- Freeradius-Users - lists.freeradius.org

Overrides for sites-available/inner-tunnel
by Roddie Hasan 13 Apr '21

13 Apr '21

This question is kind of Docker-related, but also a general question. I'm working on a project here (WIP): https://github.com/eiddor/cisco-sda-freeradius/ My goal is to include any customized files that a user would need in order to get this going. So far I've got users, clients.conf, and a sample docker-compose file. It works in general, except I figured out today that I need to change a setting in sites-available/inner-tunnel to get it to work with actual clients. (Found this fix on a ten year old mailer post :-) ). I haven't updated the repo with these findings yet. The fix is simply to change "if (0)" to "if (1)" on line #335 in the post-auth{} section. Because I'm also including instructions for users to run this in Docker, my question is: What's the best way to change this setting while keeping the repo simple and also making it easy for Docker users to implement. The way I see it, I have three options: 1) Spin-off my own Docker image with this setting changed. A heavy-lift and there's really no reason to reinvent this particular wheel for a single character change. 2) Copy sites-available/inner-tunnel out of the container, change it, and just have the user mount it as a volume (similar to clients.conf and users). This seems like the appropriate option, it just seems a bit goofy in my head to break out the full 13K file just to override a single setting. 3) Instruct the user to change the setting inside of the container itself. This isn't really an option, but I didn't want to include only two :-) Are these the only options I have or is there a way to easily override this setting from another file? If I just break out the post-auth{} section and mount it as sites-available/inner-tunnel will the other settings in the original file disappear, or are they set by default? Thanks for any input! Roddie

2 4

Proxy Config/File
by Pizu 13 Apr '21

13 Apr '21

Hi, Is it possible to call multiple proxy files according to the source Ip Address/Range in the pre-proxy? We would like to have the Switch with the 8021x calling a certain proxy file and if coming from VPN will call another. Also if calling different files is not possible something similar to this..? if ((&NAS-IP-Address == 172.16.65.0/24) || (&NAS-IP-Address == 172.16.193.0/24)) { **something here to use realm** } } elsif (&NAS-IP-Address == 10.69.3.182) { **something here to use realm** } } Regards, Pizu

3 4

EAP-TLS and elliptic curves (OPEN)
by Weisteen Per 13 Apr '21

13 Apr '21

Hi I've got some supplicants that only supports secp256r1/prime256v1 as elliptic curve while others support additional curves like x25519, secp384r1 etc. Currently I've set ecdh_curve To prime256v1 which then applies to all supplicants. If I set ecdh_curve parameter empty will the server key exchange adjust curve info dynamically according to what the supplicant has announced in TLS client hello using the "best" curve available ? ./PerW Sensitivity: Internal

2 1

Re: FreeRadius Accounting.
by Linux Threads 08 Apr '21

08 Apr '21

HI Pizu, you mind sharing what you did to get this sorted? Regards > Sorted :) > > Regards, > > Pizu On Wed, 7 Apr 2021 at 19:58, Pizu <pizpower at gmail.com> wrote: > hmm.. something like: Class := "%{Group}" - correct? > > Regards, > > Pizu > > > On Wed, 7 Apr 2021 at 19:44, Pizu <pizpower at gmail.com> wrote: > >> Hi, >> >> I need to forward the class which will reflect to a group not the actual >> LDAP-Group. >> >> The firewall is expecting the Radius Accounting-Start attribute. >> >> Example: >> Acct-Status-Type=Start,Framed-Ip-Address=10.0.0.1,User- Name=user.name >> ,Acct-Session-Id=0211a4ef,Class=usergroup1,Calling-Station-Id=00-0c- 29-44-BE-B8 >> >> I hope I explained better now. >> >> Regards, >> >> Pizu >> >> >> On Wed, 7 Apr 2021 at 19:20, Alan DeKok <aland at deployingradius.com> >> wrote: >> >>> On Apr 7, 2021, at 1:15 PM, Pizu <pizpower at gmail.com> wrote: >>> > What I mean with LDAP-Group is I need to forward the group name that is >>> > assigned to the user towards the firewall (accounting) in order for the >>> > firewall to open the access that is assigned. RSSO >>> >>> So read the firewall documentation to see which attribute it needs. >>> >>> I can guarantee you that it's not LDAP-Group. >>> >>> Alan DeKok. >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >> >>

2 1

Massaging the behavior of LDAP-Group caching?
by Braden McGrath 07 Apr '21

07 Apr '21

All, I ran into a problem with LDAP-Group and a DN that it was not able to find a friendly name for. I have a function called "group_authz" (loaded from a file in policy.d) that gets called in the post-auth{} section of my site. The function just does a few if comparisons against &LDAP-Group[*] and then updates the reply to the NAS with attributes. I ran into a situation where one of the groups it pulled from a user's memberOf list "did not resolve to an object," which then causes rlm_ldap to return "invalid" and thus rejects the whole attempt. The group it choked on is something used internally by FreeIPA. It's not a group I care about, and not user-created (it's not even visible inside the standard FreeIPA interface). There are actually multiple groups like this that I presume it will complain about, if it wasn't failing at the first one. I was able to work around the problem by trying to match on the full DN instead of the friendly name, but this is obviously a bit harder to read in the config, and I'd prefer to use the friendly names if I can find a way to make it work. Is there a way to tell LDAP-Group to ignore any DN that it finds that it can't "resolve", instead of throwing an "invalid"? Or, is there a way to get the LDAP-Group lookup process to only attempt to resolve DNs that match a specified base/filter? The base_dn in the group{} stanza of the ldap module is already set to the portion of the tree I care about, but LDAP-Group seems to still try to resolve the DNs that aren't in that base (presumably because it's just reading them from "memberOf"). If I have to just stick to matching on full DNs, I will... was just trying to learn if there was a way to deal with this lookup failure gracefully. :-) Snippet of log output in the failure state is below... In this case, I had cacheable_names=yes enabled, but I disabled caching later to test further (caching itself isn't the problem, it's just the unresoveable DN). (0) ldap: Performing search in "cn=users,cn=accounts,dc=foobar,dc=org" with filter "(uid=admin-person)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=admin-person,cn=users,cn=accounts,dc=foobar,dc=org" (0) ldap: Resolving group DN "cn=admins,cn=groups,cn=accounts,dc=foobar,dc=org" to group name (0) ldap: Performing unfiltered search in "cn=admins,cn=groups,cn=accounts,dc=foobar,dc=org", scope "base" (0) ldap: Waiting for search result... (0) ldap: Group DN "cn=admins,cn=groups,cn=accounts,dc=foobar,dc=org" resolves to name "admins" (0) ldap: Resolving group DN "cn=Replication Administrators,cn=privileges,cn=pbac,dc=foobar,dc=org" to group name (0) ldap: Performing unfiltered search in "cn=Replication Administrators,cn=privileges,cn=pbac,dc=foobar,dc=org", scope "base" (0) ldap: Waiting for search result... (0) ldap: Search returned no results (0) ldap: ERROR: Group DN "cn=Replication Administrators,cn=privileges,cn=pbac,dc=foobar,dc=org" did not resolve to an object rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ipa1.foobar.org:389 ldap://ipa2.foobar.org:389 ldap://ipa3.foobar.org:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = invalid (0) } # authorize = invalid (0) Invalid user (ldap: Group DN "cn=Replication Administrators,cn=privileges,cn=pbac,dc=foobar,dc=org" did not resolve to an object): [admin-person] (from client dc-srv- sw01 port 11526) (0) Using Post-Auth-Type Reject I appreciate any suggestions! Cheers, Braden

2 4

Implementing PEAP/MSCHAP-v2 at an application level
by Scott Neugroschl 07 Apr '21

07 Apr '21

Hi all, I've had a request to implement a PEAP/MSCHAP-v2 RADIUS client. I've been looking at FreeRADIUS and radcli libraries. My understanding is that PEAP and EAP are MAC level protocols, as opposed to Layer 3 or higher. Is this correct? My problem is that the supplicant is a wired connection that already has an IP address. Are there suggestions for how one would go about implementing this? Or would you recommend using something like stunnel at both ends, and then just implementing the MSCHAPv2 RADIUS protocol using that tunnel? --- Scott Neugroschl | XYPRO Technology Corporation 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |

2 1

FreeRadius Accounting.
by Pizu 07 Apr '21

07 Apr '21

Hi, >From the proxy.conf is it possible to forward the accounting packets towards multiple firewalls? Currently am managing to send only towards only 1 firewall and the LDAP group is not being forward. Is it possible to have an example? as I cannot find anything in the documentation :( Regards, Pizu

2 6

query mschap with ntlm_auth samba4
by Nicolás Lopiano 07 Apr '21

07 Apr '21

Hello! Sorry for the inconvenience. I have been looking for information for a long time and could not find to solve the problem I am running into. My scenario is a vm with freeradius 3.0.17 joined to a samba4 domain with sssd, samba version 4.9.5-Debian. I need to get mschap to work via ntlm_auth. When making the query for ntlm_auth I have no problem and it works. But when making the query using mschap it gives me the following error: Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) ' Wed Apr 7 11:06:35 2021: Debug: (3) mschap: External script failed Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: MS-CHAP2-Response is incorrect Next I copy how I have the config files: cat /etc/samba/smb.conf [global] workgroup = DOMAIN netbios name = RADIUS realm = DOMAIN security = ads password server = DC.DOMAIN ntlm auth = mschapv2-and-ntlmv2-only winbind use default domain = no /etc/freeradius/3.0/sites-enabled/default authorize { chap mschap preprocess suffix eap { ok = return updated = return } ldap expiration logintime authenticate { Auth-Type MS-CHAP { mschap } Auth-Type ntlm_auth { ntlm_auth } Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter } } } /etc/freeradius/3.0/mods-enabled/mschap mschap { with_ntdomain_hack = yes ntlm_auth = "/ usr / bin / ntlm_auth --allow-mschapv2 --request-nt-key --username =% {% {Stripped-User-Name}: -% {% {User-Name}: - None}} --domain =% {% {mschap: NT-Domain}: - MYDOMAIN} --challenge =% {% {mschap: Challenge}: - 00} --nt-response =% {% { mschap: NT-Response}: - 00} " pool { start = $ {thread [pool] .start_servers} min = $ {thread [pool] .min_spare_servers} max = $ {thread [pool] .max_servers} spare = $ {thread [pool] .max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } } I have tried several clients to check the service. He eapol_test and also radtest -t mschap. I can't find what the problem is any suggestion? Thanks a lot! Greetings.

2 1

Error: /etc/raddb/mods-enabled/mschap[10]: 'winbind' auth not enabled at compiled time
by Pizu 07 Apr '21

07 Apr '21

Hello, I am trying to use winbind and having the below error, can someone help? Error: /etc/raddb/mods-enabled/mschap[10]: 'winbind' auth not enabled at compiled time Error: /etc/raddb/mods-enabled/mschap[10]: Instantiation failed for module "mschap" My mschap config: MSCHAP configuration mschap { with_ntdomain_hack = yes use_mppe = yes require_encryption = no require_strong = no pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } passchange { } winbind_username = "%{mschap:User-Name}" winbind_domain = "%{mschap:NT-Domain}" } Centos Version 7.9 FreeRADIUS Version 3.0.13 Winbind Version 4.10.16 Regards, Pizu

4 7

moving from freeradius 2 to 3
by Brian Turnbow 07 Apr '21

07 Apr '21

Hello We have an outdated freeradius 2.0 setup that we are looking to upgrade to 3.0. The old setup has a mysql db and we have run into an issue trying to replicate the same configuration with 3.0. We have gotten everything installed and working but in our actual setup we use some regex expressions from the db such as NAS-Port-Type =~ ^(Ethernet|Virtual|PPPoEoVLAN)$ to filter nas port types or NAS-IP-Address =~ ^(192.168.0.11|192.168.0.227|192.168.0.34|192.168.0.244)$ to filter which nas users can connect from In 3.0 it seems that the use of regex from a db has been removed. Is there a way to make it work ? The goal We use different checks in different groups and assign the user to the correct group for the service he has purchased. If there is another way to accomplish this I am all ears. Thanks in advance Brian

3 3