- Freeradius-Users - lists.freeradius.org

Ignore mac if NAS-Port-Type is Ethernet
by HugLeo 05 Jan '17

05 Jan '17

Hi, My BRAS server send two types of radius requisition with NAS-Port-Type. For dhcp it's send "Ethernet" and for pppoe it's send "Virtual" I would like to know if is possiblie that if NAS-Port-Type = Virtual freeradius ignore validating the user by mac.

2 1

Validating plaintext passwords against Samba 4
by Brian Candler 05 Jan '17

05 Jan '17

Hi, There are several documents about how to authenticate MSCHAP requests against Samba 4 / AD. My question is, what's the preferred way to authenticate requests which contain plaintext passwords, i.e. PAP, against S4/AD? rlm_mschap has hooks to talk to ntlm_auth or winbind, but rlm_pap doesn't. It seems to me I could: * use rlm_ldap, and do a bind using the user supplied password * use rlm_krb5 (i.e. kerberos as a password oracle) Is there another/better way? Thanks, Brian.

3 2

redundant-load-balance
by Jonathan Gazeley 05 Jan '17

05 Jan '17

Hi folks, In my RADIUS config on 3.0.12 I've listed a number of LDAP servers, identically configured, and used a redundant-load-balance section to list them. This has always worked in a "normal" situation but over Christmas we had a couple of outages and I have some questions about the behaviour of redundant-load-balance. Firstly, one of the LDAP servers lost power. redundant-load-balance did the right thing, reported "Opening connection failed" and skipped that server. Later, another LDAP server got itself in a funny state where it was up and responsive, accepting connections but timing out when FreeRADIUS tried to bind, with the message "Timed out while waiting for server to respond". For some reason, redundant-load-balance continued to send LDAP queries to the server even though it wasn't working properly. How does rlm_ldap determine if a server is up or down, and what can I configure in my ldap modules or redundant-load-balance to ensure that if the LDAP server misbehaves in future, it will get marked as dead and cause redundant-load-balance to send queries to a different server? Unfortunately as the event happened in the past I don't have debug logs - only the regular radius.log. We also don't know what caused the LDAP server to get into that state (our Windows guys are looking into it) so currently we can't recreate the problem, either. Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

5 11

2 Factor Authentication
by Dudás Péter 05 Jan '17

05 Jan '17

Hello! I'm trying to integrate Duo auth proxy (2.4.19) and Freeradius 3.0.12 on Ubuntu 16.04 to have 2 Factor Authentication on VPN radius requests via Duo security. Active directory intergation done via Samba4 (winbindd). VPN authentication can be SSLVPN or L2TP. Both works - SSL uses pap authentication against the AD, L2TP uses MSCHAPv2 against the AD. SSL sends back only the Filter-Id, L2TP sends Filter-Id and MPPE keys. To have 2 Factor Authentication I created a module for Duo authentication which calls an external script with the user variables and the script writes them to a text file which is the input file for a radclient in the following way: /usr/bin/radclient -f /opt/duoauthproxy/packet -c 1 -r 2 -t 30 -x 127.0.0.1:1645 auth secret -x Radclient connects to the Duo Auth Proxy on the localhost and doing the authentication via Duo services (push/phone/otp code). After the authentication the module returns the Exit code 0 or Exit code 1 (depending on the authentication result). With the SSLVPN it works fine - simply put the Duo authorization before the AD auth in authorize section and works perfectly. With the L2TP it is not working at all. I see the successful authentication (both: Duo and Mschap), MPPE keys and Filter-Id returned, firewall grants the access - and the devices are just not connects. I don't see any errors, and as also the firewall grants the access I have no clue what could this be. Now duo auth happens at post auth section - but it can be anywhere - just not working. Here is the debug: (0) Received Access-Request Id 203 from 10.101.168.3:59819 to 10.148.64.67:1812 length 161 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) User-Name = "Peter Dudas" (0) NAS-IP-Address = 89.212.168.XYZ (0) NAS-Port = 0 (0) MS-CHAP-Challenge = 0x5556c20e9277af608a7ba5335955d181 (0) MS-CHAP2-Response = 0x32006b1c6f8f39c8c7049a9b365ac86156e90000000000000000f7a54abdb5fa7c889557a2729d2234117d36cd4a203ed4ac (0) Proxy-State = 0xfe80000000000000953e77ad63f094ba000000cb (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) if (User-Name != ""){ (0) if (User-Name != "") -> TRUE (0) (User-Name != "") { ... } # empty sub-section is ignored (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/ 10.101.168.3/auth-detail-20170104 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.101.168.3/auth-detail-20170104 (0) auth_log: EXPAND %t (0) auth_log: --> Wed Jan 4 22:35:44 2017 (0) [auth_log] = ok (0) if (User-Name != "" && Service-Type !* "") { (0) if (User-Name != "" && Service-Type !* "") -> FALSE (0) else { (0) if (MS-CHAP2-Response != "" && MS-CHAP-Challenge != "") { (0) if (MS-CHAP2-Response != "" && MS-CHAP-Challenge != "") -> TRUE (0) if (MS-CHAP2-Response != "" && MS-CHAP-Challenge != "") { (0) if (NAS-IP-Address == "89.212.168.XZY" && Framed-Protocol == "PPP") { (0) if (NAS-IP-Address == "89.212.168.XYZ" && Framed-Protocol == "PPP") -> TRUE (0) if (NAS-IP-Address == "89.212.168.XYZ" && Framed-Protocol == "PPP") { (0) if (Service-Type == "Framed-User" && Packet-Type == "Access-Request" ) { (0) EXPAND Packet-Type (0) --> Access-Request (0) if (Service-Type == "Framed-User" && Packet-Type == "Access-Request" ) -> TRUE (0) if (Service-Type == "Framed-User" && Packet-Type == "Access-Request" ) { (0) if (MS-CHAP-Challenge != "" && NAS-PORT == "0" ) { (0) if (MS-CHAP-Challenge != "" && NAS-PORT == "0" ) -> TRUE (0) if (MS-CHAP-Challenge != "" && NAS-PORT == "0" ) { (0) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) if (ok) { (0) if (ok) -> TRUE (0) if (ok) { (0) update reply { (0) Filter-Id := "L2TP-Users" (0) } # update reply = noop (0) } # if (ok) = noop (0) } # if (MS-CHAP-Challenge != "" && NAS-PORT == "0" ) = ok (0) } # if (Service-Type == "Framed-User" && Packet-Type == "Access-Request" ) = ok (0) } # if (NAS-IP-Address == "89.212.168.XYZ" && Framed-Protocol == "PPP") = ok (0) } # if (MS-CHAP2-Response != "" && MS-CHAP-Challenge != "") = ok (0) } # else = ok (0) } # authorize = ok (0) Found Auth-Type = mschap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type mschap { (0) mschap: Creating challenge hash with username: Peter Dudas (0) mschap: Client is using MS-CHAPv2 (0) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{request:User-Name} --domain=site.domain.local --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=site.domain.local\l2tp-users: (0) mschap: EXPAND --username=%{request:User-Name} (0) mschap: --> --username=Peter Dudas (0) mschap: Creating challenge hash with username: Peter Dudas (0) mschap: EXPAND --challenge=%{mschap:Challenge:-00} (0) mschap: --> --challenge=397e282f44bc0581 (0) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00} (0) mschap: --> --nt-response=f7a54abdb5fa7c889557a2729d2234117d36cd4a203ed4ac (0) mschap: Program returned code (0) and output 'NT_KEY: A1A055BBCC2133B2E1FCD8213C6B03FE' (0) mschap: Adding MS-CHAPv2 MPPE keys (0) [mschap] = ok (0) } # Auth-Type mschap = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/ 10.101.168.3/reply-detail-20170104 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.101.168.3/reply-detail-20170104 (0) reply_log: EXPAND %t (0) reply_log: --> Wed Jan 4 22:35:44 2017 (0) [reply_log] = ok (0) duo: Executing: /usr/bin/radclient -f /etc/freeradius/packet -c 1 -r 1 -t 45 127.0.0.1:1645 auth secret -x: (0) duo: Program returned code (0) and output 'Sent Access-Request Id 49 from 0.0.0.0:52464 to 127.0.0.1:1645 length 75 Packet-Type = Access-Request Service-Type = Framed-User Framed-Protocol = PPP User-Name = "Peter Dudas" User-Password = "push" NAS-IP-Address = 89.212.168.XYZ NAS-Port = 0 Cleartext-Password = "push" Received Access-Accept Id 49 from 127.0.0.1:1645 to 0.0.0.0:0 length 48 Reply-Message = "Success. Logging you in..."' (0) duo: Program executed successfully (0) [duo] = ok (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/ 10.101.168.3/reply-detail-20170104 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.101.168.3/reply-detail-20170104 (0) reply_log: EXPAND %t (0) reply_log: --> Wed Jan 4 22:35:44 2017 (0) [reply_log] = ok (0) [exec] = noop (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/ 10.101.168.3/reply-detail-20170104 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.101.168.3/reply-detail-20170104 (0) reply_log: EXPAND %t (0) reply_log: --> Wed Jan 4 22:35:44 2017 (0) [reply_log] = ok (0) } # post-auth = ok (0) Login OK: [Peter Dudas/<via Auth-Type = mschap>] (from client dc1 port 0) (0) Sent Access-Accept Id 203 from 10.148.64.67:1812 to 10.101.168.3:59819 length 0 (0) Filter-Id := "L2TP-Users" (0) MS-CHAP2-Success = 0x32533d34413036444345313735434538323544364344333939363634303638424345343738453634383132 (0) MS-MPPE-Recv-Key = 0x8e2b496673e4be264ff378973bfc4f0a (0) MS-MPPE-Send-Key = 0x3d999c39dd3234adb646ff83015329da (0) MS-MPPE-Encryption-Policy = Encryption-Required (0) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (0) Proxy-State = 0xfe80000000000000953e77ad63f094ba000000cb (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 203 with timestamp +18 I've tried to run the duo auth ant the Authorize, post auth sections - no matter where it is, the connection is not successful. Do you maybe know what change with this second authentication which blocks the L2TP VPN connection? If I comment out the DUO - then L2TP VPN connects without problem. I don't find any difference in the Reply packets (chacked with Wireshark too). Thank you! Peter Dudas

4 13

relay in background?
by Alan Batie 05 Jan '17

05 Jan '17

A while back, I setup a couple of radacct relays for archiving using the new mechanism, however occasionally the archive server is slow (the reason we moved the archival process to another server to start with), and it's impacting the primary because it doesn't respond until the proxying is done. With radrelay, this is done independently and it doesn't matter if it gets a little behind. Is there a way to make the builtin mechanism behave in the same way? If not, I'm going to resurrect radrelay...

3 5

Radius Stering
by Richard J Palmer 04 Jan '17

04 Jan '17

Hi We use FR a lot for authentication etc and this works perfectly... However I have a need for a Wholesale backhaul to run a platform radius setup - this is for session steering. At this point I actually don't care about the username or password. What I'd like to do is look at a combination of the calling-station-ID / the IP address of the radius client sending the request to us. Based on this we will return some parameters to create a L2TP tunnel. The far end will THEN send a L2TP tunnel to us that reaches here and we do the full authentication. Note that with the Calling station ID I am looking for a pattern match and not exact matches (eg We will be passed ABCD1234533 or LLAD433224). I am looking to return one set of answers if the Calling Station ID starts with ABCD and another if it starts LLAD I may also want to send different data IF the request comes from A radius client with IP 1.2.3.4 or 2.3.4.5 I am happy to dig into this but any pointers you can provide would be appreciated Richard

2 1

simultaneous use
by Bill Schoolfield 04 Jan '17

04 Jan '17

I have a client that wanted his customers limited to a single connection. So I implemented: mysql> select * from radgroupcheck; +----+--------------------+------------------+----+-------+ | id | groupname | attribute | op | value | +----+--------------------+------------------+----+-------+ | 1 | Package2MB | Simultaneous-Use | := | 1 | After some time and 100's of subscribers he now wants on a case by case (ie user) basis to allow multiple simultaneous sessions. I thought I just add Simultaneous-Use to radcheck for those users and use the "appropriate" operators. I can't seem to get this to work. I'm trying to avoid dropping the use of radgroupcheck and adding the Simultaneous-Use radcheck attribute to all users. Is this possible? What operators do I use? I used '=' in radgroupcheck and that succeeded in allowing the radcheck item to "override" the radgroupcheck item but the check fails if no radcheck item exists (as will be the case in many instances). Bill

2 5

Authorize with EAP-TLS, but use LDAP for authentication to check user's group membership
by Petar Marinkovic 03 Jan '17

03 Jan '17

I am quite a freeradius noob, so in advance, my apologies if this question of mine doesn't make too much sense. I have a mixed environment, mostly Windows users, but also Linux and Macs, and requirement is to implement a 802.1x wired authentication for DHCP clients, with dynamic VLAN assignment. As a first layer of security, I've implemented this solution https://wiki.freeradius.org/guide/mac-auth with both mac authentication (reading allowed MAC addresses) and then proceeding with EAP-TLS (with certificates issued from Windows Active Directory Certificate Services). I've created machine certificate for freeradius server (2.2, running on CentOS 6) in AD CS, converted that one and root CA, and set up everything per that solution, and I can successfully authenticate with any Windows or Linux client with allowed MAC and user having their certificate. Now, I would like to add LDAP, in order to check the user's group permissions, and to set up dynamic vlan assignment per group membership (if a HR person is member of "HR" group, put him in VLAN 10, for example). I have Juniper access switches, so this solution should work. But, I am seeking advice from you here guys on how to proceed. I've installed LDAP module, and configured my settings in /etc/raddb/modules/ldap but where should the configuration for this takes place? Currently, my /etc/raddb/sites-available/default config looks the same as on the link above, and I am not sure if I can use the username of authorized user (which is in form of username(a)domain.com from the Windows user certificate) with LDAP to check the groups of that authorized user and assign him the correct VLAN? I've googled around, but what I found didn't help me much, so any help is more than appreciated! I guess it's easier to switch to MAC and LDAP and bypass EAP-TLS, but since we're already issuing certificates to users (and they use those Windows AD certificates for other services as well), I would like to use them here as well for authorization with MAC addresses. Thanks in advance!

2 2

rlm_ldap not populating Stripped-User-Name
by Arnab Roy 03 Jan '17

03 Jan '17

Hi , Just wondering if one of you could help me with a strange issue that has suddenly appeared. Freeradius Version: 3.0.11 It looks like rlm_ldap has suddenly stopped picking up the Stripped-User-Name value, my config looks like bellow user { filter = "(samAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "dc=domain,dc=com" access_positive = yes } All was working fine with this server for a while. The same filter is working fine in other modules like mschap and ntlm_auth. The exapnsion of the filter returns no value for the Stripped-User-Name parameter. Here is the grepd version of radiusd -X Any points where I could start looking would be much appreciated as to why it suddenly stopped. # Loaded module rlm_ldap # Loading module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "172.20.0.40" port = 389 identity = "bindaccount" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { scope = "base" name_attribute = "cn" membership_attribute = "memberOf" membership_filter = "(&(objectClass=group)(member=%{control:Ldap-UserDn}))" cacheable_name = yes cacheable_dn = yes } client { scope = "sub" base_dn = "" } profile { } options { ldap_debug = 0 chase_referrals = no rebind = no net_timeout = 10 res_timeout = 10 srv_timelimit = 1 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name}} --domain=%{%{mschap:NT-Domain}:-removed.com} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" passchange { } -- # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20444 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 10 spare = 20 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 0 retry_delay = 30 spread = no } Do let me know if you would like to see some additional configuration files. Many Thanks Arnab

2 2

rlm_eap module
by Peter Balsianok 02 Jan '17

02 Jan '17

Hi, How can i prevent to compile rlm-eap module ? Thx.

2 3