- Freeradius-Users - lists.freeradius.org

EAP-TTLS+PAP vs. Ubunt 15 / Windows 10
by Bogdan Rudas 06 Sep '16

06 Sep '16

Hi, I'm trying to connect my Ubuntu 15.10 laptop to WLAN with Cisco Aironet WLC and FreeRADIUS 3.0.11. First of all, I've checked if my RADIUS server works with *eapol_test* utility from wpa_supplicant 2.5 suite and modified eap-ttls-pap.conf confguration file. Then I go to Ubuntu laptop and create custom configuration using Network Manager: [wifi-security] group= key-mgmt=wpa-eap pairwise= proto= [802-1x] altsubject-matches= anonymous-identity=anonymous eap=ttls; identity=ttest password-flags=2 phase2-altsubject-matches= phase2-auth=pap Here is server debug output: (0) Received Access-Request Id 153 from 1.2.3.2:32768 to 1.2.3.4:1812 length 264 (0) User-Name = "anonymous" (0) Chargeable-User-Identity = 0x00 (0) Location-Capable = Civix-Location (0) Calling-Station-Id = "c4-8e-8f-f5-eb-4f" (0) Called-Station-Id = "54-7c-69-f2-1c-a0:New" (0) NAS-Port = 1 (0) Cisco-AVPair = "audit-session-id=c0a819020000044557ce6e9b" (0) Acct-Session-Id = "57ce6e9b/c4:8e:8f:f5:eb:4f/2735" (0) NAS-IP-Address = 1.2.3.2 (0) NAS-Identifier = "backup" (0) Airespace-Wlan-Id = 6 (0) Service-Type = Framed-User (0) Framed-MTU = 1300 (0) NAS-Port-Type = Wireless-802.11 (0) Tunnel-Type:0 = VLAN (0) Tunnel-Medium-Type:0 = IEEE-802 (0) Tunnel-Private-Group-Id:0 = "15" (0) EAP-Message = 0x0201000e01616e6f6e796d6f7573 (0) Message-Authenticator = 0xcf196523d6fc7d6179e7b3252525b1ed (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "anonymous", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 1 length 14 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_ttls to process data (0) eap_ttls: Initiating new EAP-TLS session (0) eap_ttls: Flushing SSL sessions (of #0) (0) eap_ttls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 2 length 6 (0) eap: EAP session adding &reply:State = 0x53397887533b6d8a (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Sent Access-Challenge Id 153 from 1.2.3.4:1812 to 1.2.3.2:32768 length 0 (0) EAP-Message = 0x010200061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x53397887533b6d8a7ce5420be31fd0c8 (0) Finished request There are very similar output for Windows 10 with custom-made connection. I expect many Access-Request like in case with *eapol_test* authentification attempt. Please, help me distinguish: is it WiFi client, WLC or FreeRADIUS configuration issue? Thank you. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 4

802.1x in Windows
by Michael Schwartzkopff 06 Sep '16

06 Sep '16

Hi, this might be a little bit off topic, but perhaps someone can help here. I want to set up 802.1x for windows systems. In windows 7 an higher, is it possible to use certificates for the client authentication if no user is logged in, but passwords for the user authentication? Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Schleißheimer Straße 26/MG, 80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

2 2

Use freepbx for Asterisk VOIP
by Mohamad Yazdian 06 Sep '16

06 Sep '16

Hello everyone Can I use freepbx for Asterisk VOIP accounting? On Mon, Sep 5, 2016 at 4:31 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Salted SHA512 (Stefan Paetow) > 2. Re: Salted SHA512 (Alan DeKok) > 3. How to configure non-priveleged LDAP bind in FreeRADIUS > 3.0.11 (Bogdan Rudas) > 4. FreeRadius reboot needed on adding a NAS ? (Frederic Fichter) > 5. Re: FreeRadius reboot needed on adding a NAS ? (Alan DeKok) > 6. Re: How to configure non-priveleged LDAP bind in FreeRADIUS > 3.0.11 (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 5 Sep 2016 10:32:46 +0000 > From: Stefan Paetow <Stefan.Paetow(a)jisc.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Salted SHA512 > Message-ID: <C4E4EB29-B07F-4065-B879-AABF94592823(a)jisc.ac.uk> > Content-Type: text/plain; charset="utf-8" > > > Hmm, not sure where to look. It seems both OpenVPN and StrongSwan send > EAP requests to FreeRADIUS, but from when I can see, EAP only supports MD5 > and Crypt? Does that mean I should change it to PAP instead of EAP? > > Do StrongSwan and OpenVPN allow you to set the inner authentication method > for EAP, i.e. EAP-TTLS/EAP-GTC or EAP-TTLS/EAP-MSCHAPv2 (outer/inner)? If > you can, configure your EAP-TTLS or EAP method to use GTC (Generic Token > Card), which in FreeRADIUS is set up to use PAP. Of course, if they allow > you to set PAP as the inner, you can go straight to PAP in the inner tunnel > :-) > > Stefan Paetow > Moonshot Industry & Research Liaison Coordinator > > t: +44 (0)1235 822 125 > gpg: 0x3FCE5142 > xmpp: stefanp(a)jabber.dev.ja.net > skype: stefan.paetow.janet > > jisc.ac.uk > > Jisc is a registered charity (number 1149740) and a company limited by > guarantee which is registered in England under Company No. 5747339, VAT No. > GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, > Bristol, BS2 0JA. T 0203 697 5800. > > > > >

1 0

create SSH accounts using RADIUS pam
by Janis Heller 06 Sep '16

06 Sep '16

I use the REST module of RADIUS to validate login requests (username & password). Now I would like my users to be able to login to some servers using SSH. Their accounts should be all very unprivileged (just for SSH tunneling). After setting up the pam sshd module I recognized the login would be only possible by creating a new user with an empty password by using: adduser testuser on the server. Is there a way to prevent this and allow users to login in case of RADIUS accepted their username & password. I already searched for this problem: http://serverfault.com/questions/567628/authenticate-radius-user-using-pam-… Setting up ldap would be a bit too much for this I think, isn’t there an easier way? All the best;

5 8

EAP-TTLS sessions and 'anonymous' Access-Request
by Bogdan Rudas 05 Sep '16

05 Sep '16

Hi, When I test eap_ttls setup, for single connection attempt I see at least 6 "Access-Request" with 'anonymous' user name and some of them have log messages like this: *(1) eap_ttls: TLS_accept: unknown state(1) eap_ttls: TLS_accept: Need to read more data: unknown state* Is it encapsulation of stateful TLS session into stateless UDP-based protocol or something goes wrong with my setup? Thank you. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 1

How to configure non-priveleged LDAP bind in FreeRADIUS 3.0.11
by Bogdan Rudas 05 Sep '16

05 Sep '16

Hi, I would like to configure LDAP authentication for WiFi users with OpenLDAP back-ends (passwords are hashed). To perform initial bind to LDAP database I use restricted account which can read directory tree, determine DN on user and most of it's attributes but can't read passwords hashes. Then I expect FreeRadius to bind with DN found on previous step and user-supplied password. But instead of this I've got messages: Ready to process requests (0) User-Name = "brudas" (0) User-Password = "clearpass" (0) NAS-IP-Address = 127.0.0.1 (0) NAS-Port = 10 (0) Message-Authenticator = 0x86f22bc484991235fa4335a8b959a351 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "brudas", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=brudas) (0) ldap: Performing search in "ou=users,dc=office,dc=local" with filter "(uid=brudas)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "cn=Rudas Bogdan,ou=users,dc=office,dc=local" (0) ldap: Processing user attributes *(0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute* (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap.office.local:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> brudas (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated When I use admin user account (which can read password hashes) for initial bind, authentication test with *radtest *works well, but it is not what I want to do. I want to keep my OpenLDAP password policy working, this requires true LDAP bind attempt with credential of end-user. My final destination is EAP-TTLS with PAP inside. Please, help me to establish desired LDAP authorization schema. As far as I know it was possible in FreeRadius 2.1.x and I believe some additional configuration required here. Thank you. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 2

FreeRadius reboot needed on adding a NAS ?
by Frederic Fichter 05 Sep '16

05 Sep '16

Hi gang, I thought - but could not remember where I've read/dreamt that - that NAS defined within a SQL db could be added or removed dynamically (i.e. without the need to stop/start FreeRADIUS) ? Doesn't look to be the case in my lab. OpenWRT NAS, FreeRADIUS 3.0.11. On inserting a new NAS in the NAS table (MySQL db), requests are ignored by FreeRADIUS (as they come from an unknown NAS). Reloading (kill -HUP) the FreeRADIUS process doesn't change the problem, restarting the FreeRADIUS process solves it. Is this by design ? Any workaround available to avoid restarting FreeRADIUS everytime we add a NAS ? Thanks a lot for your help ! Best, Fred

3 2

SSH auth with FreeRADIUS
by Janis Heller 04 Sep '16

04 Sep '16

I would like to use FreeRADIUS to handle all SSH logins to my servers. Of course a „emergency“ login with a user registered on the server should be possible too (in case of RADIUS server is offline etc.). My /etc/pam.d/sshd looks like: # PAM configuration for the Secure Shell service auth sufficient pam_radius_auth.so # Standard Un*x authentication. #@include common-auth # Disallow non-root logins when /etc/nologin exists. #account required pam_nologin.so Now when I try to login as for example user test, the following code is shown at RADIUS debug: Ready to process requests (10) Received Access-Request Id 151 from XY to XY:1812 length 90 (10) User-Name = "test" (10) User-Password = "\010\n\r\177INCORRECT" (10) NAS-IP-Address = XY (10) NAS-Identifier = "sshd" (10) NAS-Port = 22688 (10) NAS-Port-Type = Virtual (10) Service-Type = Authenticate-Only (10) Calling-Station-Id = „XY" (10) # Executing section authorize from file /etc/freeradius/sites-enabled/default (10) authorize { rlm_rest (rest): Closing connection (18): Hit idle_timeout, was idle for 151 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (19): Hit idle_timeout, was idle for 151 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): 0 of 0 connections in use. You may need to increase "spare" rlm_rest (rest): Opening additional connection (20), 1 of 32 pending slots used rlm_rest (rest): Connecting to "http://XY" rlm_rest (rest): Reserved connection (20) (10) rest: Expanding URI components (10) rest: EXPAND http://XY (10) rest: --> http://XY (10) rest: EXPAND /demo/%{User-Name}/%{User-Password} (10) rest: --> /demo/test/%08%0A%0D%7FINCORRECT (10) rest: Sending HTTP GET to "http://XY/demo/test/%08%0A%0D%7FINCORRECT" (10) rest: Processing response header (10) rest: Status : 200 (OK) (10) rest: Type : json (application/json) (10) rest: Parsing attribute "control:Auth-Type" (10) rest: EXPAND Reject (10) rest: --> Reject (10) rest: Auth-Type := Reject rlm_rest (rest): Released connection (20) rlm_rest (rest): Need 2 more connections to reach 5 spares rlm_rest (rest): Opening additional connection (21), 1 of 31 pending slots used rlm_rest (rest): Connecting to "http://XY" (10) [rest] = updated (10) } # authorize = updated (10) Found Auth-Type = Reject (10) Auth-Type = Reject, rejecting user (10) Failed to authenticate the user (10) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! It seems like there is some kind of PAM module running before the RADIUS pam module. Any idea how to get this fixed? Looking into my sshd file of RADIUS I can’t see a pam module running before. -All the best;

2 1

Adding additional password encryption options
by Laurens Vets 03 Sep '16

03 Sep '16

Hello list, Is it possible to add additional password encryption options to FreeRADIUS so that the user database can be used as a user/password store (For instance PBKDF2 or scrypt)? When I look at "man rlm_pap", the amount of encryption options for passwords are limited when FreeRADIUS is your only user database. I'm creating a POC where users can register for an account to use certain services (accessible via radius authentication) and I'm trying to only use the FreeRADIUS mysql database as a backend to keep it simple, but the password encryption methods aren't considered secure by today's standards. Short of maintaining 2 databases with user information, how are people on the list handling these cases or is my use case a bit out of the ordinary?

4 4

Accounting doubt
by Tiago 02 Sep '16

02 Sep '16

Hello everyone, I've noted a few accounting records that AcctStartTime is newer than AcctStopTime. Example: StartTime = 2016-08-25 23:30:05 StopTime = 2016-08-25 23:29:03 I was wondering what could cause that? Thanks

3 4