- Freeradius-Users - lists.freeradius.org

OpenDirectory Authentication fails with eap but works with pap
by Ashley Drees 24 Feb '20

24 Feb '20

I have recently had to migrate my FreeRADIUS from one sick OpenDirectory server to a "fresh" one. FreeRadius was hard crashing whenever it got an eap authentication request on the "sick" server, on the newly promoted server it runs without crashing. the config checks out with XC and running as X works as expected. when I use (from a remote machine) radtest -x -t pap radiustest 2020Password 192.168.9.23 0 testing123 I get Received Access-Accept Id 139 from 192.168.9.23:1812 to 0.0.0.0:0 length 20 from the debug:- suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "radiustest", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: No EAP-Message, not doing EAP (3) [eap] = noop (3) [files] = noop (3) opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. (3) opendirectory: The host 192.168.9.9 does not have an access group. (3) opendirectory: no access control groups, all users allowed (3) opendirectory: Setting Auth-Type = opendirectory (3) [opendirectory] = ok (3) [expiration] = noop (3) [logintime] = noop Not doing PAP as Auth-Type is already set. (3) [pap] = noop (3) } # authorize = ok so with pap it seems to talk to OD nicely.. however... if i try and authenticate with the same id trying to auth for WiFI (unifi access points) i get a fail and the offending stanza in the debug is (11) eap_mschapv2: authenticate { (11) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (11) mschap: No NT-Password configured. Trying OpenDirectory Authentication (11) mschap: OD username_string = radiustest, OD shortUserName= (length = 0) (11) mschap: Stepbuf server challenge : 7972ffffffca6a52ffffffeb695bffffff87fffffffd46ffffffa4ffffffef18ffffffc9ffffffa0 (11) mschap: Stepbuf peer challenge : 37ffffffa043ffffffcdffffffe62503fffffffeffffffdf6f5cffffffd849ffffffb4ffffff8dffffffd2 (11) mschap: Stepbuf p24 : ffffffcdffffffc2ffffffd727472866ffffffd0fffffffe2fffffffa8263e5bffffffc150ffffff997fffffff90ffffffbbffffffb13dffffffeeffffff86 (11) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError I am a bit stuck with this, I am unsure why pap it works and it fails with eap. I did not fill this post with random logs, but if you have any ideas I can capture logs/configs etc as needed. Thanks in advance. I did have this working on the previous OD master, but a security update seemed to stop it working hence my migration efforts, I have followed the same "migration" document from Apple, but to be honest, after several days messing around I am just about ready to run up a VM and put FreeNAS into an Ubuntu box (if only I could be sure it would get its auth from OD) Ash -- -- ****Conciliation Resources | ****www.c-r.org <http://www.c-r.org/> **********Burghley Yard, 106 Burghley Road, London NW5 1AL UK *Why does inclusion matter for peace? Download our Accord <https://www.c-r.org/accord/inclusion-peace-processes> and explore our infographic <https://www.c-r.org/news-and-views/news/infographic-inclusion-why-does-it-m…> to find out.* Sign up <http://www.c-r.org/newsletter/subscribe> to our e-newsletter. See our latest updates on Twitter @CRbuildpeace <https://twitter.com/crbuildpeace> and _Facebook <https://www.facebook.com/ConciliationResources>*.*_ ***Charity registered in England and Wales (1055436). Company limited by guarantee registered in England and Wales (03196482) *** -- ***** **********This email is intended only for the named addressee(s) and may contain confidential and/or privileged material. If you have received this email in error, please notify Conciliation Resources immediately by emailing cr(a)c-r.org <mailto:cr@c-r.org> and delete the message. * * * *** ** ******* * *

2 1

Freeradius and unexpected TLS version ->Access-Reject
by iilinasi 24 Feb '20

24 Feb '20

Hello everyone! I have a weird issue with freeradius 3.0.16. I try to implement an auth exchange with the RADIUS, requesting EAP-TLS. At this moment I only need to get to the phase when server responds with Access-Challenge with server certificate (so, 2 packets from NAD and 2 from the server). To generate NAD-side packets I use python3 with scapy. Freeradius was set up to use EAP-TLS for test user auth. First access-request from the NAD side is responded with Access-Challenge from the server. So far so good. But when I send the second packet, I receive an Access-Reject. Suprisingly, the server reports I'm using unsupported TLS version ?0304?. Why "surprizingly"? Well, because I use earlier TLS version, and it is well visible even in server debugs (if you check "eap message" part, where is "0301"). I also checked in Wireshark (captured both on the server machine and "NAD" machine) - the packet is correctly dissected by latest wireshark and has TLS1.1 inside. Caching is disabled. OpenSSL is already at the newest version (1.1.1-1ubuntu2.1~18.04.5). I tried to rebuild my VM from scratch (so again, installed Ubuntu 18, freeradius 3.0.16, etc) - but the issue persists. Here is the debug: Ready to process requests (0) Received Access-Request Id 200 from 192.168.0.14:53256 to 192.168.0.59:1812 length 67 (0) Service-Type = Framed-User (0) User-Name = "test" (0) Framed-MTU = 1500 (0) EAP-Message = 0x020500090174657374 (0) Message-Authenticator = 0xefe697c97fd0118935d39e9a25d6baff (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]@/ ) { (0) if (&User-Name =~ /@[^@]@/ ) -> FALSE (0) if (&User-Name =~ /../ ) { (0) if (&User-Name =~ /../ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) -> FALSE (0) if (&User-Name =~ /.$/) { (0) if (&User-Name =~ /.$/) -> FALSE (0) if (&User-Name =~ /@./) { (0) if (&User-Name =~ /@./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Feb 14 15:03:01 2020 (0) [auth_log] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "test", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 5 length 9 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_tls to process data (0) eap_tls: Initiating new EAP-TLS session (0) eap_tls: Setting verify mode to require certificate from client (0) eap_tls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 6 length 6 (0) eap: EAP session adding &reply:State = 0xe879495de87f44cf (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 200 from 192.168.0.59:1812 to 192.168.0.14:53256 length 0 (0) EAP-Message = 0x010600060d20 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xe879495de87f44cfa950f055cfc4b84d (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 201 from 192.168.0.14:53256 to 192.168.0.59:1812 length 163 (1) Service-Type = Framed-User (1) User-Name = "test" (1) Framed-MTU = 1500 (1) EAP-Message = 0x020600570d800000004d16030100480100004403015e43c51b0000000000000000000000000000000000000000000000000000000000001600040005000a0009006400620003000600130012006301000005ff01000100 (1) State = 0xe879495de87f44cfa950f055cfc4b84d (1) Message-Authenticator = 0x70eca9c059289b575655c08683064d67 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]@/ ) { (1) if (&User-Name =~ /@[^@]@/ ) -> FALSE (1) if (&User-Name =~ /../ ) { (1) if (&User-Name =~ /../ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) -> FALSE (1) if (&User-Name =~ /.$/) { (1) if (&User-Name =~ /.$/) -> FALSE (1) if (&User-Name =~ /@./) { (1) if (&User-Name =~ /@./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (1) auth_log: --> /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (1) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (1) auth_log: EXPAND %t (1) auth_log: --> Fri Feb 14 15:03:01 2020 (1) [auth_log] = ok (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 6 length 87 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xe879495de87f44cf (1) eap: Finished EAP session with state 0xe879495de87f44cf (1) eap: Previous EAP request found for state 0xe879495de87f44cf, released from the list (1) eap: Peer sent packet with method EAP TLS (13) (1) eap: Calling submodule eap_tls to process data (1) eap_tls: Continuing EAP-TLS (1) eap_tls: Peer indicated complete TLS record size will be 77 bytes (1) eap_tls: Got complete TLS record (77 bytes) (1) eap_tls: [eaptls verify] = length included (1) eap_tls: (other): before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: <<< recv UNKNOWN TLS VERSION ?0304? [length 0048] (1) eap_tls: >>> send TLS 1.0 Alert [length 0002], fatal handshake_failure (1) eap_tls: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error (1) eap_tls: ERROR: Failed in FUNCTION (SSL_read): error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (1) eap_tls: ERROR: System call (I/O) error (-1) (1) eap_tls: ERROR: TLS receive handshake failed during operation (1) eap_tls: ERROR: [eaptls process] = fail (1) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (1) eap: Sending EAP Failure (code 4) ID 6 length 4 (1) eap: Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject What could be wrong here? Where should I debug further? Thanks a ton in advance for any hints! Cheers, Iron

3 6

Username case insensitivity
by Luveh Keraph 23 Feb '20

23 Feb '20

> On Feb 21, 2020, at 5:48 PM, Luveh Keraph <1.41421 at gmail.com> wrote: >> >> I would like for my FreeRADIUS 3.0.20 server to match user names to be >> authenticated in a case-insensitive way. > You want it to match *all* names in a case insensitive way? All user names that the FreeRADIUS receives for authentication. The password should remain case-sensitive. >> To that effect, I changed the >> contents of /etc/raddb/mods-enabled/sradutmp as follows: >> >> radutmp sradutmp { >> filename = ${logdir}/sradutmp >> case_sensitive = "no" > > No... that changes the case insensitivity of the *radutmp* module. The comments in the module > make this clear. OK, thanks. >> When I launch the FreeRADIUS server with -sfXx in the resulting traces I >> can see that the module above has been loaded, and that the case_sensitive >> attribute is indeed set to "no". However, the FreeRADIUS server remains >> user name case-sensitive. What am I misunderstanding here? > > You're seeing the server run modules which *aren't* radump, and which *don't* take any > "case_sensitive" parameter. I'm not sure why editing the "radutmp" module would make the > "files" or "pap" module be case insensitive. OK. > In FreeRADIUS, user name lookups are generally done via databases. If you want the lookups > to be case insensitive, then change the database queries > > So... which database are you using to look up user names / passwords? I am just using the basic capabilities provided by FreeRADIUS - entries in /etc/raddb/users. The user name and password information is retrieved from that file. I tried adding a policy for this in /etc/raddb/policy.d, but I couldn't get that to work either.

2 2

Create New Session Based On Accounting Update
by One Zero Art 23 Feb '20

23 Feb '20

Hi, I am trying to create a new session and insert it into radacct table based on an accounting request from NAS. When NAS sends Interim Update I want to check if that user already in radacct table and null or not null. If not null then create a new session and make that user online in freeradius. I am not sure if it's possible or even the right thing to do. Want to do that because sometimes user online in NAS but offline in freeradius. Thank you

2 3

User name case insensitivity
by Luveh Keraph 21 Feb '20

21 Feb '20

I would like for my FreeRADIUS 3.0.20 server to match user names to be authenticated in a case-insensitive way. To that effect, I changed the contents of /etc/raddb/mods-enabled/sradutmp as follows: radutmp sradutmp { filename = ${logdir}/sradutmp case_sensitive = "no" permissions = 0644 caller_id = "no" } When I launch the FreeRADIUS server with -sfXx in the resulting traces I can see that the module above has been loaded, and that the case_sensitive attribute is indeed set to "no". However, the FreeRADIUS server remains user name case-sensitive. What am I misunderstanding here?

3 2

Re: User name case insensitivity
by Luveh Keraph 21 Feb '20

21 Feb '20

The output requested is attached. My FreeRADIUS server knows about a user called kji. I first attempted to log in as Kji, and that failed. A subsequent attempt to log in as kji succeeds. -------------------------------------------------------------------------------------------------------------------------------------- Luveh, Please https://wiki.freeradius.org/guide/radiusd-X < https://wiki.freeradius.org/guide/radiusd-X> and share the output here. — Jorge Pereira jpereira at freeradius.org <mailto:jpereira at freeradius.org> > On 21 Feb 2020, at 13:48, Luveh Keraph <1.41421 at gmail.com> wrote: > > I would like for my FreeRADIUS 3.0.20 server to match user names to be > authenticated in a case-insensitive way. To that effect, I changed the > contents of /etc/raddb/mods-enabled/sradutmp as follows: > > radutmp sradutmp { > filename = ${logdir}/sradutmp > case_sensitive = "no" > permissions = 0644 > caller_id = "no" > } > > When I launch the FreeRADIUS server with -sfXx in the resulting traces I > can see that the module above has been loaded, and that the case_sensitive > attribute is indeed set to "no". However, the FreeRADIUS server remains > user name case-sensitive. What am I misunderstanding here? > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

NAS-IP-Address Match Using Groups - Freeradius 3.0
by Ope Abe 21 Feb '20

21 Feb '20

Hi there, I am newbie and learning how to use freeradius 3.0 and I wanted to configure a match criteria in both users file and hints file to perform a specific action when RADIUS auth requests are received from a specific range of NAS IP addresses. I thought this could be done by specifying the regexp for the range of IP addresses in the hints and users file using the =~ operator e.g.: *users file* Default NAS-IP-Address =~ ^81\.1\.(7[6-9]|8[0-3])\.41$ Framed-Protocol := PPP, Tunnel-Preference:1 += 1, Tunnel-Preference:2 += 1, Tunnel-Server-Endpoint:1 += 16.39.255.14, Tunnel-Server-Endpoint:2 += 16.39.255.14 *hints file* Default NAS-IP-Address =~ ^81\.1\.(7[6-9]|8[0-3])\.41$ User-Name :="%{User-Name}.ppp" For both cases above, the regexp would match the following IPs: 81.1.76-83.41 My understanding is what I've done would work fine for freeradius 2.x. However, for freeradius 3.0 I need to create a group and define my list of NAS IPs under the group which I can then use as a match criteria in the hints and users file. I know how to define a new string attribute for the group using the dictionary file in etc/freeradius/3.0 but I am not sure where I need to define the NAS IP addresses against the group, and also where I need to set the group attribute using unlang like this: update request { My-Group := "foo" } I just need someone to help confirm if the steps I've specified below are correct: Define new string attribute in etc/freeradius/3.0/dictionary ATTRIBUTE NAS-Group 3003 string in /etc/freeradius/3.0/group_local, I define the following: lts:81.1.76.41 lts:81.1.77.41 lts:81.1.78.41 lts:81.1.79.41 lts:81.1.80.41 lts:81.1.81.41 lts:81.1.82.41 lts:81.1.83.41 in /etc/freeradius/3.0/mods-available/etc_group, I add the following to the file: passwd group_local { filename = /etc/freeradius/3.0/group_local format = "NAS-Group:*NAS-IP-Address" hash_size = 50 ignore_nislike = yes allow_multiple_keys = no delimiter = ":" } in /etc/freeradius/3.0/sites-enabled/default, I add the following in the authorize { } section immediately after the preprocess module i.e.: authorize { preprocess update request { NAS-Group := "lts" } } The update users and hints files to reflect the following: *users file* Default NAS-Group == "lts" Framed-Protocol := PPP, Tunnel-Preference:1 += 1, Tunnel-Preference:2 += 1, Tunnel-Server-Endpoint:1 += 16.39.255.14, Tunnel-Server-Endpoint:2 += 16.39.255.14 *hints file* Default NAS-Group == "lts" User-Name :="%{User-Name}.ppp" Does this make any sense at all? Is this the way I need to implement what I'd like to achieve? Many thanks in anticipation of your response. Abe.

2 2

Destination port invalid
by Bassem Mettichi 21 Feb '20

21 Feb '20

Hello, i have an issue with the response packet sended from my freeradius server to the NAS, a tcpdump on NAS side give this error message: The accounting response message is unfound,The message destination port invalid.ServerIP:0xac193c27 0x00000000 0x00000000 0x00000000,DstPort:31686,Correct Range:31671<=Port<=31685 Do you have any idea why freeradius choose this range port for response packet? Thanks Bassem

4 4

Emulate AD-based machine authentication
by Munroe Sollog 20 Feb '20

20 Feb '20

Our current wireless environment uses Microsoft Active Directory with Microsoft Network Policy Server to authenticate our 802.1x wireless network. As it is configured, it supports user authentication via PEAP and mschapv2, and it also supports what NPS calls "machine authentication". Which, based on its behavior allows any computer joined to the domain to access the network with user credentials. As an example, this is useful for loaner laptops where the computer needs access to the network in order to authenticate the user against AD. I am trying to replace our current Microsoft NPS server with freeradius. I was able to follow the docs and use winbind to get PEAP-mschap user authentication working flawlessly. The last piece of this puzzle is, NPS has a "magic checkbox" that enables machine-based authentication. I have been trying to figure out what that checkbox does, without much luck. My best guess is that it's using the Active Directory certificates to do EAP-TLS auth, but that is just my guess. Has anyone ever tried to replicate this feature? or have any insight? I realize this isn't strictly a freeradius question, but thought I would ask. -- Munroe Sollog Senior Network Engineer munroe(a)lehigh.edu

3 4

RE: ntlm_auth and MSCHAP issues
by Adam McPartlan 20 Feb '20

20 Feb '20

Hi Louis, > If you followed it exactly it should work. That's what I thought. I have had another look through the config and found that I had commented out "require_encryption = yes" for some illogical reason. > Did you set this on the ad-dc and member (the proxy). : ntlm auth = > mschapv2-and-ntlmv2-only > Run also: adduser proxy winbindd_priv I had also not set the server up as a cleint in the NPS on AD. The combination of the two corrections has brought me a well received Access-Accept packet. So thank you very much for your time and your reply. Kind regards Adam CONFIDENTIALITY WARNING: This email has been sent from NYnet Ltd, a UK limited company controlled by North Yorkshire County Council. The information in this email (and any document(s) attached to it) is confidential or legally privileged, and is intended solely for the use of the person named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this E-mail is strictly prohibited. An individual with the title of director does not necessarily mean they are a statutory director. A full list of statutory directors is available for inspection at our registered office.

1 0