- Freeradius-Users - lists.freeradius.org

Routing new RFC7542-style realms
by Stefan Paetow 03 Oct '16

03 Oct '16

Sooo, I'm looking at how to configure FreeRADIUS to be able to handle RFC7542-style usernames (i.e. "realhome.realm!username(a)intermediate.realm"). At the same time, that same FreeRADIUS server must be able to handle the standard RFC4282 NAI, and authenticate NAIs that are local to it. The inner identity obviously remains the standard NAI for the real home realm, unless someone else has a better idea: Scenario 1: Outer = username(a)intermediate.realm. Authenticate locally at 'intermediate.realm'. Scenario 2: Outer = realhome.realm!username(a)intermediate.realm. Route on to 'realhome.realm'. Authenticate locally at 'realhome.realm'. Scenario 1 works just fine... But Scenario 2? I can define a prefix/suffix that works on the bang (!), so I can handle one or the other... But not both? Alan D, since RFC7542 is your baby, how do we do this? I'd love to know this. :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

3 7

Radius 3.0.12 crashes on mysql DB conection failiure
by feroze waris 03 Oct '16

03 Oct '16

Hi all, I am using freeradius version 3.0.12 with rlm_perl module and using mysql with it. When there is connectivity issue with mysql DB or it is unavailable my radius gets crash and i am getting following error. Sat Oct 1 15:04:35 2016 : Debug: (1) perl: perl_embed:: module = /usr/local/etc/raddb/mods-config/perl/example.pl , func = authenticate exit status= All data sources failed! at /usr/local/share/perl5/DBD/Multi.pm line 367. I also tried to catch this error using TryCatch module but it failed. Regards Feroze

2 1

PAM order (ssh login)
by Janis Heller 02 Oct '16

02 Oct '16

I use pam_radius to protect my servers. Using the sshd file in /etc/pam.d with this config: # Standard Un*x authentication. @include common-auth auth sufficient pam_radius_auth.so client_id=server22 My common-auth(/etc/pam.d/common-auth) looks like this: auth sufficient pam_script.so auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass auth requisite pam_deny.so auth required pam_permit.so auth optional pam_cap.so Now when I try to login using for example root account the password is sent to radius too (but system seems to ignore the radius answer). I already tried to change the order, I would like to modify PAM in a way, all the default (local) PAM checks are runned before a check is made to radius. Where’s my fault? I think checking each login request first local will speed up the server performance. All the best;

2 1

Re: AES encrypted passwords
by Stefan Paetow 01 Oct '16

01 Oct '16

>(Maybe it's safer to use a different password for wireless access than >for the rest of your enterprise services to mitigate the problem? But if >you're going to do that, you could just go the EAP-TLS route anyway. And >it doesn't obviate the need for checking the AP certificate to prevent >traffic interception) Some organisations already do this. Some universities are clear about this, i.e. that your eduroam password should not be the same as your login password to your mail etc. Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. >

2 1

AES encrypted passwords
by Dom Latter 01 Oct '16

01 Oct '16

Hi, [tech details at end [1]] some of you may remember me from a couple of months back asking about NTLM hashed passwords. I gave those a brief go but found that some devices just didn't work with them. The requirement - a commercial and marketing requirement, not a technical one - has not gone away and it is that we can say that we do not store the passwords in plain text. I have concocted a scheme whereby we do that - the following goes into dialup.conf and is I hope self-explanatory: authorize_check_query = "SELECT id, username, attribute, value, op \ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ AND attribute != 'AES-Password' \ UNION \ SELECT id, username, 'User-Password', \ AES_DECRYPT(UNHEX(value), 'aeskey'), op \ FROM radcheck \ WHERE username = '%{SQL-User-Name}' \ AND attribute = 'AES-Password' \ ORDER BY id" We replace User-Password with AES-Password, decrypt it in the sql query and pass it back to radius /as/ User-Password. (Or Cleartext-Password is more likely in the final implementation). Yes, the key is now held in /etc/freeradius and if someone gets that as well as the database then it's much the same as storing the passwords in plain text. But we can *say* that they are stored encrypted - and there may be a slight edge in security, as a file in /etc/ *may* be less vulnerable than a mysql database. Any thoughts on this scheme? thanks dom [1] wifi network with aerohive access points; freeradius with mysql data store; WPA2-Enterprise, MSCHAPv2, no control whatsoever over what the users want to connect to the network.

11 23

linelog module crashing freeradius server
by Anirudh Malhotra 30 Sep '16

30 Sep '16

Hi, I have noticed a strange behaviour, I have line log configured to do logging at various steps. In one of the steps i print the username in logs. Now when the username is non english font(any other language viz hindi, arabic, russian, chinese tested with these) it crashes the freeradius application. Debug log is as follows 124456) Received Access-Request Id 164 from 10.198.64.10:54713 to 10.40.125.30:1812 length 319 (124456) User-Name = " रहलहवकह" (124456) Chargeable-User-Identity = 0x0a (124456) Location-Capable = Civix-Location (124456) Calling-Station-Id = "xxxxx" (124456) Called-Station-Id = "xxxx" (124456) NAS-Port = 8 (124456) Cisco-AVPair = "audit-session-id=0a40c60a000653d3eee5ec57" (124456) Acct-Session-Id = "57ece5ee/xxxxx/329431" (124456) NAS-IP-Address = xxxxx (124456) NAS-IPv6-Address = 2001::2001 (124456) NAS-Identifier = "xxxxxx" (124456) Airespace-Wlan-Id = 34 (124456) Service-Type = Framed-User (124456) Framed-MTU = 1300 (124456) NAS-Port-Type = Wireless-802.11 (124456) Tunnel-Type:0 = VLAN (124456) Tunnel-Medium-Type:0 = IEEE-802 (124456) Tunnel-Private-Group-Id:0 = "807" (124456) EAP-Message = 0x0201001b0120e0a4b0e0a4b9e0a4b2e0a4b9e0a4b5e0a495e0a4b9 (124456) Message-Authenticator = 0xf478d56d8c1d498752fbd782302cf884 (124456) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (124456) authorize { (124456) if (!&session-state:unique-session-id) { (124456) if (!&session-state:unique-session-id) -> TRUE (124456) if (!&session-state:unique-session-id) { (124456) update { (124456) Executing: /usr/bin/shuf -n 1 -i 0-99999: (124456) Program returned code (0) and output '42345' (124456) EXPAND %{exec: /usr/bin/shuf -n 1 -i 0-99999} (124456) --> 42345 (124456) &session-state:unique-session-id = 42345 (124456) } # update = noop (124456) } # if (!&session-state:unique-session-id) = noop (124456) policy filter_username { (124456) update control { (124456) linelogvar := "request_attrs" (124456) } # update control = noop (124456) linelog: EXPAND messages.%{%{control:linelogvar}:-default} (124456) linelog: --> messages.request_attrs linelog module config reference = "messages.%{%{control:linelogvar}:-default}" messages { request_attrs = "%{User-Name},%{Calling-Station-Id},%{Called-Station-Id},%{NAS-Port},%{Acct-Session-Id},%{NAS-IP-Address},%{NAS-Identifier},%{Airespace-Wlan-Id},%{Service-Type},%{Framed-MTU},%{NAS-Port-Type},%{Tunnel-Type:0},%{Tunnel-Medium-Type:0},%{Tunnel-Private-Group-Id:0},%T,%{md5:%{Acct-Session-Id},%{session-state:unique-session-id}},Request:,%{EAP-Type}" } policy filter_username update control { linelogvar := "request_attrs" } linelog Although I have made a workaround of rejecting as well as substituting non english font usernames. This is to make the community aware if it is not already. Also I dont think some of us would like to reject non english username do we? BR, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

3 4

Purpose of the inner-eap module
by Graham Clinch 30 Sep '16

30 Sep '16

Hi Folks, In the standard config there's an second instance of the eap module, named 'inner-eap', but it doesn't appear to be referenced anywhere. I've swapped all occurances of 'eap' in the inner-tunnel site to 'inner-eap' and now see PEAP/EAP-MSCHAPv2 authentications complete with one fewer roundtrip, which feels like an improvement. Is there a reason inner-eap is not used in the default inner-tunnel site? As an aside, the wiki's EAP module page says "NOTE: There can only be one instance of the EAP module." (http://wiki.freeradius.org/modules/Rlm_eap) but that doesn't appear to be the case here. Graham

4 4

issue building 3.0.12 packages for Ubuntu
by Alex Sharaz 30 Sep '16

30 Sep '16

Hi, Just tried building local packages from source and got QUILT_PATCHES=debian/patches \ quilt --quiltrc /dev/null push -a || test $? = 2 Applying patch radiusd-to-freeradius.diff patching file Make.inc.in patching file raddb/radiusd.conf.in patching file scripts/monit/freeradius.monitrc Hunk #1 succeeded at 8 with fuzz 1. patching file raddb/sites-available/control-socket patching file src/main/radiusd.c Applying patch disable-dhcp-bydefault.diff patching file raddb/all.mk Hunk #1 FAILED at 8. 1 out of 1 hunk FAILED -- rejects in file raddb/all.mk Patch disable-dhcp-bydefault.diff does not apply (enforce with -f) /usr/share/quilt/quilt.make:16: recipe for target 'debian/stamp-patched' failed make: *** [debian/stamp-patched] Error 1 dpkg-buildpackage: error: debian/rules build gave error exit status 2

2 1

eap-mschapv2 and MPPE keys
by Adam Schumacher 29 Sep '16

29 Sep '16

I am trying to get an ike2 ipsec vpn to work on pfsense 2.3.2 (with strongswan 5.5) doing EAP-RADIUS to a FreeRadius server (2.2.9) that comes with Apple server (OS X 10.11). All of the pieces are connected and communicating properly. The pfsense is sending the eap-mschapv2 requests to freeradius and freeradius is sending back an Access-Accept. However, the IKE_AUTH fails because there is no MSK. Looking at the output of radiusd –X, I see that it is not sending back MS-MPPE-Send-Key/MS-MPPE-Recv-Key, even though use_mppe = yes in the mschap module config. I’ve tried toggling require_encryption as well with no noticeable difference. Does anyone have any ideas on how to get FreeRadius to send back the MPPE keys? We had initially been doing this on an older apple server and I found a reference to a bug in freeradius where rlm_eap_mschap.c was stripping MPPE keys which was fixed in 2010 (#1). As far as I can tell, the version of freeradius included in El Capitan is many versions newer and should already have this fix. I can provide any logs/debug/config that may be needed to diagnose, but don’t want to just spam the list with piles of output that wouldn’t help. ::Adam #1 http://lists.freeradius.org/pipermail/freeradius-users/2010-June/046977.html

4 5

Release of version 3.0.12
by Alan DeKok 29 Sep '16

29 Sep '16

After much delay, we are happy to announce the release of version 3.0.12. The release announcement is here: http://freeradius.org/version3.html Note that the PGP key used to sign the binaries has changed. Alan DeKok.

1 0