I have an (explicit) forward proxy configured with an authentication method RADIUS and using the tester shows me valid user accounts. They ALL get denied by the proxy however (even local database users). When disabling authentication, anonymous explicit proxy works fine.
Where can I get more insights about the malfunction? Was working before the last update (I guess it was 19.1.7->19.1.8)
access log file says TCP_DENIED/407
it has to do with RADIUS users not inheriting the "Proxy: Login" privilege. a local user with that right works fine. How to ensure a valid RADIUS user is eligible again?
the tester shows me "no groups" for my RADIUS users.
so the webproxy has changed. earlier on, any valid RADIUS user was allowed for "Proxy: Login". now they are all stalled. How to restore functionality?
They switched to pam authentification. If no manual hacks have been done via cli, I would suggest to click save/apply in the proxy/radius sections . Then the configuration should be rewriten/updated with pam support.
For more info and how to test see here:
https://forum.opnsense.org/index.php?topic=12813.msg59345#msg59345 (https://forum.opnsense.org/index.php?topic=12813.msg59345#msg59345)
saved both RADIUS and PROXY but the error persists. RADIUS users do not inherit the proxy:login privilege and as the RADIUS-based authN does not provide any group memberships, the users cannot inherit from there. it's fully broken by design AFAIK.
how to apply for a fix?
opnsense-login also shows "user <xyz> NOT authenticated for service squid"
so the new PAM logic is in place but fails with "all modules were unsuccessful for pam_sm_authenticate()". it seems it has only been checked for ldap-based authentication with respective group configured for the proxy privilege but when using RADIUS, there is no such group import. tester shows no groups. this is a true deadlock and failure by design AFAIK.
opnsense-patch 450ff5b5
Whew, this had to go all the way through Twitter to succeed 8)
https://twitter.com/opnsense/status/1135929896545464322
The patch is part of 19.1.9 tomorrow.
Cheers,
Franco