- Freeradius-Users - lists.freeradius.org

Official plugin for Freeradius + OpenVPN?
by Houman 22 Jul '20

22 Jul '20

Hello, I have been using Freeradius and Strongswan (eap-radius) for a few years now and for the first time I'm trying to achieve the same thing with OpenVPN instead. Based on my research it seems that the recommended plugin is a decade old. http://www.nongnu.org/radiusplugin/ It's hard to imagine that this wasn't updated for so long. Am I missing something? Is there any official Freeradius plugin for OpenVPN? I found this tutorial to be very promising https://www.vpsserver.com/community/tutorials/17/authenticate-openvpn-clien… but I thought I ask here first if someone has experience with this topic, and I'm on the right path. Many Thanks, Houman

3 9

chap authentication with v4
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 22 Jul '20

22 Jul '20

Hi all, Sorry this is embarrassingly simple, but I'm struggling a bit with it. Profuse apologies if I missed something obvious. We use MAC authentication with some stuff, and update the control Cleartext-Password to match the user-name field, as mac auth on the NASes here always use that as the password. Authorisation does all our useful accept/reject stuff, not authentication. Having said that I'd prefer not to "hack" it to bypass auth. My test NAS is an HP/Aruba 2530 with v15.17.0009 firmware Before the chap auth runs: Update control { &Cleartext-Password = &User-Name } Works on v3: >From the access request : Wed Jul 22 08:33:57 2020 : Debug: (0) User-Name = "08000f510d1e" Wed Jul 22 08:33:57 2020 : Debug: (0) CHAP-Password = 0x9fdc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) Message-Authenticator = 0x978dc5f6ccbcd916950b3d76190039dc .. .. and then the chap auth debug: .. Wed Jul 22 08:46:46 2020 : Debug: (0) chap: Comparing with "known good" &control:Cleartext-Password value "08000f510d1e" Wed Jul 22 08:46:46 2020 : Debug: (0) chap: Using challenge from &request:CHAP-Challenge Wed Jul 22 08:33:57 2020 : Debug: (0) chap: CHAP challenge : e7714b9a5d8463e7947041bdbf399c17 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: Client sent : dc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: We calculated : dc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: CHAP user "08000f510d1e" authenticated successfully But on v4, it doesn't like it, and I can't figure out why, says the password is incorrect. I've checked and double checked the client.conf secret is correct. Wed Jul 22 07:59:01 2020: (1) User-Name = "08000f510d1e" Wed Jul 22 07:59:01 2020: (1) CHAP-Password = 0xa1526f5b6d5cc40d3d87df334515befc07 Wed Jul 22 07:59:01 2020: (1) Message-Authenticator = 0x5433e862ac2ab58c19866ff8bb05863f .. Wed Jul 22 07:59:01 2020: (1) chap - Using "known good" cleartext password Cleartext-Password = "08000f510d1e" Wed Jul 22 07:59:01 2020: (1) chap - Using challenge from &request:CHAP-Challenge Wed Jul 22 07:59:01 2020: (1) chap - CHAP challenge : bf61a943b98f4d1b9e9885677705a6b8 Wed Jul 22 07:59:01 2020: (1) chap - Client sent : 526f5b6d5cc40d3d87df334515befc07 Wed Jul 22 07:59:01 2020: (1) chap - We calculated : 72ca08cb516acb819b0ff9d7cc5988c4 Wed Jul 22 07:59:01 2020: ERROR : (1) chap - Password comparison failed: password is incorrect Testing chap with radtest DOES work ok with v4 though, really confusing. Can anyone spot the issue? I've a feeling I've missed something obvious.. :( Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 3

NAS-Port-Type
by Darren Ward (darrward) 22 Jul '20

22 Jul '20

Hi All, Quick question - is it possible to add to the descriptive for the NAS-Port-Type field? For example beyond the RFC there's additional ones defined by consortium or vendor such as IPoE over PW etc In this case I would like to see the descriptive for NAS-Port-Type = 43 appear in the accounting logs as the name rather than integer value Cheers Darren

2 1

Configuration conflict
by Olivier 22 Jul '20

22 Jul '20

Hello, I am facing the following problem and I don't know how to configure FreeRadius for that. I have one WiFi Access point serving 2 SSID with 802.1x enabled. One SSID takes authentication in the form of username(a)domain.example and the other is just username. As it is a single AP, it communicates to FreeRadius with a single IP and is being seen as a single Radius client. Is there a way for me to declare different virtual servers. Is there a way to sort that elegantly beaside using the value of Stripped_User_Domain (and equivalent)? What would be the solution if I add to add a 3rd SSID, with authentication that does not use a domain (but has a different list of users of course)? Best regards, Olivier --

2 1

MSCHAP using multiple domains
by Klemen forneci 21 Jul '20

21 Jul '20

Hello. I know this may not be strictly radius related, but my google-fu is all used up (not much on the subject). Now to the problem: I'm using freeradius 3.13 on centos7 (Upgrading from v2 on centos6). In the modules i have 2 mschap configuration based on user domain (windows domain): mschap mschap_thor { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-THOR} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" } mschap mschap_loki { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-LOKI} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" } In the sitens-enabled/default: Auth-Type MS-CHAP { if(Realm == "um.si") { mschap_thor } elsif(Realm == "guest.um.si") { mschap_thor } elsif(Realm == "student.um.si") { mschap_loki } } When I use mschap_thor everything works. When I try mschap_loki, I get the following error: (2) mschap_loki: ERROR: Program returned code (1) and output 'Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. (0xc0000413)' (2) mschap_loki: External script failed (2) mschap_loki: ERROR: External script says: Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. (0xc0000413) (2) mschap_loki: ERROR: MS-CHAP2-Response is incorrect I've tried adding the radiusd server to the LOKI domain (net ads join), but the error remains. Are there any more settings in freeradius that i've missed or anywhere else. The whole project is on a standstill because of this :/ Thank you and best regards, Klemen

2 2

pam_radius relases
by Adrian Tschira 21 Jul '20

21 Jul '20

Hey there, we recently ran into some trouble on a v6-only migration when we discovered pam_radius did not support IPv6. While the master branch supports IPv6 the latest release, 1.4.0 from 2014, does not include those patches. There is an open issue asking about a new release[1], but it hasn't gotten any attention for a while. Has anyone been working towards a new release and are there any obstacles I could help with? Adrian Tschira [1] https://github.com/FreeRADIUS/pam_radius/issues/42

3 2

Load balancing and ldap group cache
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 21 Jul '20

21 Jul '20

Hi all, Interesting one with v4 migration. With 3.1 and previous we used to load balance over site-based ldap servers closest to the radius box authenticating the user (we've got a few sites, slow links between), e.g. switch &control:Sitename { case site1 { redundant-load-balance { site1_ldap1_authorize site1_ldap2_authorize site2_ldap3_authorize } } Case site2 { .. We then call a later reference to a user group cache in a policy e.g : if (&control:Cached-Ldap-Group && &control:Cached-Ldap-Group[*] =~ /${policy.groupdn-utvid-regexp}/) { Which has also worked fine (NB we've used a custom group cache name "Cached-Ldap-Group") The problem is previous versions used to let you have each ldap instance with the same cache name each time, e.g. ldap site1_ldap1 .. group { .. cache_attribute = "Cached-Ldap-Group" } ldap site1_ldap2 .. group { .. cache_attribute = "Cached-Ldap-Group" } etc .. .. but v4 doesn't seem to: Creating attribute site1_ldap2-LDAP-Group Error creating cache attribute /etc/freeradius/mods-enabled/ldap[94]: Bootstrap failed for module "site1_ldap2". If I rename the cache names to be unique it's ok. Guess I either "find out" which ldap module was called in the redundant-load-balance section and then reference the specific ldap instance cache name later, or somehow getting around having to check the group cache, probably doing another ldap lookup I suppose. Any ideas? Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 2

Freeradius Authenticate ADSL with Calling-Station ID
by Maile Halatuituia 19 Jul '20

19 Jul '20

Hi List Appreciate if someone would give some hint on the above subject. Thanks [TCC] Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

3 8

sending attributes
by Marco Miglietta 19 Jul '20

19 Jul '20

I have problems in sending attributes with some nas. It' seems that I have to send attributes in the access-accept message and probably it's not so. How can I solve this problem ? Thank you v.m. Marco. --

2 2

Group policy on freeradius like on microsoft NPS server
by MD. NUR KHAKIM A`ZIIZUDIN 17 Jul '20

17 Jul '20

Hi there, i'm new to freeradius, recently we are implementing freeradius as AAA server to authenticate user throug aruba wifi controller our setup is openldap + freeradius + aruba we use AD + NPS server + aruba before, and have implemented group policy on our network configuration that read filter-id attribute so how we do the same thing on freeradius, i've been searching on google and didn't find anything. if anyone know how to add group policy for openldap + freeradius + aruba setup please let me know how to do it. Best Regards -- MD Nur Khakim Aziizudin Network & system administrator directorate of IT infrastructure National Civil Service Agency of Indonesia

2 1