- Freeradius-Users - lists.freeradius.org

EAP-TLS with LDAP user attribute check
by stray electron 08 Jan '21

08 Jan '21

Hello Everyone, (short) How can I check an LDAP group membership (or attribute) in an EAP-TLS setup? Any help would be appreciated. :) (long) I try to set up a Freeradius 3.0 where the client auth is done with EAP-TLS but also checks if the client is in the LDAP (and/or check some user attribute in the LDAP). If the client has a valid certificate but is not in the LDAP then he should be rejected. Since the auth is already done by EAP-TLS certificates no user bind to the LDAP should be needed, besides I don't have the user password anyway. But I have an LDAP account configured for the Radius server so it can access the user data. So far EAP-TLS works fine, I suppose the 10-times repetition of the authorize part is due to the EAP messages exchanged with the client, or am I wrong? Problem is though, that the LDAP search is done 10-times too for each client request. I think this would lead to a huge load of our LDAP server. I tried to put the ldap stanza into other places like post-auth, but then it tries to write to the LDAP, or in authenticate where the user password is required. For now I have the LDAP configured that way, that it will do all the attribute filtering/checking for the Radius. So if a user is not allowed to access the WLAN the Radius just does not find the user. But it would be also fine if the Radius itself would do the attribute checking somehow, but I do not know how to import and use these attributes. Is there a way to reduce the LDAP searches/load somehow? (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=clientname) (0) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=clientname,ou=user,o=example,c=de" (0) ldap: Processing user attributes rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.example.de:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) } # authorize = ok (0) authenticate { (0) } # authenticate = handled ...[well this repeats several times, so I shortened it a bit] (1) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (2) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (3) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (4) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (5) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (6) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (7) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (8) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (9) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" ... (10) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (10) authorize { rlm_ldap (ldap): Reserved connection (4) (10) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (10) ldap: --> (uid=clientname) (10) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (10) ldap: Waiting for search result... (10) ldap: User object found at DN "uid=clientname,ou=user,o=example,c=de" (10) ldap: Processing user attributes rlm_ldap (ldap): Released connection (4) rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.example.de:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (10) [ldap] = ok (10) } # authorize = updated (10) authenticate { (10) } # authenticate = ok (10) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (10) post-auth { (10) } # post-auth = ok Regards, Felix Freeradius3 Configuration: ------------------------------------ server eduroam { listen { type = auth ipaddr = * port = 1812 } authorize { linelog_recv_request split_username_nai if (noop || !&Stripped-User-Domain) { reject } if (&Stripped-User-Domain != "${operator_name}") { update { control:Load-Balance-Key := &Calling-Station-ID control:Proxy-To-Realm := 'eduroam_flr' request:Operator-Name := "1${operator_name}" } return } ldap if (!ok) { reject } eap { ok = return updated = return } } pre-proxy { attr_filter.pre-proxy linelog_send_proxy_request } post-proxy { attr_filter.post-proxy linelog_recv_proxy_response } authenticate { eap } post-auth { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } if (&control:Proxy-To-Realm) { update reply { Tunnel-Private-Group-ID = ${eduroam_default_guest_vlan} } } else { update reply { Tunnel-Private-Group-ID = ${eduroam_default_local_vlan} } } if (&session-state:Stripped-User-Name) { update reply { User-Name := "%{session-state:Stripped-User-Name}@%{Stripped-User-Domain}" } } linelog_send_accept Post-Auth-Type REJECT { attr_filter.access_reject linelog_send_reject } } } # Loading module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap ldap { server = "ldaps://ldap.example.de:636" identity = "cn=radius,ou=accounts,ou=admin,o=example,c=de" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "ou=user,o=example,c=de" } profile { } options { ldap_debug = 0 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { ca_file = "/etc/ssl/certs/ca-certificates.crt" start_tls = no require_cert = "demand" } }

2 1

Unable to delete unwanted attributes from Disconnect-Request
by Tasos Kotaras 08 Jan '21

08 Jan '21

Hello<https://stackoverflow.com/posts/65629171/timeline> I'm struggling to remove some unwanted attributes from the disconnect message emitted after a failure in the rest module. More specifically, in accounting mode, when I receive a Accounting-Request, I either return an Accounting-Response or Disconnect-Request, depending on the HTTP status returned in a REST interaction. Both cases work properly, the only issue is that the disconnect message also contains these attributes that nag NAS (they cause it to return a NAK): |NAS-Port Teardown-Indicator (as 3GPP VSA) | These attributes are not present in the request. If they were, I could easily remove them and this would also affect the generated disconnect. But apparently, these attributes are added at some point that I have no control. The "/update disconnect {...}/" has no effect, as I guess it is relevant only to received messages (not clear from the documentation). I understand that disconenct belongs to a different connection, so it cannot be related and handled by tampering with 'reply' or anythig that freeradius provides me as variables. Still, I badly need to somehow solve the issue, as I have no control over the NAS itself. Configuration details: _mod-enabled/rest:_ |accounting { uri = "http://x.x.x.x:yyyy/..." method = 'post' body = 'json' tls = ${..tls} } | _sites-enables/default:_ |accounting { rest # this has no effect (same if placed inside rest {...}): update disconnect { NAS-Port !* ANY Teardown-Indicator !* ANY } } | radius -X writes these: |(0) rest: Sending HTTP POST to "http://x.x.x.x:yyyy/..." (0) rest: Encoding attribute "User-Name" (0) rest: Encoding attribute "Framed-IP-Address" (0) rest: Encoding attribute "Acct-Status-Type" (0) rest: Encoding attribute "Acct-Session-Id" (0) rest: Processing response header (0) rest: Status : 503 (Service Unavailable) (0) rest: ERROR: Server returned no data rlm_rest (rest): Released connection (0) Need 5 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (5), 1 of 27 pending slots used rlm_rest (rest): Skipping pre-connect, connect_uri not specified (0) [rest] = fail (0) } # accounting = fail (0) WARNING: Unknown destination 127.0.0.1:3799 for CoA request. (0) Not sending reply to client. (0) Finished request | REST works OK and the 503 is expected for this particular case. I cannot see something wrong (the ERROR and WARNING are not a huge surprise) I wonder if there is some workaround to persuade freeradius not to add these naughty attributes, or otherwise, give me the chance to remove them?

2 1

disable available EAP types for certain caller-id?
by Kacper Wirski 07 Jan '21

07 Jan '21

Hello, I'd like to limit EAP types available depending on called-station-id (ip addresses only for EAP-TLS. Would something like this - in general - in my "default" site work? Maybe there is a better way to achieve the same thing? Overall I want to use other EAP-types, so I can't just comment them out in eap module, but I'd like to filter them for specific connections. I'm using latest stable Freeradius (3.0.21) authorize { ... if (&Called-Station-Id == "<my-public-ip>" && &EAP-Type != EAP-TLS) { reject } eap { ok = return } ..... } Regards, Kacper -- Ta wiadomość została sprawdzona na obecność wirusów przez oprogramowanie antywirusowe Avast. https://www.avast.com/antivirus

2 2

unsubscribe
by Kostya Berger 04 Jan '21

04 Jan '21

unsubscribe

2 1

Show Dhcp assigned IPS with respective MACs.
by CpServiceSPb 01 Jan '21

01 Jan '21

I have Freeradius 3.0.21 on Ubuntu 18.04 LTS Server (no X) acting as Radius itself and as Dhcp one. There is no Freeradius Web UI installed at the time. What are ways to show assigned IPs by DHCP respectively with its MACs from CLI and from some Web UI something like: MAC IP Assignment time Lease (or RElease) time

2 1

Re: Freeradius with lets encrypt certificate
by André 30 Dec '20

30 Dec '20

Hello, Problem solved by using openssl verify for debug and this link: https://stackoverflow.com/questions/50803160/unable-to-openssl-verify-letse… And downloading the correct CA and *ADDING* this CA https://www.identrust.com/dst-root-ca-x3 to a file ca_file = file to the mods-enable/eap # tls-config tls-common { Thank you all for your help. Basically it looks like the rootCA for let's encrypt changed. Best regards, Good 2021 year to all. On Tue, Dec 29, 2020 at 7:47 PM Mark Elkins <mje(a)posix.co.za> wrote: > No idea if this will help but... > > I just had a very similar issue with Exim... my mail system. I was using > the wrong (old) intermediate certificate - which has worked for years. > > I use 'dehydrated' to obtain and renew my Let's Encrypt certs. They have > just stopped cross signing - and that triggered my issue - at 2am on the > 25th Dec. > > EXIM requires the current cert, an intermediate, as well as what's in > /usr/share/ca-certificates/mozilla (they use/are "ISRG_Root_X1.crt")... > "dehydrated" has a file in the 'cert' directory called "fullchain.pem" Look > at the second Certificate it contains - the new intermediate. > > The intermediate is no longer.... > > -----BEGIN CERTIFICATE----- > MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ > ..... cut .... > PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 > KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== > -----END CERTIFICATE----- > > but (in full) > > -----BEGIN CERTIFICATE----- > MIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/ > MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT > DkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFow > MjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT > AlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLs > jVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKp > Tm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnB > U840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7 > gcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel > /xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1R > oYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E > BAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p > ZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE > p7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE > AYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu > Y3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0 > LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYf > r52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B > AQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kH > ejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8 > S8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfL > qjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9p > O5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2Tw > UdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg== > -----END CERTIFICATE----- > > Maybe your problem - otherwise please simply delete this email and ignore > me. > > > On 12/29/20 6:23 PM, André wrote: > > freeradius cloned from github:https://github.com/FreeRADIUS/freeradius-server > > Tue Dec 29 14:31:40 2020: tls - Failed verifying chain: error:1414C086:SSL > routines:ssl_build_cert_chain:certificate verify failed:Verify error:unable > to get issuer certificate > Tue Dec 29 14:31:40 2020: rlm_eap_ttls - Failed initializing SSL context > Tue Dec 29 14:31:40 2020: > /usr/local/freeradius/etc/raddb/mods-enabled/eap[1031]: Instantiation > failed for module "eap.ttls" > > I'm using a let's encrypt certificate , but I'm getting this error message. > > What should the files I should be using for the cert? > > Best regards, > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > -- > > Mark James ELKINS - Posix Systems - (South) Africa > mje(a)posix.co.za Tel: +27.826010496 <+27826010496> > For fast, reliable, low cost Internet in ZA: https://ftth.posix.co.za > > [image: Posix Systems][image: VCARD for MJ Elkins] >

1 0

EAP-TTLS with Windows 10 issue
by André 30 Dec '20

30 Dec '20

Hello, has anyone had issues connecting windows eap-ttls to freeradius , all seems to go well but after challenge is sent to windows 10 , nothing more happens connection is ended and windows only says can't connect, I'm using a valid certificate from let's encrypt and have added let's encrypt authority to windows 10. Any suggestions? More details: freeradius -v (also tested with 3.0.21) radiusd: FreeRADIUS Version 3.0.17, for host x86_64-pc-linux-gnu, built on Apr 22 2019 at 21:23:36 FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 10 (buster) Release: 10 Codename: buster WLC 802.1X WPA2-Enterprise Software Version 8.5.135.0 Cisco 2504 WLC Client Windows 10 - Fails EAP-TTLS No encrypted password Linux Client ubuntu 20.x - Works correctly freeradius -X -xx Using a let's encrypt certificate. Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: EXPAND %{User-Name} Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: --> fern(a)xxxx.local Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: Matched entry DEFAULT at line 12 Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: EAP-Message = 0x0108003d1580000000331403030001011603030028c60ef4913a4a2a8bb545cc619ee5234cfe5c72511aa4d7a9073353f78e23a1189af29a397d34563c allowed by EAP-Message =* 0x Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: Attribute "EAP-Message" allowed by 1 rules, disallowed by 0 rules Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: Message-Authenticator = 0x00000000000000000000000000000000 allowed by Message-Authenticator =* 0x Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: Attribute "Message-Authenticator" allowed by 1 rules, disallowed by 0 rules Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: State = 0x3629afbd3321ba42cccfd968ddb33519 allowed by State =* 0x Mon Dec 28 12:00:08 2020 : Debug: (13) attr_filter.access_challenge: Attribute "State" allowed by 1 rules, disallowed by 0 rules Mon Dec 28 12:00:08 2020 : Debug: (13) modsingle[post-auth]: returned from attr_filter.access_challenge (rlm_attr_filter) Mon Dec 28 12:00:08 2020 : Debug: (13) [attr_filter.access_challenge.post-auth] = updated Mon Dec 28 12:00:08 2020 : Debug: (13) } # Post-Auth-Type Challenge = updated Mon Dec 28 12:00:08 2020 : Debug: (13) session-state: Nothing to cache Mon Dec 28 12:00:08 2020 : Debug: (13) Sent Access-Challenge Id 133 from 192.168.31.183:1812 to 192.168.31.238:32772 length 0 Mon Dec 28 12:00:08 2020 : Debug: (13) EAP-Message = 0x0108003d1580000000331403030001011603030028c60ef4913a4a2a8bb545cc619ee5234cfe5c72511aa4d7a9073353f78e23a1189af29a397d34563c Mon Dec 28 12:00:08 2020 : Debug: (13) Message-Authenticator = 0x00000000000000000000000000000000 Mon Dec 28 12:00:08 2020 : Debug: (13) State = 0x3629afbd3321ba42cccfd968ddb33519 Mon Dec 28 12:00:08 2020 : Debug: (13) Finished request Mon Dec 28 12:00:08 2020 : Debug: Waking up in 4.9 seconds. Mon Dec 28 12:00:13 2020 : Debug: (8) Cleaning up request packet ID 128 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Debug: (9) Cleaning up request packet ID 129 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Debug: (10) Cleaning up request packet ID 130 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Debug: (11) Cleaning up request packet ID 131 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Debug: (12) Cleaning up request packet ID 132 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Debug: (13) Cleaning up request packet ID 133 with timestamp +1442 Mon Dec 28 12:00:13 2020 : Info: Ready to process requests

2 5

Freeradius with lets encrypt certificate
by André 29 Dec '20

29 Dec '20

freeradius cloned from github: https://github.com/FreeRADIUS/freeradius-server Tue Dec 29 14:31:40 2020: tls - Failed verifying chain: error:1414C086:SSL routines:ssl_build_cert_chain:certificate verify failed:Verify error:unable to get issuer certificate Tue Dec 29 14:31:40 2020: rlm_eap_ttls - Failed initializing SSL context Tue Dec 29 14:31:40 2020: /usr/local/freeradius/etc/raddb/mods-enabled/eap[1031]: Instantiation failed for module "eap.ttls" I'm using a let's encrypt certificate , but I'm getting this error message. What should the files I should be using for the cert? Best regards,

2 3

EAP-TLS local issuer cert problem
by Kostya Berger 21 Dec '20

21 Dec '20

Hi, seems like I poorly expressed my problem in my previous message, sorry for that. I seem to experience a bug in the OpenBSD pkg of Freeradius 3.0.21. Server denies access to client with good certs. These work perfectly well in an absolutely identical nstallation on FreeBSD... And I can't understand what's happening. It verifies the cert, says OK. But then verifies agsin and says NOT OK. Looks like the second time temp. file it's trying to read is already removed.... or what? OpenBSD ktrace output of #radiusd -X session is attached, hope it will help. It's in text format. Thank you for help. Sent from Yahoo Mail on Android

2 1

dynamic-authorization with TLS
by murugesh pitchaiah 21 Dec '20

21 Dec '20

Hi Need help on doing coa with tls: I am working on setting up Radius TLS. Authentication and Accounting works good. But with dynamic-authorization - i see the following issue. TLS Connection between Radius server and NAS is established. But when testing the coa - looks like the radclient to Radis server communication is failing. (snip) ... new connection request on TCP socket Listening on coa from client (127.0.0.1, 41336) -> (*, 3799, virtual-server=coa) Waking up in 0.2 seconds. (0) Initiating new EAP-TLS session (0) Non-TLS data sent to TLS socket: closing Closing TLS socket from client port 41336 (snip) Here is the radclient output: (snip) cat dis.txt | radclient -P tcp -x localhost:3799 disconnect radsec Sent Disconnect-Request Id 209 from 127.0.0.1:41690 to 127.0.0.1:3799 length 36 Acct-Session-Id = "1E000001" Event-Timestamp = "Dec 20 2020 16:46:05 IST" radclient: Received bad packet (snip) To send a coa disconnect/coa request to TLS port is there any other way ? Am i missing any configuration ? Any help please. Thanks murugesh

3 6