- Freeradius-Users - lists.freeradius.org

VLAN assignment based on NAS ID
by Max Elzinga 23 Mar '21

23 Mar '21

Hello, I would like to assign VLANs based on NAS ID. We have different subnets with switches that do 802.1x. I have tried adding NAS-IP-Address to the Users file but without any success. DEFAULT NAS-Port-Type = Ethernet Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 207, NAS-IP-Address = 10.2.106.0/24 DEFAULT NAS-Port-Type = Ethernet Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 200 NAS-IP-Address = 10.2.16.0/24 How to accomplish this the right way? Thanks. Kind regards, Max

6 13

how to configure authorization using Active Directory + SQL
by Lucian Kim 23 Mar '21

23 Mar '21

Hello, I am trying to configure a RADIUS authentication server by linking FreeRADIUS and Active Directory. Authenticating in Active Directory using the mschap module was successful. However, I do not know how to set up authorization, so I ask. after merging reply items in the authorize {} section i want to authenticate using Active Directory(mschap), can I merge reply items using the sql module? Or, if there is another way, please help. I'm using EAP-PEAP(MSCHAPV2). thank you for your help.

2 1

IP Pools Question
by Richard J Palmer 22 Mar '21

22 Mar '21

Good Evening We have FreeRadius 3.0.20 running here quite happily - but have a very small issue we' like some help with Some of our connections use ippools (running from a mssql server) As a general rule this works exactly as it should Very occasionally the sql server will time out - maybe once or twice a day due to transactions clashing When this happens the session comes on-line but is not issued a IP. What I'd ideally like to do is simply reject that connection IF that happens which will force the router to log in again - it will then get an IP and will be happy Is there an easy way to catch this and reject the connection (or even re-try the ippool module) ? Thanks in advance Richard

2 1

Logging EAP-TLS certificate details
by Roberto.Franceschetti＠ocfl.net 19 Mar '21

19 Mar '21

We have several hundreds of IoT WiFi devices, each authenticating with their own individual client certificates against our FreeRADIUS v2.2.9 servers. While each device has its own unique client certificate having the device's serial number as the CN in the cert, the hardware vendors is using a generic username of "user" when specifying the username during the authentication process. This is allowed as we do not enable the "check_cert_cn" option, since this would cause other issues not only with this vendor, but with Microsoft/Apple as well as we've seen those OS sometime specify the MAC address of the client as the "Username" when authenticating with client certificates. We see this "feature" of EAP-TLS that allows to specify a completely random username as a serious security risk, as there is no information being logged in the radacct table to indicate what certificate was used to authenticate a particular session. Here is our scenario. Hundreds of IoT devices, each authenticating with certs, connecting/disconnecting multiple times per minute. All of them are logging in with the username "user". If one of those certificates is compromised and is used in a malicious way in a different device, while the radius accounting table will show us the IP address of the attacker, there will be absolutely no way to find out which of the hundreds of certificates we issued was abused, and we would thus not know which certificate was compromised and needs to be revoked. We were able to log the certificate information and link it to the client's IP during the Access-Request via syslog by modifying this in the linelog: Access-Request = "Packet-Type=\"%{Packet-Type}\" ...... ,Timestamp = %l,%{User-Name},%{Framed-IP-Address},TLS-Client-Cert-Common-Name = \"%{TLS-Client-Cert-Common-Name}\",TLS-Client-Serial=\"%{TLS-Client-Cert-Serial}\",TLS-Client-Cert-Issuer = \"%{TLS-Client-Cert-Issuer}\"," The above will ultimately probably allow us identify the compromised certificate if we're able to capture/archive the syslog data (which we do...), but this is a workaround - the certificate information should really be available in the radacct table as that's what's used to examine user's activity (time remaining connected, bytes transferred, time of connection and so forth). Customizing the accounting queries in the dialup.conf however does not seem to work for adding the same TLS-Cert fields to the radacct table (we did of course modify the schema to add the extra TLS-Cert fields). The TLS-Cert fields are being filled with blank values in the radacct table. We're thinking it's probably because the various %{TLS-Client-Cert-nnnnn} are not available during the "Accounting-Request" process. Our modified query is below. Has anyone found a solution to log certificate information in the radius accounting table for users who authenticate via EAP-TLS? Thanks, Roberto accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey, \ TLS_Client_Cert_Common_Name, TLS_Client_Cert_Serial, TLS_Client_Cert_Issuer) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}', \ '%{TLS-Client-Cert-Common-Name}', '%{TLS-Client-Cert-Serial}', '%{TLS-Client-Cert-Issuer}')" PLEASE NOTE: Florida has a very broad public records law (F. S. 119). All e-mails to and from County Officials are kept as a public record. Your e-mail communications, including your e-mail address may be disclosed to the public and media at any time.

3 2

Fwd: Question regarding the direction of eap_tls: <<< recv and eap_tls: >>> send
by Eric Nguyen 17 Mar '21

17 Mar '21

Hi, I'd like to ask a question regarding the direction of the exchanges in the radius log (radiusd -X). I used eapol_test as a client/authenticator against FreeRADIUS 3.0.21. - If I set the following parameters in the FreeRADIUS eap file, espol_test will results in a failure. In this case, "eap_tls: <<< recv TLS 1.3" looks like an exchange from FreeRADIUS to eapol_test (SERVER -> CLIENT): tls_min_version = "1.3" tls_max_version = "1.3" The FREERADIUS log shows: (2) eap_tls: <<< recv TLS 1.3 [length 00b9] (2) eap_tls: >>> send TLS 1.2 [length 0002] (2) eap_tls: ERROR: TLS Alert write:fatal:protocol version - If I set the following parameters in the FreeRADIUS eap file, espol_test will results in a success. In this case, "eap_tls: <<< recv TLS 1.2" looks like an exchange from eapol_test to FreeRADIUS (CLIENT TO SERVER): tls_min_version = "1.2" tls_max_version = "1.3" (6) eap_tls: <<< recv TLS 1.2 [length 08de] (6) eap_tls: TLS - Creating attributes from certificate OIDs Could you please clarify the meaning of these "eap_tls: <<< recv" log messages? Thanks, Eric ------------------------------------------------------------------------------------------------------------------------------------------- FULL LOG tls_min_version = "1.3" tls_max_version = "1.3" (2) eap: Calling submodule eap_tls to process data (2) eap_tls: Continuing EAP-TLS (2) eap_tls: [eaptls verify] = ok (2) eap_tls: Done initial handshake (2) eap_tls: (other): before SSL initialization (2) eap_tls: TLS_accept: before SSL initialization (2) eap_tls: TLS_accept: before SSL initialization (2) eap_tls: <<< recv TLS 1.3 [length 00b9] (2) eap_tls: >>> send TLS 1.2 [length 0002] (2) eap_tls: ERROR: TLS Alert write:fatal:protocol version tls: TLS_accept: Error in error (2) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (2) eap_tls: ERROR: System call (I/O) error (-1) (2) eap_tls: ERROR: TLS receive handshake failed during operation (2) eap_tls: ERROR: [eaptls process] = fail (2) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (2) eap: Sending EAP Failure (code 4) ID 54 length 4 (2) eap: Failed in EAP select (2) [eap] = invalid (2) } # authenticate = invalid ------------------------------------------------------------------------------------------------------------------------------------------- tls_min_version = "1.2" tls_max_version = "1.3" (6) eap: Calling submodule eap_tls to process data (6) eap_tls: Continuing EAP-TLS (6) eap_tls: Got final TLS record fragment (1272 bytes) (6) eap_tls: [eaptls verify] = ok (6) eap_tls: Done initial handshake (6) eap_tls: TLS_accept: SSLv3/TLS write server done (6) eap_tls: <<< recv TLS 1.2 [length 08de] (6) eap_tls: TLS - Creating attributes from certificate OIDs (6) eap_tls: TLS-Cert-Serial := "315fa3c827cb5c44e13222c88ff80369d1a176f1" (6) eap_tls: TLS-Cert-Expiration := "210113170058Z" (6) eap_tls: TLS-Cert-Valid-Since := "201114170058Z" (6) eap_tls: TLS-Cert-Subject := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Cert-Issuer := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Cert-Common-Name := "Example Certificate Authority" (6) eap_tls: TLS - Creating attributes from certificate OIDs (6) eap_tls: TLS-Client-Cert-Serial := "02" (6) eap_tls: TLS-Client-Cert-Expiration := "210113170058Z" (6) eap_tls: TLS-Client-Cert-Valid-Since := "201114170058Z" (6) eap_tls: TLS-Client-Cert-Subject := "/C=FR/ST=Radius/O=Example Inc./CN=user@example.org/emailAddress=user@example.org" (6) eap_tls: TLS-Client-Cert-Issuer := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress= admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Client-Cert-Common-Name := "user(a)example.org" (6) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" (6) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (6) eap_tls: TLS_accept: SSLv3/TLS read client certificate (6) eap_tls: <<< recv TLS 1.2 [length 0046] (6) eap_tls: TLS_accept: SSLv3/TLS read client key exchange (6) eap_tls: <<< recv TLS 1.2 [length 0108] (6) eap_tls: TLS_accept: SSLv3/TLS read certificate verify (6) eap_tls: TLS_accept: SSLv3/TLS read change cipher spec (6) eap_tls: <<< recv TLS 1.2 [length 0010] (6) eap_tls: TLS_accept: SSLv3/TLS read finished (6) eap_tls: >>> send TLS 1.2 [length 0001] (6) eap_tls: TLS_accept: SSLv3/TLS write change cipher spec (6) eap_tls: >>> send TLS 1.2 [length 0010] (6) eap_tls: TLS_accept: SSLv3/TLS write finished (6) eap_tls: (other): SSL negotiation finished successfully (6) eap_tls: TLS - Connection Established (6) eap_tls: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) eap_tls: TLS-Session-Version = "TLS 1.2" (6) eap_tls: TLS - got 51 bytes of data (6) eap_tls: [eaptls process] = handled

3 3

Working with data used at authentication time during accounting
by Marki 16 Mar '21

16 Mar '21

Hello, During authentication/authorization Radius queries our backend for validity of the user (exec modules), which return several response attributes to Radius and in consequence to the NAS. Now, if possible, I would like to re-use some of that information at accounting stage. The thing is that I'm proxying the NAS' accounting packets to another firewall for SSO access, which also requires that information. The NAS doesn't remember the custom attributes from authentication response and doesn't include them in the accounting request. Probably, it doesn't have or need to. Still, I have to add them back in somehow . Of course I could just ask the backend again, to obtain the same information, but maybe it's possible without that. Less scripts, you know. Maybe there's no magic here which I'll gladly accept. :) I thought that since the server seems to know during challenge-response at authentication time which session is which, there may be a way here too. Don't hang me if that's not the case and these things are unrelated. I see that the NAS transmits an audit-session-id which is identical in both the authentication and accounting packets. Maybe I could leverage that. But still both worlds (authentication/accounting) would somehow need to share some data. Thanks, Marki

2 2

Need support for radclient tool
by tejeswi 16 Mar '21

16 Mar '21

Hi Team, Greetings for the day..!! We started using radclient tool for simulating radius traffic. We need your support in resolving our queries. Query 1: We are trying to send request with id as 31 using id '-i' argument in radclient command. Command used: radclient -c 1 -i 31 -n 1 -p 1 -r 1 -t 1 -sx 192.167.3.31:4444 auth testing123 -f input -d /usr/share/freeradius Output of command: Sent Access-Request Id 124 from 192.167.3.6:2001 to 192.167.3.31:4444 length 89 (0) No reply from server for ID 124 socket 3 Packet summary: Accepted : 0 Rejected : 0 Lost : 1 Passed filter : 0 Failed filter : 0 Issue is though we are specifying id number from command line, it is not considering the id and it picks some random number and sends the request. We need to simulate the id of the request. please help us out in resolving this issue Issue 2: We are trying to simulate both A & B traffic and C is the router for both MME and HSS. [image: image.png] We were able to simulate traffic from A to C(A1) and C is forwarding the request to B(A2). Now B has to send response to C(A3). Can you support us in simulating response from C. Please note that response should be sent with the corresponding request id only. Free radius version used: 3.0.13 Utils version used: freeradius-utils-3.0.13-15.el7.x86_64 Attached is the radiusd output. -- ------------------------ Regards Tejeswi K +91-8880007462 -----------------------

3 5

EAP protocol on Free RADIUS
by السعيد محمد صالح عبدالكريم 16 Mar '21

16 Mar '21

Hello and good morning, I am interested in a RADIUS Server, when I upload the product to my device and connect to it can I view EAP protocol data for scientific research purposes. But if not, please direct me or advise me. My goal in studying the EAP packet is to know the response time for a number of different passwords to develop a product, as I am a master's researcher in information and network security from Qassim University in Saudi Arabia.

2 1

EAP-AKA
by Bassem Mettichi 15 Mar '21

15 Mar '21

Hello, Please could you tell me if Freeradius 3.0.21 supports EAP-AKA or not? if yes, if there is any guide or example of configuration and use? Best Regards Bassem

2 4

run multiple sql queries
by Imdad Hasan 15 Mar '21

15 Mar '21

Hii all, Can i run multiple sql queries at a time in freeradius sql module.? specifically for accounting. for manage accounting data in different different tables. Thanks

3 3