- Freeradius-Users - lists.freeradius.org

RE: EAP-TLS Signature Check Failure
by Peter Bance 12 Aug '20

12 Aug '20

2 months later, a quick update on this topic (apologies, I may have broken the threading as I don't have a copy of the original e-mails any more!), just so there's an online reference here for anyone encountering the same error. Turns out I was wrong about it being Windows and OpenSSL getting muddled over TLS 1.2 vs. 1.3... To recap: Windows 10 clients, corporate WiFi network using EAP-TLS to RADIUS with machine certificate (SCEP) authentication only. Error in Freeradius logs: (6) eap_tls: ERROR: TLS Alert write:fatal:decrypt error tls: TLS_accept: Error in error (6) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read) (6) eap_tls: ERROR: error:0407E086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last octet invalid (6) eap_tls: ERROR: error:1417B07B:SSL routines:tls_process_cert_verify:bad signature (6) eap_tls: ERROR: System call (I/O) error (-1) (6) eap_tls: ERROR: TLS receive handshake failed during operation (6) eap_tls: ERROR: [eaptls process] = fail After encountering the error on a few machines again, even with "tls_max_version" set, I delved into the guts of Windows again, and found the error (which isn't helpful or descriptive) was actually caused because: * Some machine certificates had were stored/managed by the "Microsoft Platform Crypto Provider" (TPM-backed) * Built-in security measures control access to keys in that CSP, and it cannot be used non-interactively * Windows WiFi profile was set to auto-join (non-interactive) * Windows couldn't get the key, so $deity knows what signature it was sending * OpenSSL rightly got confused The solution: Ensure machine certificate keys are stored in the "Microsoft Software Key Storage Provider" (or another CSP/KSP that permits non-interactive use). All is well again, and I'm close to shutting down NPS :-) -- Peter Bance Information Security Adviser Alan DeKok wrote: > A final update on this, in case anyone here's interested (or to "wrap > up" for anyone stumbling across this thread online) - I fixed it, and > Windows clients are now happily joining WiFi. It's a beautiful thing to > behold :-) > > In the end, I had to force OpenSSL on FreeRADIUS to stop offering > TLS1.3 ciphers using the mods/eap config: > > tls_max_version = "1.2" Good to hear. > It seems there may be a bug in OpenSSL 1.1.1 such that even though the > negotiation resulted in a TLS 1.2 session, the weird back-port of TLS > 1.3 ciphers into TLS 1.2 confused things (a lot), and it tried checking > for TLS 1.3 style signatures inappropriately. Weird, but OK. It's OpenSSL :( Alan DeKok.

1 0

Windows 10 does not response EAP-Request/Identity from Switch after sucessfuly authentication of 802.1X
by luckydog xf 12 Aug '20

12 Aug '20

Hello, This may not be a question of Freeradius, but I post it here to see whether someone ran into the same issue before and found a way to fix it. We're running H3C switch, configure eap authentication, client is windows 10 and uses certificate authentication. Initially windows 10 can be online and soon after that it goes offline. By checking freeradius log, we can see that accounting Acct-Status-Type is Start and later becomes Stop. We use wireshark to capture packets of windows 10 and find that, after it's successfully online, Switch sends EAP-Request/Identity to it and expects a response. Yet windows 10 ignores it. Switch sends a 'Stop' to Freeradius when it's timeout. The whole process is listed http://www.h3c.com/en/Support/Resource_Center/Technical_Documents/Home/Swit… [ EAP relay ] section. 11. After the client comes online, the access device periodically sends handshake requests to check whether the client is still online. By default, if two consecutive handshake attempts fail, the device logs off the client. 12. Upon receiving a handshake request, the client returns a response. If the client fails to return a response after a number of consecutive handshake attempts (two by default), the access device logs off the client. This handshake mechanism enables timely release of the network resources used by 802.1X users that have abnormally gone offline. So it's quite weird, why does Windows 10 ignore it ? Appreciated for any help. Thanks.

1 1

MSCHAPV2 + OpenLDAP
by Клеусов Владимир Сергеевич 11 Aug '20

11 Aug '20

Hi Source data: OpenLDAP FreeRADIUS Version 3.0.21 I am trying to configure authentication via freeradius client VPN. Users in OpenLDAP . The problem is that the standard MacOS vpn client works via ms chap v2 (in the debut mode, I see the Client is using MS-CHAPv2). I would be grateful for help if someone had experience setting up in this configuration.

7 13

EXEC : possible to update pairs directly?
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 11 Aug '20

11 Aug '20

Hi all, Just researching possibilities to help me around the upgrades I need to do to move from old operating systems and FR3.1. I tried v4 for a while, and may go back to that, but am struggling with the exec module race condition - the dilemma is that I can't spend too long redoing what we used to do in exec. I've gone back to v3.0.22 to see what I can do there, but missed the SQL maps bit quite a bit so have do a few quick tests to see what I can achieve in the exec module, expanding my knowledge as it were. The following url contains an example that would be useful, but I can't get it working in 3.0.22 : https://stackoverflow.com/questions/26442693/freeradius-reading-attributes-… In the example Arran says : "Version 3 supports attribute assignment similar to what you've posted, but it'd be: update { control: += `/usr/bin/php -f /web/auth.php '%{NAS-Identifier} %{Calling-Station-Id}'` } Then modify your script output to be: Auth-Type = Accept reply:WISPr-Bandwidth-Max-Up = xxx .. " The key question is the inclusion of "reply:" attribute in an update { control : } section - it would be useful to be able to update any pairs via exec, not just the control (in this example), as you can do directly via Update [ Reply:reply-message := .. Control:auth-type := .. } When I try the example above, FR 3.0.22 can't parse the output: ERROR: Failed parsing output from: /usr/bin/php -f /etc/freeradius/sql_active_device_check_accounting.php -- '--hostname %{control:Hostname} --username %{request:User-Name} --nasipaddress %{request:NAS-IP-Address} --nasport %{request:NAS-Port} --macaddresslimit %{%{control:MacAddressLimit}:-0}': Expecting operator (0) ERROR: Program returned code (0) and output 'Auth-Type = Accept,reply:WISPr-Bandwidth-Max-Up = 123' It works if removing the reply: specifier from the "reply:WISPr-Bandwidth-Max-Up", i.e. Program returned code (0) and output 'Auth-Type = Accept,WISPr-Bandwidth-Max-Up = 123' (0) control::Auth-Type = Accept (0) control::WISPr-Bandwidth-Max-Up = 123 It's not the end of the world to have to copy the attributes from one "set" to another, but was hoping to be a bit cleaner if possible. IT's possible I just don't have the right syntax. Also happy taking advice on how best to replicate sql maps and attribute pair functionality best, possibly in python or perl I suppose, although those seem more "fixed" at a glance than exec. Thanks! Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 2

Is it possible to specify which authorization mode is being used?
by Kristian Faller 10 Aug '20

10 Aug '20

Hi everyone, I am brand new to FreeRadius so please excuse me for what could be a simple question with a simple answer. Is it possible to specify which authentication mode and tunnel type are being used? If yes, what files do I need to modify in order to do this? I have tried reading the documentation and looking through some of the config files, but as a complete beginner at this, I'm not sure if I'm even looking in the right places. Background: I work with software testing for reMarkable (we create an E ink tablet based on Linux), and we want to conduct more specified testing on WPA Enterprise (802.1X over Wi-Fi). At the moment we have done testing on our network gear which consists of Ubiquiti Unifi which only implements eap_peap with MSCHAPv2. While this is probably used for many companies all over the world, we would like to test other kinds of authentication and tunnel types, thus I started setting up FreeRadius on a Raspberry Pi 4, running Ubuntu 19.10 for IoT devices. Our tablet runs a flavor of Linux, using wpa_supplicant and should (in theory) be able to connect to most kinds of network. However, we know that certificate-based networks won't work at the moment due to not having a way to import licenses. However, I do believe there are other types of networks not needing certificates, and these are the ones we'd like to test. I got FreeRadius up and running, but for every connection attempt, I can see from the output with "freeradius -X" that eap_peap and MSCHAPv2 are used. I want to be able to set specific (valid) values so that our company can implement and properly test the different variations of auth modes and tunnels. I have also attached the (entire) output from 'freeradius -X'. If I miss any details or lack some information in my above text, please let me know, and I'll make sure to clarify/elaborate. Forhåndsvis vedlegget freeradius -x.txt freeradius -x.txt 85 KB <https://mail.google.com/mail/u/0?ui=2&ik=beb323e764&attid=0.1&permmsgid=msg…> -- *Kristian Faller* QA Engineer kristian.faller(a)remarkable.com +47 908 06 444 <+4790806444> Biermanns gate 6, 0473 Oslo, Norway <https://goo.gl/maps/YU24JR1ZYQM2> remarkable.com [image: cid:85D31282-3FFB-4F74-B5D9-6CB7ED4003E7] The privileged confidential information contained in this email is intended for use only by the addressees as indicated by the original sender of this email. If you are not the addressee indicated in this email or are not responsible for delivery of the email to such a person, please kindly reply to the sender indicating this fact and delete all copies of it from your computer and network server immediately. Your cooperation is highly appreciated. It is advised that any unauthorized use of confidential information of REMARKABLE AS is strictly prohibited.

2 2

rlm_ldap fails but ldapsearch works
by Victor 08 Aug '20

08 Aug '20

Hello, I'm trying to check whether a user belongs to a group or not: (0) if (LDAP-Group == "someusers") { (0) Searching for user in group "someusers" rlm_ldap (ldap): Reserved connection (6) (0) Using user DN from request "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" (0) Checking for user in group objects (0) EXPAND (&(cn=someusers)(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local)))) (0) --> (&(cn=someusers)(|(&(uid=common_user)(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local)))) (0) Performing search in "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" with filter "(&(cn=someusers)(|(&(uid=common_user)(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local))))", scope "sub" (0) Waiting for search result... (0) Search returned no results (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local", scope "base" (0) Waiting for search result... (0) No group membership attribute(s) found in user object rlm_ldap (ldap): Released connection (6) but ldapsearch -b "dc=domain,dc=local" "(&(cn=someusers)(member=uid\3dcommon_user\2ccn\3dusers\2ccn\3daccounts\2cdc\3ddomain\2cdc\3dlocal))" -D uid=common_user,cn=users,cn=accounts,dc=domain,dc=local -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: (&(cn=someusers)(member=uid\3dcommon_user\2ccn\3dusers\2ccn\3daccounts\2cdc\3ddomain\2cdc\3dlocal)) # requesting: ALL # # someusers, groups, accounts, domain.local dn: cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject description: Default group for all users cn: someusers ipaUniqueID: ebca3046-a5a0-11ea-8166-9a6e275fb41f member: uid=common_user,cn=users,cn=accounts,dc=domain,dc=local member: uid=very_special_user,cn=users,cn=accounts,dc=domain,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 and ldapsearch -b "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" -D uid=common_user,cn=users,cn=accounts,dc=domain,dc=local -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=common_user,cn=users,cn=accounts,dc=domain,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # common_user, users, accounts, domain.local dn: uid=common_user,cn=users,cn=accounts,dc=domain,dc=local displayName: utilisateur banal uid: common_user krbCanonicalName: common_user(a)DOMAIN.LOCAL objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson objectClass: inetuser objectClass: posixaccount objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipasshuser objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry objectClass: ipauserauthtypeclass loginShell: /bin/bash initials: ub gecos: utilisateur banal sn: banal homeDirectory: /home/common_user mail: common_user(a)domain.local krbPrincipalName: common_user(a)DOMAIN.LOCAL givenName: utilisateur cn: utilisateur banal ipaUniqueID: some_unique_ID uidNumber: theSameNumber gidNumber: theSameNumber krbPasswordExpiration: the_pass_exp krbLastPwdChange: the_pass_exp memberOf: cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local memberOf: cn=manyemoreusers,cn=groups,cn=accounts,dc=domain,dc=local ipaUserAuthType: o_type ipaSshPubKey: some_pubkey # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Some of the configuration: /etc/raddb/sites-enabled/default ... user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = 'uid=common_user,cn=users,cn=accounts,dc=domain,dc=local' scope = 'sub' membership_filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..ldapgroup})))" membership_attribute = 'memberOf' } /etc/raddb/mods-enabled/ldap ... post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } if (LDAP-Group == "someusers") { update { reply:Class := "OKOKOKOKOK" } } else { update { reply:Class := "NONONONONO" } } } Where to go from here? Kind regards

4 9

Accounting-Packets from Huawei NAS randomly not being written to the database
by Antônio Modesto 08 Aug '20

08 Aug '20

Hello everyone, I have some radius servers configured to use decoupled-accounting to avoid overwhelming the database with real-time writes. In all of them I am having the same problem. Some accounting packets sent from Huawei devices are not being written to the database. I have set up a second detail log file to check if the packets were being sent by the NAS. For example: Packet received from the NAS, stored in the second detail file: Fri Aug 7 08:54:43 2020 User-Name = "andersonoliveira" NAS-Port = 3162917 NAS-IP-Address = X.X.X.X Framed-IP-Address = 100.64.218.153 NAS-Identifier = "TI5-BRAS01" Acct-Status-Type = Stop Acct-Delay-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Session-Id = "TI5-BRA00304080500000a598ccAAADbA" Acct-Authentic = RADIUS Acct-Session-Time = 200 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Terminate-Cause = Lost-Carrier Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Event-Timestamp = "Aug 7 2020 08:54:43 -03" NAS-Port-Type = Ethernet Calling-Station-Id = "58:10:8c:07:48:8f" NAS-Port-Id = "slot=0;subslot=3;port=4;vlanid=805;" Service-Type = Framed-User Framed-Protocol = PPP Connect-Info = "1300000/1000000" Idle-Timeout = 0 Session-Timeout = 0 Huawei-IPHost-Addr = "100.64.218.153 58:10:8c:07:48:8f" Huawei-Input-Peak-Rate = 1000000 Huawei-Input-Peak-Rate = 1000000 Huawei-Input-Average-Rate = 1000000 Huawei-Output-Peak-Rate = 1300000 Huawei-Output-Average-Rate = 1300000 Huawei-Priority = 15 Huawei-Connect-ID = 13206 Huawei-Domain-Name = "provedor_pppoe" Huawei-Accounting-Level = 0 Huawei-Up-Priority = 15 Huawei-Down-Priority = 15 Huawei-Acct-IPv6-Input-Octets = 0 Huawei-Acct-IPv6-Output-Octets = 0 Huawei-Acct-IPv6-Input-Packets = 0 Huawei-Acct-IPv6-Output-Packets = 0 Huawei-Acct-IPv6-Input-Gigawords = 0 Huawei-Acct-IPv6-Output-Gigawords = 0 Huawei-User-Mac = "58:10:8c:07:48:8f" Huawei-Acct-Update-Address = 0 Huawei-Input-Burst-Size = 625000 Huawei-Output-Burst-Size = 812504 Huawei-Input-Peak-Burst-Size = 625000 Huawei-Output-Peak-Burst-Size = 812504 Timestamp = 1596801283 Record in the redacct table: -[ RECORD 5 ]-------+---------------------------------- username | andersonoliveira acctsessionid | TI5-BRA00304080500000a598ccAAADbA acctstarttime | 2020-08-07 08:51:23-03 acctlocalupdatetime | 2020-08-07 08:51:23-03 acctstoptime | As you can see, neither acctlocalupdatetime or acctstoptime were updated with the correct timestamps from the packet received by the NAS. I checked the logs and I couldn’t find any error message related to this. As the server is in production, enabling the debug creates a lot of output. The only thing I think could be causing this is this condition I have in my accounting section: if (noop) { ok } What do you guys suggest? Thanks in advance.

2 5

How to bind Freeradius outbound traffic to a network interface?
by kesavan km 07 Aug '20

07 Aug '20

Hi, With Freeradius Virtual-server construct, there is a possibility to select a Virtual-server instance based on a network interface (eth0 vs wlan0). But when Virtual-server-eth0 uses an LDAP, is it possible to bind the outgoing LDAP requests to eth0 and likewise, outbound LDAP requests initiated from Virtual-server-wlan0 to be bound to wlan0? For example, - Server hosting Freeradius has 3 interfaces Eth0, wlan-corp, wlan-misc - VS-wlan-corp - listening on interface "wlan-corp" --- loads module ldap-wlan-corp: LDAP_IP_X (Reachable only via wlan0) - VS-wlan100 - listening on interface wlan100 --- loads module ldap-wlan100: LDAP_IP_Y (Reachable only via wlan100) Above LDAP is just an example, same holds true for AD, proxy or any outbound communication initiated by Freeradius. Thanks, Kesavan

1 0

scripting pap off to eapol_test?
by Jonathan 06 Aug '20

06 Aug '20

I'm thinking of passing received PAP username and password on a realm/proxy basis to eapol_test to transform a PAP request into a proxied EAP request for further authentication upstream towards a 3rd party radius which only accepts secured EAP-PEAP:mschapv2 requests. If this would be possible, what would be the easiest way to do this from within a proxy config? scenario: 1) hotspot pap send to freeradius 2) freeradius matching realm, transform to eap-peap:mschapv2 request and proxy to upstream 3rd party server

2 1

Exec module questions, v4
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 04 Aug '20

04 Aug '20

Hi all, Does the exec module in v4 still support "non-xlat" use, i.e. where you stipulate a program, run it, maybe collect output pairs values? If so, I have an example where the execution is a bit different from v3, and wanted to query it. Using pretty much stock setup, only just added two bits - one to update the cleartext-password for chap testing, and the other to reject the user every time, for another reason. I have an exec module "testexec" exec testexec { program='/etc/freeradius/test.sh' wait = yes input_pairs = request output_pairs = reply } And my test.sh program #!/bin/bash echo "Reply-Message := \"hello\"" exit 0 Some observations - The stdout output "pickup" didn't seem to be consistent, here I've used radtest to fire a test auth twice in a row without changing anything (let me know if you'd like to see the complete output) .. (0) pap - Setting &control:Auth-Type = pap (0) pap (updated) (0) testexec (yield) (0) EXPAND /etc/freeradius/test.sh (0) --> /etc/freeradius/test.sh (0) Running request (0) tmpl - Resuming execution (0) testexec - EXEC GOT -- Reply-Message := \"hello\" (0) testexec (ok) .. pap - Setting &control:Auth-Type = pap (1) pap (updated) (1) testexec (yield) (1) EXPAND /etc/freeradius/test.sh (1) --> /etc/freeradius/test.sh (1) Running request (1) tmpl - Resuming execution (1) testexec (ok) .. - Also, the module return code isn't the same as it used to be, i.e. where 0 was ok, 1 was reject, 2 fail, as per https://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html If I modify the program to: #!/bin/bash echo "Reply-Message := \"hello\"" exit 1 ./test.sh ; echo $? Reply-Message := "hello" 1 I still get (ok), not (reject), and some more output inconsistency, one has status code, one not, even with no modifications (except the exit code in the script) or restarting the service (3) pap - Setting &control:Auth-Type = pap (3) pap (updated) (3) testexec (yield) (3) EXPAND /etc/freeradius/test.sh (3) --> /etc/freeradius/test.sh (3) Running request (3) tmpl - Resuming execution (3) testexec (ok) pap - Setting &control:Auth-Type = pap (4) pap (updated) (4) testexec (yield) (4) EXPAND /etc/freeradius/test.sh (4) --> /etc/freeradius/test.sh (4) Running request (4) tmpl - Resuming execution (4) Program failed with status code 1 (4) testexec (ok) I'm not modifying the module behaviour with { reject=1 } etc. We used to rely on the text output, even if the exit code was non zero, and that exit code value to do some more stuff after a CoA request. I should try modifying my unlang to do some xlats instead, but thought I'd ask first - is it just me - do I not understand deliberate changes that have taken place? I've tried changing shell_escape value, using sh instead of bash, with similar results. Thanks! Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 6