- Freeradius-Users - lists.freeradius.org

Freeradius EAP-TLS and LDAP
by Lennart Johansson 05 Sep '24

05 Sep '24

Hello, my fist question here, so bare with me The solution is perhaps simple, but I cant seem to figure it out I want to setup vpn authentication for users using Freeradius as Radius backend in vpn server User certificates are created using a Edirectory server that also is CA and ldap server What do I have to do to configure Freeradius role in this, if I search for solutions online, most is related to AD and MS NPS. My understanding is that EAP-TLS requires that the vpn server pass the certificate request to Freeradius and Freeradius is verifying the certificate and reply with a accept or deny. But what is needed for Freeradius to verify the certificate, is it only that the CA certificate to verify that the certificate is issued by that CA or is it possible for Freeradius to pick the subject or SAN like email address and to a lookup in LDAP to get specific group or attribute back and based on that respond with accept or deny? Or how to you do it? /Lennart Med vänlig hälsning/Kind regards Lennart Johansson Telefon: +4610 5516810 Mobil: +4670 2334116 B-IQ Business in Quaternion AB Kivra: 556949-6648 106 31 Stockholm Sverige/Sweden

2 1

Freeradius realms and/or user issue
by Nick Ryce 05 Sep '24

05 Sep '24

I'm currently running freeradius (on v2.1.22, don't shoot me) with sql backend. I need to accept *(a)randombroadband.co.uk<mailto:*@randombroadband.co.uk> and send an Access Accept. I have defined the realm in proxy.conf as below: realm randombroadband.co.uk { authhost = LOCAL nostrip } in my users file I have the following: DEFAULT User-Name =~ "@randombroadband.co.uk" Auth-Type := Accept In the logs we have the following rad_recv: Access-Request packet from host a.b.c.d port 61384, id=49, length=183 User-Name = moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> User-Password = "moo" Service-Type = Framed-User Framed-Protocol = PPP Chargeable-User-Identity = "" Acct-Session-Id = "9277500" ERX-Dhcp-Mac-Addr = "abcd.0000.0001" NAS-Identifier = "LNS1" NAS-Port = 4095 NAS-Port-Id = "-0/0/0.0" NAS-Port-Type = Ethernet ERX-Pppoe-Description = "pppoe ab:cd:00:00:00:01" NAS-IP-Address = a.b.c.d # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "randombroadband.co.uk" for User-Name = moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> [suffix] Found realm "randombroadband.co.uk" [suffix] Adding Realm = "randombroadband.co.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] expand: %{User-Name} -> moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> [files] users: Matched entry DEFAULT at line 165 [files] expand: %{User-Name} -> moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> ++[files] returns ok [sql] expand: %{User-Name} -> moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> [sql] sql_set_user escaped user --> 'moo(a)randombroadband.co.uk' rlm_sql (sql): Reserving sql socket id: 48 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'moo(a)randombroadband.co.uk' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'moo(a)randombroadband.co.uk' ORDER BY priority rlm_sql (sql): Released sql socket id: 48 [sql] User moo(a)randombroadband.co.uk<mailto:moo@randombroadband.co.uk> not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. So it finds the realm and the user in the user file then seems to ignore the accept and decides to lookup the SQL table. Is there any way to get it to stop that once it gets to the accept from the users file? Thanks

2 1

Can I change permissions under /var/log/radius ?
by White, Daniel E. (GSFC-764.0)[AEGIS] 05 Sep '24

05 Sep '24

I need to allow our network engineers to see the logs without giving them sudo access to the entire server. I can tinker a bit in /etc/logrotate.d/radius, but that will not guarantee the directory permissions under /var/log/radius/radacct ? A side question: There was a comment in /etc/logrotate.d/radius about setting "detailfile" in radius.conf, but then /etc/raddb/README.rst says it was deprecated. Is there any way to change the name of the files and directories under /var/log/radius/radacct ?

2 1

Reopening old defect
by BuzzSaw Code 05 Sep '24

05 Sep '24

Apologies in advance if this is irregular but was hoping we could get an old defect on github reopened: https://github.com/FreeRADIUS/freeradius-server/issues/4327 I've added more information and finally had the cycles to verify the issue. I know this is issue necromancy since years have passed, but I'd like to help get this fixed.

2 1

Users rejected when no connection with remote domain controllers
by Rodrigo Abrantes Antunes 03 Sep '24

03 Sep '24

Hi all, My institution has multiple AD domain controllers, one for each campus, all of them respond for the same domain and connect to each other through internet using a vpn. One of the servers is located in my campus and freeradius authenticates directly against this server. When the vpn is up, everything works as it should but when the vpn is down, users sometimes can't authenticate. This seems to be random, users authenticate normally then suddenly can't and suddenly can again. When they are rejected I see this in debug: ... (2535) mschap: --> --username=gloriasantos (2535) mschap: Creating challenge hash with username: gloriasantos (2535) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (2535) mschap: --> --challenge=2aa82edbd744104d (2535) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (2535) mschap: --> --nt-response=7c9a6934a7363630b270dddeb82ad6f347a54a1ff9fc768c Child PID 64739 is taking too much time: forcing failure and killing child. (2535) mschap: ERROR: Failed to read from child output (2535) mschap: External script failed (2535) mschap: ERROR: External script says: (2535) mschap: ERROR: MS-CHAP2-Response is incorrect (2535) eap_mschapv2: [mschap] = reject ... And at this moment, if I try the command "ntlm_auth --username=user --password=pass" it takes more time than it should and then succeds. The pid 64739 is ntlm_auth I think. Everything in freeradius, samba, and dns configuration points to the local active directory domain controller, but it seems that when vpn is down something is still trying to contact the remote domain controllers (which are unavailable). Any ideas of what might be happening? Feel free to ask for needed configuration. Freeradius 3.2.1 Samba 4.17.9-Debian

1 0

Version 3.2.6 has been released
by Matthew Newton 24 Aug '24

24 Aug '24

We have released FreeRADIUS version 3.2.6. A few issues were found after the last release, which have been fixed, as well as some other small updates. Note especially that the "require_message_authenticator" behaviour has been fixed when set to "auto" and used with wildcard clients (i.e. a network rather than a single address). When using wildcard clients, the "auto" option will now never require Message-Authenticator. You should either use one client entry per client or, preferably, upgrade all the clients. There is a similar fix for dynamic clients which will now inherit "require_message_authenticator" and "limit_proxy_state" from the dynamic clients definition. See doc/ChangeLog for full details. Download from the usual places: https://freeradius.org/releases/ https://freeradius.org/ftp/pub/freeradius/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_6 As usual, InkBridge Networks (Network RADIUS) is providing pre-built packages for common Linux distributions: https://packages.networkradius.com/ and Docker images on Dockerhub: https://hub.docker.com/r/freeradius/freeradius-server -- Matthew

1 0

Splitting lines in config files (OPEN)
by Per Weisteen 22 Aug '24

22 Aug '24

Hi I'm running Freeradius version 3.2.3 doing a check on valid CAs in check-eap-tls. As of now I've just made a rather long and unwieldy if test with several or conditions like this : if ("%{TLS-Client-Cert-Issuer}" =~ /\/C=NO\/ST=Norway\/L=Oslo\/O=Telenor\ Norge\ AS\/OU=Internal\ Certificate\ Authority\/CN=Acme.*/) || ("%{TLS-Client-Cert-Issuer}" =~ /\/C=NO\/O=Telenor\ Norge\ AS\/CN=Telenor\ Norge\ Internal\ Issuing\ CA\ ECDSA\ TEST.*/) || ("%{TLS-Client-Cert-Issuer}" =~ /\/C=NO\/O=Telenor\ Norge\ AS\/OU=TEST\ ECDSA\/CN=TN\ Int\ 256\ Facilities\ CCTV\ ICA.*/) || ("%{TLS-Client-Cert-Issuer}" =~ /\/C=NO\/O=Telenor\ Norge\ AS\/CN=Telenor\ Norge\ Internal\ Issuing\ CA.*/) { update config { &Auth-Type := Accept } } else { update config { &Auth-Type := Reject } update reply { &outer.Reply-Message := "Your certificate is not valid." } } I've tried to split the long if line into separate lines for each condition just to make it more readable but that doesn't seem to work. Is splitting this if statement over several lines supposed to work? Would it be possible to have the list of valid CAs stored in a text file and do some coding to parse that file? Any other suggestions? (SQL and LDAP is currently not an option unfortunately) ./PerW Sensitivity: Internal

4 3

FreeRad crashing (RHEL 9.4, jut patched
by James Potter 19 Aug '24

19 Aug '24

Hi team, Is anyone else experiencing FreeRad core dumping on RHEL 9.4 with the latest patch? Tum history info 59 gives: Packages Altered: Upgrade freeradius-3.0.21-40.el9_4.x86_64 @rhel-9-for-x86_64-appstream-rpms Upgraded freeradius-3.0.21-39.el9_3.x86_64 @@System Upgrade freeradius-ldap-3.0.21-40.el9_4.x86_64 @rhel-9-for-x86_64-appstream-rpms Upgraded freeradius-ldap-3.0.21-39.el9_3.x86_64 @@System This appears to be related to status_check = status-server set in proxies (commenting it out seems to cause less/no crashes). With these lines commented out it runs fine, with these present service dies after ~5+ mins of running (running radiusd -X waiting for it to die again, its taking its time...) Change from v39 -> v40 appears to be related to BlastRADIUS vulnerability. Is there any issue with the fix for Blast + status_server checks? Thanks, Jim Potter Jisc

4 3

Bug in the CUI policy?
by Stefan Paetow 19 Aug '24

19 Aug '24

Hi folks, Just to verify something. In https://github.com/FreeRADIUS/freeradius-server/blob/21307a061b1d9d859febe0… it appears that the policy now sets the reply:User-Name to the request:User-Name. However, you realise that when you send out a CUI, which is a hash of three parts, and you have two of them, you could potentially deduce the third? I defer to your expertise Alan, but shouldn't the User-Name be set to something not the real value, like maybe the outer-request:User-Name (in the case where the outer was anonymised)? I realise that's pointless where the inner User-Name and the outer User-Name match (like with oh-too-many eduroam people). Maybe '@realm'? Just a question. With kind regards Stefan Paetow Federated Roaming Technical Specialist eduroam(UK), Jisc email/teams: stefan.paetow(a)jisc.ac.uk gpg: 0x3FCE5142 For eduroam support, please contact the eduroam team via help(a)jisc.ac.uk and mark it for eduroam’s attention. On Wednesdays and Fridays, I am not available between 12:00 and 15:00 London time (UTC in winter, UTC+0100 in summer). jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB Tel: 020 3697 5800.

1 0

libssl version mismatch issue
by Andrew Meyer 16 Aug '24

16 Aug '24

Hello,I just installed FreeRADIUS from the networkradius/freeradius repo and tried to start the radiusd service and it failed - Jul 30 17:06:19 d1xradiusadm01 radiusd[54302]: libssl version mismatch. built: 30000070 linked: 30200020 I am running CentOS Stream 9. I've looked up some stuff and found that I can change the LD_LIBRARY_PATH but haven't tried that because i'm not sure if it will work for this. Any help? Thank you

3 3