- Freeradius-Users - lists.freeradius.org

lpad on regular expression matches does not work
by Tomasz Chiliński 04 Mar '21

04 Mar '21

Hello all, I try to improve Calling-Station-Id MAC address canonicalization a little bit, so that is should left pad MAC octets with zeroes. I modified default settings as is: mac-addr-regexp = '([0-9a-f]{1,2})[:\-\.]([0-9a-f]{1,2})[:\-\.]([0-9a-f]{1,2})[:\-\.]([0-9a-f]{1,2})[:\-\.]([0-9a-f]{1,2})[:\-\.]([0-9a-f]{1,2})' This regular expression matches example MAC address properly: [0] => 18:d0:71:f3:70:8 [1] => 18 [2] => d0 [3] => 71 [4] => f3 [5] => 70 [6] => 8 Then I want to make the whole thing this way: rewrite_calling_station_id { if (&Calling-Station-Id && (&Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i)) { update request { &Calling-Station-Id := "%{toupper:%{lpad:%{1} 2 0}:%{lpad:%{2} 2 0}:%{lpad:%{3} 2 0}:%{lpad:%{4} 2 0}:%{lpad:%{5} 2 0}:%{lpad:%{6} 2 0}}" } updated } else { noop } } And here's surprise - lpad expression function handles only attribute parameters (ex. {lpad:&User-Name 100 0}), but not regexp matches. What am I doing wrong? -- Bests, Tomasz Chiliński, Chilan opiekun projektu LMS - https://lms.org.pl kierownik projektu LMS Plus / LMS+ - https://lms-plus.org -- Pozdrawiam Tomasz Chiliński, Chilan opiekun projektu LMS - https://lms.org.pl kierownik projektu LMS Plus / LMS+ - https://lms-plus.org

3 5

Bug in new freeradius patch
by lingctam 04 Mar '21

04 Mar '21

Hi all, We have two freeradius servers running as a pair. After applying the new freeradius patch to both servers, the radiusd service would disappear one in one server and soon after, the service disappears in the second sever. There are no indication of the root cause from system logs. New version: freeradius-3.0.20-3.module_el8.3.0+476+0982bc20.x86_64 Old version: freeradius-3.0.17-7.module_el8.2.0+321+f9fd5d26.x86_64 After reverting one server to old freeradius version, the radiusd service runs without issue. Has anyone run into this issue? Thanks in advance.

2 1

Standard & Realm Authentication
by Richard J Palmer 02 Mar '21

02 Mar '21

Hello All We have been using FreeRadius for quite a long time to authenticate PPPoE and L2TP sessions and hotspots. So far everything works. However I'd like to add an extra function and wondered if you could provide a pointers, Generally Users send their username - we look in SQL and return Data from radreply / ip pools etc. We have no problem there. On our LNS / LAC Devices we also have a small number of sessions that we forward to other ISPs. With these we don't have the username - but forward based on realm On our LNS We have: --- <match name="EXAMPLE-FWD" graph="EXAMPLE-FWD" username="*myexample.co.uk @example.ws" payload-table="0" relay-pick="true" relay-ip="1.2.3.4 1.2.3.5" relay-secret="test123" relay-hostname="test-hostname"/> --- As an alternative the LNS can get this data from Radius - and given the growing number of LNS devices - rather than keeping the sync up to date on multiple devices it makes sence to run this as part of the radius. NOTE this is not a radius proxy - where we pass on the radius request if it's a matching realm - BUT a radius reply to the LNS telling it to forward the connection on to the customers LNS. What I am trying to achieve in FreeRadius is 1) If there's an exact username (as now) continue as now 2) IF there's not a match either run a second SQL which will find the realm - and return accept. And then pass back the necessary attributes back to allow the session to forward. Pretty happy to do most of the work here but some pointers would be perfect. I could I suppose do this by replacing the SQL query with a stored procedure - but open to any better ideas? Thanks in advance Richard

3 6

sqlippool, same username, give different pool IP addresses
by Alberio Mirko 26 Feb '21

26 Feb '21

hello there, I am using a freeradius instance for assigning PPPoE public ip addresses to our customers. Also I created a different ip pool for service purpose, we have a service PPPoE single username for the management of the routers and it is always the same, the goal is that when the router is connected to our network it gets a private management IP so we can access and configure it. The management IP should be took from the aforemented pool, dynamically, and freed when the router is configured. So for example pool is: 172.16.0.1 172.16.0.2 172.16.0.3 172.16.0.4 routerA authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 routerB authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.2 ... etc. Could this can be done using freeradius and its modules? At the moment using sqlippool I can only get the same user to get always the same ip, example: routerA authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 routerB authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 ... etc. can somebody help me? Thanks-a-lot! I attach the debugfile as intended. -- Mirko Alberio mirko.alberio(a)telemar.it

2 1

Freeradius3.x with Openldap Authorization
by Srijan 26 Feb '21

26 Feb '21

Hello, greetings.. I got some queries related to openldap authentication and authorization, followed ldap_howto.rst. Able to Authenticate via ldap but for authorization not working according to userwise's profiles.. how can i obtain user's profile. if i put default profile then it works and reply same to all users, Here's my ldap config: ldap { server = 'localhost' identity = 'cn=adm,dc=xyx,dc=com.' base_dn = 'ou=radius,dc=xyz,dc=com' update { control:Password-With-Header += 'userPassword' control:Expiration := 'radiusExpiration' control:Calling-Station-Id := 'radiusCallingStationId' control:NAS-Identifier := 'radiusNASIdentifier' control:Simultaneous-Use := 'radiusSimultaneousUse' reply:Reply-Message := 'radiusReplyMessage' control:NT-Password := 'ntPassword' reply:Idle-Timeout := 'radiusIdleTimeout' reply:Session-Timeout := 'radiusSessionTimeout' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" sasl { } } profile { filter = '(objectclass=radiusprofile)' default = 'uid=planx,ou=profiles,ou=radius,dc=xyz,dc=com' attribute = 'radiusProfileDn' } Result with Default profile config: Sent Access-Request Id 188 from 0.0.0.0:60201 to 127.0.0.1:1812 length 77 User-Name = "user1" User-Password = "user123" NAS-IP-Address = 10.21.8.10 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "user123" Received Access-Accept Id 188 from 127.0.0.1:1812 to 127.0.0.1:60201 length 104 Idle-Timeout = 600 Session-Timeout = 86400 Acct-Interim-Interval = 10800 ERX-Egress-Policy-Name = "20MD" ERX-Ingress-Policy-Name = "20MU" MS-Primary-DNS-Server = 1.1.1.1 MS-Secondary-DNS-Server = 9.9.9.9 Framed-Pool = "staff-pool" Openldap: # planx, profiles, radius, xyz.com dn: uid=planx,ou=profiles,ou=radius,dc=xyz,dc=com cn: planx radiusIdleTimeout: 600 radiusSessionTimeout: 86400 radiusServiceType: Framed-User radiusFramedProtocol: PPP uid: planx objectClass: radiusObjectProfile objectClass: radiusprofile radiusReplyAttribute: Acct-Interim-Interval := 10800 radiusReplyAttribute: ERX-Egress-Policy-Name := 10MD radiusReplyAttribute: ERX-Ingress-Policy-Name := 20MU radiusReplyAttribute: MS-Primary-DNS-Server := 1.1.1.1 radiusReplyAttribute: MS-Secondary-DNS-Server := 9.9.9.9 radiusReplyAttribute: Framed-Pool := staff-pool # plany, profiles, radius, xyz.com dn: uid=plany,ou=profiles,ou=radius,dc=xyz,dc=com cn: plany objectClass: radiusObjectProfile objectClass: radiusprofile objectClass: top radiusFramedProtocol: PPP radiusIdleTimeout: 600 radiusServiceType: Framed-User radiusSessionTimeout: 86400 uid: plany radiusReplyAttribute: Acct-Interim-Interval := 10800 radiusReplyAttribute: ERX-Egress-Policy-Name := 10MD radiusReplyAttribute: ERX-Ingress-Policy-Name := 10MU radiusReplyAttribute: MS-Primary-DNS-Server := 1.1.1.1 radiusReplyAttribute: MS-Secondary-DNS-Server := 9.9.9.9 radiusReplyAttribute: Framed-Pool := default-pool # users, radius, xyz.com dn: ou=users,ou=radius,dc=xyz,dc=com objectClass: organizationalUnit objectClass: top ou: users dn: uid=user1,ou=users,ou=radius,dc=xyz,dc=com radiusGroupName: planx uid: user1 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: radiusprofile *is " radiusGroupName:" obsolete in Freeradius3 ?* dn: uid=user2,ou=users,ou=radius,dc=xyz,dc=com radiusGroupName: plany uid: user2 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: radiusprofile ----- How can I obtain a user's profile, please suggest.. Regards, Srijan

2 1

Change Of Authorization
by Hassan, Hazem (Nokia - EG/Cairo) 26 Feb '21

26 Feb '21

Hi , Is it possible to do COA via FreeRadius ? If yes how? Thanks, Hazem

3 2

Upgrade freeradius from version 3.0.16 to 3.0.21
by Brahim Bouchaiba 24 Feb '21

24 Feb '21

Hi, I'm new to freeradius and was tasked with upgrading Freeradius on ubuntu . Right now we are on version 3.0.16 and we would like to upgrade to version 3.018. I have searched around and can't seem to find any article or link on that process. Do we just run apt update and apt --list upgradable then apt--only-upgrade install freeradius, I have already backed up all the files in /etc/freeradius Please help. Thanks.

3 2

unknown CA when trying to authenticate
by Tyler Montney 24 Feb '21

24 Feb '21

Version 3.0.16, running on Ubuntu 18.04. While running freeradius -X and trying to connect a user (Ubiquiti controller), I see "eap_peap: ERROR: TLS Alert read:fatal:unknown CA". /etc/freeradius/3.0/mods-enabled/eap has its tls-config tls-common section like private_key_file = /etc/freeradius/3.0/certs/letsencrypt/privkey.pem certificate_file = /etc/freeradius/3.0/certs/letsencrypt/cert.pem ca_file = /etc/ssl/certs/ca-certificates.crt My CA was copied to /usr/local/share/ca-certificates/ and ran dpkg-reconfigure ca-certificates. I then checked ca-certificates.crt and confirmed my CA was appended to the bottom.

3 17

Comments on Active Directory IdP and YubiKey OTP integration that supports MS-CHAP v2
by David Herselman 23 Feb '21

23 Feb '21

Hi, I was hoping the following may provide a more complete start to finish integration guide for others that may have similar requirements. I would very much like to invite dialogue regarding any recommendations anyone may have. Our requirements were: * RADIUS servers domain joined to handle PAP and MS-CHAP v2 authentication using information only from Active Directory * We do not want to store credentials in AD with reversible encryption * AD Group membership validation based on source * Yubico OTP Multi-Factor Authentication (MFA) System are domain joined as member servers using Samba. Samba winbind subsequently presents users and groups as native system accounts, which allows references to just the group name and unlike LDAP does not make the link sensitive to the placement of the security group within the AD folders or organisational units (distinguished name or DN). Password Authentication Protocol (PAP) transmits unencrypted passwords (i.e. plain-text) over the network so connectivity should be encrypted using either IPSec or TLS (RadSec or EAP-TTLS). MS-CHAP v2 provides mutual authentication and uses a hash of the password. This means that the request only includes a hash representing the password, so there is nothing to cut the password and OTP out of. One can however transmit the OTP as the username and then lookup the associated owner's AD account name for FreeRADIUS to retrieve the hash used during authentication via Samba winbind. Yubico devices generate a unique 32 character modhex passcode each time you press the button on a YubiKey 5 or scan it using NFC. This passcode comes after a 12 character public id, which is unique to each YubiKey. We therefore have two method of transmitting the OTP during login. The first is the classic RSA token method (although reversed) where we use our username, type our password and then press the YubiKey button, herewith an example: Username: davidh Password: secretcccccct00001krbhnvrjrdlujuujdcjvltdcrdkhhtit This method requires PAP, as we require the client to transmit the entered credentials, so that we can cut the information in to a password and Yubico OTP. The alternative is to make use of the YubiKey's public ID to lookup the AD username. This method works for PAP and allows MS-CHAP v2 authentication, herewith an example: Username: cccccct00001krbhnvrjrdlujuujdcjvltdcrdkhhtit Password: secret In the second case we type out password out and then press the YubiKey when prompted for the username. Devices we were authenticating to are generally switches and routers where we can transmit attributes as part of the access accept message to grant eg access permissions. Some platforms however (eg Check Point Management and VyOS) require user accounts to be defined, in those cases you are stuck with PAP being the only possible integration. PS: All is not lost, if you implement a jump host that you enforce MFA access to, which in turn simply uses single factor. Additional detail on the Yubico OTP is available directly from Yubico: https://developers.yubico.com/OTP/OTPs_Explained.html The following notes pertain to a Debian buster (10) install, they would require path changes but should in essence work on any Linux distribution. Join system to Active Directory: apt-get install libnss-winbind samba winbind; pico /etc/krb5.conf [libdefaults] default_realm = AD.ACME.COM dns_lookup_realm = false dns_lookup_kdc = true pico /etc/samba/smb.conf [---------------------------------------- /etc/samba/smb.conf ----------------------------------------] [global] server role = member server workgroup = ACME realm = ad.acme.com netbios name = FreeRADIUS1 server string = FreeRADIUS and Yubico OTP bind interfaces only = yes interfaces = 127.0.0.1/8 192.168.1.48/24 ntlm auth = mschapv2-and-ntlmv2-only guest account = nobody idmap cache time = 300 kerberos method = system keytab idmap config * : backend = tdb idmap config * : range = 100001-120000 idmap config Domain-01 : backend = rid idmap config Domain-01 : range = 1000-100000 template homedir = /home/users/%U template shell = /sbin/nologin log level = 2 log file = /var/log/samba/%m.log enable core files = no max log size = 50 dont descend = /dev, /mirror, /proc time server = no wins support = no map acl inherit = yes store dos attributes = yes printing = cups cups options = raw winbind use default domain = yes winbind enum users = yes winbind enum groups = yes winbind expand groups = 2 [nobody] path = /dev/null comment = Access denied - Guest guest ok = no printable = no browseable = no [---------------------------------------- /etc/samba/smb.conf ----------------------------------------] net ads join -U adm-domain-davidh; systemctl restart smbd; pico /etc/nsswitch.conf; # Append 'winbind' to 'passwd' and 'group' Check winbind and ntlm_auth authentication are working: wbinfo -t ntlm_auth --allow-mschapv2 --request-nt-key --domain=ACME --username=davidh pico /etc/group /etc/gshadow # Add 'freerad' to 'winbindd_priv:' Finally check that you are able to retrieve users and groups as if they were local users: getent passwd davidh getent group client_cpe_admin Install FreeRADIUS with the YubiKey module: apt-get install freeradius-yubikey If necessary set shortname on defined clients to apply different AD group membership or altering what reply attributes are sent back /etc/freeradius/3.0/clients.conf # Hash out existing active lines, then append: client fw1.acme.com { ipaddr = 192.168.10.1 secret = **************** require_message_authenticator = yes nastype = other shortname = checkpoint } client switch6.acme.com { ipaddr = 192.168.20.7 secret = **************** require_message_authenticator = yes nastype = cisco shortname = client_cpe } Define custom attributes: /etc/freeradius/3.0/dictionary.custom ATTRIBUTE sAMAccountName 3000 string ATTRIBUTE Original-User-Name 3001 string Sample Livingston style users file, in this case for use with MikroTik RouterOS, make as many as you need with whatever reply attributes you require: /etc/freeradius/3.0/users DEFAULT FreeRADIUS-Client-Shortname == "client_cpe", Group == "client_cpe_view" Mikrotik-Group = "view" DEFAULT FreeRADIUS-Client-Shortname == "client_cpe", Group == "client_cpe_admin" Mikrotik-Group = "full" DEFAULT FreeRADIUS-Client-Shortname == "client_cpe", Auth-Type := Reject Reply-Message = "Access Denied - Not a member of any client_cpe security groups" DEFAULT Auth-Type := Reject Reply-Message = "Access Denied" Edit MS-CHAP v2 module to use winbind and alter the username: /etc/freeradius/3.0/mods-available/mschap winbind_username = "%{%{sAMAccountName}:-%{mschap:User-Name}}" winbind_domain = "%{mschap:NT-Domain}" Add 'allow-mschapv2' and again change the username expansion variable: /etc/freeradius/3.0/mods-available/ntlm_auth program = "/usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key --domain=DOMAIN-01 --username=%{%{sAMAccountName}:-%{mschap:User-Name}} --password=%{User-Password}" Register for a Yubico API integration account and then enable and configure the module: cd /etc/freeradius/3.0/mods-enabled; ln -s ../mods-available/yubikey yubikey; /etc/freeradius/3.0/mods-enabled/yubikey validate = yes client_id = ***** api_key = '****************************' The following changes are all in /etc/freeradius/3.0/sites-available/default Hash out 'pap', we'll force NTLMv2 by obtaining a hash of the password hash from AD with each authentication request and perform necessary operations on the plain text password we receive as part of the request After 'preprocess' in 'authorize {' if (&User-Name =~ /^([cbdefghijklnrtuv]{44})$/) { update request {Yubikey-OTP = "%{1}"} } elsif (&User-Password =~ /^(.+?)([cbdefghijklnrtuv]{44})$/) { update request {User-Password := "%{1}", Yubikey-OTP = "%{2}"} } if (&Yubikey-OTP =~ /^([cbdefghijklnrtuv]{12})/) { switch "%{1}" { case cccccct00001 {update request {sAMAccountName = "davidh"}} case cccccct00002 {update request {sAMAccountName = "philipo"}} } if (!&sAMAccountName || (&User-Name != &Yubikey-OTP && &User-Name != &sAMAccountName)) { update reply {Reply-Message := "Unregistered or user mismatch"} reject } } Before and after 'files' in 'authorize {' update request {FreeRADIUS-Client-Shortname = "%{Client-Shortname}"} if (&sAMAccountName && &User-Name != &sAMAccountName) { update request { Original-User-Name := "%{User-Name}", User-Name := "%{sAMAccountName}"}} files if (&Original-User-Name) {update request {User-Name := "%{Original-User-Name}"}} End of 'authorize {' if (&control:Auth-Type == "mschap") { if (&Yubikey-OTP) { update control {Auth-Type := "YubiCHAP"} } else {update control {Auth-Type := "MS-CHAP"}} if (!control:Auth-Type && User-Password) { if (&Yubikey-OTP) { update control {Auth-Type := "YubiNTLM"} } else {update control {Auth-Type := "ntlm_auth"}} } Exclusively have the following in 'authenticate {' Auth-Type MS-CHAP { mschap } Auth-Type YubiCHAP { mschap yubikey } Auth-Type ntlm_auth { ntlm_auth } Auth-Type YubiNTLM { ntlm_auth yubikey } Beginning of 'post-auth {' if (&sAMAccountName && &User-Name != &sAMAccountName) {update request {User-Name := "%{sAMAccountName}"}} Beginning of 'Post-Auth-Type REJECT {' if (&sAMAccountName && &User-Name == &Yubikey-OTP) {update request {User-Name := "%{sAMAccountName}"}} Herewith all active lines, as a comparative to where you've ended up: [---------------------------------------- grep -v '^\s*#\|^\s*$' /etc/freeradius/3.0/sites-enabled/default ----------------------------------------] server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { filter_username preprocess if (&User-Name =~ /^([cbdefghijklnrtuv]{44})$/) { update request {Yubikey-OTP = "%{1}"} } elsif (&User-Password =~ /^(.+?)([cbdefghijklnrtuv]{44})$/) { update request {User-Password := "%{1}", Yubikey-OTP = "%{2}"} } if (&Yubikey-OTP =~ /^([cbdefghijklnrtuv]{12})/) { switch "%{1}" { case cccccct0001 {update request {sAMAccountName = "davidh"}} case cccccct0002 {update request {sAMAccountName = "philipo"}} } if (!&sAMAccountName || (&User-Name != &Yubikey-OTP && &User-Name != &sAMAccountName)) { update reply {Reply-Message := "Unregistered or user missmatch"} reject } } chap mschap digest suffix eap { ok = return } update request {FreeRADIUS-Client-Shortname = "%{Client-Shortname}"} if (&sAMAccountName && &User-Name != &sAMAccountName) { update request { Original-User-Name := "%{User-Name}", User-Name := "%{sAMAccountName}"}} files if (&Original-User-Name) {update request {User-Name := "%{Original-User-Name}"}} -sql -ldap expiration logintime if (&control:Auth-Type == "mschap") { if (&Yubikey-OTP) { update control {Auth-Type := "YubiCHAP"} } else {update control {Auth-Type := "MS-CHAP"}} } if (!control:Auth-Type && User-Password) { if (&Yubikey-OTP) { update control {Auth-Type := "YubiNTLM"} } else {update control {Auth-Type := "ntlm_auth"}} } } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type YubiCHAP { mschap yubikey } Auth-Type ntlm_auth { ntlm_auth } Auth-Type YubiNTLM { ntlm_auth yubikey } } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { if (&sAMAccountName && &User-Name != &sAMAccountName) {update request {User-Name := "%{sAMAccountName}"}} update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { if (&sAMAccountName && &User-Name == &Yubikey-OTP) {update request {User-Name := "%{sAMAccountName}"}} -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } [---------------------------------------- grep -v '^\s*#\|^\s*$' /etc/freeradius/3.0/sites-enabled/default ----------------------------------------] NB: Once everyone has a YubiKey hash out the single factor authenticate options (Auth-Type MS-CHAP and Auth-Type ntlm_auth) methods or update unlang to exempt 2FA from jump hosts or NMS. Unvalidated idea for users file: DEFAULT Yubikey-OTP !* "", Packet-Src-IP-Address !~ /192\.168\.14\./, Auth-Type := Reject Reply-Message = "Access Denied - 2FA required" Regards David Herselman

2 3

Remove from FreeRadius users mailing list
by YewFong.Chua＠fujitsu.com 23 Feb '21

23 Feb '21

Hi FreeRadius support, I would like to remove my email account from the mailing list as I am being spam by email non-related by other users. Regards, Yew Fong Off-in-Lieu Planning: Nil Annual Leave Planning: 5th, 12th, 19th, 25th and 26th Mar 2021 National Reservist Leave 23rd Apr to 6th May 2021 Fujitsu Asia Pte Ltd Nexus @One-North 1 Fusionopolis Link, #04-01 Singapore 138542 DID: +65 6512 7525 Mobile: +65 9794 6548 E-mail: yewfong.chua(a)fujitsu.com<mailto:yewfong.chua@fujitsu.com> Web: http://sg.fujitsu.com<http://sg.fujitsu.com/> | LinkedIn: www.linkedin.com/company/fujitsu-asia<http://www.linkedin.com/company/fujitsu-asia>

2 1