- Freeradius-Users - lists.freeradius.org

freeradius with Active Directory via winbind or MAC address access
by Vieri 29 Nov '17

29 Nov '17

Hi, I would like to allow access when user authentication is approved by AD through winbind, OR when the MAC address is in a local file. I'm trying to follow this guide: https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind but also this other guide: https://wiki.freeradius.org/guide/mac-auth#mac-auth-or-802-1x My software versions: freeradius-3.0.14 samba-4.5.10 Samba/winbind works fine: # ntlm_auth --username=user --domain=DOMAIN Password: NT_STATUS_OK: Success (0x0) freeradius build.log looks good: checking for wbclient.h in /usr/include/samba-4.0/... yes checking for wbcCtxAuthenticateUserEx in -lwbclient... yes # grep winbind_ /etc/raddb/mods-available/mschap | grep -v ^# winbind_username = "%{mschap:User-Name}" winbind_domain = "DOMAIN" # tail -n 6 /etc/raddb/clients.conf client 10.215.144.92 { ipv4addr = 10.215.144.92 secret = testrad shortname = testsys require_message_authenticator = no } >From 10.215.144.92: # radtest -t mschap user password 10.215.144.91 0 testrad Sent Access-Request Id 181 from 0.0.0.0:39653 to 10.215.144.91:1812 length 132 User-Name = "user" MS-CHAP-Password = "password" NAS-IP-Address = 10.215.144.92 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "user" MS-CHAP-Challenge = 0x5e0a69983fa65564 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000005b82652f1e38b465daebf5a3fb1a2697b12af97676f7c721 Received Access-Reject Id 181 from 10.215.144.91:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject Radius log: (0) Received Access-Request Id 181 from 10.215.144.92:39653 to 10.215.144.91:1812 length 132 (0) User-Name = "user" (0) NAS-IP-Address = 10.215.144.92 (0) NAS-Port = 0 (0) Message-Authenticator = 0x1905f61891b983253895b1d8d33976d8 (0) MS-CHAP-Challenge = 0x5e0a69983fa65564 (0) MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000005b82652f1e38b465daebf5a3fb1a2697b12af97676f7c721 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) policy rewrite_calling_station_id { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy rewrite_calling_station_id = noop (0) if (!EAP-Message) { (0) if (!EAP-Message) -> TRUE (0) if (!EAP-Message) { (0) authorized_macs: EXPAND %{Calling-Station-ID} (0) authorized_macs: --> (0) [authorized_macs] = noop (0) if (!ok) { (0) if (!ok) -> TRUE (0) if (!ok) { (0) [reject] = reject (0) } # if (!ok) = reject (0) } # if (!EAP-Message) = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> user (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 181 from 10.215.144.91:1812 to 10.215.144.92:39653 length 20 # grep user /etc/raddb/radiusd.conf | grep -v '#' user = radius I cannot find any subdir named 'winbindd_privileged': # ls /var/lock/samba/ brlock.tdb mutex.tdb smbXsrv_session_global.tdb g_lock.tdb names.tdb smbXsrv_tcon_global.tdb gencache_notrans.tdb printer_list.tdb smbXsrv_version_global.tdb leases.tdb serverid.tdb smb_krb5 locking.tdb smbXsrv_client_global.tdb smbd_cleanupd.tdb msg.lock smbXsrv_open_global.tdb Why is my radtest above not getting an Access-Accept? Thanks, Vieri

3 6

virtual servers
by Andrew Meyer 29 Nov '17

29 Nov '17

I need some help with setting up multiple eap types. I am running CentOS 7.4. I have 2 profiles or virtual servers setup and want to use eap for one and eap-tls for the other. I am a little confused on how to set this up. For reference i've been trying to follow these sites:Freeradius Example Configuration - OTPme | | | Freeradius Example Configuration - OTPme Redmine | | | https://wiki.freeradius.org/config/Virtual-server Do I add the virtual_server=profile1 to the type of authentication in the eap config file? Thank you,

3 7

Is pkcs8 file format supported
by Sumant Gupta 28 Nov '17

28 Nov '17

Hi, I am using pkcs8 file format in private key file (eap config file) placeholder. private_key_file = ${certdir}/*DevFromRoot-Server-AABBCCDD.pkcs8* But after that when i restart freeradius i get the following error: *rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line* *rlm_eap_tls: Error reading private key file /etc/freeradius/certs/DevFromRoot-Server-AABBCCDD.pkcs8* *rlm_eap: Failed to initialize type tls* */etc/freeradius/eap.conf[17]: Instantiation failed for module "eap"* */etc/freeradius/sites-enabled/default[310]: Failed to load module "eap".* If i use the .pem file format it works! Regards Sumant

4 4

Any last requests for 3.0.16?
by Alan DeKok 28 Nov '17

28 Nov '17

I think we're pretty much good to go for 3.0.16. Any last requests / bugs to report? If not, I'll release 3.0.16 later this week. Alan DeKok.

4 10

Re: Accoiunting proxy Issue
by Richard J Palmer 27 Nov '17

27 Nov '17

Hi Matthew It is indeed... I've already spoken to Adrian on this - but it's not a quick fix from their side - but they are looking at it - hence the seeing what we can do for now If I can work round it while Adrian looks it's the best of both > --- Original message --- > Subject: Re: Accoiunting proxy Issue > From: Matthew Newton <matthew(a)newtoncomputing.co.uk> > To: <freeradius-users(a)lists.freeradius.org> > Date: Monday, 27/11/2017 2:20 PM > > On Mon, 2017-11-27 at 14:08 +0000, Richard J Palmer wrote: >> >> It all seems to make sense but if I have any questions I'll ask but >> that looks to be enough to me > > Assuming this is a FireBrick from RevK (of Andrews & Arnold), I would > definitely raise it with them, and would be fairly surprised if it > wasn't fixed. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: Accoiunting proxy Issue
by Richard J Palmer 27 Nov '17

27 Nov '17

Thanks Alan That sounds sensible - I'll have a look at this - it looks very sensible. It all seems to make sense but if I have any questions I'll ask but that looks to be enough to me Thanks again for your help Richard On Monday 27/11/2017 at 1:40 pm, Alan DeKok wrote: > On Nov 26, 2017, at 3:28 PM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> However the firebrick does not provide the username in interim updates >> or stop messages - which means that the proxy based on realm fails >> (the username / realm is not there). > > That's just stupid. I mean, how hard is to to follow a spec which > was written 20 years ago? > >> >> Is there a way using unlang to proxy these - I was looking at the >> lines in detail - we do also have the records in our SQL server and >> from the AcctSessionID I can look up the username which is possible >> >> I do have one other possibility. The Interim updates have a field: >> Chargeable-User-Identity = "XXXXX" >> Which I can set as part of the auth process (I already add some >> fields in post_proxy). Is there a way in FreeRadius to inspect this >> field in a accounting packet and if set to 'resellerx' set the packet >> to be sent to their proxy / home server ? > > You can do anything in "unlang". > > - in "post-auth", create a Chargeable-User-Identity > - store the Chargeable-User-Identity and User-Name into the radacct > table via an SQL statement > > - in "preacct", look up Chargeable-User-Identity in SQL, and get the > User-Name > > > The simple way is to just mangle the incoming packet (no one cares > about this by the time post-auth is called): > > post-auth { > ... > ... create Chargeable-User-Identity in the reply ... > ... > > update request { > Acct-Status-Type = Start # pretend we're starting a session > Chargeable-User-Identity := &reply:Chargeable-User-Identity > ... anything else you need... > } > sql.accounting # store the packet into radacct > ... > } > > and then in preacct: > > preacct { > ... > > if (!User-Name && Chargeable-User-Identity) { > update request { > User-Name := "%{sql:SELECT username from radacct where cui = > %{Chargeable-User-Identity} > } > > } > > ... and proxying, suffix, etc. > > } > > You'll need to add a ''cui' column to the radacct table. And, > update the accounting 'start' query to store Chargeable-User-Identity > in the 'cui' column. > > But that's about it. The details matter, but it's not *too* > complex. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Accoiunting proxy Issue
by Richard J Palmer 27 Nov '17

27 Nov '17

Hi there We use firebrick Routers as LNS routers and they have worked fine in the past. However I have a new requirement to proxy one realm (authentication and accounting) to a remote server for a customer. I have the auth side working find - and the account start packet. However the firebrick does not provide the username in interim updates or stop messages - which means that the proxy based on realm fails (the username / realm is not there). Is there a way using unlang to proxy these - I was looking at the lines in detail - we do also have the records in our SQL server and from the AcctSessionID I can look up the username which is possible I do have one other possibility. The Interim updates have a field: Chargeable-User-Identity = "XXXXX" Which I can set as part of the auth process (I already add some fields in post_proxy). Is there a way in FreeRadius to inspect this field in a accounting packet and if set to 'resellerx' set the packet to be sent to their proxy / home server ? The second I assume would be faster .... I have also emailed the router manufacturer to see if the username can be added easily in a software patch but that may take time ... An example current accounting packet is: Sun Nov 26 20:00:05 2017 Acct-Status-Type = Interim-Update Chargeable-User-Identity = "BBEU12345675" Event-Timestamp = "Nov 26 2017 20:00:00 GMT" Acct-Input-Octets = 7137840 Acct-Input-Gigawords = 0 Acct-Output-Octets = 487340050 Acct-Output-Gigawords = 0 Acct-Session-Time = 576 Acct-Input-Packets = 99535 Acct-Output-Packets = 342237 Tunnel-Client-Endpoint:0 = "ADSL" NAS-Identifier = "aglovale.merula.net" Acct-Session-Id = "S600000269717072AECC00" NAS-IP-Address = 1.2.3.4 NAS-Port = 697 Connect-Info = "39550000/1000000000" Acct-Unique-Session-Id = "c89cbc69ab30d4afaff763c46057b04e" Timestamp = 1511726405 I would be grateful for any suggestions Richard

2 1

ntlm...ldap
by Carlos Bordon 24 Nov '17

24 Nov '17

Hi , > > I worte from argentina, i want ask you something please, > > i configure the freeradius with ntlm, but now need take groups of AD for the vlans, > > i have to do this part with ldap? > in resume, authentication with ntlm and groups with ldap, is right? > > Regards ands congratulations for this aplication. > Carlos

2 1

Module eap - attributes ca_file and ca_path
by Jérôme BERTHIER 24 Nov '17

24 Nov '17

Hello, Just a question about the section "tls-config tls-common" of the module eap file. Do both attributes ca_file and ca_path permit to verify a client certificate in an EAP-TLS authentication ? And so, if we do NOT want to permit EAP-TLS authentication, we have to : - comment out the attributes ca_file AND ca_path - concatenate the server certificate and the CA certificate (as explained in comments) This setup should allow to establish TLS tunnel for other EAP method (TTLS, PEAP) but refuse an EAP-TLS request. Is it correct ? our am I wrong ? Regards, -- Jérôme BERTHIER

2 2

PEAP correct client certificate
by Oliver Tollning 23 Nov '17

23 Nov '17

Hello, I'm currently setting up a RADIUS server(v. 2.2.8) for the first time. I followed the instructions and could connect with EAP and PEAP to my server. Since I only want to use PEAP I disabled every other authentication method by commenting out everything else in /sites-enabled/default. This works fine, since I cant connect with normal EAP anymore. I went through the process of creating my own certificate with openssl and set everything up in eap.conf under eap-tls{}. In peap{} I added EAP-TLS-Require-Client-Cert = Yes. The problem is, that the client can connect to the server even though he doesnt have the correct client certificate. How can I tell the server to check the client certificate?

4 12