- Freeradius-Users - lists.freeradius.org

wired 802.1x
by Vieri Di Paola 25 May '21

25 May '21

Hi, I have a FR setup working fine for wireless clients with either EAP-TLS (computer certificate) or EAP-PEAP (user credentials validated by winbind/AD). I'm trying to expand on that and have wired clients authenticate via 802.1X with EAP-TLS (computer certificate). In my test I'm using the same Windows client that properly authenticates wirelessly with EAP-TLS. I configured its wired interface to use 802.1X with the same local certificate. The FR log indeed shows a "Received Access-Request" which is identical to what I see when it connects wirelessly, except of course for the calling station's MAC addr. The request log also finishes in a similar way with: (38) Found Auth-Type = eap (38) # Executing group from file /etc/raddb/sites-enabled/default (38) authenticate { (38) eap: Peer sent packet with method EAP Identity (1) (38) eap: Calling submodule eap_tls to process data (38) eap_tls: Initiating new TLS session (38) eap_tls: Setting verify mode to require certificate from client (38) eap_tls: [eaptls start] = request (38) eap: Sending EAP Request (code 1) ID 3 length 6 (38) eap: EAP session adding &reply:State = 0x5bf4e1345bf7eccc (38) [eap] = handled (38) } # authenticate = handled (38) Using Post-Auth-Type Challenge (38) # Executing group from file /etc/raddb/sites-enabled/default (38) Challenge { ... } # empty sub-section is ignored (38) Sent Access-Challenge Id 6 from 10.215.144.91:1812 to 10.215.110.190:49154 length 0 (38) EAP-Message = 0x010300060d20 (38) Message-Authenticator = 0x00000000000000000000000000000000 (38) State = 0x5bf4e1345bf7eccc1b644b2a242dee88 (38) Finished request However, FR keeps receiving "Access-Request" messages from the same station without the "State" field. So, could it be that the client is not responding properly (or ignoring/denying) FR's "Access-Challenge"? What should I be looking for and where (I suspect it's all on the client, but I'd like to make sure I don't need to do anything else in FR)? Would it be useful if I posted the full "Access-Request" log? If so, one would be enough if subsequent request messages are the same, I guess (except for msg ID of course). Regards, Vieri

2 5

Help: EAP-FAST/EAP-MSCHAPv2
by manjunatha srinivasan 25 May '21

25 May '21

Hi Below is my-setup of testing EAP-FAST/EAP-MSCHAPv2 with cross-over cable connected between supplicant's client and hostapd/freeradius. Note, both hostapd and freeradius are running on host - Ubuntu 16.04. Also attached log of freeradius. <wpa_supplicant(v2.9)<--->Authenticator(hostapd)<----->Authentication server(freeradius v3.0.15). By the way, wpa_suppliant is not enabled for CONFIG_EAP_FAST support and default to gnuTLS. I have re-compiled it, to support openssl (1.1.0) and enabled EAP_FAST for testing. The question is: I am successfully testing EAP-PEAP/EAP-MSCHAPv2 and EAP-TTLS/EAP-MSCHAPv2. But, fails in EAP-FAST/EAP-MSCHAPv2. Please let me know if EAP-MSCHAPv2 is supported in freeradius with wpa_supplicant communication. Below is wpa_supplincant's configuration: ------------- ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=0 ap_scan=0 network= { key_mgmt=IEEE8021X eap=FAST anonymous_identity="anonymous" identity="user2" password="user222" phase1="fast_provisioning=1" phase2="auth=MSCHAPV2" pac_file="/tmp/wpa_supplicant.eap-fast-pac" ca_cert="/tmp/wpa/ca.pem" eapol_flags=0 } -------------- Below is partial output where error occurs during inner tunnel authentication: ---------------- 7) mschap: Found Cleartext-Password, hashing to create NT-Password (7) mschap: Found Cleartext-Password, hashing to create LM-Password (7) mschap: Creating challenge hash with username: user2 (7) mschap: Client is using MS-CHAPv2 *(7) mschap: ERROR: MS-CHAP2-Response is incorrect*(7) [mschap] = reject (7) } # authenticate = reject (7) eap: Sending EAP Failure (code 4) ID 147 length 4 (7) eap: Freeing handler (7) [eap] = reject (7) } # authenticate = reject (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (7) Post-Auth-Type REJECT { (7) attr_filter.access_reject: EXPAND %\{User-Name} (7) attr_filter.access_reject: --> user2 (7) attr_filter.access_reject: Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated (7) update outer.session-state { (7) &Module-Failure-Message := &request:Module-Failure-Message -> *'mschap: MS-CHAP2-Response is incorrect' (7) }* # update outer.session-state = noop (7) } # Post-Auth-Type REJECT = updated (7) } # server inner-tunnel (7) Virtual server sending reply (7) Reply-Message = "Hello, user2" (7) MS-CHAP-Error = "\223E=691 R=1 C=5246972f1401f7122b3a9da2f0c28f25 V=3 M=Authentication failed" (7) EAP-Message = 0x04930004 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_fast: Got tunneled Access-Reject (7) eap_fast: Reject -------------- Below are reference about EAP-FAST limitation with freeradius, please clarify: http://w1.fi/cgit/hostap/plain/wpa_supplicant/eap_testing.txt (test report of wpa_supplincant<->hostapd<-->freeradius) https://networkradius.com/doc/FreeRADIUS-Implementation-Ch6.pdf (page 46 says it is developed by Cisco and not widely used outside of Cisco environment). Thanks & Regards Manjunatha Srinivasan N

2 2

random 3.0.22 issues with hostapd
by Michael Ströder 23 May '21

23 May '21

HI! I'm running a Wifi access point with hostapd 2.9 and FreeRADIUS 3.0.22 [1] running on raspberry pi armv6 (32-bit) with openSUSE Tumbleweed (kernel 5.12.3). OpenLDAP (Æ-DIR) is used as user management backend. Client is also a Laptop with openSUSE Tumbleweed x86_64 and the usual Network Manager setup with WPA2 with EAP-TTLS/PAP. In general the configuration seems to work and I had no issues with 3.0.21. But with 3.0.22 every now and then it does not work anymore. Restarting radiusd "fixes" it for some time. Unfortunately I did not find a way to easily reproduce it. In syslog I see these messages (first line is the last good case before failure): 2021-05-21T17:24:13.571211+00:00 ap1 radiusd[1728]: (13) Login OK: [miwi] (from client localhost port 1 cli 84-EF-18-F7-9E-6E) 2021-05-21T18:18:31.765761+00:00 ap1 radiusd[1728]: (20) Invalid user (ldap: Bind with (anonymous) to ldaps://ae-dir.hv.local:636 failed: Local error): [miwi] (from client localhost port 0 via TLS tunnel) 2021-05-21T18:18:31.772668+00:00 ap1 radiusd[1728]: (20) Login incorrect (ldap: Bind with (anonymous) to ldaps://ae-dir.hv.local:636 failed: Local error): [miwi] (from client localhost port 0 via TLS tunnel) 2021-05-21T18:18:31.775870+00:00 ap1 radiusd[1728]: (20) Login incorrect (eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed): [miwi] (from client localhost port 1 cli 84- >From the above I suspect radiusd does not properly properly reconnect as configured with SASL/EXTERNAL bind (using its EAP-TLS server cert as client cert) probably after reaching idle connection timeout. Instead it seems to use an anonymous bind. Any clue what's going on here? Ciao, Michael. [1] https://build.opensuse.org/package/show/home:stroeder:iam/freeradius-server

2 4

Public Domain Certificate for EAP-TTLS
by Dean Arnold 22 May '21

22 May '21

Hello Freeradius Users, I'm a new Freeradius user, and I am setting up a for Radius server for LDAP/GSuite Authorization with WiFi 802.11x (WPA2Enterprise) and EAP-TTLS/PAP. The good news is I have all that working, at least for Apple clients; Windows & Android tests pending. The network is in a School environment and the Student's devices are BYOD Laptops, Tablets & Phones, and it's not scalable to installing client certificates for my own CA, so I do not want to use EAP-TLS. I'd like to create a Certificate (Certificate Signing Request) for a CA like Comodo (or other suggested) to create a Public DNS (I have a public domain) signed certificate for use with the EAP-TTLS. I've looked in the docs and user groups and have not seen documentation on how to do this. It's possible I missed it. Could someone please point me to some documents/sites that describe how to make a CSR for a Certificate that will be compatible with OSX and MS clients? Thanks in advance! Dean.

2 2

Upgrade Version 3.0.19. -> 3.0.22 needed??
by uj2.hahn＠posteo.de 22 May '21

22 May '21

Hi, FR-team! * *A while ago I installed FR 3.0.19 on Ubuntu 19.04.(ntlm_auth) The school which is using this implementation for WLAN access has a very basic use model. They need authentification functionality only. Question is: Is there an urgent need (e.g. security, new hot functionality,...) to upgrade to 3.0.22? Or do you think 3.0.19 is still good enough? Thanks Uwe

2 2

ENV {} and rlm_ldap.so
by Michael Ströder 21 May '21

21 May '21

HI! If I set ENV { LDAPNOINIT = '1' } in radiusd.conf will this env var be set before libldap gets loaded via rlm_ldap.so and initialized? Background: Setting LDAPNOINIT to any value will prevent OpenLDAP's libldap to read any default settings from a system-wide ldap.conf (see man page ldap.conf(5)). This ensures that only LDAP settings in the FreeRADIUS config will be used. Of course I can also set this in the systemd unit. But for those not using systemd this would even be a nice better default. Ciao, Michael.

2 1

FreeRadius Load balancing AWS Network Load Balancer
by Emile Swarts 21 May '21

21 May '21

Hi, We're implementing containerised Freeradius servers on AWS which we intend to scale horizontally to accommodate current load. We use ECS Fargate and currently have 6 servers running behind a Network Load balancer. Each of these servers have exactly the same configuration and connect to a centralised RDS database. We've tested this setup and it's all looking successful. Ran performance tests using eapol_test pointed at the load balancer. The fear was that authentication requests could be broken up and fail when distributed incorrectly to the containers. This seems to not be an issue because of a concept known as the "UDP Flow" ( https://aws.amazon.com/blogs/containers/aws-fargate-now-supports-udp-load-b…) with AWS Network load balancers. For extra assurance on this proof of concept, I wanted to check if anyone is aware any potential pitfalls with this design that I might be missing? It looks like the Radius servers don't keep much state in memory (beyond eap sessions), which would be a problem. Beyond that, does this architecture design sound feasible? Thanks, Emile

2 1

Shared data between in perl module
by Юрий Иванов 21 May '21

21 May '21

Hi, I plan to implement accounting logic with the help of perl module. Looks simple, but every time I should open new database connection which is not very effective in case of high load systems. sub accounting { $redis = Redis->new(server => '127.0.0.1:6379', reconnect => 2); ... Is there way to make some sort of "shared" variable in perl module? P.S. Maybe there is even some way to create some buffer array variable inside perl module which persists between perl modules so I can drop redis?

3 3

Security issue - WiFi authentication logging a fake username
by Roberto Franceschetti 20 May '21

20 May '21

Imagine if the Windows CTRL-ALT-DEL login screen, in addition to the username/password fields, also had a field for you to enter an "ALIAS". You then login Windows with your username, but what gets logged in the Security event logs and/or Domain Controller was NOT your username, but the bogus name you entered for the Alias. Your login would be untraceable, and some security admins would go ballistic. This is exactly what is happening with freeradius. It's a scenario similar to what was reported in http://lists.freeradius.org/pipermail/freeradius-users/2021-March/099613.ht…, but worse. See this screenshot showing the WiFi settings on an Android phone (https://www.smugmug.com/gallery/n-vQJqzB) If the WiFi network supports PEAP, in addition to their login credentials users can enter an "Anonymous identity". Unbelievably, if someone does that, what gets logged by freeradius is NOT their login username used to authenticate, but the bogus "Anonymous identity" they entered. I can login via WiFi with my credentials, but enter the username of *another* employee in the "Anonymous identity". If I do this, the *other* employee's username will be logged in the radacct table, and in syslog there will be a "login ok" for the *other* user. I can then perform whatever nefarious acts I want, knowing that my FramedIPAddress will be logged in radacct in the record for the *other* user. The *other* user will thus be investigated and possibly be jailed as all logs will point to them, not me. This post is two-fold. First - AWARENESS. Admins need to be made aware that the information in syslog and in the radacct table can easily be faked - the usernames you see being logged are NOT necessarily the real usernames used to authenticate in your environments. You cannot rely on that data alone during audits/reports/investigations. Second - for the freeradius developers. freeradius is a very valid product that offers a lot of flexibility, but it's seriously lacking in auditing. I'm not disputing the RFCs that allow for inner/outer identities, and the fact that freeradius can be configured to require them to be the same. But you as as developers don't get to tell sysadmins "you should require them to be the same and if you don't it's your fault". The RFCs allow for that, and if business requirements allow them to be different freeradius needs to deal with it. Basic security practices require applications to log and record the account used to authenticate. freeradius is NOT doing that. Freeradius must, out-of-the-box, log and audit all parameters used to login, meaning it needs to capture and log *both* the inner and outer identities, along with the certificate details if certs are used to login. Just like we did with the lack of logging for certificates in the other post, I'm sure we'll be able to address and fix this issue as well. But this (not logging the correct authenticating username) should have never been allowed to happen. You can't have a product that is used to authenticate a variety of devices NOT log the login information unless admins make complex changes to database schema and get creative with config files in order to log and audit basic authentication data that should be logged by default. Now to the details. Below are these are the relevant entries you'll see with freeradius -X when authenticating with the settings as seen in the screenshot: #MAC address: of the wireless device is: 60-a1-0a-89-12-34 #Real Active Directory Username used to authenticate: roberto #Anonymous Identity in PEAP WiFi settings: HACKER rad_recv: Access-Request packet from host 10.252.59.26 port 43972, id=201, length=286 User-Name = "HACKER" ..................... [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - roberto [peap] Got inner identity 'roberto' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0208000c01726f626572746f server lwap-clients { [peap] Setting User-Name to roberto Sending tunneled request EAP-Message = 0x0208000c01726f626572746f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "roberto" ..................... [mschap] Creating challenge hash with username: roberto [mschap] Client is using MS-CHAPv2 for roberto, we need NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=roberto ..................... Login OK: [roberto] (from client 10.252.59.26 port 0 via TLS tunnel) ..................... Sending Access-Challenge of id 210 to 10.252.59.26 port 43972 EAP-Message = 0x010b002b19001703010020e885af0d8fcdc4bd84c0f31439ad983a38ae207bf5faa41bd351a7c209434ab7 Message-Authenticator = 0x123456000000000000000000000000000 ..................... rad_recv: Access-Request packet from host 10.252.59.26 port 43972, id=211, length=373 User-Name = "HACKER" ..................... Login OK: [HACKER] (from client 10.252.59.26 port 8 cli 60-a1-0a-89-12-34) ..................... ++update reply { ++} # update reply = noop [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> HACKER [sql] expand: %{%{User-Name}:-DEFAULT} -> HACKER [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> HACKER [sql] sql_set_user escaped user --> 'HACKER' [sql] expand: INSERT INTO radpostauth (username, message, nasipaddress, reply, authdate, CallingStationid, TLS_Client_Cert_Common_Name, TLS_Client_Cert_Serial, TLS_Client_Cert_Issuer) VALUES ( '%{User-Name}', '%{Module-Failure-Message}', '%{NAS-IP-Address}', '%{reply:Packet-Type}', '%S', '%{Calling-Station-Id}', '%{TLS-Client-Cert-Common-Name}', '%{TLS-Client-Cert-Serial}', '%{TLS-Client-Cert-Issuer}') -> INSERT INTO radpostauth (username, message, nasipaddress, reply, authdate, CallingStationid, TLS_Client_Cert_Common_Name, TLS_Client_Cert_Serial, TLS_Client_Cert_Issuer) VALUES ( 'HACKER', '', '10.252.59.26', 'Access-Accept', '2021-05-14 11:47:45', '60-a1-0a-89-12-34', ..................... Sending Access-Accept of id 211 to 10.252.59.26 port 43972 MS-MPPE-Recv-Key = 0x233bb553a75bf91234567897259fa357c32c6e3ca4cd1e42166817f0f3ebe MS-MPPE-Send-Key = 0xf19b1d7b899c99c12345678987178c5c09d9b77fb729827550c8667a0d29a50 EAP-Message = 0x030b0004 Message-Authenticator = 0x12345600000000000000000000000000 User-Name = "HACKER" Reply-Message = "Welcome to LWAP Controllers" Finished request 278. ==================================================== FYI there is one single item that may be used to see that something is wrong if you're collecting syslogs. In addition to the entry showing the *other" username and the MAC address used to cross-reference and validate the radacct table: Login OK: [HACKER] (from client 10.252.59.26 port 8 cli 60-a1-0a-89-12-34) There will be a vague entry without any corresponding entry in the radacct table, and with no MAC address that can be used as a reference: Login OK: [roberto] (from client 10.252.59.26 port 0 via TLS tunnel) So if you either read this post or are a very thorough investigator and do not trust your radacct table (you shouldn't), you will see that at around the same time that HACKER logged in, there is also an event showing my real login used to login (but without any other useful information). That should prevent the victim I tried to blame from going to jail for reasonable doubt, but it will not prove that I am the true culprit. Roberto Franceschetti

4 7

Re: Inner-tunnel EAP-TTLS with two radcheck items
by Fabricio Viana 20 May '21

20 May '21

Alan, thank you very much for you help. Problem solved! My mistake was not knowing that, for the SQL module to consider Cleartext-Password, all other attributes had to exist. In this particular case, in order for the Calling-Station-Id attribute to be passed into the inner-tunnel, I also had to make changes to the EAP module: copy_request_to_tunnel = yes use_tunneled_reply = yes After that, I changed the Calling-Station-Id to 00-27-22-A2-07-C5 within MySQL and everything worked! Thank you so much again! Regards Fabricio Viana

1 0