- Freeradius-Users - lists.freeradius.org

Force reauth possible? (INTERNAL)
by Per Weisteen 26 Sep '24

26 Sep '24

Hi I may have asked this before but can't find any references or replies. Anyway, I'm running FreeRADIUS 3.2.6 and I'm using EAP-TLS only. When a device has authenticated it seems to be in that state forever until it reboots or loses its network connection. Is there any parameter I could set that would force my devices to re-authenticate after a certain amount of time? ./PerW Sensitivity: Internal

2 1

802.1x and MAC Authentication
by Connor Herring 24 Sep '24

24 Sep '24

Hi All, I am attempting to setup my server so that it now checks a MAC address and then provided the MAC address is ok it then moves on to performing EAP authentication. This seems to be working fine but I noticed something in the logs that I wanted to query. I am using this guide <https://wiki.freeradius.org/guide/Mac-auth#mac-auth-and-802-1x>. Whenever the RADIUS server sends an Access-Challenge, it still sends the usual EAP-Message, Message-Authenticator, and State attributes, however it now also sends a Reply-Message on the line above these in the format of the one in the aforementioned guide: Reply-Message = "Device with MAC Address %{Calling-Station-Id} authorized for network access" Doesn't seem like something to worry about just wondered if there was any way around this? Further to this the guide says: if (!ok) { # Reject if the MAC address was not permitted. reject } # If this is NOT 802.1x, mac-auth if (!EAP-Message) { # MAC address has already been checked, so accept update control { Auth-Type := Accept Unless I am misunderstanding this is saying, "check the MAC address, if this isn't correct then continue. If it is correct but someone isn't using EAP then just allow them through". Surely unless someone were to comment out all authentication modules besides EAP in the default server, this would just allow someone to get onto the network with a correct MAC even if they don't have auth credentials? Kind regards, Connor

2 3

Re: Windows Slow EAP-TLS Authentication
by George Benjin 20 Sep '24

20 Sep '24

You need to be very careful running a RADIUS server in Azure if you're using RADIUS/UDP. Azure has a network security feature on by default that drops fragmented UDP packets that arrive out of order. This negatively impacts RADIUS/UDP traffic. To give you an example, at least 20% of EAP-TLS auth attempts were failing for us in the cert auth phase due to this issue. Azure support can turn on the 'enable-udp-fragment-reordering' feature by request after providing packet captures and use case info etc. They will also only turn it on in a brand new subscription that's dedicated to running VMs that require this feature. After we did this, our auth success rate increased to 100%. Another thing to be wary of is setting 'tls_max_version' to 1.3. Windows 11 supports TLS 1.3 by default for EAP-TLS etc but does not yet support session resumption when using this protocol (see https://learn.microsoft.com/en-us/windows-server/networking/technologies/ex…) It's worth dropping the Max version to 1.2.

4 9

SQL Injection
by Connor Herring 19 Sep '24

19 Sep '24

Hi All, Hopefully a quick one, is the SQL module still susceptible to SQL injection in version 3.2.1 of FreeRADIUS? I was having a look through implementing some anti SQL injection measures since I found a security notification on the FreeRADIUS site for it, but given that it is quite an old notification, is this still required? If it is, are there any recommended measures? Kind regards, Connor

2 4

EAP-TLS not working with ECC Keys
by n5d9xq3ti233xiyif2vp＠pm.me 19 Sep '24

19 Sep '24

Hi What am I missing to get EAP working both radius server and clients having ECC (P521) keys ? Running freeradius in the foreground shows me this: (8) eap_tls: (TLS) EAP Peer says that the final record size will be 378 bytes (8) eap_tls: (TLS) EAP Got all data (378 bytes) (8) eap_tls: (TLS) recv TLS 1.3 Handshake, ClientHello (8) eap_tls: (TLS) Handshake state - Server SSLv3 read client hello A (8) eap_tls: (TLS) send TLS 1.3 Handshake, ServerHello (8) eap_tls: (TLS) Handshake state - Server SSLv3 write server hello A (8) eap_tls: (TLS) send TLS 1.3 Handshake, type=8 (8) eap_tls: (TLS) send TLS 1.3 Handshake, CertificateRequest (8) eap_tls: (TLS) Handshake state - Server SSLv3 write certificate request A (8) eap_tls: (TLS) send TLS 1.3 Alert, fatal handshake_failure (8) eap_tls: ERROR: (TLS) Server : Error in SSLv3 write certificate A (8) eap_tls: ERROR: (TLS) Failed reading from OpenSSL (8) eap_tls: ERROR: (TLS) error:1402D0FB:SSL routines:ACCEPT_SW_CERT:unknown pkey type (8) eap_tls: ERROR: (TLS) error:14FFF0A8:SSL routines:(UNKNOWN)SSL_internal:missing rsa certificate (8) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (8) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation "missing rsa certificate" is the bit that jumps out at me. My /etc/raddb/mods-available/eap file looks like the following: eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} tls-config tls-common { private_key_password = THIS_HAS_BEEN_REMOVED_TO_PROTECT_THE_INNOCENT private_key_file = /etc/foobar/wifi/cert-out.key certificate_file = /etc/foobar/wifi/cert-out.crt ca_file = /etc/foobar/wifi/ca-chain.pem dh_file = /etc/foobar/wifi/dh.pem ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no tls_min_version = "1.2" tls_max_version = "1.3" ecdh_curve = "secp521r1" cache { enable = no store { Tunnel-Private-Group-Id } } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } tls { tls = tls-common } }

2 2

FreeRadius dynamic DB secret with vault
by James Fan 19 Sep '24

19 Sep '24

Hi All, I am using FreeRADIUS 3.2.6 and want to do the dynamic DB secret with Vault. I failed to use the console socket to send a SIGHUP signal to reload the SQL module when the DB secret changes. It seems that not all of the modules support reloading. So, I wonder if there are any ways to reload the SQL module or support the dynamic Vault secret. Thanks.

2 1

root ca creation issue
by Joost Ringoot 19 Sep '24

19 Sep '24

Hi all, I am trying to make a root ca per recommendation [ https://www.freeradius.org/documentation/freeradius-server/4.0.0/raddb/cert… | https://www.freeradius.org/documentation/freeradius-server/4.0.0/raddb/cert… ] but when I run $ make distclean as suggested to remove the test certificates I get this root@host:/etc/freeradius/certs# make distclean make: *** No rule to make target 'distclean'. Stop. Trying to bootstrap again, just to test root@host:/etc/freeradius/certs# ./bootstrap server.pem: OK I can do those 2 commands again without difference BTW: I used these instructions to install the binary [ https://www.networkradius.com/packages/#fr32-debian-bookworm | https://www.networkradius.com/packages/#fr32-debian-bookworm ] So it is not the 4.0.0 but I can't find this in the 3.2 manual thanks for any suggestions, Joost

2 2

Re: Windows Slow EAP-TLS Authentication
by George Benjin 19 Sep '24

19 Sep '24

> I had discussions with Microsoft a year or so about this. They were very happy to tell me that they had decided to not implement session resumption for TLS 1.3. They were not happy when I explained it was 100% necessary for many environments. > A year later, "yeah, we'll fix it eventually". > That's not useful. > Alan DeKok. Yeah, not useful at all. I'm going to raise a ticket with MS about setting the identity when using EAP-TLS on Windows instead of defaulting to 'host/<cert CN>' (with machine auth). We have to do EAP-TTLS with EAP-TLS inner just because of this limitation. I'll ask them about their session resumption plans with TLS1.3 at the same time. Cheers

1 0

TLS errors and clients sometimes rejected
by Rodrigo Abrantes Antunes 18 Sep '24

18 Sep '24

Hi, sometimes clients are rejected with the errors below, and sometimes the same clients are accepted. I thought that this could be because of old clients and then defined this but the errors continued: cipher_list = "DEFAULT@SECLEVEL=0" tls_min_version = "1.0" tls_max_version = "1.2" Any ideas what might be going wrong? Freeradius 3.2.1 (911) eap_peap: (TLS) send TLS 1.2 Alert, fatal protocol_version (911) eap_peap: ERROR: (TLS) Alert write:fatal:protocol version (911) eap_peap: ERROR: (TLS) Error in fragmentation logic - code 1 (911) eap_peap: ERROR: (TLS) Failed reading application data from OpenSSL: error:0A00010B:SSL routines::wrong version number (911) eap_peap: ERROR: (TLS) System call (I/O) error (-1) (911) eap_peap: ERROR: [eaptls process] = fail (911) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (6470) eap_peap: (TLS) send TLS 1.0 Alert, fatal protocol_version (6470) eap_peap: ERROR: (TLS) Alert write:fatal:protocol version (6470) eap_peap: (TLS) Server : Need to read more data: error (6470) eap_peap: ERROR: (TLS) Failed reading from OpenSSL: error:0A00010B:SSL routines::wrong version number (6470) eap_peap: ERROR: (TLS) System call (I/O) error (-1) (6470) eap_peap: ERROR: (TLS) EAP Receive handshake failed during operation (6470) eap_peap: ERROR: [eaptls process] = fail (6470) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (7412) eap_peap: (TLS) recv TLS 1.2 Alert, fatal internal_error (7412) eap_peap: (TLS) The client is informing us that there is a failure inside the TLS protocol exchange. (7412) eap_peap: ERROR: (TLS) Alert read:fatal:internal error (7412) eap_peap: (TLS) Server : Need to read more data: error (7412) eap_peap: ERROR: (TLS) Failed reading from OpenSSL: error:0A000438:SSL routines::tlsv1 alert internal error (7412) eap_peap: (TLS) In Handshake Phase (7412) eap_peap: (TLS) Application data. (7412) eap_peap: ERROR: (TLS) Cannot continue, as the peer is misbehaving. (7412) eap_peap: ERROR: [eaptls process] = fail (7412) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed

2 10

Re: Windows Slow EAP-TLS Authentication
by George Benjin 18 Sep '24

18 Sep '24

No worries. You could look at using RadSec instead if your APs support it. I'm not sure about Meraki. I'm looking forward to going full RadSec and moving our FreeRADIUS VMs/containers back into our standard subscriptions as soon as one of our partners supports it. We're good on the device front. Cheers

2 1