- Freeradius-Users - lists.freeradius.org

Windows 7, wired 802.1x, native EAP-TLS w/o AD, NPS
by Timo Buhrmester 18 Apr '17

18 Apr '17

Hello list, I'm trying to implement 802.1x/EAP-TLS on a wired network. Getting that to work on Linux clients was reasonably straightforward using wpa_supplicant (and freeradius as the back-end). However, we also have Windows (7) clients on the network, and I'm having issues setting that up. It is my understanding that a) EAP-TLS is mandatory for systems that claim to support 802.1x b) Windows claims to support 802.1x. Unfortunately, every resource I could find either assumes there's an Active Directory infrastructure (which, fortunately, we don't use here) and other shady things involved (NPS -- seems to be sort of an ersatz-radius), OR talks about wireless, OR refers to other versions of Windows, OR ... None seems to describe the combination Windows 7, native supplicant, freeradius, no AD/NPS. So my question, although not directly freeradius-related, is: Does anyone have experience setting up EAP-TLS on a wired network on Windows 7 clients? Is AD strictly required? If so, I wonder how Windows could get away claiming to support 802.1x. I.e.: Does anybody know whether this is possible *at all*? I'm already considering trying 3rd party supplicants, but I'd much rather go with the native one. Thanks, Timo

5 13

tip: note about -sql and -ldap
by Alan Buxey 17 Apr '17

17 Apr '17

hi, just to remind people, with version 3 of the FreeRADIUS server, a new feature arrived which was/is called "Conditional modules". TL;DR -sql and -ldap are calls to the SQL and LDAP modules respectively that work if those modules are configured and enabled The conditional modules feature is documented in very few locations , the main reference source in the configuration files being the mods-available/README.rst file (if using a distribution version then I really hope they keep that file present!) this can be found online here: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai… what this feature means is that as the default server ships, the config files have a lots of features ready for use but not active. all you need to do is configure either sql or ldap modules (or both!), link the mods-available to mods-enabled and then the server will read the module config, note that SQL and/or LDAP are configured and then automatically use them - previously if you wanted to use SQL or LDAP, not only did you have to configure the modules but you then also had to try guessing where to stick the 'sql' or 'ldap' calls into the configuration - a nice game of whack-a-mole that many people failed at, sticking the calls into all kinds of places ;-) note, as it says in the documentation , not very useful for production environments because normally by then you will know what modules/options you want and whether you need/want any of those modules...at which point, you comment out the non needed stuff and can convert (or would convert ) -sql into sql etc as you know its configured and you want it. personally, would like to see many other modules become conditional so the server works out of the box and you just configure the modules/features you want, then go through removing all the modules not needed (flagged in debug yellow with "Ignoring module....." ) rather than guessing if something is needed....a final pass would then convert all remaining -module with module. et voila! :) alan

1 0

RE: Acct-Status-Type = 7 [SOLVED]
by Oscar Jofre 17 Apr '17

17 Apr '17

Hi, [SOLVED] As you told Alan, I did uncomment on accounting if (noop) { ok } And then on production Accounting-on worked with user informed and user not informed. But I wandered why on TEST environment with that lines comment worked. Finally a saw the differences. If you have uncommented details on accounting section then Accounting-on works always, with user informed and not informed --> that’s why on TEST was working, and on production that details are commented the Accounting-on with no user defined was not responding. So: THIS WORKS: accounting { ... detail ... # if (noop) { # ok # } } THIS WORKS: accounting { ... # detail ... if (noop) { ok } } THIS DOESN'T WORKS: accounting { ... # detail ... # if (noop) { # ok # } } All have an explanation for me at the end ! Thanks for the help ! -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: lunes, 17 de abril de 2017 19:02 Para: FreeRadius users mailing list Asunto: Re: Acct-Status-Type = 7 On Apr 17, 2017, at 12:41 PM, Oscar Jofre <oscar(a)jofre.com> wrote: > I wish no need to try for hours, but even I'm a developer I don't have the deep knowledge about radius and even linux environment ... can't know about everything...\ The idea is simple: follow the instructions on this list. When I say to post the debug log, I mean for you to post all of it. All of the documentation makes this clear. When you post part of the debug log, you are making it difficult for us to help you. > I wish you to point me to the correct instructions, I've read many pages about radius debugging, I've tried, trust me, to figure out by myself ... but still with no understand where is the difference. Then post the debug log and let *us* help. It's not hard. > I really appreciate you help ! > > The packets should be exactly the same (no username in both requests and different result). I'm sure I missing something ... It doesn't need a User-Name attribute. The NAS is rebooting. There's no "user". > If you need any more detail please let me know and I will the all to give necessary informations. That was enough. The short answer is to go to the file raddb/sites-enabled/default. In the "accounting" section after the "sql" module, add: if (noop) { ok } There should already be code like that in the file, but commented out. > I don’t understand about: It's in the FAQ, "man" pages, web pages, and pretty much daily on this list When I say to post the debug log. It's mentioned EVERYWHERE in the documentation, and daily on this list. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Acct-Status-Type = 7
by Oscar Jofre 17 Apr '17

17 Apr '17

Hi Alan and thanks, About last answer i will check it but the accounting on should response anything ? Thanks. -------- Mensaje original -------- De: Alan DeKok <aland(a)deployingradius.com> Fecha: 14/4/17 1:41 (GMT+01:00) Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Asunto: Re: Acct-Status-Type = 7 On Apr 13, 2017, at 5:56 PM, Oscar Jofre <oscar(a)jofre.com> wrote: > When I reboot a mikrotik with hotspot + radius activated, after reboot the > router sends Acct-Status-Type = 7. Which is "Accounting On". It's best to use names instead of numbers. They're more informative. > What I understand is that with this Acct-Status-Type = 7 the mikrotik tells > radius that router has rebooted and then radius close all connections with > NAS-Reboot. Yes. > What happens in my case is that freeradius is not responding the > Acct-Status-Type = 7 and then mikrotik thinks that and accumulate timeoute > from raiuds. Well, run the server in debugging mode to see what it's doing. As suggested in the FAQ, web pages, "man" pages, and daily on this list. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 9

Matching in VSA
by Noah 14 Apr '17

14 Apr '17

Hi there freeradius list, I need to be able to match a client request with a specific key. I generally do this by matching IPs in the clients.conf file. Is there any way to match to a Vendor specific attribute? For instance if the request comes in from a specific vendor-id in the request I could match based on that and a specific radius secret key is used for the radius authentication session. Cheers, Noah

3 10

Acct-Status-Type = 7
by Oscar Jofre 13 Apr '17

13 Apr '17

Hi, When I reboot a mikrotik with hotspot + radius activated, after reboot the router sends Acct-Status-Type = 7. What I understand is that with this Acct-Status-Type = 7 the mikrotik tells radius that router has rebooted and then radius close all connections with NAS-Reboot. What happens in my case is that freeradius is not responding the Acct-Status-Type = 7 and then mikrotik thinks that and accumulate timeoute from raiuds. Mikroitk keeps trying Acct-Status-Type = 7 and accumulates tiemouts. When the first users connects, then mikrotik sends Access-Request and after Access-Accept starts accounting. But then after that mikrotik sends another and LAST Acct-Status-Type = 7 that makes this firs connection to close with NAS-Reboot. After that everything goes ok but I have a user connected with NAS-Reboot on Radius. I did send this behavior to mikrotik. My question is if it is correct that mikrotik is not reciving response from Acct-Status-Type = 7 or maybe I have some misconfiguration on freeradius. I'm using FreeRADIUS Version 3.0.10 Thanks !

2 1

question about default site file
by Bill Schoolfield 13 Apr '17

13 Apr '17

I'm writing a little tool that our clients will execute to configure their freeradius instance (given a stock - nothing changed yet setup). Basically it parses the various setup files and makes substitutions, changes, etc. The idea here is the client won't (shouldn't) edit the files manually. Anyway I noticed that the files ship with sql module directives with a prefixed dash. Ie. -sql What's the meaning of this? Couldn't find it documented anywhere. Another comment method? Something else? Bill

3 3

freeradius, mysql and encrypted columns
by petr.linke＠seznam.cz 13 Apr '17

13 Apr '17

Hi, I have very simple question: Is it possible to use encrypted columns in freeradius? I wish to hide 'sensitive' data (cleartext-password in radcheck table, secret in nas table ...) from simple raw reading block device, where the mysql tables are stored. One way is to use LUKS (but here is performance storage impact), second way is encrypting on database level. And where is the problem: If in freeradius is used nas table and nas query from default, all works perfectly. But if I use encrypted columns - for example modified nas query like: nas_query = "SELECT id, nasname, shortname, type, DES_DECRYPT(secret), server FROM ${nas_table}", freeradius stops resolving clients from nas table. In column secret in nas table is des_encrypted value given by des_encrypt('some_secret',1), mysql is started with one key slot in key-file as a key for encryption. example: cleartext column secret in the nas table, nas_query is set to: "SELECT id, nasname, shortname, type, secret, server FROM ${nas_table}" result executing the nas query: SELECT id, nasname, shortname, type, secret, server FROM nas; +----+-------------------+-------------+-------+--------+--------+ | id | nasname | shortname | type | secret | server | +----+-------------------+-------------+-------+--------+--------+ | 6 | 10.255.246.120/32 | client test | other | test | NULL | +----+-------------------+-------------+-------+--------+--------+ - all works works fine - result from radtest: radtest user password 10.255.246.120 1 test Sending Access-Request of id 113 to 10.255.246.120 port 1812 User-Name = "user" User-Password = "password" NAS-IP-Address = 10.255.246.120 NAS-Port = 1 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 10.255.246.120 port 1812, id=113, length=37 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "123" But when I put into column secret des_encrypted value, and modify the nas query to: "SELECT id, nasname, shortname, type, DES_DECRYPT(secret), server FROM ${nas_table}", freeradius stops resolving correctly the clients from nas table, and in freeradius log appears: Ignoring request to authentication address 10.255.246.120 port 1812 from unknown client 10.255.246.120 port 56837 but the result from modified nas query with encrypted column secret is the same as query result with cleartext secret: SELECT id, nasname, shortname, type, DES_DECRYPT(secret), server FROM nas; +----+-------------------+-------------+-------+---------------------+--------+ | id | nasname | shortname | type | DES_DECRYPT(secret) | server | +----+-------------------+-------------+-------+---------------------+--------+ | 6 | 10.255.246.120/32 | client test | other | test | NULL | +----+-------------------+-------------+-------+---------------------+--------+ The same situation is with encrypted column Value in radcheck or radgroupcheck table. It looks that when some columns are encrypted and in the query is used DES_DECRYPT() function, freeradius has problem to fill the value from encypted columns into internal variables. For example in debug from freeradius is (encrypted column Value in radcheck table): [pap] Using clear text password "" - it looks that freeradius do not take DES_DECRYPT(Value) from radcheck table. Thank you for answer, Petr Linke

2 3

Install Freeradius in Centos7 with Perl support
by Fabian Borot 13 Apr '17

13 Apr '17

Hi I installed freeradius-server-3.0.13 on centos7 from http://networkradius.com/doc/FreeRADIUS%20Technical%20Guide.pdf THE FREERADIUS TECHNICAL GUIDE HAPTER NTRODUCTION WHAT ... networkradius.com Copyright (C) 2014 Network RADIUS SARL 1 of 58 THE FREERADIUS TECHNICAL GUIDE CHAPTER 1 - INTRODUCTION WHAT IS FREERADIUS? Chapter 1 - Introduction I proceedd with the regular, configure, make, make install steps but I saw a lot of warnings about messing dependencies and as I was noticing them I added them to a yum install list, see below yum install net-snmp net-snmp-utils libtalloc-devel unixODBC-devel unixODBC openssl openssl-devel perl-ExtUtils-CBuilder perl-ExtUtils-MakeMaker wireshark mysql-devel libmemcached libmemcached-devel libpcap-devel perl-devel python-devel freeradius-perl freeradius-python freeradius-unixODBC -y but I still cant get the perl module as shown below when doing the config part === configuring in src/modules/rlm_perl (/usr/src/freeradius-server-3.0.13/src/modules/rlm_perl) checking whether perl executable path has been provided... no checking for perl... /bin/perl Can't locate ExtUtils/Embed.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .). BEGIN failed--compilation aborted. Can't locate ExtUtils/Embed.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .). BEGIN failed--compilation aborted. checking for perl.h... no checking for perl.h in /usr/local/include/... no checking for perl.h in /opt/include/... no configure: WARNING: silently not building rlm_perl. configure: WARNING: FAILURE: rlm_perl requires: EXTERN.h EXTERN.h libperl.so libperl.so. please advise... thank you fborot

3 6

RADIUS OTP auth with Apache
by Scholz, Dieter 12 Apr '17

12 Apr '17

Hello, at the moment I'm facing the problem to implement a OTP (one time password) auth solution for Apache httpd. The webserver should act as a proxy for several internal sites (it runs Debian Stretch). The OTP software solution I use is LINOTP. Freeradius is my radius server (default package from Debian Jessie - runs on another host). I have no problem authentication on the command line. Using radtest everything works as expected. But I have problems with the Apache radius auth config. I tested several configurations. At the moment the configuration that runs best is the libapache2-mod-auth-radius variant (Stretch package). It works fine when connecting using an icognito browser tab. But if I use a standard browser tab everytime I close and reopen the browser the first auth attempt fails. Looking at the log I found that the auth cookie is not deleted when closing the browser. The docs state it should be deleted when the browser exits. So when the browser is restarted the first auth attempt is using the stale cookie information and fails. This is a bit unconvenient. I couldn't find an answer (but a similar unanswered question) for this problem when searching the mailing list. Here's my Apache config: <VirtualHost *:80> DocumentRoot /var/www/btw ProxyPass / http://<IP>/ ProxyPassReverse / http://<IP>/ LogLevel debug <Proxy *> Order allow,deny Allow from all </Proxy> AddRadiusAuth <IP>:1812 <SECRET> 5:3 AddRadiusCookieValid 5 <Location /> AuthType Basic AuthName "<A_NAME>" AuthBasicProvider radius AuthRadiusActive On AuthRadiusCookieValid 5 AuthRadiusAuthoritative on require valid-user </Location> </VirtualHost> I tried a different variant for the auth problem using PAM and the PAM radius module but only reached a situation that the first auth attempt works but each new request triggered a new login dialog box. So here are my questions: - Is there a solution for the cookie not getting deleted when using the libapache2-mod-auth-radius module? - Is there another way to auth against a radius server (or the linotp server) that works? At the moment I'm stuck so any help is appreciated. Thanks. Regards, Dieter

3 3