- Freeradius-Users - lists.freeradius.org

SQL SELECT statement
by Charly 19 May '20

19 May '20

Hello, I would like to update Cisco-AVPair attribute using a SQL request : update reply { Cisco-AVPair += "%{sql:SELECT value FROM radreply WHERE username = '%{User-Name}' AND attribute = 'Cisco-AVPair' ORDER BY id}" } But only the first row is returned. Charlye

2 7

Is it possible? CoA disconnect packet communication between radius 3 and Unifi AP Clients
by Luis Gutierrez 18 May '20

18 May '20

Hello, I am new to this mailing list. I will be brief, I need an AAA server over a network of Ubiquiti AP Unifi, I have to say that it was not difficult for me to install a freeradius 3.0.x server. My problem: But I can't disconnect devices, using CoA packets: echo User-Name = 'user' radclient 127.0.0.1:3799 disconnect testing123 I consult them: Someone managed to use the CoA disconnect packets between a freeradius 3.0.X server and AP's ubuquiti Unifi AP. I have read the ubiquiti forums without clear results. Greetings and thanks. -- Luis Gutierrez Cruz Movil: 71255832 Twitter: @LuisBPS

2 1

CHAP Authentication with rlm_perl module
by Imdad Hasan 16 May '20

16 May '20

So, if i want to make the framed-ip with dynamic value than how can i do that.? And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module. Is that possible?

2 7

Remove my email from liste free radius
by rafik.benchemekh＠sofrecom.com 16 May '20

16 May '20

Hello Would you please remove my email from freeradius_user@list Thank you Rafik

2 1

SSL: SSL3 alert: write (local SSL3 detected an error):fatal:bad record mac
by Jim Shi 15 May '20

15 May '20

Hi, When I run eapol_test with PEAP/MSCHAPv2, I got the following error: SSL: (where=0x4008 ret=0x214) SSL: SSL3 alert: write (local SSL3 detected an error):fatal:bad record mac EAP: Status notification: local TLS alert (param=bad record mac) OpenSSL: tls_connection_decrypt - Decryption failed - SSL_read error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac SSL: Failed to decrypt Phase 2 data Any idea why I am getting this error? Thanks Jim

2 1

Accounting Data to Multiple Servers
by J. Russell Woodman 15 May '20

15 May '20

Hi, I'd like to send RADIUS accounting data to three separate accounting servers. I believe most of the configuration I need can be borrowed from robust-proxy-accounting from the default sites-available. However, I don't think "type = load-balancing" in the pool declaration is the option I need. Could someone point me in the right direction to make sure all three servers get all accounting data? Thanks, Russ Woodman russ(a)natcotech.com

2 1

looking for test client for PEAP/MSCHAPv2
by Jim Shi 15 May '20

15 May '20

Hi, I am looking for a test client that I can use to test PEAP/MSCHAPv2 Seems radtest does not support PEAP/MSCHAPv2? Any help is appreciated. Thanks a lot. Jim

4 4

Re: Freeradius-Users Digest, Vol 181, Issue 21
by Imdad Hasan 15 May '20

15 May '20

So, if i want to make the framed-ip with dynamic value than how can i do that.? And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module. Is that possible? On Fri, May 15, 2020 at 3:30 PM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Wifi + Active Directory without ntlm (Alan DeKok) > 2. Re: Wifi + Active Directory without ntlm (Fabrice Durand) > 3. looking for test client for PEAP/MSCHAPv2 (Jim Shi) > 4. Re: looking for test client for PEAP/MSCHAPv2 (Matthew Newton) > 5. Re: looking for test client for PEAP/MSCHAPv2 (Jorge Pereira) > 6. CHAP Authentication with rlm_perl module (Imdad Hasan) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 14 May 2020 10:59:13 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Wifi + Active Directory without ntlm > Message-ID: <8A61A9A6-900D-41D6-9F33-3174FCFCF6D9(a)deployingradius.com> > Content-Type: text/plain; charset=utf-8 > > On May 14, 2020, at 10:56 AM, Клеусов Владимир Сергеевич via > Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > > > The idea was to link freeradius and ad via an ldap module. That is, do > not install samba and windbind. To authentifizierte using the ldap module. > That is, it will not work like this. Right ? > > That question has been asked and answered about 4 times now. The answer > won't change if you keep asking the same question. The only thing you'll > do is annoy the people who are trying to help you. > > > So the ldap module is it for other LDAP implementations, such as > openldap ? > > The LDAP module is for any server which implements LDAP. Like AD. > > But as you were already told, the issue isn't LDAP. It's AD. > > Alan DeKok. > > > > > ------------------------------ > > Message: 2 > Date: Thu, 14 May 2020 12:53:24 -0400 > From: Fabrice Durand <fdurand(a)inverse.ca> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Wifi + Active Directory without ntlm > Message-ID: <4d796e43-502b-b71f-4c6e-d4394ee70176(a)inverse.ca> > Content-Type: text/plain; charset=utf-8; format=flowed > > I did this kind of configuration a long time ago and most of the work > needs to be done on the AD side. > > The idea is to mimic what a Edirectory server do (universal password) > and create a ldap attribute where you will store the NTHASH of the > user/computer. > > > https://github.com/inverse-inc/packetfence/tree/devel/addons/nthash_AD_attr… > > > The other way is to extract the NTHASH for each users, store it > somewhere (sql per example) and configure FreeRADIUS to fetch the NTHASH > based on the username. > > > https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump… > > > Regards > > Fabrice > > Le 20-05-14 à 10 h 56, Клеусов Владимир Сергеевич via Freeradius-Users a > écrit : > > The idea was to link freeradius and ad via an ldap module. That is, do > not install samba and windbind. To authentifizierte using the ldap module. > That is, it will not work like this. Right ? So the ldap module is it for > other LDAP implementations, such as openldap ? > > > >> 14 мая 2020 г., в 16:40, Josef Vybíhal <josef.vybihal(a)gmail.com> > написал(а): > >> > >> Is it possible, that you mean that you just don't want to use ntlm_auth > >> command? If yes, then read the winbind comment section in the mschap > module > >> config. > >> # winbind_username = "%{mschap:User-Name}" > >> # winbind_domain = "%{mschap:NT-Domain}" > >> > >> or this > >> https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind > >> > >> On Thu, May 14, 2020 at 3:32 PM Клеусов Владимир Сергеевич via > >> Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > >> > >>> Ideally, I want to authenticate the domain user and if he is in the > >>> domain, check his group. If not in the group, do not connect to wifi. > Is > >>> this possible without ntlm ? > >>> > >>> 14 мая 2020 г., в 16:07, Matthew Newton <mcn(a)freeradius.org<mailto: > >>> mcn(a)freeradius.org>> написал(а): > >>> > >>> o do what? Just get policy information/groups etc, or to authenticate? > >>> > >>> FreeRADIUS can use LDAP to query AD to get group information etc just > >>> fine. However, AD won't give you a password over LDAP. So in the vast > >>> majority of cases if you want to authenticate you need to use mschap. > >>> > >>> - > >>> List info/subscribe/unsubscribe? See > >>> http://www.freeradius.org/list/users.html > >> - > >> List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- > Fabrice Durand > fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca > Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence ( > http://packetfence.org) > > > > ------------------------------ > > Message: 3 > Date: Thu, 14 May 2020 18:04:10 +0000 (UTC) > From: Jim Shi <hjshi(a)yahoo.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: looking for test client for PEAP/MSCHAPv2 > Message-ID: <1191804016.213541.1589479450003(a)mail.yahoo.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > I am looking for a test client that I can use to test PEAP/MSCHAPv2 > Seems radtest does not support PEAP/MSCHAPv2? > Any help is appreciated. > Thanks a lot. > Jim > > > > ------------------------------ > > Message: 4 > Date: Thu, 14 May 2020 19:07:50 +0100 > From: Matthew Newton <mcn(a)freeradius.org> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: looking for test client for PEAP/MSCHAPv2 > Message-ID: <a71f17df-a2f0-da95-9b20-4980b93e2956(a)freeradius.org> > Content-Type: text/plain; charset=utf-8; format=flowed > > > On 14/05/2020 19:04, Jim Shi via Freeradius-Users wrote: > > I am looking for a test client that I can use to test PEAP/MSCHAPv2 > > Seems radtest does not support PEAP/MSCHAPv2? > > eapol_test from wpa_supplicant: > > https://w1.fi/wpa_supplicant/ > > There are example configs in the FreeRADIUS source (see "make test"). > > -- > Matthew > > > ------------------------------ > > Message: 5 > Date: Thu, 14 May 2020 15:12:15 -0300 > From: Jorge Pereira <jpereira(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: looking for test client for PEAP/MSCHAPv2 > Message-ID: <47565E26-014E-4114-B3BC-186CDD7E113B(a)freeradius.org> > Content-Type: text/plain; charset=utf-8 > > Hi Jimm > > Take a look at “eapol_test” tool. We have some config samples in our repo. > > e.g: > > [jpereira@jorge-sugarloaf freeradius-server-v3.0.x.git]$ grep eapol_test > -r src/ > src//tests/eap-md5.conf:# eapol_test -c eap-md5.conf -s testing123 -n > src//tests/Makefile:EAPOL_TEST = $(shell which eapol_test) > src//tests/Makefile:# Run eapol_test if it exists. Otherwise do nothing > src//tests/eap-mschapv2.conf:# eapol_test -c eap-mschapv2.conf -s > testing123 > src//tests/eap-ttls-eap-mschapv2.conf:# eapol_test -c > eap-ttls-eap-mschapv2.conf -s testing123 > src//tests/peap-mschapv2.conf:# ./eapol_test -c peap-mschapv2.conf -s > testing123 > src//tests/eap-ttls-mschapv2.conf:# eapol_test -c eap-ttls-mschapv2.conf > -s testing123 > src//tests/peap-client-mschapv2.conf:# ./eapol_test -c > peap-mschapv2.conf -s testing123 > src//tests/.gitignore:eapol_test > src//tests/eap-tls.conf:# eapol_test -c eap-tls.conf -s testing123 > src//tests/eap-ttls-pap.conf:# eapol_test -c eap-ttls-pap.conf -s > testing123 > [jpereira@jorge-sugarloaf freeradius-server-v3.0.x.git]$ > > --- > Jorge Pereira > jpereira(a)freeradius.org <mailto:jpereira@freeradius.org> > > > > > > On 14 May 2020, at 15:04, Jim Shi via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > > Hi, > > I am looking for a test client that I can use to test PEAP/MSCHAPv2 > > Seems radtest does not support PEAP/MSCHAPv2? > > Any help is appreciated. > > Thanks a lot. > > Jim > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Message: 6 > Date: Fri, 15 May 2020 04:30:52 +0530 > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: CHAP Authentication with rlm_perl module > Message-ID: > < > CAPidyMXKC+6zXm1sCNpHiSfaJKddrbNM7D7Ayd2JWM0hXjpfkQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Dear all, > > i am using perl module, its working all like exec module but no doubt its > increased the performance on high load. But i have some queries when i use > CHAP authentication method with perl module. > > > In CHAP authentication i can't verify the password with Cleartext-Password, > right? > That's why i set RADCHECK attribute Cleartext-Password="password" and after > that freeradius verify them with authenticator and all. and if password > doesn't matched than its return Reject. > > But if i want to accept those user ( who have wrong password ) with special > disabled framed-ip than how can i?? > > > Thanks all, > > Imdad > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 181, Issue 21 > ************************************************* >

1 0

CHAP Authentication with rlm_perl module
by Imdad Hasan 15 May '20

15 May '20

Dear all, i am using perl module, its working all like exec module but no doubt its increased the performance on high load. But i have some queries when i use CHAP authentication method with perl module. In CHAP authentication i can't verify the password with Cleartext-Password, right? That's why i set RADCHECK attribute Cleartext-Password="password" and after that freeradius verify them with authenticator and all. and if password doesn't matched than its return Reject. But if i want to accept those user ( who have wrong password ) with special disabled framed-ip than how can i?? Thanks all, Imdad

2 1

RE: How to force EAP-Identity Request sending after EAP START
by Fernando Alvarez 15 May '20

15 May '20

Hi! We are experiencing the same problem, and we were able to reproduce it using the following environment: Auth method: EAP-MSCHAPv2 against file with clear text passwords. NAS: Nokia vSR 7750 FreeRADIUS 3.0.21 3 clients tested: - Linux (StrongSwan client): works OK - MacOS (native client): partial OK. Works only if “local-id” is set with the username. - Windows 10 (native client): KO We check in logs that we receive the local IP address from the Windows and Mac clients as the user-name attribute. During MSCHAPv2 challenge, the user-name provided to the identity backend is the local IP address, thus making the authentication fail, as it doesn’t receive the actual username. Digging a little further in the issue, we see that clients do not send the actual username because they do not receive the Identity request from RADIUS server. Likewise, FreeRadius doesn’t send the Identity Request because it didn’t receive an EAP start message. This behaviour is documented in the “handled" return code in the Processing/authorize section of the EAP module documentation ( https://networkradius.com/doc/current/raddb/mods-available/eap.html) Here the relevant log in our environment: Ready to process requests (3) Received Access-Request Id 7 from 85.57.4.42:64391 to 10.0.103.175:1812 length 145 (3) User-Name = "192.168.1.19" (3) Acct-Session-Id = "85.51.29.253-87.217.240.140:4500-1589384382" (3) NAS-Port-Id = "tunnel-1.public:10" (3) NAS-Identifier = "secgw01" (3) EAP-Message = 0x020b0011013139322e3136382e312e3139 (3) Message-Authenticator = 0x9f6ec0d3f5148c3a19ecc9580cc24d61 (3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default As discussed before in this thread, this behavior considers the EAP start as a MANDATORY, when the RFC 3579 says that: "the NAS MAY send an Access-Request packet to the RADIUS server containing an EAP-Message attribute signifying EAP-Start” (page 7). In other NAS like StrongSwan server, we have found that this specific issue has forced StrongSwan to send the identity request to the client on behalf of the FreeRADIUS server. In our view, maybe this is something that shouldn’t be done, as the NAS is impersonating part of the RADIUS flow, right? We have tried to shortcut this issue and we modified the source code with a quick & very dirty workaround in line 691 of eap.c file (https://github.com/FreeRADIUS/freeradius-server/blob/af8643bd8b7487fd687dee…) making EAP messages containing certain length to enter the "if" statement, and thus making FreeRadius to act if it received the EAP START message: if ((eap_msg->vp_length == 0) || (eap_msg->vp_length == 2) || (eap_msg->vp_length == 18) || (eap_msg->vp_length == 14)) { Note here that we specified length of 18 and 14, as it was the two lengths that we were receiving from our two test clients. This obviously cannot be a general solution, as this length varies with the user-name field. ** The first question here is: How should be in your opinion this made, and implement the MAY instead of MUST? After “fixing” this issue, we have found also that there’s s paranoid check in this very same eap.c file (https://github.com/FreeRADIUS/freeradius-server/blob/af8643bd8b7487fd687dee…) FreeRadius checks if sent user-name value matches identity. Unfortunately, it doesn´t, because Windows and Mac send local IP address as user-name and the actual username as the identity: “Identity does not match User-Name, setting from EAP Identity” Again, we did the trick of deleting this check and continued forward. ** Second question here: should this check be deleted, as there’re legitim use cases that do not comply with this? Should this be configurable via a configuration option? Finally, we get to a dead end with the nt_password validation. FreeRADIUS is using the user-name field to look for the password, instead of using the identity field. So, authentication fails because rlm_mschap module doesn’t find the provided username (it’s a local IP address!), and thus validations fail, even when the right password is sent. We ended up in this file: https://github.com/FreeRADIUS/freeradius-server/blob/aeb8d49ba823ee69f8a032… **So third and last question is: which and where to change the provided parameters to mschap module in order to send the right ones (identity vs. user-name)? We really appreciate your support on this. We have tried our best to provide as much detail as possible, even when we are not RADIUS experts, nor having knowledge on FreeRadius source code. Best, Fer Alvarez

1 0