- Freeradius-Users - lists.freeradius.org

Enforcing cryptobinding
by Nik Mitev 22 Nov '19

22 Nov '19

Hi, I was looking at this article about the sycophant attack https://sensep ost.com/blog/2019/peap-relay-attacks-with-wpa_sycophant/ and the success of it reportedly hangs on whether cryptobinding is enforced or not. On NPS it is not enforced by default, but there is a "Disconnect clients without cryptobinding" setting that can be enabled. Can anyone confirm what is the FR default on cryptobinding and whether it can be changed in configuration? If it is not enabled by default, can it be enabled? If it is enabled by default, can it be disabled - inadvertently of on purpose. Regards, Nik

2 1

DHCP 82 Option Controls
by Maile Halatuituia 21 Nov '19

21 Nov '19

Hi I have this send to my FreeRadius Server from a BRAS that serves as a DHCP Server for Clients. I want to authorize my user using their phones number as send by the BRAS as the Calling-Station-Id below. I understand that I can't authenticate as this is DHCP, please correct me if I am wrong compare to PPPoE. >From BRAS to FreeRadius Server BRAS (Cisco ASR 1001) --> Freeradius Version 3.0.15 *Nov 21 14:28:36: RADIUS: User-Name [1] 10 "67624029" Nov 21 14:28:36: RADIUS: User-Password [2] 18 *Nov 21 14:28:36: RADIUS: Calling-Station-Id [31] 10 "67624029" *Nov 21 14:28:36: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Nov 21 14:28:36: RADIUS: NAS-Port [5] 6 0 *Nov 21 14:28:36: RADIUS: NAS-Port-Id [87] 35 "NUK-MSAN4 atm 16/13:0.34:67624029" *Nov 21 14:28:36: RADIUS: Vendor, Cisco [26] 47 *Nov 21 14:28:36: RADIUS: Cisco AVpair [1] 41 "circuit-id-tag=NUK-MSAN4 atm 16/13:0.34" *Nov 21 14:28:36: RADIUS: Vendor, Cisco [26] 30 *Nov 21 14:28:36: RADIUS: Cisco AVpair [1] 24 "remote-id-tag=67624029" *Nov 21 14:28:36: RADIUS: Service-Type [6] 6 Outbound [5] *Nov 21 14:28:36: RADIUS: NAS-IP-Address [4] 6 10.254.36.225 *Nov 21 14:28:36: RADIUS: Acct-Session-Id [44] 18 "0000000000000146" *Nov 21 14:28:36: RADIUS: Nas-Identifier [32] 21 "HA_BNG3.kalianet.to" *Nov 21 14:28:36: RADIUS: Event-Timestamp [55] 6 1574299716 My Default Server Control Portion. This is the portion I believe it is relate to this where I attach some realm in this case (prepaid.to) . if ( &WiMAX-BS-Id ) { perl mschap } else { if ( &Calling-Station-Id ) { update request { &User-Name := "%{%{Stripped-User-name}:-%{User-Name}}@prepaid.to" } ### for keyed-balance update control { &Load-Balance-Key := "%{Calling-Station-Id}" } } else { if ( &User-Name !~ /\@/ ){ update request { &User-Name := "%{User-Name}(a)kalianet.to" } } } I am not sure I have this as a valid start or this does something other than what I want to achieve. My problem I can summarise on these two points. 1. First how can I use my Calling Station to authorize the DHCP Clients. ??? 2. Secondly if possible to do Authentication with Calling-Station-Id before address assigned to the Customer.??? Attached is the Debug File. Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

1 0

Freeradius 3 Log user calling IP in table
by JAHANZAIB SYED 21 Nov '19

21 Nov '19

Scenario: We are using Freeradius 3.0.19 & Mikrotik Routerboard as NAS. When any user connects , FR inserts his entry in radacct table with relevant data. We want to additionally log userend calling IP (maybe its called Packet-Src-IP-Address , IP which he gets from the DHCP) in the radacct or in any other table. is it doable ? would appreciate if some tips can be given Regards, Jz <http:///>

3 5

FreeRadius Auth Method variables
by Sep0lkit 21 Nov '19

21 Nov '19

I want to log user auth-method(PAP/CHAP/EAP-TLS/EAP-PEAP), i search the freeradius website and google, but there is nothing. i think this variables is very useful, may this features add in future?

2 4

TLS failover behaviour and a backtrace if want it.
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 20 Nov '19

20 Nov '19

Hi, Using 3.0.19 on Ubuntu from the Ubuntu networkradius repo. I've been doing some testing on tls proxy connections. sites-enabled/tls below. home_server rsh-haproxy-rp1 { ipaddr = 192.168.110.46 port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { private_key_file = /etc/freeradius/certs/privkey.pem certificate_file = /etc/freeradius/certs/fullchain.pem ca_file = /etc/ssl/certs/ca-certificates.crt dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" } limit { idle_timeout = 0 } } home_server prh-haproxy-rp1 { ipaddr = 192.168.12.200 port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { private_key_file = /etc/freeradius/certs/privkey.pem certificate_file = /etc/freeradius/certs/fullchain.pem ca_file = /etc/ssl/certs/ca-certificates.crt dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" } } home_server_pool some_radius_servers { type = fail-over home_server = rsh-haproxy-rp1 home_server = prh-haproxy-rp1 } realm DEFAULT { auth_pool = some_radius_servers } Firstly, I must admit I expected failover to be "within same request", but it takes a repeat request from the client should a tls server be unavailable. I guess this is just me misunderstanding the failover for tls, I assumed same as something like a redundant {} section. If the server isn't listening on 2083, i.e. service stopped: .. (1) Starting proxy to home server 192.168.110.46 port 2083 (1) server default { (1) } Failed opening new proxy socket 'proxy (0.0.0.0, 0) -> home_server (192.168.110.46, 2083)' : Failed connecting socket: Connection refused (1) Failed to insert request into the proxy list (1) There was no response configured: rejecting request .. If the client repeats the request, it tries the next server ok, but I'd be a little concerned some might not after a direct reject reply. Could someone please confirm this is by design? Also, I'm noticing a crash if the home server pool is depleted to zero, i.e. all servers are down. It's unlikely to happen, but you may be interested in coding these out. .. (2) } # authorize = updated (2) ERROR: Failed to find live home server: Cancelling proxy (2) WARNING: No home server selected (2) Clearing existing &reply: attributes (2) Found Post-Proxy-Type Fail-Authentication Thread 3 "freeradius" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffe552e700 (LWP 169613)] 0x0000555555587c8b in ?? () (gdb) bt #0 0x0000555555587c8b in ?? () #1 0x000055555558e61a in ?? () #2 0x0000555555586a75 in ?? () #3 0x00007ffff6bde6db in start_thread (arg=0x7fffe552e700) at pthread_create.c:463 #4 0x00007ffff644b88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

3 9

TLS questions
by Alex Sharaz 19 Nov '19

19 Nov '19

Hi, 1). I'm looking to reject external incoming TLS auth . requests with client certs containing a specific pattern in their CN. Other than configuring check-eap-tls and linking it into /etc/freeradius/sites-enabled, is there anything else I need to do ? 2). I've just downloaded 3.0.20 and when firing up on my test server I get a message recommending that I set min_tls to 1.2 ..... fine but where do I configure it? Rgds A

2 2

Getting LDAP reply parameters
by Chinnapaiyan, Nagamani 19 Nov '19

19 Nov '19

Hi, I am using Freeradius 4.x version(for DHCP). I am trying to use LDAP module. It seems LDAP authentication is successful and query is also successful. But, I could not get the reply attributes from LDAP in to Free Radius attributes. LDAP Module config: Ldap { ... update { &reply:Reply-Message += 'DN' &reply:Reply-Message += 'dn' &reply:DHCP-Vendor += 'utConfig' &control: += 'radiusControlAttribute' &request: += 'radiusRequestAttribute' &reply: += 'radiusReplyAttribute' } ... } Freeradius dhcp site config: recv DHCP-Discover { ... ldap "%{reply:Reply-Message}" "%{reply:DHCP-Vendor}" ... } Radiusd -X output: ... Instantiating module "ldap" rlm_ldap (ldap) - Couldn't find configuration for accounting, will return NOOP for calls from this section post-auth { reference = "." } rlm_ldap (ldap) - Initialising connection pool pool { start = 4 min = 4 max = 4 max_pending = 0 spare = 1 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3 held_trigger_min = 0 held_trigger_max = 0.5 retry_delay = 30 spread = no } rlm_ldap (ldap) - Ignoring "spare = 1", forcing to "spare = 0" rlm_ldap (ldap) - Opening additional connection (0), 1 of 4 pending slots used rlm_ldap (ldap) - Waiting for bind result... rlm_ldap (ldap) - Bind successful rlm_ldap (ldap) - Performing search in "" with filter "(objectclass=*)", scope "base" rlm_ldap (ldap) - Waiting for search result... rlm_ldap (ldap) - Directory type: OpenLDAP rlm_ldap (ldap) - Opening additional connection (1), 1 of 3 pending slots used rlm_ldap (ldap) - Waiting for bind result... rlm_ldap (ldap) - Bind successful rlm_ldap (ldap) - Performing search in "" with filter "(objectclass=*)", scope "base" rlm_ldap (ldap) - Waiting for search result... rlm_ldap (ldap) - Directory type: OpenLDAP rlm_ldap (ldap) - Opening additional connection (2), 1 of 2 pending slots used rlm_ldap (ldap) - Waiting for bind result... rlm_ldap (ldap) - Bind successful rlm_ldap (ldap) - Performing search in "" with filter "(objectclass=*)", scope "base" rlm_ldap (ldap) - Waiting for search result... rlm_ldap (ldap) - Directory type: OpenLDAP rlm_ldap (ldap) - Opening additional connection (3), 1 of 1 pending slots used rlm_ldap (ldap) - Waiting for bind result... rlm_ldap (ldap) - Bind successful rlm_ldap (ldap) - Performing search in "" with filter "(objectclass=*)", scope "base" rlm_ldap (ldap) - Waiting for search result... rlm_ldap (ldap) - Directory type: OpenLDAP ... (0) Received DHCP-Discover XID 8119ade4 from 127.0.0.1:6768 to 127.0.0.1:6767 via lo ... (0) ldap - EXPAND . (0) ldap - --> . (0) ldap - EXPAND Authenticated at %S (0) ldap - --> Authenticated at 2019-11-18 15:28:14 (0) ldap - Reserved connection (0) (0) ldap - Performing search in "dc=viasat,dc=com" with filter "(cn=1,6,00:a0:bc:6c:7d:00)", scope "sub" (0) ldap - Waiting for search result... (0) ldap - User object found at DN "cn=1\,6\,00:A0:BC:6C:7D:00,dc=viasat,dc=com" (0) ldap - Modifying object with DN "cn=1\,6\,00:A0:BC:6C:7D:00,dc=viasat,dc=com" (0) ldap - Waiting for modify result... (0) ldap - Released connection (0) (0) ldap (ok) (0) EXPAND %{reply:Reply-Message} (0) --> (null) (0) EXPAND %{reply:DHCP-Vendor} (0) --> (null) ... I could not get the "dn" attribute into "reply:Reply-Message". Regards, Nagamani Chinnapaiyan

2 2

Radius server for 2 different domains
by Renato Sousa 18 Nov '19

18 Nov '19

Hello all, We have a freeradius server in our infrastructure that is used as a proxy to forward to another central server. There has been a new demand for authentication of a visitor network. Is it possible to use the same server to authenticate the new network by storing the password in the mysql database or should I create a new dedicated server for this? Regards, Renato

2 3

Integrating to FreeRadius via third party system.
by Hendré Louw 18 Nov '19

18 Nov '19

Hello What is the preffered method to integrate with the FreeRadius server? Can I communicate via the command line, via REST or via a database. Hendré

3 4

Issue 2828 and building against atomics.
by Matthew Schumacher 15 Nov '19

15 Nov '19

Backstory: https://github.com/FreeRADIUS/freeradius-server/issues/2828 This patch: https://github.com/FreeRADIUS/freeradius-server/commit/5a7df325116a3c2e995e… Fixes a build issue on Debian where it needs to link against atomics to compile. On slackware, that patch also causes the build system to link against libatomics, but as that library is in the gcc-5.5.0 tarball, slackware includes it in the gcc package thus making the freeradius binary require the entire gcc build suite package on this platform. If I revert the patch, it doesn't link against libatomic and thus I no longer have this dependency. Alan suggested installing libatomic as the solution, and while I can make a package for that, I don't understand what I would be loosing by omitting -latomic from the linker and building without it. Can someone explain why I shouldn't just revert the patch in my build script and eliminate this dependency? Thanks, schu

2 2