- Freeradius-Users - lists.freeradius.org

Re: freeradius authentication problem
by Matthew Newton 13 Jul '18

13 Jul '18

Please keep replies on-list. On 12 July 2018 09:50:10 BST, Mallikarjuna Peddappanavara Karibasappa <mallikarjuna.peddappanavara(a)igrid-td.com> wrote: >in the both the case shared secret is same. You're either editing the wrong config files, or using the wrong config setting in the file. The only way you are getting what you are seeing is because the secret is different. >radius_server "radius_server1" { ... >share_secret "testing123" That doesn't look right. shared? -- Matthew

4 8

EAP-TLS with multiple certificates
by Алексей Морозенко 13 Jul '18

13 Jul '18

Hello everyone. I'm using freeradius-3.0.15 on ubuntu 16.04. I manage one SSID with WPA2-Enterprise based on certificates. My idea is to issue user certificates signed by different CAs, then user to vlan based on an user certificate issuer. I use default server with eap module that requests check-eap-tls site to check TLS-Client-Cert-Issuer attribute. Also I changed /etc/freeradius/mods-config/files/authorize to reflect vlan id depending on issuer. Tell me please is it right thinking and is it possible at all? Earlier I tried to create two eap modules but no success yet. -- Best regards, Alex Morozenko

2 1

Install Additional Certificates
by Byron Jeffery 13 Jul '18

13 Jul '18

Hi Currently we have a Freeradius server setup for 802.1X auth (against Active Directory) for our wifi as well as an Internet content filter that does SSL inspections and so requires an install of the SSL certificate. As we are predominately BYOD, certificate deployment can become tricky at best, not so much on the radius wifi side but on the content filter side as sometimes the user misses the step to install the content filter certificate. Apart from MDM solutions or captive portal solutions, could I perhaps somehow get FreeRadius server to check for the additional certificate and if it is not there, prompt to install the certificate. My thinking is to get all the certificates installed during the initial signup to the wifi. I am open to suggestions if there are alternatives. - Kind Regards - Byron Jeffery

2 1

Radius packet proxy to relam by seen the attribute if only that attribute matches
by Nimesha Balasuriya 13 Jul '18

13 Jul '18

Hi all, I want to proxy only the radius packets which has attribute and value as Ruckus-SSID = " Broadband" to relam -> test1. I put below command in acct_user file. DEFAULT Ruckus-SSID =~ "Broadband", Proxy-To-Realm := test1 But its not working. Kindly assist. If there is another way please mention. Thank You ! Best Regards, Nimesha

2 1

checking whether an AD accou t is enabled or disabled in FR 3.0.17
by Alex Sharaz 13 Jul '18

13 Jul '18

I've been trialing eap-tls for users for quite a while. Unfortunately our security people insisted that in addition to eap-tls I had to check that the associated users AD account was also enabled. In clearpass ( on site authentication service) this is a simple thing to do. So on campus a user can use eap-tls on their client providing their AD account is enabled. If account enabled Access-Accept, if not Access-Reject. However, our external facing RADIUS servers are FR 3.0.17 boxes acting as our ORPS systems. Inbound from the outside world EAP-TLS requests get handled by freeradius which then performs an OCSP validation request. This all works except for the fact I'm not checking for an enabled AD account. FR is configured to use winbindd. The TLS cert CN is of the form <userid>-<4digit hex number>@york.ac.uk Is there any way of me checking for an enabled AD account? e.g. ntlm_auth using userid component of the CN and checking a status response ? or another way ? Rgs Alex

3 2

Backslash in AD Password
by Bernhard Knoll 13 Jul '18

13 Jul '18

Hello, is it possible to see what password a module is forwarding to an application? I have the problem that I run freeradius with an external OTP Software (LinOTP) via a rlm_perl module. When I try to authenticate from a Cisco ASA with Anyconnect the authentication fails if there is a backslash in the username. If I try to authenticate directly agauinst the OTP Software it works with the backslash. In the radius -X log is see the password with escaped backslash: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok Found Auth-Type = perl # Executing group from file /etc/freeradius/sites-enabled/linotp +group authenticate { rlm_perl: Config File /etc/linotp2/rlm_perl.ini found! rlm_perl: Default URL https://linotpserver/validate/simplecheck rlm_perl: RAD_REQUEST: Called-Station-Id = y.y.y.y rlm_perl: RAD_REQUEST: Vendor-3076-Attr-146 = 0x4d55435f48515f53706c6974496e7465726e65745f324641 rlm_perl: RAD_REQUEST: Cisco-AVPair = ARRAY(0x1607ff0) rlm_perl: RAD_REQUEST: NAS-IP-Address = z.z.z.z rlm_perl: RAD_REQUEST: Vendor-3076-Attr-150 = 0x00000002 rlm_perl: RAD_REQUEST: Tunnel-Client-Endpoint = x.x.x.x rlm_perl: RAD_REQUEST: Calling-Station-Id = x.x.x.x rlm_perl: RAD_REQUEST: User-Name = test-vpn rlm_perl: RAD_REQUEST: NAS-Port-Type = Virtual rlm_perl: RAD_REQUEST: User-Password = 123456a\\932684 rlm_perl: RAD_REQUEST: NAS-Port = 19587072 rlm_perl: Auth-Type: perl rlm_perl: Url: https://172.28.8.190/validate/simplecheck rlm_perl: User: test-vpn rlm_perl: urlparam pass = 123456a\\932684 rlm_perl: urlparam realm = check24 rlm_perl: urlparam client = a.a.a.a.a rlm_perl: urlparam user = test-vpn rlm_perl: Content :-( rlm_perl: return RLM_MODULE_REJECT rlm_perl: Added pair Called-Station-Id = y.y.y.y. rlm_perl: Added pair Vendor-3076-Attr-146 = 0x4d55435f48515f53706c6974496e7465726e65745f324641 rlm_perl: Added pair Cisco-AVPair = mdm-tlv=device-platform=android rlm_perl: Added pair Cisco-AVPair = mdm-tlv=device-type=Xiaomi Mi A1 rlm_perl: Added pair Cisco-AVPair = mdm-tlv=device-mac=f4-f5-db-ea-66-e9 rlm_perl: Added pair Cisco-AVPair = mdm-tlv=device-platform-version=8.0.0 rlm_perl: Added pair Cisco-AVPair = mdm-tlv=device-phone-id=GSM:865181033404965 rlm_perl: Added pair Cisco-AVPair = mdm-tlv=ac-user-agent=AnyConnect Android 4.6.00143 rlm_perl: Added pair Cisco-AVPair = mdm-tlv=device-uid=48FE3052979F54499178B9B0CB4F940BFB462365F18920AA5D715718BCAF15E9 rlm_perl: Added pair Cisco-AVPair = audit-session-id=c0a80101012ae0005b4769b5 rlm_perl: Added pair Cisco-AVPair = ip:source-ip=x.x.x.x rlm_perl: Added pair Cisco-AVPair = coa-push=true rlm_perl: Added pair NAS-IP-Address = z.z.z.z. rlm_perl: Added pair Vendor-3076-Attr-150 = 0x00000002 rlm_perl: Added pair Tunnel-Client-Endpoint = x.x.x.x rlm_perl: Added pair Calling-Station-Id = x.x.x.x rlm_perl: Added pair User-Name = test-vpn rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair User-Password = 123456a\\932684 rlm_perl: Added pair NAS-Port = 19587072 rlm_perl: Added pair Reply-Message = LinOTP server denied access! rlm_perl: Added pair Auth-Type = perl ++[perl] = reject +} # group authenticate = reject Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.7 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 142 to z.z.z.z. port 54015 Reply-Message = "LinOTP server denied access!" Waking up in 4.9 seconds. Cleaning up request 0 ID 142 with timestamp +46 Ready to process requests. rlm_perl: Added pair User-Name = test-vpn rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair User-Password = 123456a\\932684 rlm_perl: Added pair NAS-Port = 19587072 rlm_perl: Added pair Reply-Message = LinOTP server denied access! rlm_perl: Added pair Auth-Type = perl ++[perl] = reject +} # group authenticate = reject Failed to authenticate the user. Is there a way to see if freeradius sends the password with 2 backslashes? Bernhard Knoll

2 2

Configure rlm_rest module to allow token authentication
by Rohith Asrk 13 Jul '18

13 Jul '18

Hi all, I'm working on the django-freeradius project. First of all, Thanks for the help on session limits feature. Now we wish to put restrictions on the API and therefore are thinking to go with Token authentication for each organization/ app. Can anyone tell me how to configure FreeRADIUS to allow token authentication, i.e., dealing with the requests having a token parameter? Also, it would be great to know if multiple tokens can be authorized, for ex., each user/ a group of users having a single token. Thank you, Rohith ASRK

4 11

RE: REST module post-auth
by adrian.p.smith＠bt.com 12 Jul '18

12 Jul '18

http://lists.freeradius.org/pipermail/freeradius-users/2018-July/092166.html From: Smith,AP,Adrian,TEC5 R Sent: 12 July 2018 17:06 To: FreeRadius users mailing list Subject: REST module post-auth I'm trying to use the rest module in the post-auth section. It seems that if you simply use body = 'post', you get the Access-Request sent to the REST endpoint, which is nice. I've also worked out that I can cherry pick the reply and request like this: data = 'Calling-Station-Id=%{&request:Calling-Station-Id}&User-Name=%{&reply:User-Name}&Session-Timeout=%{&reply:Session-Timeout}&Idle-Timeout=%{&reply:Idle-Timeout}&Cisco-AVPair=%{&reply:Cisco-AVPair}&Cisco-SSG-Account-Info=%{&reply:Cisco-SSG-Account-Info[0]}&Cisco-SSG-Account-Info=%{&reply:Cisco-SSG-Account-Info[1]}' Is there any way to get ALL of the request and all of the reply without having to select individual AVPs ? And if so, could they be qualified so the REST service can tell which ones are from the Request and the Response? Thanks in advance. Adrian

2 2

REST module post-auth
by adrian.p.smith＠bt.com 12 Jul '18

12 Jul '18

I'm trying to use the rest module in the post-auth section. It seems that if you simply use body = 'post', you get the Access-Request sent to the REST endpoint, which is nice. I've also worked out that I can cherry pick the reply and request like this: data = 'Calling-Station-Id=%{&request:Calling-Station-Id}&User-Name=%{&reply:User-Name}&Session-Timeout=%{&reply:Session-Timeout}&Idle-Timeout=%{&reply:Idle-Timeout}&Cisco-AVPair=%{&reply:Cisco-AVPair}&Cisco-SSG-Account-Info=%{&reply:Cisco-SSG-Account-Info[0]}&Cisco-SSG-Account-Info=%{&reply:Cisco-SSG-Account-Info[1]}' Is there any way to get ALL of the request and all of the reply without having to select individual AVPs ? And if so, could they be qualified so the REST service can tell which ones are from the Request and the Response? Thanks in advance. Adrian

1 0

Yet another shared secret mismatch issue
by Alberto Martínez Setién 12 Jul '18

12 Jul '18

Hi all, I'm trying to configure hardware (MAC) auth using FreeRADIUS. It works nice with another provider, but on this new one seems to do shared secret signing wrong. Fri Jul 6 08:37:40 2018 : Info: Ready to process requests Fri Jul 6 08:37:50 2018 : Debug: (0) Received Access-Request Id 4 from 10.70.8.199:44611 to 172.16.250.2:8812 length 271 Fri Jul 6 08:37:50 2018 : Info: Dropping packet without response because of error: Received packet from 10.70.8.199 with invalid Message-Authenticator! (Shared secret is incorrect.) (wireshark decoding below) RADIUS Protocol Code: Access-Request (1) Packet identifier: 0x2 (2) Length: 271 Authenticator: 579f8d81dc3deb6a9f37ebae3d0b7cde Attribute Value Pairs AVP: l=14 t=User-Name(1): 9068C3435B5A AVP: l=18 t=User-Password(2): Encrypted AVP: l=6 t=Service-Type(6): Call-Check(10) AVP: l=6 t=NAS-IP-Address(4): 10.70.8.199 AVP: l=22 t=NAS-Identifier(32): WLAN-pruebas_udguest AVP: l=30 t=Called-Station-Id(30): DC0856003BF0:pruebas_udguest AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=6 t=NAS-Port(5): 1 AVP: l=11 t=NAS-Port-Id(87): wifi-2.4G AVP: l=14 t=Calling-Station-Id(31): 9068C3435B5A AVP: l=46 t=Acct-Session-Id(44): 10.70.8.199_05/07/2018 12:13:28_9068c3435b5a AVP: l=6 t=Framed-MTU(12): 1400 AVP: l=28 t=Vendor-Specific(26) v=Xylan Corp.(800) AVP: l=20 t=Vendor-Specific(26) v=Xylan Corp.(800) AVP: l=18 t=Message-Authenticator(80): 7611eb291b65f41849d0451d3f027382 I have no doubt that FR does the right thing, and I'm sure that this is not a "maybe you didn't input the same secret in both places" issue. This is either a hardcoded secret (not their first time) or a bad implementation. They deny any wrongdoing on their part. I intend to prove that they are doing RADIUS secret wrong and have locate the fr_radius_verify function. My questions are: Can I brute force the secret somehow? Can I make my point to them somehow else? Regards, Alberto

3 4