FreeRADIUS latest package upgrade

viktor_g

@johnpoz said in FreeRADIUS latest package upgrade:

[forever] = noop
(1) if (notfound || noop) {
(1) if (notfound || noop) -> TRUE
(1) if (notfound || noop) {
(1) if (notfound || noop) {
(1) if (notfound || noop) -> TRUE
(1) if (notfound || noop) {
(1) [reject] = reject
(1) } # if (notfound || noop) = reject
(1) } # if (notfound || noop) = reject
(1) } # if ((notfound || noop) && (&control:Auth-Type != Accept)) = reject
(1) } # authorize = reject

this is about the _25 change that broke plain mac auth:
https://github.com/pfsense/FreeBSD-ports/commit/8f80400e337a7e97bd0dbdc73abf9727c911c9f2

it sequentially check all DB (files, sql, ldap) for user and reject authentication if not found.
Successfully tested with EAP-TLS and EAP-PEAP with files and LDAP backends.

could you provide more info about your configuration?
are you sure this user exists?

johnpoz

Yeah they exist - since they were logging on just before update.

What other info do you want? I can post up the full configs.

Here is login from yesterday from same phone.

Jan 28 01:16:49 	radiusd 	18052 	(582) Login OK: [johnsXR/<via Auth-Type = eap>] (from client uap-lite port 0 cli F4-06-16-4F-F6-36) 192.168.2.4 Auth-Type: eap

And above showed valid login from my wife phone.. So clearly the users exist..

They have been in use for like 2 years.. And were working just fine last night.. I woke up this morning noticed a few package updates. I updated them all... Then noticed this thread with newer update _26

So I updated to that.. After that is when I noticed my phone was not using the eap-tls ssid.. And was logged into one of my psk ssids.

So I tried to change it back over and it failed, that is when started to look in the log.. Is there I can reload package from before _25??

viktor_g

@johnpoz hm.. SQL backend?
please post /usr/local/etc/raddb/sites-enabled/default

johnpoz

No SQL backend..

 cat /usr/local/etc/raddb/sites-enabled/default
server default {
listen {
        type = auth
        ipaddr = 192.168.2.253
        port = 1812
}

authorize {
#       filter_username
#       filter_password
        preprocess
#       operator-name
#       cui
##### AUTHORIZE FOR PLAIN MAC-AUTH IS DISABLED #####
#       auth_log
        chap
        mschap
        digest
#       wimax
#       IPASS
        suffix
        ntdomain
        eap {
                ok = return
#               updated = return
        }
#       unix
        files
        if ((notfound || noop) && (&control:Auth-Type != Accept)) {
                        ### sql DISABLED ###
        -daily
        -weekly
        -monthly
        -forever
                if (notfound || noop) {
                        ### ldap ###
                        if (notfound || noop) {
                                reject
                        }
                }
        }
        # Formerly checkval
        if (&request:Calling-Station-Id == &control:Calling-Station-Id) {
                ok
        }
        expiration
        logintime
        pap
        Autz-Type Status-Server {

        }
}

authenticate {
        Auth-Type PAP {
                pap
        }
        Auth-Type CHAP {
                chap
        }
        Auth-Type MS-CHAP {
                mschap
        }
        mschap
        Auth-Type MOTP {
                motp
        }
        Auth-Type GOOGLEAUTH {
                googleauth
        }
        digest
#       pam
#       unix

        #Auth-Type LDAP {
                #ldap
                #### ldap2 disabled ###
        #}

        eap
#       Auth-Type eap {
#               eap {
#                       handled = 1
#               }
#               if (handled && (Response-Packet-Type == Access-Challenge)) {
#                       attr_filter.access_challenge.post-auth
#                       handled  # override the "updated" code from attr_filter
#               }
#       }
}

preacct {
        preprocess
##### ACCOUNTING FOR PLAIN MAC-AUTH DISABLED #####
#       acct_counters64
        update request {
                &FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"
        }
acct_unique
#       IPASS
        suffix
        ntdomain
        files
}

accounting {
#       cui
        detail
        ### This makes it possible to run the datacounter_acct module only on accounting-stop and interim-updates
        if ((request:Acct-Status-Type == Stop) || (request:Acct-Status-Type == Interim-Update)) {
                datacounterdaily
                datacounterweekly
                datacountermonthly
                datacounterforever
        }
#       unix
        radutmp
#       sradutmp
#       main_pool
        ### sql DISABLED ###
        daily
        weekly
        monthly
        forever
#       if (noop) {
#               ok
#       }
#       pgsql-voip
        exec
        attr_filter.accounting_response
        Acct-Type Status-Server {

        }
}

session {
#       radutmp
        radutmp
}

post-auth {
#       if (!&reply:State) {
#               update reply {
#                       State := "0x%{randstr:16h}"
#               }
#       }
        update {
                &reply: += &session-state:
        }
#       main_pool
#       cui
#       reply_log
### sql DISABLED ###
#       ldap
        exec
#       wimax
#       update reply {
#               Reply-Message += "%{TLS-Cert-Serial}"
#               Reply-Message += "%{TLS-Cert-Expiration}"
#               Reply-Message += "%{TLS-Cert-Subject}"
#               Reply-Message += "%{TLS-Cert-Issuer}"
#               Reply-Message += "%{TLS-Cert-Common-Name}"
#               Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}"
#
#               Reply-Message += "%{TLS-Client-Cert-Serial}"
#               Reply-Message += "%{TLS-Client-Cert-Expiration}"
#               Reply-Message += "%{TLS-Client-Cert-Subject}"
#               Reply-Message += "%{TLS-Client-Cert-Issuer}"
#               Reply-Message += "%{TLS-Client-Cert-Common-Name}"
#               Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}"
#       }
#       insert_acct_class
#       if (&reply:EAP-Session-Id) {
#               update reply {
#                       EAP-Key-Name := &reply:EAP-Session-Id
#               }
#       }
        remove_reply_message_if_eap
        Post-Auth-Type REJECT {
                # log failed authentications in SQL, too.
                # sql
                attr_filter.access_reject
                eap
                remove_reply_message_if_eap
        }
        Post-Auth-Type Challenge {

        }
}

pre-proxy {
#       operator-name
#       cui
#       files
        attr_filter.pre-proxy
#       pre_proxy_log
}

post-proxy {

#       post_proxy_log
        attr_filter.post-proxy
        eap
#       Post-Proxy-Type Fail-Accounting {
#                       detail
#       }
}
}
[2.4.5-RELEASE][admin@sg4860.local.lan]/root:

viktor_g

@johnpoz EAP-TLS? PEAP, TTLS?
same username registry in freeradius?
check /usr/local/etc/raddb/users

johnpoz

eap-tls

No there are no users listed in registry.. They have never been there, and worked before..

[2.4.5-RELEASE][admin@sg4860.local.lan]/root: cat /usr/local/etc/raddb/users
[2.4.5-RELEASE][admin@sg4860.local.lan]/root:

Have never had to put users in there before, not when using eap-tls and they have certs.

Again this was just working last night.. before update to _25 and then _26 no changes on anything.

So I added johnsXR as a user - and now working.. But they were never in there..

an 29 11:08:48 	radiusd 	9145 	(7) Login OK: [johnsXR/<via Auth-Type = eap>] (from client uap-pro port 0 cli F4-06-16-4F-F6-36) 192.168.2.2 Auth-Type: eap

A Former User

Wow, I thought you had to have a user that matched the common name of the cert?

johnpoz

Been working 2 years with no users listed in the freerad users group. I know that for sure..

I have 3 devices using eap-tls, well actually 4 (my pc - but its never on wireless) My phone, my wife phone and the ipad.

All three connect just fine, and show log as they authed. And there have been no users in the freerad users..

A Former User

Indeed strange.

I have to run out. Taking my elderly neighbor to get her Covid vaccine.

viktor_g

@johnpoz all users you created on the FreeRADIUS / Users page are saved in /usr/local/etc/raddb/users

it seems that you connected using this (fixed in _25) issue https://redmine.pfsense.org/issues/11054:

A user attempting TLS authentication with a certificate signed by the configured CA, and with a common name matching the user-provided identity, passes authentication even if that common name/identity is not a valid user configured under FreeRADIUS / Users. This option only seems to ensure the common name of the client certificate matches the user-provided identity.

johnpoz

Ok - so that was an issue that it would auth, even without users in the freerad users.. And you fixed that. So now I just add them that match the CN on the certs..

Not a big deal.. Thanks!!

All back to working for my 3 devices.. And it does make sense.. That users should also have to be listed in freerad to match the CN on the cert.

And - makes it easy to just delete a user vs worried about revoking a cert, etc. etc..

Thanks again for looking into this so quickly and link to the other bug that was fixed.. That was causing my problem.

edit: Project for this weekend maybe is moving to eap-tls via wpa3-enterprise.. I got wpa3 working on my psk ssids.. But have to do some reading - Not sure wpa3-enterprise really gets me all that much over wpa2-enterprise.. Can use a higher level encryption sure.. But not sure if makes any sense when using eap-tls.. Some reading to do..

But wpa3-psk is working nice.. Sad part is - with all these shitty iot devices, that don't support wpa3, you have to still run in wpa2/wpa3 mode..