- Freeradius-Devel - lists.freeradius.org

Dual mode rejecting accounting requests in tcp only mode
by Natarajan M 03 Jun '22

03 Jun '22

If I use auth+acct with TLS+TCP, then both authentication & accounting packets are accepted, but if I use same auth+acct with just TCP no TLS, then accounting packets are rejected as invalid code. When I look at tls_listen.c vs listen.c, I see following code snippet in tls_listen.c is missing in listen.c, patching this fixes the issue also. Is it just a bug or design intent was to support auth+acct only for TLS? Thanks Natarajan diff --git a/src/main/listen.c b/src/main/listen.c index 19d22a24fd..0bd88cdde0 100644 --- a/src/main/listen.c +++ b/src/main/listen.c @@ -575,7 +575,16 @@ static int dual_tcp_recv(rad_listen_t *listener) #ifdef WITH_ACCOUNTING case PW_CODE_ACCOUNTING_REQUEST: - if (listener->type != RAD_LISTEN_ACCT) goto bad_packet; + if (listener->type != RAD_LISTEN_ACCT) { + /* + * Allow auth + dual. Disallow + * everything else. + */ + if (!((listener->type == RAD_LISTEN_AUTH) && + (listener->dual))) { + goto bad_packet; + } + } FR_STATS_INC(acct, total_requests); fun = rad_accounting; break;

2 1

Periodic Data Usage Reporting
by Max James 10 Apr '22

10 Apr '22

Hey all, I have followed the below "Periodic Data Usage Reporting" article found on the freeradius wiki. https://wiki.freeradius.org/guide/Data-Usage-Reporting I am using the postgresql process-radacct.sql script which can be found on the freeradius-server github. https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-conf… The implementation was successful and works as expected, however I did notice an issue that I can't seem to figure out myself. If a users session ends and a new one begins, the next time the fr_new_data_usage_period() function is executed, it seems to be inserting the data usage for that entire session instead of only the data usage that was accrued since the last time the function was executed. The function reports usage as expected until it comes across users that have a new session since the function was last executed. I've spent a few hours trying to figure out the cause but I've had no luck. Any advice or help is much appreciated. Thanks in advance. Kind regards, Max

3 3

FreeRADIUS / pam_radius
by Senouci Briksi, Djelloul 17 Feb '22

17 Feb '22

Hi, We are using pam_radius to authenticate a witty http-browser (client) to a freeradius server. Our freeradius server is configured to send a dedicated/special Reply-Message when responding to an authenticate-request. I have seen in pam_radius_auth.c<https://github.com/FreeRADIUS/pam_radius/blob/master/src/pam_radius_auth.c> that Reply-Messages are only read as long as (response->code == PW_ACCESS_CHALLENGE). Reply-Messages are currently not read if (response->code == PW_AUTHENTICATION_ACK). Is there a reason why Reply-Messages are not read in this case? Freundliche Grüsse / Best regards / Cordialement Djelloul Briksi Software Development ANNAX Schweiz AG Zentweg 9 - 3006 Bern - Switzerland ------------------------------------------------------------------------ Phone: +41 31 950 86-21 Fax: +41 31 950 86-10 ------------------------------------------------------------------------ E-Mail: djelloul.briksi(a)wabtec.com Skype: djelloul.briksi(a)wabtec.com Internet: www.annax.de This email and any attachments are only for use by the intended recipient(s) and may contain legally privileged, confidential, proprietary or otherwise private information. Any unauthorized use, reproduction, dissemination, distribution or other disclosure of the contents of this e-mail or its attachments is strictly prohibited. If you have received this email in error, please notify the sender immediately and delete the original. Neither this information block, the typed name of the sender, nor anything else in this message is intended to constitute an electronic signature unless a specific statement to the contrary is included in this message.

2 6

Patch freeradius-server-release_3_0_25 for choosing server certificate based on SNI in tls client hello
by Natarajan M 21 Jan '22

21 Jan '22

Freeradius provides the ability to respond with different server certificates depending on SNI (Server-name-Indication) in the radsec's TLS client hello msg. But this functionality didn't work (always returned default server certificate irrespective of SNI). This is because in the callback tls_sni_callback, conf->realms check was failing. This comes from the tls_reals_load function in tls.c file where a hashtable is created and entries are added but conf->realms didn't get assigned to this hashtable. Following patch fixes the issues. Please correct if my understanding/root cause is incorrect. --- tls.c.orig 2022-01-21 05:51:27.428815007 +0000 +++ tls.c 2022-01-21 05:51:42.592755195 +0000 @@ -4505,7 +4505,7 @@ goto error; } } - + conf->realms = ht; return 0; }

2 1

Mailing list move
by Matthew Newton 19 Jan '22

19 Jan '22

At some point over the next week or so we're planning to migrate the FreeRADIUS mailing lists over to a different server. Apart from the possibility of mail being delayed a bit, hopefully nobody will notice much... -- Matthew

1 1

FreeRADIUS 3.0.23 custom mysql queries in mysql/queries.conf
by Dave Grassi 01 Oct '21

01 Oct '21

I'm trying to add a custom query for the accounting section under interim-update, but have been somewhat unsuccessful in my goal. I was able to add my custom query (saving and manipulating octets in a new table), but by doing so it disables the original update/insert queries. Disable might be the wrong word, it seems that you can only have 2 queries per section (an update and insert which one should succeed). If I move my queries below the original insert/updating accounting queries, those run but now mine do not. I then tried moving my custom query into its own section interim-update {} however the behavior persists, only the 1st interim-update scope gets processed. If I move my interim-update scope above the original interim-update scope, my mysql queries execute but the original interm-update is skipped. I also tried creating my own accounting{} scope with type{} then interim-update{} and put my own queries there, but same behavior they are skipped. Any assistance would be appreciated.

2 1

Block guest VPN
by Sazzad Hossain 21 Sep '21

21 Sep '21

Hello, At first, Thanks in advance for your valuable time! I want to block our Guest users to use our VPN and i wrote following under / sites-enable/default. *ldap* * if (&control:Ldap-Group [*] == "Gast") { update control { AUth-Type = reject } }* and under /freeradius/users *DEFAULT Ldap-Group == "Gast", Auth-Type := Reject Fall-Through = yes* when i compile it then shows the following output. ______________________________________________________________ root@xx:/etc/freeradius/3.0/sites-enabled# freeradius -X FreeRADIUS Version 3.0.20 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/ldap including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/detail including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/rfc7542 including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/debug including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default /etc/freeradius/3.0/sites-enabled/default[426]: *Parse error in condition* /etc/freeradius/3.0/sites-enabled/default[426]: *(&control:Ldap-Group [*] == "Gast") {* /etc/freeradius/3.0/sites-enabled/default[426]: *^ Invalid text. Expected comparison operatorErrors reading or parsing /etc/freeradius/3.0/radiusd.conf* Any suggestion please? Have a nice day! Best regards

2 1

(no subject)
by Sazzad Hossain 21 Sep '21

21 Sep '21

Hello, At first, Thanks in advance for your valuable time! I want to block our guest to use our VPN and i wrote

1 0

freeradius <---> sambaNT ldap
by Sazzad Hossain 26 Aug '21

26 Aug '21

Hello, At first, Thanks in advance for your valuable time! In my ldap(productive) server user password is saved in SambaNT format. For test purpose i write clear test password [*radtest user CleartextPassword 127.0.0.1 1812 testing123*] and then obviously it shows error. Can anyone help me What can i do? One more question, when i will test from my test freeradius(server) PC to productive ldap server,should i have to write 127.0.0.1 in the (test)command [ *radtest user CleartextPassword 127.0.0.1 1812 testing123* ]? Have a nice day! . ############################################################################################################### root@xx:~# freeradius -X FreeRADIUS Version 3.0.20 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License 0) Received Access-Request Id 79 from 127.0.0.1:50497 to 127.0.0.1:1812 length 76 (0) User-Name = "riedel" (0) User-Password = "testtest1A" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x07cfed3ddf824369cf2e958253e1f76b (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "riedel", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=riedel) (0) ldap: Performing search in "ou=people,dc=de" with filter "(uid=riedel)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=riedel,ou=people,dc=de" (0) ldap: Processing user attributes (0) ldap: control:Password-With-Header += '971a62f4bb490cb69e9661cac35a2274' rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://10.9.25.56:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = updated (0) [expiration] = noop (0) [logintime] = noop (0) pap: No {...} in Password-With-Header, re-writing to Cleartext-Password (0) pap: Removing &control:Password-With-Header (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password *(0) pap: ERROR: Cleartext password does not match "known good" password* (0) pap: Passwords don't match (0) [pap] = reject (0) } # Auth-Type PAP = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> riedel (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 79 from 127.0.0.1:1812 to 127.0.0.1:50497 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 79 with timestamp +3

2 7

Adding Cleartext-Password for EAP requests (new module development)
by Suneth Kariyawasam 11 Aug '21

11 Aug '21

Hello, I am trying to develop a freeradius module for authorization with OpenIAM and the module works fine with PAP and EAP-TTLS with PAP. Is there a way to decode the EAP packet and access the User-Password attributes within the mod_authorize method of my module or using an unlang policy? Currently, EAP-TTLS wth PAP only woks because when the request is tunneled eap_ttls copy all attributes but with MS-CHAP and others are not working due to missing Cleartext-Password. Thank you, Suneth.

2 10