July 2020 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

CentOS 8 packages missing winbind support?
by Josef Vybíhal 14 Jun '21

14 Jun '21

Packages for CentOS 8 at https://networkradius.com/freeradius-packages/ appear to be compiled without winbind support. Is there a reason for that? CentOS 7 package have it - not sure about other distros. ... snip... # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting_syslog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vlanlog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap_winbind" from file /etc/raddb/mods-enabled/mschap /etc/raddb/mods-enabled/mschap[1]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/mschap[1]: Instantiation failed for module "mschap_winbind" P.

6 12

FR 3.0.21 on Debian Buster delivering strange cert+chain?
by Martin Pauly 19 Aug '20

19 Aug '20

Hi all, I'm getting an obscure effect with FR 3.0.21 on a fresh Debian Buster installation (I compiled myself from the download package). Despite an identical config (as compared to the predecessor with FR 3.017 on Debian Jessie), some clients will not match the server cert to the chain provided. Seemingly, these are all Apple supplicants and also eapol_test, see attached output Any idea what's going wrong? I've just seen there is FR 3.0.21 on buster-backports, are there any related changes in there? TIA, Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 9

rlm_ldap fails but ldapsearch works
by Victor 08 Aug '20

08 Aug '20

Hello, I'm trying to check whether a user belongs to a group or not: (0) if (LDAP-Group == "someusers") { (0) Searching for user in group "someusers" rlm_ldap (ldap): Reserved connection (6) (0) Using user DN from request "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" (0) Checking for user in group objects (0) EXPAND (&(cn=someusers)(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local)))) (0) --> (&(cn=someusers)(|(&(uid=common_user)(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local)))) (0) Performing search in "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" with filter "(&(cn=someusers)(|(&(uid=common_user)(memberOf=cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local))))", scope "sub" (0) Waiting for search result... (0) Search returned no results (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local", scope "base" (0) Waiting for search result... (0) No group membership attribute(s) found in user object rlm_ldap (ldap): Released connection (6) but ldapsearch -b "dc=domain,dc=local" "(&(cn=someusers)(member=uid\3dcommon_user\2ccn\3dusers\2ccn\3daccounts\2cdc\3ddomain\2cdc\3dlocal))" -D uid=common_user,cn=users,cn=accounts,dc=domain,dc=local -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: (&(cn=someusers)(member=uid\3dcommon_user\2ccn\3dusers\2ccn\3daccounts\2cdc\3ddomain\2cdc\3dlocal)) # requesting: ALL # # someusers, groups, accounts, domain.local dn: cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject description: Default group for all users cn: someusers ipaUniqueID: ebca3046-a5a0-11ea-8166-9a6e275fb41f member: uid=common_user,cn=users,cn=accounts,dc=domain,dc=local member: uid=very_special_user,cn=users,cn=accounts,dc=domain,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 and ldapsearch -b "uid=common_user,cn=users,cn=accounts,dc=domain,dc=local" -D uid=common_user,cn=users,cn=accounts,dc=domain,dc=local -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=common_user,cn=users,cn=accounts,dc=domain,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # common_user, users, accounts, domain.local dn: uid=common_user,cn=users,cn=accounts,dc=domain,dc=local displayName: utilisateur banal uid: common_user krbCanonicalName: common_user(a)DOMAIN.LOCAL objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson objectClass: inetuser objectClass: posixaccount objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipasshuser objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry objectClass: ipauserauthtypeclass loginShell: /bin/bash initials: ub gecos: utilisateur banal sn: banal homeDirectory: /home/common_user mail: common_user(a)domain.local krbPrincipalName: common_user(a)DOMAIN.LOCAL givenName: utilisateur cn: utilisateur banal ipaUniqueID: some_unique_ID uidNumber: theSameNumber gidNumber: theSameNumber krbPasswordExpiration: the_pass_exp krbLastPwdChange: the_pass_exp memberOf: cn=someusers,cn=groups,cn=accounts,dc=domain,dc=local memberOf: cn=manyemoreusers,cn=groups,cn=accounts,dc=domain,dc=local ipaUserAuthType: o_type ipaSshPubKey: some_pubkey # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Some of the configuration: /etc/raddb/sites-enabled/default ... user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = 'uid=common_user,cn=users,cn=accounts,dc=domain,dc=local' scope = 'sub' membership_filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..ldapgroup})))" membership_attribute = 'memberOf' } /etc/raddb/mods-enabled/ldap ... post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } if (LDAP-Group == "someusers") { update { reply:Class := "OKOKOKOKOK" } } else { update { reply:Class := "NONONONONO" } } } Where to go from here? Kind regards

4 9

Exec module questions, v4
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 04 Aug '20

04 Aug '20

Hi all, Does the exec module in v4 still support "non-xlat" use, i.e. where you stipulate a program, run it, maybe collect output pairs values? If so, I have an example where the execution is a bit different from v3, and wanted to query it. Using pretty much stock setup, only just added two bits - one to update the cleartext-password for chap testing, and the other to reject the user every time, for another reason. I have an exec module "testexec" exec testexec { program='/etc/freeradius/test.sh' wait = yes input_pairs = request output_pairs = reply } And my test.sh program #!/bin/bash echo "Reply-Message := \"hello\"" exit 0 Some observations - The stdout output "pickup" didn't seem to be consistent, here I've used radtest to fire a test auth twice in a row without changing anything (let me know if you'd like to see the complete output) .. (0) pap - Setting &control:Auth-Type = pap (0) pap (updated) (0) testexec (yield) (0) EXPAND /etc/freeradius/test.sh (0) --> /etc/freeradius/test.sh (0) Running request (0) tmpl - Resuming execution (0) testexec - EXEC GOT -- Reply-Message := \"hello\" (0) testexec (ok) .. pap - Setting &control:Auth-Type = pap (1) pap (updated) (1) testexec (yield) (1) EXPAND /etc/freeradius/test.sh (1) --> /etc/freeradius/test.sh (1) Running request (1) tmpl - Resuming execution (1) testexec (ok) .. - Also, the module return code isn't the same as it used to be, i.e. where 0 was ok, 1 was reject, 2 fail, as per https://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html If I modify the program to: #!/bin/bash echo "Reply-Message := \"hello\"" exit 1 ./test.sh ; echo $? Reply-Message := "hello" 1 I still get (ok), not (reject), and some more output inconsistency, one has status code, one not, even with no modifications (except the exit code in the script) or restarting the service (3) pap - Setting &control:Auth-Type = pap (3) pap (updated) (3) testexec (yield) (3) EXPAND /etc/freeradius/test.sh (3) --> /etc/freeradius/test.sh (3) Running request (3) tmpl - Resuming execution (3) testexec (ok) pap - Setting &control:Auth-Type = pap (4) pap (updated) (4) testexec (yield) (4) EXPAND /etc/freeradius/test.sh (4) --> /etc/freeradius/test.sh (4) Running request (4) tmpl - Resuming execution (4) Program failed with status code 1 (4) testexec (ok) I'm not modifying the module behaviour with { reject=1 } etc. We used to rely on the text output, even if the exit code was non zero, and that exit code value to do some more stuff after a CoA request. I should try modifying my unlang to do some xlats instead, but thought I'd ask first - is it just me - do I not understand deliberate changes that have taken place? I've tried changing shell_escape value, using sh instead of bash, with similar results. Thanks! Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 6

Freeradius and smsotp
by Milovan Kotlica 30 Jul '20

30 Jul '20

Hi, I have installed Freeradius 2.1.12 on Centos 6 and I use Thomas Glanzmann SMSOTP. Now I want to migrate that on Centos 8. I installed Freeradius 3.0.17 and same SMSOTP. When I login on vpn I first type username/password and after that smsotp pin. On new instalation I have issue with smsotp. My first login is OK and smsotp module creates and send smsotp pin. But after I type smsotp pin on vpn radius reject. smsotpd.pl scripts return wornings: Subroutine _call redefined at (eval 155) line 30. Subroutine SendSMSExtService::want_som redefined at (eval 155) line 73. Subroutine AUTOLOAD redefined at (eval 155) line 90. Subroutine SendSMSExtService::SendSMSExt redefined at (eval 155) line 88. Server session encountered read error 104: Connection reset by peer Server session encountered read error 104: Connection reset by peer p.s. In attach is last part of Freeradius debug. Thanks

2 4

Virtual Servers & nas_table Server Column Problem
by Ali Arslan 29 Jul '20

29 Jul '20

Hello, I use freeradius 3.0.20 on ubuntu server 20.04 virtual machines with mssql backend accessed by freetds. I had 3 virtual machines just for freeradius, so i wanted to run them all on a single machine to make better use of resources and decided to make use of Virtual Server capability of freeradius. i kept the defualt site as the server of main ISP and added 2 more virtual servers, namely WISPServer and HotspotServer (for hotels and cafes) whose listen sections are as follows: server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } ... } server WISPServer { listen { type = auth ipaddr = * port = 2812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 2813 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 2812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 2813 type = acct limit { } } ... } server HotspotServer { listen { type = auth ipaddr = * port = 3812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 3813 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 3812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 3813 type = acct limit { } } ... } And sql module definitions are all similar except database names. sql { # default server # sql WISPSQL{ for WISPServer # sql HotspotSQL{ for HotspotServer dialect = "mssql" driver = "rlm_sql_freetds" server = "SQLServer" port = 1433 login = "sa" password = "<<servet>>" radius_db = "ISP" # radius_db = "WISP" for WISPServer # radius_db = "Hotspot" for HotspotServer acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radcheck" delete_stale_sessions = yes pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } read_clients = yes client_table = "nas" group_attribute = "SQL-Group" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } Here i use radcheck GroupName custom column to define groups, a user can only have a singe group and it is a calculated field. nas_table has a Server column to define virtual server name: nas_query = " SELECT Id, IPAddress, ShortName, 'other', Secret, ISNULL(Server, '') FROM ${nas_table}" The attached debug file shows that the client added to WISPServer clients list: rlm_sql (WISPSQL): Adding client 192.168.1.1 (ofis) to WISPServer clients list rlm_sql (192.168.1.1): Client "ofis" (WISPSQL) added But when the client ( 92.168.1.1 ) sends an accountig request i get error: Ignoring request to acct address * port 2813 bound to server WISPServer from unknown client 192.168.1.1 port 41272 proto udp To make it work i needed to do one two things, remove Server column from nas query or make it NULL (actually empty string, NULL does not work either), in this case it adds clients to global client list saying rlm_sql ( WISPSQL): Adding client 192.168.1.1 (ofis) to global clients list For security reasons i wan to define client for a Virtual Server, how can i make it work? An example debug oupt is attached. Thaks.

2 2

Lease Query is not working in latest master branch
by Chinnapaiyan, Nagamani 29 Jul '20

29 Jul '20

Hi, Lease Query is not working in latest master(#feb57bfef488dbb8a850b47b6a72eb1db0285fbe), Other messages are working fine. And same LQ was working fine previously. Debug output: Info : FreeRADIUS Version 4.0.0 Info : Copyright 1999-2020 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/raddb/dictionary" ... ... proto_dhcpv4_udp - Received DHCP-Request XID 13df720c length 332 dhcpv4_udp server 127.0.0.1 port 6767 on interface lo (11) Running request (11) Received DHCP-Request XID 13df720c from 127.0.0.1:6768 to 127.0.0.1:6767 via lo (11) DHCP-Opcode = Client-Message (11) DHCP-Hardware-Type = Ethernet (11) DHCP-Hardware-Address-Length = 6 (11) DHCP-Hop-Count = 0 (11) DHCP-Transaction-Id = 333410828 (11) DHCP-Number-of-Seconds = 0 (11) DHCP-Flags = 0 (11) DHCP-Client-IP-Address = 0.0.0.0 (11) DHCP-Your-IP-Address = 0.0.0.0 (11) DHCP-Server-IP-Address = 0.0.0.0 (11) DHCP-Gateway-IP-Address = 0.0.0.0 (11) DHCP-Client-Hardware-Address = 04:11:22:33:44:55 (11) DHCP-Message-Type = DHCP-Request (11) DHCP-Client-Identifier = 0x041122334455 (11) DHCP-Parameter-Request-List = DHCP-Subnet-Mask (11) DHCP-Parameter-Request-List = DHCP-Router-Address (11) DHCP-Parameter-Request-List = DHCP-Domain-Name-Server (11) DHCP-Vendor-Class-Identifier = 0x766961736174312e30 (11) DHCP-Subscriber-Id = "041122334455(a)aut.res.viasat.com" (11) DHCP-Relay-Remote-Id = 0x04a0bc112233 (11) DHCP-Relay-Circuit-Id = 0x00a0bc223344 (11) DHCP-Requested-IP-Address = 169.254.1.191 (11) DHCP-DHCP-Server-Identifier = 10.43.18.31 (11) Running 'recv DHCP-Request' from file /etc/raddb/sites-enabled/dhcp (11) recv DHCP-Request { ... ... TIMER - proto_dhcpv4_udp - cleanup delay proto_dhcpv4_udp - Received DHCP-Lease-Query XID 103fd54a length 321 dhcpv4_udp server 127.0.0.1 port 6767 on interface lo Failed tracking packet from client default - discarding it Regards, Nagamani Chinnapaiyan

2 3

tls: Failed changing permissions with networkradius.com packages
by Arnaud LAURIOU 29 Jul '20

29 Jul '20

Hi, We are replacing our default ubuntu (18.04) FR packages with those provided by networkradius.com (3.0.21). We use TLS (radsec), we kept the same tls virtual-server and with networkradius packages we have an error during the startup process : freeradius[19720]: tls: Failed changing permissions on /var/tmp/radsec: No such file or directory This directory exists, it is owned by freeradius user and it is empty : $ ls -al /var/tmp/radsec total 8 drwx------ 2 freerad freerad 4096 juil. 28 15:41 . drwxrwxrwt 7 root root 4096 juil. 28 17:15 .. In debug mode (freeradius -fxx -l stdout) : freeradius start fine, no error. listen { type = "auth" virtual_server = "default" ipaddr = 194.57.7.17 port = 2083 proto = "tcp" .. verify { skip_if_ocsp_ok = no tmpdir = "/var/tmp/radsec" client = "/usr/bin/openssl verify -CApath /etc/freeradius/certs -CAfile /etc/freeradius/certs/eduPKICA.crt %{TLS-Client-Cert-Filename}" } Any idea ? Regards, Arnaud Lauriou -- Direction des Services Applicatifs RENATER - Rennes https://www.renater.fr/

2 2

MAC address Randomization
by Eric Aguilar 28 Jul '20

28 Jul '20

Hello! I wanted to exchange some ideas on the impact we will all have on the MAC address randomization being implemented as an enabled by default feature on iOS14 Apple Devices (https://support.apple.com/en-us/HT211227) Some authentication procedures on our networks are based on the MAC address so I think the impact is going to be huge and certainly, analytics and accounting will be impacted as well. ¿What are your thoughts on this? ¿What are some workarounds we should implement? ¿are there any?

3 2

EAP-PWD Authentication with Username and MAC
by psuet 27 Jul '20

27 Jul '20

Hi, I want to authenticate users with EAP-PWD with ./mods-config/files/authorize and check the used Calling-Station-ID in the process. A example for an entry in the authorize file: > username Calling-Station-Id == "A1-B2-C3-D4-E5-F6" Cleartext-Password > := "password" Authentication works fine for PEAP, but it looks like Calling-Station-ID is not available when the file is checked against when using EAP-PWD. Is there a method to make Calling-Station-Id available to the files mod when using EAP-PWD? (Freeradius 3.0.21) Thanks for any answer! Paul

4 5

help on REST HTTP-headers
by Mark Grayson (mgrayson) 24 Jul '20

24 Jul '20

Hi All Very new to freeRADIUS and trying to set up a post-auth rest POST to a 3rd party system that is expecting an API-key. So I set up rest config as post-auth { uri = "{$..connect_uri}/post" method = 'post' body = 'json' REST-HTTP-Header = "x-api-key: 94332cabcdef57456582e5af2bfa123456789" data = '{"end-user":"radius-test"}' tls = ${..tls} } But the debug I see from the POST server is Headers ------- Forwarded: for="<IP@>";proto=https X-Cloud-Trace-Context: 0edff73713fcbb7dd9741ac6e8ca6436/18102608228808296760 X-Forwarded-For: <IP@>, 169.254.1.1 Content-Length: 26 Content-Type: application/json X-Forwarded-Proto: https X-Freeradius-Section: post-auth X-Freeradius-Server: default Accept: */* User-Agent: FreeRADIUS 3.0.22 Body ---- {"end-user":"radius-test"} Any idea what I'm doing wrong when trying to configure the x-api-key header? Cheers, Mark

3 4

Expansion of acct-unique-session-id query
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 23 Jul '20

23 Jul '20

Hi all, Me again ☺ I’m having an issue with the creation of the Acct-Unique-Session-Id control attribute in v4. In v3, the policy did something like the following : (545) else { (545) update request { (545) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (545) --> 0a28ca134cc4f141e97cacdf91f7551f (545) Acct-Unique-Session-Id := "0a28ca134cc4f141e97cacdf91f7551f" If I do something like : echo -n "00c0b7869f20,001E00000002,192.168.105.142,IT-2530-2,,5" | md5sum I get the same md5 hash, good: 0a28ca134cc4f141e97cacdf91f7551f - In v4, (I’ve altered the attributes used in the calculation to match the v3 calculation, to try and demonstrate the issue). The output should in theory be the same? I get: (0) else { (0) update request { (0) EXPAND %{User-Name} (0) --> 00c0b7869f20 (0) EXPAND %{Acct-Session-ID} (0) --> 001E00000002 (0) EXPAND %{NAS-IP-Address} (0) --> 192.168.105.142 (0) EXPAND %{NAS-Identifier} (0) --> IT-2530-2 (0) EXPAND %{NAS-Port-ID} (0) --> , (0) EXPAND %{NAS-Port} (0) --> 5 (0) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (0) (%{md5:00c0b7869f20,001E00000002,192.168.105.142,IT-2530-2,,5}) (0) --> 0xa5850401f8c9f7ffdd43a04100ca8190 (0) &Acct-Unique-Session-Id := "\245\205\004\001\370\311\367\377\335C\240A\000ʁ\220" Everything expands ok, and it says it’s doing an md5 on the correct resulting “string”, but the output looks pretty odd. Should the md5 come out in hex format? I guess it’s maybe that part at fault, instead of the hex->string conversion? Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 3

Official plugin for Freeradius + OpenVPN?
by Houman 22 Jul '20

22 Jul '20

Hello, I have been using Freeradius and Strongswan (eap-radius) for a few years now and for the first time I'm trying to achieve the same thing with OpenVPN instead. Based on my research it seems that the recommended plugin is a decade old. http://www.nongnu.org/radiusplugin/ It's hard to imagine that this wasn't updated for so long. Am I missing something? Is there any official Freeradius plugin for OpenVPN? I found this tutorial to be very promising https://www.vpsserver.com/community/tutorials/17/authenticate-openvpn-clien… but I thought I ask here first if someone has experience with this topic, and I'm on the right path. Many Thanks, Houman

3 9

chap authentication with v4
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 22 Jul '20

22 Jul '20

Hi all, Sorry this is embarrassingly simple, but I'm struggling a bit with it. Profuse apologies if I missed something obvious. We use MAC authentication with some stuff, and update the control Cleartext-Password to match the user-name field, as mac auth on the NASes here always use that as the password. Authorisation does all our useful accept/reject stuff, not authentication. Having said that I'd prefer not to "hack" it to bypass auth. My test NAS is an HP/Aruba 2530 with v15.17.0009 firmware Before the chap auth runs: Update control { &Cleartext-Password = &User-Name } Works on v3: >From the access request : Wed Jul 22 08:33:57 2020 : Debug: (0) User-Name = "08000f510d1e" Wed Jul 22 08:33:57 2020 : Debug: (0) CHAP-Password = 0x9fdc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) Message-Authenticator = 0x978dc5f6ccbcd916950b3d76190039dc .. .. and then the chap auth debug: .. Wed Jul 22 08:46:46 2020 : Debug: (0) chap: Comparing with "known good" &control:Cleartext-Password value "08000f510d1e" Wed Jul 22 08:46:46 2020 : Debug: (0) chap: Using challenge from &request:CHAP-Challenge Wed Jul 22 08:33:57 2020 : Debug: (0) chap: CHAP challenge : e7714b9a5d8463e7947041bdbf399c17 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: Client sent : dc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: We calculated : dc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: CHAP user "08000f510d1e" authenticated successfully But on v4, it doesn't like it, and I can't figure out why, says the password is incorrect. I've checked and double checked the client.conf secret is correct. Wed Jul 22 07:59:01 2020: (1) User-Name = "08000f510d1e" Wed Jul 22 07:59:01 2020: (1) CHAP-Password = 0xa1526f5b6d5cc40d3d87df334515befc07 Wed Jul 22 07:59:01 2020: (1) Message-Authenticator = 0x5433e862ac2ab58c19866ff8bb05863f .. Wed Jul 22 07:59:01 2020: (1) chap - Using "known good" cleartext password Cleartext-Password = "08000f510d1e" Wed Jul 22 07:59:01 2020: (1) chap - Using challenge from &request:CHAP-Challenge Wed Jul 22 07:59:01 2020: (1) chap - CHAP challenge : bf61a943b98f4d1b9e9885677705a6b8 Wed Jul 22 07:59:01 2020: (1) chap - Client sent : 526f5b6d5cc40d3d87df334515befc07 Wed Jul 22 07:59:01 2020: (1) chap - We calculated : 72ca08cb516acb819b0ff9d7cc5988c4 Wed Jul 22 07:59:01 2020: ERROR : (1) chap - Password comparison failed: password is incorrect Testing chap with radtest DOES work ok with v4 though, really confusing. Can anyone spot the issue? I've a feeling I've missed something obvious.. :( Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 3

NAS-Port-Type
by Darren Ward (darrward) 22 Jul '20

22 Jul '20

Hi All, Quick question - is it possible to add to the descriptive for the NAS-Port-Type field? For example beyond the RFC there's additional ones defined by consortium or vendor such as IPoE over PW etc In this case I would like to see the descriptive for NAS-Port-Type = 43 appear in the accounting logs as the name rather than integer value Cheers Darren

2 1

Configuration conflict
by Olivier 22 Jul '20

22 Jul '20

Hello, I am facing the following problem and I don't know how to configure FreeRadius for that. I have one WiFi Access point serving 2 SSID with 802.1x enabled. One SSID takes authentication in the form of username(a)domain.example and the other is just username. As it is a single AP, it communicates to FreeRadius with a single IP and is being seen as a single Radius client. Is there a way for me to declare different virtual servers. Is there a way to sort that elegantly beaside using the value of Stripped_User_Domain (and equivalent)? What would be the solution if I add to add a 3rd SSID, with authentication that does not use a domain (but has a different list of users of course)? Best regards, Olivier --

2 1

MSCHAP using multiple domains
by Klemen forneci 21 Jul '20

21 Jul '20

Hello. I know this may not be strictly radius related, but my google-fu is all used up (not much on the subject). Now to the problem: I'm using freeradius 3.13 on centos7 (Upgrading from v2 on centos6). In the modules i have 2 mschap configuration based on user domain (windows domain): mschap mschap_thor { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-THOR} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" } mschap mschap_loki { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-LOKI} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" } In the sitens-enabled/default: Auth-Type MS-CHAP { if(Realm == "um.si") { mschap_thor } elsif(Realm == "guest.um.si") { mschap_thor } elsif(Realm == "student.um.si") { mschap_loki } } When I use mschap_thor everything works. When I try mschap_loki, I get the following error: (2) mschap_loki: ERROR: Program returned code (1) and output 'Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. (0xc0000413)' (2) mschap_loki: External script failed (2) mschap_loki: ERROR: External script says: Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. (0xc0000413) (2) mschap_loki: ERROR: MS-CHAP2-Response is incorrect I've tried adding the radiusd server to the LOKI domain (net ads join), but the error remains. Are there any more settings in freeradius that i've missed or anywhere else. The whole project is on a standstill because of this :/ Thank you and best regards, Klemen

2 2

pam_radius relases
by Adrian Tschira 21 Jul '20

21 Jul '20

Hey there, we recently ran into some trouble on a v6-only migration when we discovered pam_radius did not support IPv6. While the master branch supports IPv6 the latest release, 1.4.0 from 2014, does not include those patches. There is an open issue asking about a new release[1], but it hasn't gotten any attention for a while. Has anyone been working towards a new release and are there any obstacles I could help with? Adrian Tschira [1] https://github.com/FreeRADIUS/pam_radius/issues/42

3 2

Load balancing and ldap group cache
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 21 Jul '20

21 Jul '20

Hi all, Interesting one with v4 migration. With 3.1 and previous we used to load balance over site-based ldap servers closest to the radius box authenticating the user (we've got a few sites, slow links between), e.g. switch &control:Sitename { case site1 { redundant-load-balance { site1_ldap1_authorize site1_ldap2_authorize site2_ldap3_authorize } } Case site2 { .. We then call a later reference to a user group cache in a policy e.g : if (&control:Cached-Ldap-Group && &control:Cached-Ldap-Group[*] =~ /${policy.groupdn-utvid-regexp}/) { Which has also worked fine (NB we've used a custom group cache name "Cached-Ldap-Group") The problem is previous versions used to let you have each ldap instance with the same cache name each time, e.g. ldap site1_ldap1 .. group { .. cache_attribute = "Cached-Ldap-Group" } ldap site1_ldap2 .. group { .. cache_attribute = "Cached-Ldap-Group" } etc .. .. but v4 doesn't seem to: Creating attribute site1_ldap2-LDAP-Group Error creating cache attribute /etc/freeradius/mods-enabled/ldap[94]: Bootstrap failed for module "site1_ldap2". If I rename the cache names to be unique it's ok. Guess I either "find out" which ldap module was called in the redundant-load-balance section and then reference the specific ldap instance cache name later, or somehow getting around having to check the group cache, probably doing another ldap lookup I suppose. Any ideas? Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 2

Freeradius Authenticate ADSL with Calling-Station ID
by Maile Halatuituia 19 Jul '20

19 Jul '20

Hi List Appreciate if someone would give some hint on the above subject. Thanks [TCC] Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

3 8

sending attributes
by Marco Miglietta 19 Jul '20

19 Jul '20

I have problems in sending attributes with some nas. It' seems that I have to send attributes in the access-accept message and probably it's not so. How can I solve this problem ? Thank you v.m. Marco. --

2 2

Group policy on freeradius like on microsoft NPS server
by MD. NUR KHAKIM A`ZIIZUDIN 17 Jul '20

17 Jul '20

Hi there, i'm new to freeradius, recently we are implementing freeradius as AAA server to authenticate user throug aruba wifi controller our setup is openldap + freeradius + aruba we use AD + NPS server + aruba before, and have implemented group policy on our network configuration that read filter-id attribute so how we do the same thing on freeradius, i've been searching on google and didn't find anything. if anyone know how to add group policy for openldap + freeradius + aruba setup please let me know how to do it. Best Regards -- MD Nur Khakim Aziizudin Network & system administrator directorate of IT infrastructure National Civil Service Agency of Indonesia

2 1

Helper Script to convert clients.conf to new format
by Sven Hartge 17 Jul '20

17 Jul '20

Hi .*, I need to convert some larger legacy clients.conf to the new format and wondered if anyone has already written a little helper script automating this and is willing to share it. Grüße, Sven.

1 0

SQL Maps
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 16 Jul '20

16 Jul '20

Hi all, We've been using the 3.1 branch for the sql maps ability for a bit, but realise we now need to move onto a currently supported branch as it no longer compiles in recenty versions of Ubuntu, our preferred linux flavour. We extensively used sql maps with the syntax talked about here: https://github.com/FreeRADIUS/freeradius-server/issues/984 e.g. map <map proc isnt> <source> { <server attr0> <op0> <result attr0> <server attr1> <op1> <result attr1> <server attrN> <opN> <result attrN> } .. a real example we used being map sql_SP_radiussql &control:Tmp-String-0 { control:Tmp-string-1 += tmp_acctuniqueid control:Tmp-string-2 += tmp_acctsessionid control:Tmp-string-3 += tmp_username control:Tmp-string-4 += tmp_devicetype control:Tmp-string-5 += tmp_macaddresslimit control:Tmp-string-6 += tmp_acctstarttime control:Tmp-string-7 += tmp_duplicate } Which worked well. Is this functionality still valid, and is the syntax now different? Kind Regards Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

3 6