- Freeradius-Users - lists.freeradius.org

Re: does freeradius support key-wrap
by Michael Martinez 10 Apr '16

10 Apr '16

Ok, I have more context for my question: Does Freeradius support something similar to Cisco's use of key-wrap as defined in https://tools.ietf.org/html/draft-zorn-radius-keywrap-18 ? In their implementation they define a way to securely transmit cryptographic keying material (such as from an EAP conversation) between NAS and Radius server using a a keywrap around the keying material to protect encryption key distribution. Supposedly this "protects" a man-in-the-middle from grabbing the EAP keys? I'm not sure how this increases security because you can't do anything with the public keys anyway. But I suppose it's a "stronger" way of encrypting that information as opposed to the standard hash that's currently done. The reason I'm asking, I'm doing some contract work for a university. The bosses want to know, presumably because they have some compliance requirements they need to satisfy. I see a few past discussion of this from the mailing list, but no clear answer on whether freeradius does this. -- --- Michael Martinez http://www.michael--martinez.com

2 2

rlm_python
by Arran Cudbard-Bell 09 Apr '16

09 Apr '16

Spent some time poking at it in v3.1.x. It seems to work OK with multiple threads now, and i've reworked the code to use separate interpreters for each module instance for cleanliness. I don't see any of the crashes previously observed when using multiple rlm_python instances. If heavy users of python in v3.0.x could try v3.1.x it would be appreciated. As v3.0.x was marked as THREAD_UNSAFE, you should see substantial performance improvements in v3.1.x. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 8

Re: Forward Accounting Packets to Fortiage - need help
by Eby Mani 08 Apr '16

08 Apr '16

Thanks, i should have provided more details earlier. freeRadius is configured with mysql and users are authenticated using EAP - PEAP without certificates. Once users are authenticated thru radius, ip address is released thru another dhcp server. Issue 1, When Users are getting authenticated, freeradius isn't sending Class attribute of the usergroup/user in Access-Accept message. Only User-Name is sent to NAS. NAS is configured to forward RADIUS accounting packets to Fortigate, where fortigate gets only authenticated username and ip address from NAS. As freeRadius is not sending Class attributes in Access-Accept. NAS isn't sending any Class info to Fortigate. Without usergroup info in Class attribute, can't provide RSSO based access to various networks. While troubleshooting NAS it was found freeradius is sending Class attribute information in Access-Challenge message !!. . Further troubleshooting on radius server revealed the following; 1, radtest from the server return class attributes of user/usergroup. 2, when running server in debug mode and authenticating from NAS, it doesn't. Is this the default behaviour ?. How do i tell freeradius to send Class attribute of usergroup in Access-Accept ?. Issue 2, freeradius is not sending accounting copies to Fortigate. Having Added "realm {}" in proxy.conf, added "detailfile = ${radacctdir}/detail" in detail file and included "update control {}" in preacct section of copy-acct-to-home-server file and linked the same to sites-enabled folder. I'm not sure if i have missed anything. One might ask why send accounting again, Fortigate can have only one RSSO Agent, thus sending accounting packets from multiple NAS is not possible. Also I'm planning to use some old gear that doesn't support sending accounting to another server. Sending accounting copies from freeradius will eliminate various admin overheads. Attached config files. Eby -------------------------------------------- On Thu, 7/4/16, Alan DeKok <aland(a)deployingradius.com> wrote: Subject: Re: Forward Accounting Packets to Fortiage - need help To: "Eby Mani" <eby_km(a)yahoo.com>, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thursday, 7 April, 2016, 4:42 PM On Apr 7, 2016, at 11:37 AM, Eby Mani via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > Thanks Alan, the NAS and Fortigate does RADIUS. > > The easiest way for me is to configure NAS to forward RADIUS accounting packets to Fortigate. But my freeRadius is not sending Class attributes in Access-Accept to NAS client, thus NAS client isn't sending any Class info to Fortigate. > > However freeRadius is sending Class attributes in Access-Challenge to NAS !!!. > > Is there a command to include Class attributes in Access-Accept ?. Configure the server to send it. As always, run the server in debug mode, and READ IT. Also, describe what you're doing. In detail. Your questions are nearly content free. We're not mind readers. We don't know what you've configured. You don't say if you're using EAP or another authentication method. Any answer to help you depends on knowing what you're actually doing. Since we don't know what you're doing, we can't really help you. Alan DeKok.

2 1

Session-Timeout
by Aurélio de Souza Ribeiro Neto 08 Apr '16

08 Apr '16

Helo Again! ;) Now I'm trying to enable session-timeout. I set in MySQL database in radgroupreply table Atrribute Session-Timeout := 86400 and tried to put the same in radreply table, but is not working. Someone can help me? Radacct LOG: Fri Apr 8 15:03:38 2016 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 15728675 NAS-Port-Type = Ethernet User-Name = "testepppoe" Calling-Station-Id = "F8:1A:67:58:42:E7" Called-Station-Id = "CE - TESTE PPPoE" NAS-Port-Id = "ether2" Acct-Session-Id = "81e00023" Framed-IP-Address = 187.120.201.79 Acct-Authentic = RADIUS Event-Timestamp = "Apr 7 2016 11:59:42 BRT" Acct-Status-Type = Start NAS-Identifier = "CE - TESTE PPPoE" Acct-Delay-Time = 0 NAS-IP-Address = 172.20.200.2 Acct-Unique-Session-Id = "8b6a5050f5d5ea7e" Timestamp = 1460138618 Thanks Aurelio

2 1

Freeradius dhcp + allow unknown-clients
by Алексей Елиферов 08 Apr '16

08 Apr '16

Hi! We have freeradius v.2.2.9 with dhcp module And it's understand how to give IP-address with MAC or opt82. But if it's a new client, that does not established in mysqldb, how to give IP? In isc-dhcp it is doing by allow unknown-clients and dynamic pool. Does freeradius have anything like it? -- Sincerely yours, Yeliferov A. CTO LLC INTRAFFIC intraffic.ua / 044.200.44.00

4 3

COA to multiple NAS
by Mike 08 Apr '16

08 Apr '16

Hi I've got a scenario where we have multiple NAS devices authenticating their clients via a freeradius server. I want to originate COA requests to the NAS devices from the radius server and I have succeeded for one device by making an entry for a specific NAS in the home-server section of originate-coa. We add and remove NAS devices quite often and don't want to have to reconfigure originate-coa and restart freeradius every time. How we can enable dynamic addition of NAS to send COA requests OR can we send COA to servers without preconfiguring? Currently using & testing Freeradius 2.2.6 but in the process of migrating to 3, latest.

5 10

Proxy Freeradius 3.0.11 remove Message-Authenticator
by LABAT, Xavier 08 Apr '16

08 Apr '16

Hello, We would like to upgrade our proxy RADIUS solution from Freeradius 2.2.6 to Freeradius 3.0.11. We collect and switch PPP authentication/accounting requests to our different customers. One of them reject all authentication request if they are sent with < Message-Authenticator > attribute. We would like to upgrade without asking any changes to our clients. We configure the home_server with option "require_message_authenticator = no" in proxy.conf but < Message-Authenticator > attribute is still present in the proxy request. Alan DeKok said previously : "> I believe Message-Authenticator is now always sent in 3.0, unconditionally. Yes. It's best to always send it. It enables security and debugging checks that are otherwise not possible." Even if it's recommanded, is it possible to remove < Message-Authenticator > attribute in the proxy request ? Regards. Xavier -- Les donnees et renseignements contenus dans ce message sont personnels, confidentiels et secrets. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee. Si vous n'etes pas le bon destinataire, nous vous demandons de ne pas lire, copier, utiliser ou divulguer cette communication. Nous vous prions de notifier cette erreur a l'expediteur et d'effacer immediatement cette communication de votre systeme. Any data and information contained in this electronic mail is personal, confidential and secret. Any total or partial publication, use or distribution must be authorized. If you are not the right addressee, we ask you not to read, copy, use or disclose this communication. Please notify this error to the sender and erase at once this communication from your system.

3 3

Multiple instances of custom module
by Richard Levenberg 08 Apr '16

08 Apr '16

I have a custom module that is working perfectly with FreeRADIUS. I am now interested in creating multiple instances of the module for different NAS's that might be connecting via RADIUS. So from what I gather I can use unlang's switch statement in both the authorize and authenticate sections of the config file like so: authorize { . . switch &request:NAS-IP-Address { case "192.168.1.100" { customer1 } case “192.168.1.110” { customer2 } case { reject } } . . } authenticate { . . Auth-Type CUSTOM { switch &request:NAS-IP-Address { case "192.168.1.100" { customer1 } case “192.168.1.110” { customer2 } } } . . } So my questions are 1) is that the correct way to address multiple instances and 2) is the default case of reject in the authorize section the appropriate way to limit things to the defined instances? r

2 1

Re: Forward Accounting Packets to Fortiage - need help
by Eby Mani 07 Apr '16

07 Apr '16

Thanks Alan, the NAS and Fortigate does RADIUS. The easiest way for me is to configure NAS to forward RADIUS accounting packets to Fortigate. But my freeRadius is not sending Class attributes in Access-Accept to NAS client, thus NAS client isn't sending any Class info to Fortigate. However freeRadius is sending Class attributes in Access-Challenge to NAS !!!. Is there a command to include Class attributes in Access-Accept ?. Eby -------------------------------------------- On Wed, 6/4/16, Alan DeKok <aland(a)deployingradius.com> wrote: Subject: Re: Forward Accounting Packets to Fortiage - need help To: "Eby Mani" <eby_km(a)yahoo.com>, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, 6 April, 2016, 4:39 PM On Apr 6, 2016, at 9:22 AM, Eby Mani via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > FreeRADIUS Version 2.1.12, Ubuntu 14.04 LTS You should really upgrade. 2.1.12 is many years out of date. > I'm trying to send copy of accounting packets to Fortigate. Is there any official documentation / example for this ?. There is a lot of documentation on proxying. There is no documentation for "how do I configure vendor X product Y firmware Z". If the product does RADIUS, then normal RADIUS configuration will work. If the product doesn't do RADIUS, throw it in the garbage and buy one that does RADIUS. > I'm trying to get "Group" info of authenticated users for providing access to other networks thru RSSO. Doesl the Fortigate documentation say it returns a group in a RADIUS attribute? If not, then it's impossible. > I configured as per the following blog, > https://freeradiustips.wordpress.com/2015/02/17/forward-accounting-packets-… That's better than most, but I'm still amazed at the work people put into *not* reading the documentation that comes with FreeRADIUS. > Fortigate interface is listening for Radius Accounting packets, yet i'm not getting any accounting packets from freeRadius. Not sure i've missed anything vital. Run the server in debugging mode as suggested in the FAQ, "man" pages, web pages, and daily on this list. This is documented. Alan DeKok.

2 1

Implementing Dynamic Interface Group Assignment with Cisco WLC
by Clement Ogedengbe 07 Apr '16

07 Apr '16

Hi, Does anyone have any idea about what attribute to use to return parameter to Cisco WLC for Interface group assignment instead of Tunnel-Private-Group-Id which just returned the VLAN ID. Best Regards Clement -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of Stefan Winter Sent: 06 April 2016 08:31 To: freeradius-users(a)lists.freeradius.org Subject: Re: using SSL certs with EAP-TLS Hi, >> No. If your server certificate is from a CA, the client can verify >> that your server is genuine (if the client side is configured >> correctly to actually check CA and server name). > With using client: you mean the RADIUS explanation of client? Like the > Access Point? or the WLAN device, like a smartphone? In this context, I meant the WLAN device. >> Since there's no need to go down that route: don't. Issue client >> certificates from your own self-signed CA, and hand out client certs >> only to your own account holders. Then, no further checks are needed. > Ok, thanks. I will reconsider. It's not that I am too lame to generate > new certs and then import them to a handful devices. It's more that I > like it that the same client cert in iOS can be used for S/MIME and > for auth with WPA2 Enterprise. Ah, well that's a reason for using a commercial CA for the client certs indeed. As others have pointed out, attributes like TLS-Client-Cert-CN can be used to compare the cert name against a list of known-good names. Of course you'll have to manage that list of names yourself in config; on a scale of "handful" that's not a problem I guess. But on a larger scale, it will get bothersome. Greetings, Stefan Winter > >> Yes. There are examples in the shipped tarball of FreeRADIUS for that >> I think. That does not mean that it's the best idea to go down that route. > I'll look into that (I think it has something to do with the by Alan > suggested check_cert_cn). > >> When you write above that you can use whatever string you like then >> probably you didn't try this at a remote hotspot. :-) > Thats correct :D. In fact, last week was the first time I experienced > WPA2 Enterprise and only with one (my own) AP. > > Cheers! > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 3