- Freeradius-Users - lists.freeradius.org

Unable to decipher what's coming back via a PEAP tunnel
by Joe Garcia 15 Jan '20

15 Jan '20

I'm working with a third-party app that authenticates to a FreeRADIUS server via MSCHAPv2 over PEAP and need up update a few parts of it, but I can't figure out what FreeRADIUS is sending over the PEAP tunnel when it's not sending MSCHAPv2 data. The current code doesn't try and break down the messages, possibly because my predecessor also couldn't figure out what they were, but there's now a requirement to do this. The initial Identity Request sent by FreeRADIUS over the PEAP tunnel is: 01 // Identity-Request 06 // ? 00 05 // length = 5 01 // ? The Identity Request sent by FreeRADIUS over the PEAP tunnel in response to an incorrect identity in the MSCHAPv2 process, i.e. what you get instead of an MSCHAPv2 response, is: 01 // Identity-Request 08 // ? 00 0B // length = 11 21 80 03 00 02 00 02 // ? Problem is I can't translate these messages into anything useful (the field names I've used above are guesswork), this doesn't correspond to any message format that I can identify, RADIUS, EAP, DIAMETER, PEAP, there are bits and pieces in there that could correspond to various things like EAP and RADIUS, and the byte string starting 0x21 could be a MS-Authentication-TLV but what follows doesn't match draft-hiller-eap-tlv-01.txt, and it also doesn't work as an EAP-Request, also 0x21. Can anyone tell me what format this is? JG.

2 2

How make freeradius - rlm_exec run multithreaded?
by Ryan Allen 15 Jan '20

15 Jan '20

In FreeRadius, we are trying to use rlm_exec to call an external script in a multithreaded fashion, but once "exec" is called, it blocks other requests and only processes one request at a time. We need to support multiple users signing in at the same time. How can we make this multithreaded/multiprocessed? Here is a simple example we used to verify the blocking issue: # In file: raddb/sites-available/default authorize { ... exec update reply { Reply-Message = config:Reply-Message State = config:State } handled ... } # In file: raddb/mods-enabled/exec exec { program = "/bin/bash -f /etc/raddb/mods-config/.../execBashCustomAuthorization.sh" wait = yes input_pairs = request output_pairs = config shell_escape = yes timeout = 30 } # In file: raddb/mods-config/.../execBashCustomAuthorization.sh #!/bin/bash sleep 5 echo "Reply-Message = \"A short message\"," echo "State = \"2496578198c5447a8167fe3fe0398133\"," echo "Response-Packet-Type = \"Access-Challenge\"" exit 0 If we send 5 requests to our freeradius server, we expect all 5 responses to come back at about the same time, but they each respond 5 seconds apart, and it takes about 25 seconds for all to complete. We know that "wait=yes" makes freeradius wait for the script to finish and processes what the external script sent to stdout, but we thought it could still handle multiple requests in parallel. We can't use "wait=no" because we need output from the external script. Here are the details of our runtime environment: FreeRADIUS Version: 3.0.19 Python Version: 2.7.15 Please let us know if you need any additional environmental or configuration information. We thank you in advance for any help you can provide.

5 7

In freeradius rlm_exec - How keep "\n" newline in messages
by Ryan Allen 14 Jan '20

14 Jan '20

So in freeradius (version 3.0.19), we are using rlm_exec to call an external shell script. The script sends all responses to standard out (which gets returned back to freeradius), and that is working, but if we put the "\n" newline character in our messages, that newline is getting removed. We use "\n" to format some messages for the end user. Is there any way to create messages that keep the newline character? Thank you for your help! Ryan

2 1

AD group membership
by Munroe Sollog 14 Jan '20

14 Jan '20

I have successfully configured freeradius to authenticate against AD using the winbind socket (not the ntlm_auth command). I find myself needing to also authorize based on AD group membership, more precisely based on negative group membership (We maintain a "deny wireless" group). It seems like I could use the LDAP module and test for the group there, but I noticed that the ntlm_auth command supports some notion of group checking through the '--require-membership-of=STRING' option. It follows that winbind has access to AD groups and could be used to check. I haven't been able to find any guidance on the freeradius.org documentation site, so I was wondering if there is a preferred method for AD-based group checking when using winbind. -- Munroe Sollog Senior Network Engineer munroe(a)lehigh.edu

3 3

IPoE Access- how can I achieve this?
by Nitin sidhu 14 Jan '20

14 Jan '20

Hello We are using IPoE as user access mechanism. The BNG/BRAS uses the option82 in the DHCP discover message and creates a username from that and passes this username to the radius server. All the users are in a postgres DB. We need to wall garden any user that is not in the DB when the radius servers looks at the DB tables. We require that any user that is not in the DB, the radius server should pass these attributes in access-accept packet to the client: 1) Filter-id 2) HW-Web-URL How can we achieve this please if this is possible? and where would we need to add the necessary policies? Kind regards Nitin Sidhu

2 1

EAP stress testting
by work vlpl 13 Jan '20

13 Jan '20

Hello, I want to do a stress test of my Freeradius setup with EAP connections. radclient tool support arguments that allow to send many packets/request per second, but eapol_test tool does not support it. So to simulate may EAP connections/request per second I am starting many eapol_test processes in parallel. It kinda works, but I wonder if there is a better tool to do that. -- Vladimir

4 5

Microsoft AD group check
by Marek Smoliński 13 Jan '20

13 Jan '20

Hi, I want to implement 802.1x. The computers belonging to Microsoft domey will be authenticated. The switch port will be configured in VLAN according to the computer's group membership. Simple configuration. Works well ;) FreeRadius 3.0.19 Question: due to AD complexity, is it possible to assign the same VLAN to computers from different groups? Currently I'm doing it as follows: in post-auth if (Ldap-Group == VLAN16_SIEO1) { update reply { ... } } I want to allocate the same VLAN to groups such as VLAN16_BSTO1 and VLAN16_ADMCE1 and others starting with VLAN16_. Is it possible to check the group name so as not to create many "if" conditions? In my case these conditions will be about 800 :) if I change the „if” condition if (Ldap-Group[*] =~ /.*VLAN16_.*/) { update reply { ... } } I've got the result: Debug: (10) User is not a member of "VLAN129" Debug: (10) elsif (LDAP-Group == VLAN129) -> FALSE Debug: (10) elsif (LDAP-Group[*] =~ /.*VLAN16_.*/) { Debug: No old matches Debug: (10) elsif (LDAP-Group[*] =~ /.*VLAN16_.*/) -> FALSE Debug: (10) elsif (LDAP-Group == VLAN131) { Debug: (10) Searching for user in group "VLAN131" anyone can help me, tell me how to config can solve this problem, thanks. regards Marek Smoliński

4 15

Question on syntax in site definitions
by Coy Hile 12 Jan '20

12 Jan '20

Hi all, Quick question that I don’t see documented (at least not in the comments themselves). If one looks at sites-available/default (https://github.com/FreeRADIUS/freeradius-server/blob/release_3_0_20/raddb/s…) one sees “-sql” and “-ldap”. What’s the function of the `-‘ there? Is it a “use this if it is defined, but ignore it otherwise” bit of syntactic sugar? -- Coy Hile coy.hile(a)coyhile.com

2 1

Radius certificate issue on Win10
by uj2.hahn＠posteo.de 12 Jan '20

12 Jan '20

I know, this is not really a freeradius tool question but more a Windows issue. I created new radius certificates and installed them on server and some Android clients. Everything is working fine. These clients can login without password now. But not comes the real exercise: I tried to setup Win 10 (version 1909) clients to be used in same way (login via certificate instead of user/passwd). But something is completely wrong. I followed some guidelines I found in the web and created a WLAN profile with the necessary setting. But when I use the profile to open the WLAN connection, the only thing I see is something like: "Connection is not possible, You need a certificate to login. Please contact your admin." Is there anybody out there who can help me to resolve that issue? Thanks a lot Uwe

2 1

Is it possible to proxy a request to a second radius server if the first one rejects the request?
by ngoetz24＠gmail.com 12 Jan '20

12 Jan '20

We are in the process to migrating a large number of users from our existing OTP server to a new OTP solution. During this process it will take around a moth to assign all the users a new physical token. Because of this, we will need to support both OTP servers until all the users have their new tokens. We currently have two realms setup in the proxy.conf file. One goes to the old OTP radius server, and the other goes to the new OTP radius server. Using each of these realms individually works just fine. Is there a way to configure freeradius to proxy the request to the first realm, and if it gets a rejection to then proxy the request to the second realm? We are trying to make this transition as seamless as possible to our users. During the transition period, it would be useful if we could find a way to proxy the request to both OTP servers and as long as one of them accepts the request the user will be granted access. It would be ideal if it would proxy to the old OTP server first and only if the request is rejected to forward the request to the second OPT server. Since the OTP server is configured to lock an account after 3 failures, we want the request to try the old OTP server first. This way once the user get's their new token it won't matter if their token gets locked on the old system. Once the transition is complete and all the users have their new tokens, we will shutdown the old OTP server. If this is at all possible, I would be grateful is someone could point me in the right direction on how to do this. We are currently running on FreeRadius 3.0.20 Thank You.

2 1