November 2020 - Freeradius-Users - lists.freeradius.org

expiration after one month, how?
by anisihadi2＠yahoo.com 14 Nov '20

14 Nov '20

Hello Dears I installed a freeradius server + mysql in centos 8 every thinks is ok but I want to expire one month after first login for a user. how can I do this. thank you about your great radius server. Best regard.

2 1

Automatic Yum upgrade of freeradius overwrite dictionary
by Rob Hughes 13 Nov '20

13 Nov '20

Hi, We have an auto yum upgrade on CentOS overwrite our /usr/share/freeradius/dictionary file last night. Is there a way to prevent this? Should we put $INCLUDE dictionary.whatever into /etc/raddb/dictionary instead? Regards Rob

2 1

Re: query on files under /etc/raddb/certs
by Dan Swartzendruber 13 Nov '20

13 Nov '20

Alan is on a roll, here! On November 12, 2020, at 7:14 PM, Alan DeKok <aland(a)deployingradius.com> wrote: On Nov 12, 2020, at 5:00 PM, SIMON BABY <simonkbaby(a)gmail.com> wrote: > > When I read the file README it says below content: Yes, please post that to the list. Because we haven't seen it before. > So can someone create a false certificate and key and create a session ? I think you didn't read my previous message. If someone breaks into your system, then having them read these certificate files is the LEAST of your worries. Stop worrying about useless things. If you want to know how the server uses these files, read the documentation and then default configuration files. > If we delete all these scripts also it is not possible to create any > certificate and we get complete control of where it gets the > certificates and keys ? Yes, because the scripts aren't available anywhere else on the Internet. Oh, wait... A secure system is *not* created by worrying about random things. A secure system is created by *understanding* things. Right now, you're asking very detailed questions, and not paying attention to the bigger picture. This is entirely the wrong approach. Your questions are irrelevant because they're based on a false understanding of how things work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

query on files under /etc/raddb/certs
by SIMON BABY 13 Nov '20

13 Nov '20

Hello, I see the files below are generated under /etc/raddb/certs directory. Can someone explain to me the usage of these files? Our system is very secure and did not want to create certs and keys dynamically. -rw-r--r-- 1 root 0 4393 Nov 5 18:47 01.pem -rw-r--r-- 1 root 0 4370 Nov 5 18:47 02.pem -rw-r----- 1 root 0 6155 Nov 5 18:42 Makefile -rw-r----- 1 root 0 8714 Nov 5 18:42 README -rwxr-x--- 1 root 0 2706 Nov 5 18:47 bootstrap -rw-r----- 1 root 0 1432 Nov 5 18:42 ca.cnf -rw-r--r-- 1 root 0 1256 Nov 5 18:47 ca.der -rw-r--r-- 1 root 0 1751 Nov 5 18:47 ca.key -rw-r--r-- 1 root 0 1757 Nov 5 18:47 ca.pem -rw-r----- 1 root 0 1103 Nov 5 18:42 client.cnf -rw-r--r-- 1 root 0 4370 Nov 5 18:47 client.crt -rw-r--r-- 1 root 0 1045 Nov 5 18:47 client.csr -rw-r--r-- 1 root 0 1743 Nov 5 18:47 client.key -rw-r--r-- 1 root 0 2581 Nov 5 18:47 client.p12 -rw-r--r-- 1 root 0 3545 Nov 5 18:47 client.pem -rw-r--r-- 1 root 0 424 Nov 5 18:47 dh -rw-r--r-- 1 root 0 229 Nov 5 18:47 index.txt -rw-r--r-- 1 root 0 21 Nov 5 18:47 index.txt.attr -rw-r--r-- 1 root 0 21 Nov 5 18:47 index.txt.attr.old -rw-r--r-- 1 root 0 120 Nov 5 18:47 index.txt.old -rw-r----- 1 root 0 1131 Nov 5 18:42 inner-server.cnf -rw-r--r-- 1 root 0 166 Nov 5 18:42 passwords.mk -rw-r--r-- 1 root 0 3 Nov 5 18:47 serial -rw-r--r-- 1 root 0 3 Nov 5 18:47 serial.old -rw-r----- 1 root 0 1125 Nov 5 18:42 server.cnf -rw-r--r-- 1 root 0 4393 Nov 5 18:47 server.crt -rw-r--r-- 1 root 0 1062 Nov 5 18:47 server.csr -rw-r--r-- 1 root 0 1751 Nov 5 18:47 server.key -rw-r--r-- 1 root 0 2589 Nov 5 18:47 server.p12 -rw-r--r-- 1 root 0 3576 Nov 5 18:47 server.pem -rw-r--r-- 1 root 0 3545 Nov 5 18:47 user(a)example.org.pem -rw-r----- 1 root 0 708 Nov 5 18:42 xpextensions Regards Simon

2 5

Status-Server requests are blocked if an Access-Request is waiting for downstream service to respond
by Ignacio Arces 12 Nov '20

12 Nov '20

Hello, I'm running a containerized FreeRADIUS server v3.0.19 with a custom authentication module written in C language that authenticates users through a HTTP API. I also configured the Status server as detailed in https://wiki.freeradius.org/config/Status and I'm using it to monitor my server by sending Server-Status requests using raclient to health check my server. We recently experienced an outage in the auth API and since we didn't have timeouts properly configured in the curl calls in our custom C module, the requests were hanging indefinitely. When this happened, we also noticed that our containerized server was restarted by Docker as the container was set to "Unhealthy" state, so the health checks were failing. Troubleshooting the health checks we found that Status-Server requests were not responding while the auth request was hanging waiting for the auth API to respond. Now that we have a 10s timeout properly configured in our curl requests, we have mitigated the undesired restarts but we still can understand why even a single stuck auth request is impacting Status-Server request.

2 4

Packet-Src-IP-Address Unknown attribute
by Onur GURSOY 12 Nov '20

12 Nov '20

Hello All, Thanks for your all of answer in advance. I have some trouble about perl module. freeradius rlm_perl module requires libperl5.26 in ubuntu 18.04 but in 20.04 there is per which is version 5.30 so freeradius didn't start. when i install activeperl which has include libperl.so,5.26 I got error like this: /opt/sinecins/bin/freeradius/etc/raddb/mods-enabled/detail[34]: Failed > parsing expanded string: > /opt/sinecins/bin/freeradius/etc/raddb/mods-enabled/detail[34]: > ...reeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/det... > /opt/sinecins/bin/freeradius/etc/raddb/mods-enabled/detail[34]: But i remove perl module from mods-enable, freeradius begins. I couldn't understand clearly where is the relationship and error Many thanks, With My Best Regards, -- Onur GÜRSOY R&D Engineer in Embedded Systems Master Student at Gebze Institute Of Technology Department Of Electronic Engineering GSM : 0(545) 764 7653 e-mail: onurgursoygyte(a)gmail.com

2 1

linelog permission issue
by lingctam 12 Nov '20

12 Nov '20

Dear all, My client authentications keep failing due to linelog permissions issues: Thu Nov 12 19:22:15 2020 : Auth: (58) Login OK: [xxxxxxxxxxxxxx(a)anon.com] (from client xxxxxxxxxx port 0 via TLS tunnel) Thu Nov 12 19:22:15 2020 : Error: rlm_linelog: Failed to open /radius/log/linelog-20201112: Permission denied Thu Nov 12 19:22:15 2020 : Error: rlm_linelog: Failed to open /radius/log/linelog-20201112: Permission denied Thu Nov 12 19:22:15 2020 : Auth: (59) Rejected in post-auth: [xxxxxxxxxxx(a)anon.com] (from client xxxxxxxxxxxx port 13 cli 0ec84fa38cad) There are no issues writing into authentication, accounting, and reply logs. I have set 660 permissions for the linelog module as well. Could someone please help? Or offer a way to bypass this? Authentications are fine once linelog has been commented out in the virtual server configs... but having the linelog would help immensely in monitoring the authentications coming in the hundreds per minute. Thanks in advance.

3 2

radius tls for dynamic-authorization
by murugesh pitchaiah 12 Nov '20

12 Nov '20

Hi I am working on using freeradius as radsec server (radius tls). Able to see auth and acct works good. Is it feasible to do it for dynamic-authorization as well ? In the 'sites-available/tls' file not able to add ' coa' to type along with 'auth+acct'. Also I see the 'coa' file in sites-available; but not sure if feasible to configure it for TLS with listening in port 2083. Please share comments.Thanks. Thanks. murugesh

2 2

802.1x supplicant address with freeradius backend
by X Xiao 11 Nov '20

11 Nov '20

I'm using EAP/802.1x (hostapd) along with freeradius to authenticate wireless users which worked well, is there a way for me to know which IP address is used by each logged-in user? Thanks,

3 2

RADIUS TOTP Setup
by Nemanja Simpraga 11 Nov '20

11 Nov '20

Greetings, I am working on a TOTP authentication method setup with FreeRADIUS. For starters, I'd just like to generate a static user which uses TOTP (Time-based One-Time Passwords) to authenticate against the server. My company uses BitWarden which has an integrated Authenticator feature which can generate TOTP tokens which you can use for passing MFA challenges and logging in. Is it possible to have a user defined in RADIUS which is bound to a BitWarden token generator in some way? We do the same thing for accounts in our directory. The codes MSFT generates for their intended MSFT Auth mobile app I put into the BitWarden token generator to bind those accounts to the generator. After that I can use the codes from BitWarden to pass the MFA challenge and sign in. I've read about multiOTP and LinOTP but I can't seem to understand how they fit into this picture. Am I going in the right direction with this? Is this BitWarden setup possible? I am still quite new to FreeRADIUS, so bear with me. Thank you! Best regards, [cid:image001.png@01D6A951.934B5080] [cid:image002.png@01D6A951.934B5080]<https://www.facebook.com/iOLAPInc/> [cid:image003.png@01D6A951.934B5080] <https://twitter.com/iolapinc> [cid:image004.png@01D6A951.934B5080] <https://www.linkedin.com/company/iolap/> [cid:image005.png@01D6A951.934B5080] <https://iolap.com/> NEMANJA ŠIMPRAGA System Network Administrator [cid:image006.png@01D6A951.934B5080] nsimpraga(a)iolap.com<mailto:nsimpraga@iolap.com> +385 95 922 71 70

2 3