. Also tried with both CA certificates in the same file. As long as the CNs are different, authentication happens as desired, with no issues. If the CNs collide, auth fails. When I use OpenSSL to verify the client certs against the CA certs, OpenSSL authenticates the certs correctly even if the names collide. FreeRADIUS appears to be sharing the responsibility of validating the supplicant's certificate with the SSL library, and treating it differently than openSSL does when used independently. -- *Ash Wilson* | Technical Director *e:* ash.wilson(a)valimail.com This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified of any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system.

2 1

Identify request in post-auth section
by Arnaud LAURIOU 04 Jun '21

04 Jun '21

Hi, On our eduroam proxy server, we use a virtual server to reject requests with an unknown realm in our federation : authorize { update request { &Module-Failure-Message += 'Rejected: Realm unknown in .fr' } reject } We would also like to identify these requests in the 'Post-Auth-Type REJECT' of the default virtual server. How can we do this ? Trying to match %{proxy-reply:Module-Failure-Message} doesn't seem to work. Thank's. -- Direction des Services Applicatifs RENATER - Rennes https://www.renater.fr/

2 2