July 2020 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

CentOS 8 packages missing winbind support?
by Josef Vybíhal 14 Jun '21

14 Jun '21

Packages for CentOS 8 at https://networkradius.com/freeradius-packages/ appear to be compiled without winbind support. Is there a reason for that? CentOS 7 package have it - not sure about other distros. ... snip... # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting_syslog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vlanlog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap_winbind" from file /etc/raddb/mods-enabled/mschap /etc/raddb/mods-enabled/mschap[1]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/mschap[1]: Instantiation failed for module "mschap_winbind" P.

6 12

FR 3.0.21 on Debian Buster delivering strange cert+chain?
by Martin Pauly 19 Aug '20

19 Aug '20

Hi all, I'm getting an obscure effect with FR 3.0.21 on a fresh Debian Buster installation (I compiled myself from the download package). Despite an identical config (as compared to the predecessor with FR 3.017 on Debian Jessie), some clients will not match the server cert to the chain provided. Seemingly, these are all Apple supplicants and also eapol_test, see attached output Any idea what's going wrong? I've just seen there is FR 3.0.21 on buster-backports, are there any related changes in there? TIA, Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 9

rlm_ldap fails but ldapsearch works
by Victor 08 Aug '20

08 Aug '20

Hello, I'm trying to check whether a user belongs to a group or not: (0) if (LDAP-Group == "someusers") { (0) Searching for user in group "someusers" rlm_ldap (ldap): Reserved connection (6) (0) Using user DN from request "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" (0) Checking for user in group objects (0) EXPAND (&(cn=someusers)(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local)))) (0) --> (&(cn=someusers)(|(&(uid=common_user)(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local)))) (0) Performing search in "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" with filter "(&(cn=someusers)(|(&(uid=common_user)(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local))))", scope "sub" (0) Waiting for search result... (0) Search returned no results (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local", scope "base" (0) Waiting for search result... (0) No group membership attribute(s) found in user object rlm_ldap (ldap): Released connection (6) but ldapsearch -b "dc=domain,dc=local" "(&(cn=someusers)(member=uid\3dcommon_user\2ccn\3dusers\2ccn\3daccounts\2cdc\3ddomain\2cdc\3dlocal))" -D uid=common_user,cn=users,cn=accounts,dc=domain,dc=local -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: (&(cn=someusers)(member=uid\3dcommon_user\2ccn\3dusers\2ccn\3daccounts\2cdc\3ddomain\2cdc\3dlocal)) # requesting: ALL # # someusers, groups, accounts, domain.local dn: cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject description: Default group for all users cn: someusers ipaUniqueID: ebca3046-a5a0-11ea-8166-9a6e275fb41f member: uid=common_user,cn=users,cn=accounts,dc=domain,dc=local member: uid=very_special_user,cn=users,cn=accounts,dc=domain,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 and ldapsearch -b "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" -D uid=common_user,cn=users,cn=accounts,dc=domain,dc=local -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=common_user,cn=users,cn=accounts,dc=domain,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # common_user, users, accounts, domain.local dn: uid=common_user,cn=users,cn=accounts,dc=domain,dc=local displayName: utilisateur banal uid: common_user krbCanonicalName: common_user(a)DOMAIN.LOCAL objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson objectClass: inetuser objectClass: posixaccount objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipasshuser objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry objectClass: ipauserauthtypeclass loginShell: /bin/bash initials: ub gecos: utilisateur banal sn: banal homeDirectory: /home/common_user mail: common_user(a)domain.local krbPrincipalName: common_user(a)DOMAIN.LOCAL givenName: utilisateur cn: utilisateur banal ipaUniqueID: some_unique_ID uidNumber: theSameNumber gidNumber: theSameNumber krbPasswordExpiration: the_pass_exp krbLastPwdChange: the_pass_exp memberOf: cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local memberOf: cn=manyemoreusers,cn=groups,cn=accounts,dc=domain,dc=local ipaUserAuthType: o_type ipaSshPubKey: some_pubkey # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Some of the configuration: /etc/raddb/sites-enabled/default ... user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = 'uid=common_user,cn=users,cn=accounts,dc=domain,dc=local' scope = 'sub' membership_filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..ldapgroup})))" membership_attribute = 'memberOf' } /etc/raddb/mods-enabled/ldap ... post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } if (LDAP-Group == "someusers") { update { reply:Class := "OKOKOKOKOK" } } else { update { reply:Class := "NONONONONO" } } } Where to go from here? Kind regards

4 9

Exec module questions, v4
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 04 Aug '20

04 Aug '20

Hi all, Does the exec module in v4 still support "non-xlat" use, i.e. where you stipulate a program, run it, maybe collect output pairs values? If so, I have an example where the execution is a bit different from v3, and wanted to query it. Using pretty much stock setup, only just added two bits - one to update the cleartext-password for chap testing, and the other to reject the user every time, for another reason. I have an exec module "testexec" exec testexec { program='/etc/freeradius/test.sh' wait = yes input_pairs = request output_pairs = reply } And my test.sh program #!/bin/bash echo "Reply-Message := \"hello\"" exit 0 Some observations - The stdout output "pickup" didn't seem to be consistent, here I've used radtest to fire a test auth twice in a row without changing anything (let me know if you'd like to see the complete output) .. (0) pap - Setting &control:Auth-Type = pap (0) pap (updated) (0) testexec (yield) (0) EXPAND /etc/freeradius/test.sh (0) --> /etc/freeradius/test.sh (0) Running request (0) tmpl - Resuming execution (0) testexec - EXEC GOT -- Reply-Message := \"hello\" (0) testexec (ok) .. pap - Setting &control:Auth-Type = pap (1) pap (updated) (1) testexec (yield) (1) EXPAND /etc/freeradius/test.sh (1) --> /etc/freeradius/test.sh (1) Running request (1) tmpl - Resuming execution (1) testexec (ok) .. - Also, the module return code isn't the same as it used to be, i.e. where 0 was ok, 1 was reject, 2 fail, as per https://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html If I modify the program to: #!/bin/bash echo "Reply-Message := \"hello\"" exit 1 ./test.sh ; echo $? Reply-Message := "hello" 1 I still get (ok), not (reject), and some more output inconsistency, one has status code, one not, even with no modifications (except the exit code in the script) or restarting the service (3) pap - Setting &control:Auth-Type = pap (3) pap (updated) (3) testexec (yield) (3) EXPAND /etc/freeradius/test.sh (3) --> /etc/freeradius/test.sh (3) Running request (3) tmpl - Resuming execution (3) testexec (ok) pap - Setting &control:Auth-Type = pap (4) pap (updated) (4) testexec (yield) (4) EXPAND /etc/freeradius/test.sh (4) --> /etc/freeradius/test.sh (4) Running request (4) tmpl - Resuming execution (4) Program failed with status code 1 (4) testexec (ok) I'm not modifying the module behaviour with { reject=1 } etc. We used to rely on the text output, even if the exit code was non zero, and that exit code value to do some more stuff after a CoA request. I should try modifying my unlang to do some xlats instead, but thought I'd ask first - is it just me - do I not understand deliberate changes that have taken place? I've tried changing shell_escape value, using sh instead of bash, with similar results. Thanks! Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 6

Freeradius and smsotp
by Milovan Kotlica 30 Jul '20

30 Jul '20

Hi, I have installed Freeradius 2.1.12 on Centos 6 and I use Thomas Glanzmann SMSOTP. Now I want to migrate that on Centos 8. I installed Freeradius 3.0.17 and same SMSOTP. When I login on vpn I first type username/password and after that smsotp pin. On new instalation I have issue with smsotp. My first login is OK and smsotp module creates and send smsotp pin. But after I type smsotp pin on vpn radius reject. smsotpd.pl scripts return wornings: Subroutine _call redefined at (eval 155) line 30. Subroutine SendSMSExtService::want_som redefined at (eval 155) line 73. Subroutine AUTOLOAD redefined at (eval 155) line 90. Subroutine SendSMSExtService::SendSMSExt redefined at (eval 155) line 88. Server session encountered read error 104: Connection reset by peer Server session encountered read error 104: Connection reset by peer p.s. In attach is last part of Freeradius debug. Thanks

2 4

Virtual Servers & nas_table Server Column Problem
by Ali Arslan 29 Jul '20

29 Jul '20

Hello, I use freeradius 3.0.20 on ubuntu server 20.04 virtual machines with mssql backend accessed by freetds. I had 3 virtual machines just for freeradius, so i wanted to run them all on a single machine to make better use of resources and decided to make use of Virtual Server capability of freeradius. i kept the defualt site as the server of main ISP and added 2 more virtual servers, namely WISPServer and HotspotServer (for hotels and cafes) whose listen sections are as follows: server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } ... } server WISPServer { listen { type = auth ipaddr = * port = 2812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 2813 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 2812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 2813 type = acct limit { } } ... } server HotspotServer { listen { type = auth ipaddr = * port = 3812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 3813 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 3812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 3813 type = acct limit { } } ... } And sql module definitions are all similar except database names. sql { # default server # sql WISPSQL{ for WISPServer # sql HotspotSQL{ for HotspotServer dialect = "mssql" driver = "rlm_sql_freetds" server = "SQLServer" port = 1433 login = "sa" password = "<<servet>>" radius_db = "ISP" # radius_db = "WISP" for WISPServer # radius_db = "Hotspot" for HotspotServer acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radcheck" delete_stale_sessions = yes pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } read_clients = yes client_table = "nas" group_attribute = "SQL-Group" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } Here i use radcheck GroupName custom column to define groups, a user can only have a singe group and it is a calculated field. nas_table has a Server column to define virtual server name: nas_query = " SELECT Id, IPAddress, ShortName, 'other', Secret, ISNULL(Server, '') FROM ${nas_table}" The attached debug file shows that the client added to WISPServer clients list: rlm_sql (WISPSQL): Adding client 192.168.1.1 (ofis) to WISPServer clients list rlm_sql (192.168.1.1): Client "ofis" (WISPSQL) added But when the client ( 92.168.1.1 ) sends an accountig request i get error: Ignoring request to acct address * port 2813 bound to server WISPServer from unknown client 192.168.1.1 port 41272 proto udp To make it work i needed to do one two things, remove Server column from nas query or make it NULL (actually empty string, NULL does not work either), in this case it adds clients to global client list saying rlm_sql ( WISPSQL): Adding client 192.168.1.1 (ofis) to global clients list For security reasons i wan to define client for a Virtual Server, how can i make it work? An example debug oupt is attached. Thaks.

2 2

Lease Query is not working in latest master branch
by Chinnapaiyan, Nagamani 29 Jul '20

29 Jul '20

Hi, Lease Query is not working in latest master(#feb57bfef488dbb8a850b47b6a72eb1db0285fbe), Other messages are working fine. And same LQ was working fine previously. Debug output: Info : FreeRADIUS Version 4.0.0 Info : Copyright 1999-2020 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/raddb/dictionary" ... ... proto_dhcpv4_udp - Received DHCP-Request XID 13df720c length 332 dhcpv4_udp server 127.0.0.1 port 6767 on interface lo (11) Running request (11) Received DHCP-Request XID 13df720c from 127.0.0.1:6768 to 127.0.0.1:6767 via lo (11) DHCP-Opcode = Client-Message (11) DHCP-Hardware-Type = Ethernet (11) DHCP-Hardware-Address-Length = 6 (11) DHCP-Hop-Count = 0 (11) DHCP-Transaction-Id = 333410828 (11) DHCP-Number-of-Seconds = 0 (11) DHCP-Flags = 0 (11) DHCP-Client-IP-Address = 0.0.0.0 (11) DHCP-Your-IP-Address = 0.0.0.0 (11) DHCP-Server-IP-Address = 0.0.0.0 (11) DHCP-Gateway-IP-Address = 0.0.0.0 (11) DHCP-Client-Hardware-Address = 04:11:22:33:44:55 (11) DHCP-Message-Type = DHCP-Request (11) DHCP-Client-Identifier = 0x041122334455 (11) DHCP-Parameter-Request-List = DHCP-Subnet-Mask (11) DHCP-Parameter-Request-List = DHCP-Router-Address (11) DHCP-Parameter-Request-List = DHCP-Domain-Name-Server (11) DHCP-Vendor-Class-Identifier = 0x766961736174312e30 (11) DHCP-Subscriber-Id = "041122334455(a)aut.res.viasat.com" (11) DHCP-Relay-Remote-Id = 0x04a0bc112233 (11) DHCP-Relay-Circuit-Id = 0x00a0bc223344 (11) DHCP-Requested-IP-Address = 169.254.1.191 (11) DHCP-DHCP-Server-Identifier = 10.43.18.31 (11) Running 'recv DHCP-Request' from file /etc/raddb/sites-enabled/dhcp (11) recv DHCP-Request { ... ... TIMER - proto_dhcpv4_udp - cleanup delay proto_dhcpv4_udp - Received DHCP-Lease-Query XID 103fd54a length 321 dhcpv4_udp server 127.0.0.1 port 6767 on interface lo Failed tracking packet from client default - discarding it Regards, Nagamani Chinnapaiyan

2 3

tls: Failed changing permissions with networkradius.com packages
by Arnaud LAURIOU 29 Jul '20

29 Jul '20

Hi, We are replacing our default ubuntu (18.04) FR packages with those provided by networkradius.com (3.0.21). We use TLS (radsec), we kept the same tls virtual-server and with networkradius packages we have an error during the startup process : freeradius[19720]: tls: Failed changing permissions on /var/tmp/radsec: No such file or directory This directory exists, it is owned by freeradius user and it is empty : $ ls -al /var/tmp/radsec total 8 drwx------ 2 freerad freerad 4096 juil. 28 15:41 . drwxrwxrwt 7 root root 4096 juil. 28 17:15 .. In debug mode (freeradius -fxx -l stdout) : freeradius start fine, no error. listen { type = "auth" virtual_server = "default" ipaddr = 194.57.7.17 port = 2083 proto = "tcp" .. verify { skip_if_ocsp_ok = no tmpdir = "/var/tmp/radsec" client = "/usr/bin/openssl verify -CApath /etc/freeradius/certs -CAfile /etc/freeradius/certs/eduPKICA.crt %{TLS-Client-Cert-Filename}" } Any idea ? Regards, Arnaud Lauriou -- Direction des Services Applicatifs RENATER - Rennes https://www.renater.fr/

2 2

MAC address Randomization
by Eric Aguilar 28 Jul '20

28 Jul '20

Hello! I wanted to exchange some ideas on the impact we will all have on the MAC address randomization being implemented as an enabled by default feature on iOS14 Apple Devices (https://support.apple.com/en-us/HT211227) Some authentication procedures on our networks are based on the MAC address so I think the impact is going to be huge and certainly, analytics and accounting will be impacted as well. ¿What are your thoughts on this? ¿What are some workarounds we should implement? ¿are there any?

3 2