- Freeradius-Users - lists.freeradius.org

How to cleanly shut down a PEAP TLS tunnel
by Joe Garcia 11 Sep '23

11 Sep '23

I've got a client that tries to shut down the TLS tunnel used for PEAP after running through the full authentication process and getting the Access-Accept/Success at the end. However the Access-Accept/Success comes in without a State attribute, and if the TLS Close-Alert (appropriately wrapped in several layers of outer protocols) is sent that way then FreeRADIUS reports: (18) eap: ERROR: EAP requires the State attribute to work, but no State exists in the Access-Request packet. (18) eap: ERROR: The RADIUS client is broken. No amount of changing FreeRADIUS will fix the RADIUS client. (18) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request If OTOH I use the State value from the last message preceding the Access-Accept/Success I get: (37) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x57f74ed950ff57da (37) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request What's the correct way to perform a clean shutdown of the TLS tunnel after completing the PEAP authentication process? Or do you just leave it hanging? Although no two diagrams seem to be able to agree on what happens at this point, one example is this: https://mrncciew.files.wordpress.com/2014/08/eap-peap-20.png which tears down the tunnel at step 15 and then the client gets the Access-Accept/Success at step 16/17, while with FreeRADIUS I'm getting the Access-Accept/Success before the TLS tunnel is torn down and then one of the two errors above with an attempt to tear down the tunnel. JG.

2 2

Is Radius Authorization bound to Radius Authentication?
by little-nemo＠virgilio.it 08 Sep '23

08 Sep '23

Dear members, I managed to autenticate users through MschapV2/ntlm_auth vs Active Directory (reference#1 https://networkradius.com/articles/2021/02/04/active-directory-with-FreeRAD…, reference#2 https://networkradius.com/articles/2021/09/29/configure-authentication-with…) Freeradius version: 3.0.21. Then I read "Authentication systems and protocol compatibility https://networkradius.com/articles/2021/10/08/authentication-system-and-pro…" and "Authenticating Users with LDAP https://freeradius.org/documentation/freeradius-server/3.2.4/concepts/modul…", so now I wonder whether I could also use LDAP(S) for the Authorization phase-only. The doubt comes from the presence of the "identity" in mods-available/ldap. Is that Identity used for the binding to AD? I guess so. Thus, username/password of the user trying to authenticate are not involved in the LDAP binding. Am I wrong? Is it worth to spend additional time to study how to setup LDAP Authorization? The primary goal is to read group membership but in future other needs may arise. Thanks in advance for your time. Pietro

2 1

freeradius windows machine authentication
by Härtl, Calvin 04 Sep '23

04 Sep '23

Hi all, first of all thanks for your great help in my past questions! Sadly, I have yet another one, that I can not quite figure out. Maybe I missed something, I don’t know. I tried looking for past list-threads, to no avail. When my Windows client connects to the WiFi and subsequently to the FreeRADIUS server, it first authenticates via machine authentication (host/HOSTNAME.MYDOMAIN.COM) This fails and the client cannot connect to the WiFi: (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) eap_mschapv2: authenticate { (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: Client is using MS-CHAPv2 (6) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (6) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (6) mschap: --> --username=host/HOSTNAME.DOMAIN.COM (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (6) mschap: --> --challenge=ef98e59da6aea4aa (6) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (6) mschap: --> --nt-response=1e7106295666480efb781446f97f618e57e09017da042590 (6) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)' (6) mschap: External script failed (6) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) (6) mschap: ERROR: MS-CHAP2-Response is incorrect (6) eap_mschapv2: [mschap] = reject (6) eap_mschapv2: } # authenticate = reject However, if I manually configure the WiFi on my Windows device to only use user authentication, it works flawlessly (as expected): (14) eap_mschapv2: authenticate { (14) mschap: Creating challenge hash with username: calvin.haertl (14) mschap: Client is using MS-CHAPv2 (14) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (14) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (14) mschap: --> --username=MYUSERNAME (14) mschap: Creating challenge hash with username: MYUSERNAME (14) mschap: Program returned code (0) (14) mschap: Adding MS-CHAPv2 MPPE keys (14) eap_mschapv2: [mschap] = ok (14) eap_mschapv2: } # authenticate = ok (14) eap_mschapv2: MSCHAP Success (14) eap: Sending EAP Request (code 1) ID 9 length 51 My FreeRADIUS server is connected to our Active Directory via SAMBA and winbind, and I checked that the users can authenticate via radtest. Is FreeRADIUS natively capable of doing machine authentication via AD, do I have to configure some additional files or are there any modules that I can install to do this for me? Kind regards, Calvin

4 5

Observing a common error in Freeradius with Postgres but not justification why it happens
by Ibrahim Al Mahfooz 02 Sep '23

02 Sep '23

Hello all, We have implemented freeradius 3.2.3 with Postgresql 12.15 to store accounting packets i.e start, interim-update, stop for reporting purposes. We customized the queries files to store fewer columns than the original schema since this is what we need. The following columns are customized in the accounting queries and same columns in postgres radacct table: radacctid, acctsessionid, acctuniqueid, acctstarttime, acctudpatetime, acctstoptime, callingstationid, framedipaddress, imei, 3gpplocation. Also the following indexes are in radacct table: 1. radacct_active_session_idx (this is the original from FR schema of postgresql) 2. framedipaddress, starttime, stoptime, updatetime (This one we added to use upon need in our read queries on report generation) Currently, from postgres dashboard we observe around 300-400 write/update transactions. The issue we noticed a couple of days ago is there were a lot of messages in radius log stating "Error: xxx requests have been waiting in the processing queue for x seconds. Check that all databases are running properly!" And sometimes we see another warning stating "Warning: Please check the configuration file. The value for 'max_requests' is probably set too low. " Based on the above observed messages, we tuned two matters: 1. the postgresql db by changing the default shared_buffer from 128MB to 8GB since we have plenty of RAM in the server, and this clearly reflected in the performance and removed around 98% of the above error messages. However we sometimes see the same error message showing up in peak hours and KPI of radius is impacted per the NAS report. After tuning the Postgres, we used pgbench and the following is what we get: [postgres@postgresql-syslog01 ~]$ pgbench -c 10 -j 2 -t 1000 my_benchmark_test_db starting vacuum...end. transaction type: <builtin: TPC-B (sort of)> scaling factor: 1 query mode: simple number of clients: 10 number of threads: 2 number of transactions per client: 1000 number of transactions actually processed: 10000/10000 latency average = 10.931 ms tps = 914.869517 (including connections establishing) tps = 915.175572 (excluding connections establishing) 2. In radiusd.conf we have the following, and we tuned max request to 32000, start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_request_time = 30 max_requests = 32000 Radius server specs: We have 4 sockets 1.87Ghz and RAM 8GB In Linux top command, load average is almost always : 0.17, 0.14, 0.13 Postgres server specs: 8 sockets 2.5Ghz and RAM 16GB In Linux top command, load average is around most of the time : 0.59, 0.50, 0.45 The questions to summarize are : 1. Is ~900 TPS and 10ms acceptable DB performance for accounting? 2. In the max_requests setting, what does the clients mean here, does it mean NAS client or SQL connections based on max requests? how to size it? 3. What could be the culprit given the fact all the servers are relaxed? Really appreciate your guidance here Best,

3 10

VLAN Assignment
by Rodrigo Abrantes Antunes 31 Aug '23

31 Aug '23

Hello, is there a guide to configure vlan assignment on freeradius? I searched the documentation and didn't find. Thanks.

5 6

Re: compilation problem deprecated: Since OpenSSL 3.0
by Joost Ringoot 29 Aug '23

29 Aug '23

Thanks for the suggestion. Meanwhile I found the eapoltest is available in debian as separate package, and it appears to function https://packages.debian.org/bookworm/eapoltest I have other questions however: Is there an upgrade or current documentation that handles EAP-TTLS? Can you provide a link? because this is all I can find on your site about it, all the searches and throughclicking seem to lead to this same PDF from 2014 (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) >> chapter 6 -EAP authentication, Pg 46,47) Further I read everywhere on internet that mschap and also mschapv2 is flawed microsoft advises not to use it https://learn.microsoft.com/en-us/windows/security/identity-protection/cred… some security sites show how to walk trough it's defense. https://www.kitploit.com/2021/09/assless-chaps-crack-mschapv2.html https://securityonline.info/assless-chaps-crack-mschapv2-challenge-response… Thanks, Joost ----- Original Message ----- > From: "Alan DeKok" <aland(a)deployingradius.com> > To: "Joost Ringoot" <joost.ringoot(a)meteo.be>, "hostap" <hostap(a)lists.infradead.org> > Sent: Thursday, 15 June, 2023 14:31:19 > Subject: Re: compilation problem deprecated: Since OpenSSL 3.0 > On Jun 15, 2023, at 6:30 AM, Joost Ringoot <joost.ringoot(a)meteo.be> wrote: >> I am trying to compile eampol_test >> >> "make eapol_test" >> >> (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) >> chapter 6 -EAP authentication, Pg 46,47) > > That guide was written long before OpenSSL3 came out. It is very likely that's > it's not relevant here. > > I suggest looking at the hostap source. > > $ git grep -i openssl3 > > That may be instructive. > > Alan DeKok.

2 1

Realm Config
by Carlos Botejara 25 Aug '23

25 Aug '23

I need to configure 2 realms, and validate users depending on the realm from which they connect, I need specific rules for each site (with different sql queries). The users are in a mysql database. I configured the Realms in the proxy.conf file as follows (because I don't have domain) realm1 { nostrip } realm2 { nostrip } The realm is configured in the Mikrotik router of each site. The Realm attribute for Mikrotik is Mikrotik-Realm [image: image.png] Could you help me with this?

2 6

Freeradius Authentification with active directory
by Etienne CREMILLIEUX 23 Aug '23

23 Aug '23

Hello, I try a connection my freeradius with active directory. the command sudo freeradius -X return this : *(1) ldap: --> Authenticated at 2023-08-23 17:16:46rlm_ldap (ldap): Reserved connection (1)(1) ldap: EXPAND (sAMAccountName=%{Stripped-User-Name}%{user-name}})(1) ldap: --> (sAMAccountName=wifirst_test(a)prodges.local})(1) ldap: Performing search in "ou=Utilisateurs,dc=prodges,dc=local" with filter "(sAMAccountName=login_test@**domain* *.local})", scope "sub"(1) ldap: Waiting for search result...(1) ldap: Search returned no resultsrlm_ldap (ldap): Released connection (1)Need more connections to reach 10 sparesrlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots usedrlm_ldap (ldap): Connecting to ldaps://172.19.16.7:636 <http://172.19.16.7:636>* I have a FreeRADIUS Version 3.2.1 on Debian GNU/Linux 12 (bookworm) My conf /etc/freeradius/3.0/mods-enabled/ldap : *ldap { # Note that this needs to match the name(s) in the LDAP server # certificate, if you're using ldaps. See OpenLDAP documentation # for the behavioral semantics of specifying more than one host. # # Depending on the libldap in use, server may be an LDAP URI. # In the case of OpenLDAP this allows additional the following # additional schemes: # - ldaps:// (LDAP over SSL) # - ldapi:// (LDAP over Unix socket) # - ldapc:// (Connectionless LDAP) server = 'ldaps://172.19.16.7 <http://172.19.16.7>'# server = 'ldap.rrdns.example.org <http://ldap.rrdns.example.org>'# server = 'ldap.rrdns.example.org <http://ldap.rrdns.example.org>' # Port to connect on, defaults to 389, will be ignored for LDAP URIs. port = 636 # Administrator account for searching and possibly modifying. # If using SASL + KRB5 these should be commented out. identity = 'login_sync(a)domain.local' password = 'password123' # Unless overridden in another section, the dn from which all # searches will start from. base_dn = 'DC=**domain* *,DC=local'* * user { # Where to start searching in the tree for users base_dn = "ou=Utilisateurs,dc=**domain* *,dc=local" # Filter for user objects, should be specific enough # to identify a single user object. # # For Active Directory, you should use # "samaccountname=" instead of "uid=" # # filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" filter = "(sAMAccountName=%{Stripped-User-Name}%{user-name}})" # filter = "(UserPrincipalName=%{Stripped-User-Name}:%{user-name}})" # For Active Directory nested group, you should comment out the previous 'filter = ...' # and use the below. Where 'group' is the group you are querying for. # # NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP_MATCHING_RULE_IN_CHAIN. # This applies only to DN attributes. This is an extended match operator that walks # the chain of ancestry in objects all the way to the root until it finds a match. # This reveals group nesting. It is available only on domain controllers with # Windows Server 2003 SP2 or Windows Server 2008 (or above). # # See: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-dir… <https://social.technet.microsoft.com/wiki/contents/articles/5392.active-dir…> # # filter = "(&(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf:1.2.840.113556.1.4.1941:=ou=Utilisateurs,dc=* *domain* *,dc=local))" # SASL parameters to use for user binds # # When we're prompted by the SASL library, these control # the responses given. # # Any of the config items below may be an attribute ref # or and expansion, so different SASL mechs, proxy IDs # and realms may be used for different users.* Regards Etienne -- *Ce message et toutes les pièces jointes (ci-après le "message") sont établis à l’intention exclusive des destinataires désignés. Il contient des informations confidentielles et pouvant être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de détruire le message. Toute utilisation de ce message non conforme à sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse de l'émetteur*

1 0

Fwd: AUTO AND MANUAL DISCONNECT NOT WORK FREE RADIUS-DALO RADIUSS
by King Slaver 23 Aug '23

23 Aug '23

---------- Forwarded message --------- From: King Slaver <nandishchauhan.ssstd9(a)gmail.com> Date: Sat, 19 Aug, 2023, 2:01 pm Subject: AUTO AND MANUAL DISCONNECT NOT WORK FREE RADIUS-DALO RADIUSS To: <freeradius-users-owner(a)lists.freeradius.org> Greetings, I have my local CentOS 7 VM, WITH FREE Radius version 3.0.22, and daloradius 1.3 All the things are configured correctly with openvpn, All accounting is working. But when accessperiod reaches, it sends a coa disconnect request, which results in recv- coa And disconnect ACK but the user still connected, if it loggot manualy on next login it gets error of plan reached. However fot me it is also not working manual radius -x disconnect, it does same send and gets received, user still got connected. It's been too long I been doing rnd, help me for it. I am waiting for answer soon. As I hope.

3 2

Regarding LDAP Module
by Vinit Bhosle 23 Aug '23

23 Aug '23

Dear Support, I have installed Freeradius 3.2.2. but I am getting an error while using LDAP module. Following is the error /usr/local/etc/raddb/mods-enabled/ldap[8]: Failed to link to module 'rlm_ldap': /usr/local/lib/rlm_ldap.so: cannot open shared object file: No such file or directory I am using CentOS Linux release 8.4.2105. How to load rlm_ldap ? Regards Vinit

2 1