April 2020 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

CentOS 8 packages missing winbind support?
by Josef Vybíhal 14 Jun '21

14 Jun '21

Packages for CentOS 8 at https://networkradius.com/freeradius-packages/ appear to be compiled without winbind support. Is there a reason for that? CentOS 7 package have it - not sure about other distros. ... snip... # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting_syslog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vlanlog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap_winbind" from file /etc/raddb/mods-enabled/mschap /etc/raddb/mods-enabled/mschap[1]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/mschap[1]: Instantiation failed for module "mschap_winbind" P.

6 12

Memory leak in FR 3.0.19 ?
by Arnaud LAURIOU 30 Jun '20

30 Jun '20

Hi, We are suspecting memory leak in FR 3.0.19 : process memory status show VmData always keep increasing leading to VmSwap use after a few days which also keep increasing. I have 2 questions : - What are the compile options to use valgrind ? only flag --enable-developper ?|| - In the changelog for version 3.0.20 : some memories problems seems to be solved, do you know when this version will be released ? (if the release date is close, we can wait to test this release rather than 3.0.19) Regards, Arnaud Lauriou

3 5

radmin : client/home_server list limited to 256 ?
by Arnaud LAURIOU 07 May '20

07 May '20

Hello, With FR 3.0.16 It seems that radmin 'show client (or home_server) list' has a limit to display 256 hosts max. Is there a way to increase this limit ? Regards, Arnaud Lauriou

3 3

Aborted connection
by Aurélio de Souza Ribeiro Neto 04 May '20

04 May '20

Hello, I´m using FreeRadius 3.0.19 and MySQL 5.7, and I got many errors in mysql log like: Aborted connection 17531 to db: 'freeradius' user: 'FREERADIUS' host: 'XXXXXXXXXX' (Got an error reading communication packets) My database is up to date and querys running very fast, something like 0.003s When it happens I have this messages in freeradius LOGs: WARNING: (131915) WARNING: Module rlm_sql became unblocked Error: Received conflicting packet from client ce-popfd-rb port 49756 - ID: 101 due to unfinished request in module sql. Giving up on old request What I need to adjust do solve this issue? Thanks

3 3

Vulnerability in FreeRADIUS
by HANCHATE Ravikiran (u5574292) 04 May '20

04 May '20

Dears, we received Vulnerability in FreeRADIUS , Can you please assist here, 1/ How this will impact on our radius infra ? 2/ what steps need to be taken to Apply the Linux Fedora patches regarding the FreeRADIUS vulnerability ? Please provide step by step guides or implement instructions to Apply the Linux Fedora patches ? Please let me know if you need any information on this ? Regards, Ravi *********DISCLAIMER********* This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Orange Belgium does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. Unless clearly and unambiguously stated otherwise, the content of this e-mail and its attachment is provided to you for information purposes only, and nothing herein shall be binding upon, or shall constitute or be construed as a binding offer of Orange Belgium. *****END OF DISCLAIMER*****

4 5

Best/simplest authentication method to validate an encrypted user/password against encrypted known-good.
by Gleb Lisikh 02 May '20

02 May '20

Hi guys! I am running into a bit of a problem where I least expected, so looking for a general advice here. I'd like to be able to authenticate a user by comparing password provided with the client's authentication request with what's in a password store. It can be easily done by Clear-Text password, of course, but I cannot have a known good password in that password store in Clear-Text form - only encrypted (doesn't really matter how). So ideally, i'd like to get an encrypted password string from a client, and compare it with an encrypted password string retrieved from the known good password store. The retrieval of the known good password is done in the python module. And I'd rather not use SQL instead for the Python. EAP methods encrypt the whole message using the user passwords as a key (as far as I understand it), which complicates the matter... Any advice as to what standard mechanism(s)/method(s) can be used in such case? I hope I explained it well enough... Thank you so much! Gleb

3 5

Freeradius-client
by erwin＠generex.de 30 Apr '20

30 Apr '20

Hi, How can I communicate to an external server encrypted (TLS)? Thanks, Erwin

2 1

Brocade attribute with AD
by Luke Smith 29 Apr '20

29 Apr '20

I'm curious to see if anyone using freeradius with Brocade and Active Directory and how they are successfully getting logins to work. I know that I need to add the attribute brocade-admin and I've got that configured on my AD and propagated but when I go to the Brocade/Extreme device I login with the AD credentials but the attribute doesn't get passed along. If I edit my client.conf file I can make a local username work just fine, but I don't want to manage user accounts out of freeradius, I want that managed by AD. Anyone have any insight? Thanks in advance! Luke Smith Director Network/IT Colorado Valley Communications direct: 979.247.8122 | mobile: 979.249.7376 email: lukes(a)coloradovalley.com<mailto:lukes@coloradovalley.com> url: http://www.cvctx.com<http://www.cvctx.com/> Confidentiality Notice: The information herein transmitted or attached is intended only for the person or entity to which this e-mail is addressed and may contain confidential and/or legally privileged material. Any review, retransmission, dissemination, other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this in error, please contact the sender immediately and delete the material from any and all computers, servers, and e-mail programs. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.

2 1

Re: The RADIUS client has mangled the State attribute
by Kyle Keilson 29 Apr '20

29 Apr '20

I've reviewed the debug output and it appears to point to the attr_filter.post_proxy filter. I should mention that the defaults for the attr_filter are in use and have not been changed. Here is the output when the server is processing packets: (0) Received Access-Request Id 150 from 192.168.1.5:61168 to 192.168.1.4:1812 length 381 (0) User-Name = "testuser(a)ringlingtest.com" (0) Service-Type = Framed-User (0) Cisco-AVPair = "service-type=Framed" (0) Framed-MTU = 1485 (0) EAP-Message = 0x02010018014b4b45494c534f4e4064657061756c2e656475 (0) Message-Authenticator = 0x168a719ee6ceaba1d478fa2f469bf647 (0) Cisco-AVPair = "audit-session-id=B5BF26D800000D54C6C4F544" (0) Cisco-AVPair = "method=dot1x" (0) Cisco-AVPair = "client-iif-id=855639101" (0) Cisco-AVPair = "vlan-id=5" (0) NAS-IP-Address = 192.168.1.5 (0) NAS-Port-Id = "capwap_9000013c" (0) NAS-Port-Type = Wireless-802.11 (0) NAS-Port = 6018 (0) Called-Station-Id = "07-4c-d9-2e-12-c0:eduroam" (0) Calling-Station-Id = "e0-32-7e-72-b4-9a" (0) Airespace-Wlan-Id = 4 (0) Cisco-AVPair = "cisco-wlan-ssid=eduroam" (0) NAS-Identifier = "test-controller" (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy split_username_nai { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) -> TRUE (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) update request { (0) EXPAND %{1} (0) --> testuser (0) &Stripped-User-Name := testuser (0) } # update request = noop (0) if ("%{3}" != '') { (0) EXPAND %{3} (0) --> ringlingtest.com (0) if ("%{3}" != '') -> TRUE (0) if ("%{3}" != '') { (0) update request { (0) EXPAND %{3} (0) --> ringlingtest.com (0) &Stripped-User-Domain = ringlingtest.com (0) } # update request = noop (0) } # if ("%{3}" != '') = noop (0) [updated] = updated (0) } # if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) = updated (0) ... skipping else: Preceding "if" was taken (0) } # policy split_username_nai = updated (0) if (noop || !&Stripped-User-Domain) { (0) if (noop || !&Stripped-User-Domain) -> FALSE (0) if (&Stripped-User-Domain != "ringling.edu") { (0) if (&Stripped-User-Domain != "ringling.edu") -> TRUE (0) if (&Stripped-User-Domain != "ringling.edu") { (0) update { (0) control:Load-Balance-Key := &Calling-Station-ID -> 'e0-32-7e-72-b4-9a' (0) control:Proxy-To-Realm := 'DEFAULT' (0) request:Operator-Name := "1ringling.edu" (0) } # update = noop (0) return (0) } # if (&Stripped-User-Domain != "ringling.edu") = noop (0) } # authorize = updated (0) Starting proxy to home server 163.253.30.2 port 1812 (0) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (0) pre-proxy { (0) attr_filter.pre-proxy: EXPAND %{Realm} (0) attr_filter.pre-proxy: --> DEFAULT (0) attr_filter.pre-proxy: Matched entry DEFAULT at line 50 (0) [attr_filter.pre-proxy] = updated (0) } # pre-proxy = updated (0) Proxying request to home server 163.253.30.2 port 1812 timeout 30.000000 (0) Sent Access-Request Id 59 from 0.0.0.0:42392 to 163.253.30.2:1812 length 160 (0) User-Name = "testuser" (0) EAP-Message = 0x02010018014b4b45494c534f4e4064657061756c2e656475 (0) Message-Authenticator = 0x168a719ee6ceaba1d478fa2f469bf647 (0) NAS-IP-Address = 192.168.1.4 (0) Called-Station-Id = "08-4f-f9-2e-13-c0:eduroam" (0) Calling-Station-Id = "e0-32-7e-72-b4-9a" (0) NAS-Identifier = "test-controller" (0) Operator-Name := "1ringling.edu" (0) Proxy-State = 0x313530 Waking up in 0.3 seconds. (0) Marking home server 163.253.30.2 port 1812 alive (0) Clearing existing &reply: attributes (0) Received Access-Reject Id 59 from 163.253.30.2:1812 to 199.27.242.193:42392 length 89 (0) Message-Authenticator = 0xde3171110d3a45e469ec27c03d000dad (0) EAP-Message = 0x04010004 (0) Reply-Message = "Empty Realm Forwarded by ringling.edu." (0) Proxy-State = 0x313530 (0) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (0) post-proxy { (0) attr_filter.post-proxy: EXPAND %{Realm} (0) attr_filter.post-proxy: --> DEFAULT (0) attr_filter.post-proxy: Matched entry DEFAULT at line 102 (0) [attr_filter.post-proxy] = updated (0) eap: No pre-existing handler found (0) [eap] = noop (0) } # post-proxy = updated (0) Login incorrect (Home Server says so): [testuser(a)ringlingtest.com] (from client test-controller port 6018 cli e0-32-7e-72-b4-9a) (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> testuser(a)ringlingtest.com (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> TRUE (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) update reply { (0) &Reply-Message !* ANY (0) } # update reply = noop (0) } # if (&reply:EAP-Message && &reply:Reply-Message) = noop (0) ... skipping else: Preceding "if" was taken (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect: [testuser(a)ringlingtest.com] (from client amplify-controller port 6018 cli e0-32-7e-72-b4-9a) (0) Sent Access-Reject Id 150 from 199.27.242.193:1812 to 192.168.1.5:61168 length 0 (0) Message-Authenticator = 0xde3171110d3a45e469ec27c03d000dad (0) EAP-Message = 0x04010004 (0) Finished request Waking up in 4.9 seconds. Kyle Keilson Manager, macOS Technology and Help Desk Institutional Technology Ringling College of Art and Design 2700 N Tamiami Trail Sarasota, FL 34234 Office: 941.359.7633 Web: www.ringling.edu <http://www.ringling.edu/> On 4/29/20, 12:26 PM, "Freeradius-Users on behalf of Alan DeKok" <freeradius-users-bounces+kkeilson=ringling.edu(a)lists.freeradius.org on behalf of aland(a)deployingradius.com> wrote: On Apr 29, 2020, at 12:21 PM, Kyle Keilson <kkeilson(a)ringling.edu> wrote: > > I’ve installed CentOS 8 with FreeRadius 3.0.17 and encountering an issue with eap proxied requests. When a client is proxied to another server, the EAP response is: > > eap: The RADIUS client has mangled the State attribute, OR you are forcing EAP in the wrong situation > > I’ve also noticed that the username from the EAP request is filtering out the suffix before proxying to another server. Any thoughts on why this is occurring? Because you configured it to do this. That isn't the default configuration. In order to see *why* this is happening, read the debug output. > Below is the output from radiusd -X command: That isn't helpful. See the docs: https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwiki.freer… We need to see the debug when the server is processing packets. Nothing else will help. Alan DeKok. - List info/subscribe/unsubscribe? See https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freera…

2 2