- Freeradius-Users - lists.freeradius.org

How to deal with device self-registration best?
by Nilsson, Cristian (Göteborg) 03 Feb '20

03 Feb '20

Hello everyone! I am quite new to freeradius and apologize if this has been answered before, I have searched - and a lot of it without finding a good answer. Please direct me if this is already answered. I have a setup of Extreme Wing wi-fi controller and want to implement a guest-user system with captive-portal and device registration/recognition in combination with the standard pre-defined users. I have a radius server going and everything is good as long as I have a user created in radius. Now my challenge is that for "device registration" I see in radius debugs a username sent in form of device mac-address (password is empty) and the expected access-reject as this user is not defined. How can I on the fly add non-existing users into radius database (we use mysql) and from there let accounting take over for session limitations etc? Preferably this would also match some sort of criteria, example a specific subnet. I greatly appreciate any help! Mvh Cristian Nilsson Systemingenjör IP - NMC Service Support Service Assurance Communication - NMC ELTEL Networks Infranet AB Postadress - Box 8914, 402 73 Göteborg Besöksadress - Säterigatan 20, 417 64 Göteborg Orgnr: 556555-1073 Säte: Stockholm cristian.nilsson(a)eltelnetworks.se<mailto:cristian.nilsson@eltelnetworks.se> Telefon +46(0)727 09 72 71 www.eltelnetworks.se CONFIDENTIALITY NOTICE This e-mail is confidential and may contain legally privileged information. If you have received it by mistake, please inform us by reply e-mail and then delete it (including any attachments) from your system; you should not copy it or in any other way disclose its content to anyone.

2 5

Building FreeRADIUS packages for Red Hat/CentOS
by Chris Howley 03 Feb '20

03 Feb '20

Hello Matthew, Thank you for the information in the previous e-mail. > 4. The FreeRADIUS spec file for 3.0.20 requires OpenLDAP software. > How do I modify the spec file to use the LTB OpenLDAP distribution? You don't. Install OpenLDAP from the LTB repo, not the RedHat one. That's then the only one which can be used. I've been told that the Red Hat OpenLDAP package is part of our standard server build and the software is used by applications on the server. Would the presence of both the Red Hat and LTB OpenLDAP software cause any issues for the FreeRADIUS server? I noticed the following note on the LTB project web site (https://ltb-project.org/documentation/openldap-rpm) for the RPMs: "The installation is done under /usr/local, in order to avoid conflicts with existing OpenLDAP installation. In particular, we do not touch the ldap system libraries, which are linked in by many other programs." I'm not a software developer so I'd appreciate your advice. Thank you, Chris Howley

2 1

Re : request for radius dictionary EVS entry examples
by robert.stannard＠bt.com 03 Feb '20

03 Feb '20

?Goodmorning, Does anyone have an example of an EVS dictionary entry ? I've found examples for type TLV (please see below), but not EVS?. ATTRIBUTE FreeDHCP-Relay-Agent-Information 82 tlv ATTRIBUTE FreeDHCP-Agent-Circuit-Id 82.1 octets I would like see how the entries are organised in the dictionary. I've checked the dictionaries in the latest FreeRadius download but couldn't find a single example. If someone is using them or has an example (for instance for testing) then could you please share it ? Cheers, Robert.

2 1

Building FreeRADIUS packages for Red Hat/CentOS
by Chris Howley 03 Feb '20

03 Feb '20

Hello, 1. Please would you tell me if the NetworkRADIUS packages are built with direct winbind support or do I need to build the packages from a SRPM. 2. Is the information on the FreeRADIUS Wiki (https://wiki.freeradius.org/guide/Red-Hat-FAQ) current for building the packages? 3. Should I be using the OpenLDAP project or LDAP Tool Box project software when building the packages? 4. The FreeRADIUS spec file for 3.0.20 requires OpenLDAP software. How do I modify the spec file to use the LTB OpenLDAP distribution? I have a limited knowledge of building packages so please excuse me if my questions are a bit vague. Thank you for your time, Chris Howley

2 1

Using Cleartext-Password with MS-CHAP-Use-NTLM-Auth := No
by Richard Green 03 Feb '20

03 Feb '20

Hi list : ) With mschap, to avoid calling an expensive external program for both my authorize and authenticate (multiotp), it is appealing to set "MS-CHAP-Use-NTLM-Auth := No" in the control items, and the mschap module will do the authentication itself without calling ntlm_auth, however I have failed thus far to get this working: how to I make the Cleartext-Password available? I have set this in my policy.conf: policy { # Change to a specific prefix if you want to deal with normal PAP authentication as well as OTP # e.g. "multiotp_prefix = 'otp:'" multiotp_prefix = '' multiotp.authorize { # This test force multiOTP for any MS-CHAP(v2) attempt if (control:Auth-Type == MS-CHAP) { update control { Auth-Type := multiotpmschap MS-CHAP-Use-NTLM-Auth := No } } # This test force multiOTP for any MS-CHAP(v2) attempt elsif (control:Auth-Type == mschap) { update control { Auth-Type := multiotpmschap MS-CHAP-Use-NTLM-Auth := No } } . . . radtest appears to send the a Cleartext-Password (actually an OTP token which has been accepted in the authorize section): # radtest -x -t mschap bob $(./totp.py) localhost 0 testing123 Sent Access-Request Id 76 from 0.0.0.0:37601 to 127.0.0.1:1812 length 129 User-Name = "bob" MS-CHAP-Password = "631266" NAS-IP-Address = 10.118.240.180 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "631266" MS-CHAP-Challenge = 0x674bc434692c64f3 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000027167c876e56981640f36d071e8335dfa39b7c5bdac381bf Received Access-Reject Id 76 from 127.0.0.1:1812 to 0.0.0.0:0 length 61 MS-CHAP-Error = "\000E=691 R=1 C=24b53a75a9d80580 V=2" (0) -: Expected Access-Accept got Access-Reject However the server component appears not to expose Cleartext-Password for my use. From raddebug: (3) Sun Feb 2 02:19:01 2020: Debug: Received Access-Request Id 76 from 127.0.0.1:37601 to 127.0.0.1:1812 length 129 (3) Sun Feb 2 02:19:01 2020: Debug: User-Name = "bob" (3) Sun Feb 2 02:19:01 2020: Debug: NAS-IP-Address = 10.118.240.180 (3) Sun Feb 2 02:19:01 2020: Debug: NAS-Port = 0 (3) Sun Feb 2 02:19:01 2020: Debug: Message-Authenticator = 0x784a3fcd0eaa0a74d07afa17da59adad (3) Sun Feb 2 02:19:01 2020: Debug: MS-CHAP-Challenge = 0x674bc434692c64f3 (3) Sun Feb 2 02:19:01 2020: Debug: MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000027167c876e56981640f36d071e8335dfa39b7c5bdac381bf (3) Sun Feb 2 02:19:01 2020: Debug: # Executing section authorize from file /etc/raddb/sites-enabled/default (3) Sun Feb 2 02:19:01 2020: Debug: authorize { (3) Sun Feb 2 02:19:01 2020: Debug: policy filter_username { . . . (3) Sun Feb 2 02:19:02 2020: Debug: } # authorize = ok (3) Sun Feb 2 02:19:02 2020: Debug: Found Auth-Type = mschap (3) Sun Feb 2 02:19:02 2020: Debug: # Executing group from file /etc/raddb/sites-enabled/default (3) Sun Feb 2 02:19:02 2020: Debug: Auth-Type mschap { (3) Sun Feb 2 02:19:02 2020: WARNING: multiotpmschap: No Cleartext-Password configured. Cannot create NT-Password (3) Sun Feb 2 02:19:02 2020: WARNING: multiotpmschap: No Cleartext-Password configured. Cannot create LM-Password (3) Sun Feb 2 02:19:02 2020: Debug: multiotpmschap: Client is using MS-CHAPv1 with NT-Password (3) Sun Feb 2 02:19:02 2020: ERROR: multiotpmschap: FAILED: No NT/LM-Password. Cannot perform authentication (3) Sun Feb 2 02:19:02 2020: ERROR: multiotpmschap: MS-CHAP2-Response is incorrect (3) Sun Feb 2 02:19:02 2020: Debug: [multiotpmschap] = reject (3) Sun Feb 2 02:19:02 2020: Debug: } # Auth-Type mschap = reject (3) Sun Feb 2 02:19:02 2020: Debug: Failed to authenticate the user Thanks :) ________________________________________________________________ Richard Green IT Solution Design & Delivery | UNSW Sydney | NSW 2052 richard.green(a)unsw.edu.au | +61(2) 9385 8738 ABN 57 195 873 179 | CRICOS Provider Code 00098G

2 3

Disable logging for one virtual server
by Richard Green 31 Jan '20

31 Jan '20

Is it possible to disable logging for one virtual server, with FreeRADIUS 3? I have a network load balancer in front of FreeRADIUS 3, for the purposes of multiple availability zone fail-overs in AWS. The health checks (which are only valid for TCP btw) are resulting in many logged errors: Wed Jan 29 04:28:24 2020 : Error: Ignoring request to auth proto tcp address * port 1812 bound to server health-check-tcp from unknown client 10.118.241.27 port 43332 proto tcp Thanks Richard ______ Richard Green IT Solution Design & Delivery | UNSW Sydney | NSW 2052

5 6

SQL Module not Enabling
by Mark Kohler 31 Jan '20

31 Jan '20

I am attempting to enable the SQL module on a freeradius server I have hosted on my local computer, but I can't seem to get it to work. output of radiusd -x FreeRADIUS Version 3.0.21 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/detail including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/accounting including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } instantiate { } # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" disable_tlsv1 = yes disable_tlsv1_1 = yes tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Please use tls_min_version and tls_max_version instead of disable_tlsv1 Please use tls_min_version and tls_max_version instead of disable_tlsv1_2 # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel:336 } # server inner-tunnel server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 32952 Listening on proxy address :: port 33980 Ready to process requests contents of mods-enabled total 0 lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 always -> ../mods-available/always lrwxrwxrwx 1 freerad freerad 29 Jan 30 14:52 attr_filter -> ../mods-available/attr_filter lrwxrwxrwx 1 freerad freerad 27 Jan 30 14:52 cache_eap -> ../mods-available/cache_eap lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 chap -> ../mods-available/chap lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 detail -> ../mods-available/detail lrwxrwxrwx 1 freerad freerad 28 Jan 30 14:52 detail.log -> ../mods-available/detail.log lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 digest -> ../mods-available/digest lrwxrwxrwx 1 freerad freerad 33 Jan 30 14:52 dynamic_clients -> ../mods-available/dynamic_clients lrwxrwxrwx 1 freerad freerad 21 Jan 30 14:52 eap -> ../mods-available/eap lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 echo -> ../mods-available/echo lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 exec -> ../mods-available/exec lrwxrwxrwx 1 freerad freerad 28 Jan 30 14:52 expiration -> ../mods-available/expiration lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 expr -> ../mods-available/expr lrwxrwxrwx 1 freerad freerad 23 Jan 30 14:52 files -> ../mods-available/files lrwxrwxrwx 1 freerad freerad 25 Jan 30 14:52 linelog -> ../mods-available/linelog lrwxrwxrwx 1 freerad freerad 27 Jan 30 14:52 logintime -> ../mods-available/logintime lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 mschap -> ../mods-available/mschap lrwxrwxrwx 1 freerad freerad 27 Jan 30 14:52 ntlm_auth -> ../mods-available/ntlm_auth lrwxrwxrwx 1 freerad freerad 21 Jan 30 14:52 pap -> ../mods-available/pap lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 passwd -> ../mods-available/passwd lrwxrwxrwx 1 freerad freerad 28 Jan 30 14:52 preprocess -> ../mods-available/preprocess lrwxrwxrwx 1 freerad freerad 25 Jan 30 14:52 radutmp -> ../mods-available/radutmp lrwxrwxrwx 1 freerad freerad 23 Jan 30 14:52 realm -> ../mods-available/realm lrwxrwxrwx 1 freerad freerad 27 Jan 30 14:52 replicate -> ../mods-available/replicate lrwxrwxrwx 1 freerad freerad 21 Jan 30 14:52 soh -> ../mods-available/soh lrwxrwxrwx 1 freerad freerad 21 Jan 31 10:49 sql -> ../mods-available/sql lrwxrwxrwx 1 freerad freerad 26 Jan 30 14:52 sradutmp -> ../mods-available/sradutmp lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 unix -> ../mods-available/unix lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 unpack -> ../mods-available/unpack lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 utf8 -> ../mods-available/utf8

2 1

rlm_rest learnings - PAP and PEAP/MSCHAPv2
by Lang, Russell 30 Jan '20

30 Jan '20

Thanks to Arran for his hints on calling a REST API from FreeRADIUS. rlm_rest is working, doing authentication for WPA2-Personal (PAP via captive portal) and WPA2-Enterprise Wi-Fi clients (PEAP/MSCHAPv2). Using FreeRADIUS 3.0.16 (Ubuntu 18.04). PAP is handled in the default site, while the MSCHAP2 part of PEAP/MSCHAP2 is handled in the inner-tunnel. The trick is preventing the REST API from being called in the default site with EAP outer messages, which would result in 9 unwanted API calls. The authorize REST API code does pre-authentication and if it passes it returns the NT-Password or Cleartext-Password as appropriate. To find out if the user was authenticated, a post-auth REST API is used to log success/failure. rest module configuration: authorize { uri = "RADIUS_API_PATH/radius?action=authorize" method = 'post' body = 'json' auth = 'basic' username = 'RADIUS_API_USER' password = 'RADIUS_API_PASSWORD' } post-auth { uri = "RADIUS_API_PATH/radius?action=post-auth&result=%{control:Post-Auth-Type}" # result is either '' or 'Reject' ... } API pseudo code for authorize: if pre-authenticated if mschap return { "control:NT-Password": {"type":"octets","value":[ "0x0123456789ABCDEF0123456789ABCDEF" ]}}, 200 else return { "control:Cleartext-Password": {"type":"string","value":[ "clear-text-password-here" ]}}, 200 else: return {}, 401 default site config: authorize { mschap eap { ok = return } if (!ok && !updated) { # Only call rest if not handled by EAP rest } pap } post-auth { ... if (!&reply:EAP-Message) { # Only call rest if not EAP rest } ... } inner-site config: authorize { mschap eap { ok = return } if (!ok && !updated) { # Only call rest if not already handled rest } pap } post-auth { ... rest ... } Issues: When doing PEAP/MSCHAPv2, the authorize REST API gets called twice in the inner-tunnel, for two different EAP messages. Wastes a few milliseconds, but only a minor issue. Using radtest -t mschap valid-user@domain invalid_password 127.0.0.1 0 radius_secret replied with MS-CHAP-Error = "\000E=691 R=1 C=ad8367a70f809d72 V=2" My reading of the MS-CHAP-V2 RFC2759 and PPP CHAP RFC1994 is that this should have been MS-CHAP-Error = "E=691 R=1 C=ad8367a70f809d72 V=2"

3 3

Dealing with Apple Watches?
by Ted Hyde (RSI) 30 Jan '20

30 Jan '20

Howdy - So I'm not an "Apple Guy". I tolerate them, I support them, but I don't own them. I recently redesigned one of our office networks to split up departments into vlans (something that was on my list for a long time and desperately needed), and after some labbing, rolled it out last week. I intentionally kept the wifi out of the main distribution loop because I needed to really find out what levels of security the staff would permit. While I would love to enforce full EAP-TLS (or TTLS) some of that is difficult with transient workers, staff, and of course some devices that don't support certificates. So to wrangle this, I created a dedicated subnet (a little /27) and made it wpa2-psk. Simple test just to keep the bare minimum going. Except after giving two people the pwd, I ran out of scope. This seemed odd, how could two people eat up some 28-odd ip addresses? First thought, they blabbed. Turns out they did tell "only a couple of other people" - which is exactly what I needed to find out in this test - a psk is useless security in the workplace. That still didn't account for everything. So I cleared out all the ip bindings and watched as all the clients re-acquired ip addresses. 28 gone in a heartbeat. There weren't 28 people in the building. Half of these folks were "very-Apple-people". That means iMac, Mac-top, ipad, watch, phone, backup watch, backup phone..... and they all of course (in hindsight it's obvious) use their devices in "Default" mode which means accepting all of Apple's recommendations without reading them. After clearing the scope and changing the password, I went and worked with one user directly, typed in the credential myself on her laptop. While I was holding her phone, I got interrupted, and when my attention went back to the phone, I saw that it had already connected - how did it get the new key? I'm sure at this moment there are 50 admins talking to the screen saying "oh, all Apple users can set their devices to share and automatically connect as a convenience" - an item that I was not aware of prior. I took the test a step further and was able to observe that another user has credentials automatically pop up to his icloud account, wherein his ENTIRE FAMILY gets the credential. Not good. Definitely not good. I'm sure this is happening in school campus scenarios where staff and students eat up scope from devices that shouldn't ever be permitted on a particular network, and since folks like the convenience, they sync their phones to their dtops, and no group policy is going to get in the way of that. Does anyone have a workable solution to controlling this above? Is it "some auth" + Mac Auth? Or is it "give up on control and just make huge networks so there's enough scope"? With decidedly less hair, many thanks, Ted.

3 2

802.1x radius issue
by Amardeep Singh 30 Jan '20

30 Jan '20

Hi Guys, While testing 802.1x in our lab we are getting the following error on radius: Debug: [mschap] No Cleartext-Password configured. Cannot create LM-Password. Debug: [mschap] No Cleartext-Password configured. Cannot create NT-Password. Debug: [mschap] Creating challenge hash with username: test951 Debug: [mschap] Client is using MS-CHAPv2 for test951, we need NT-Password Debug: [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. Debug: [mschap] FAILED: MS-CHAP2-Response is incorrect Debug: ++[mschap] = reject There are valid entries in the radius tables. select * from radcheck where username = 'test951'; +-----------+--------------+--------------------+----+--------------+ | id | username | attribute | op | value | +-----------+--------------+--------------------+----+--------------+ | 115850045 | jerrytest951 | Cleartext-Password | := | jerrytest951 | Please suggest! Thanks, Amardeep

5 8