September 2020 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

CentOS 8 packages missing winbind support?
by Josef Vybíhal 14 Jun '21

14 Jun '21

Packages for CentOS 8 at https://networkradius.com/freeradius-packages/ appear to be compiled without winbind support. Is there a reason for that? CentOS 7 package have it - not sure about other distros. ... snip... # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting_syslog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vlanlog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap_winbind" from file /etc/raddb/mods-enabled/mschap /etc/raddb/mods-enabled/mschap[1]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/mschap[1]: Instantiation failed for module "mschap_winbind" P.

6 12

IP allocation from Pool
by kabin mool 16 Oct '20

16 Oct '20

hi, With the help of below documentation, I am able to allocated the static IP to user from my MySQL DB but is it possible to allocated IP from pool . If yes, can you share me the step how can we manage it. https://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation#let-s-start… guide/dhcp for static ip allocation<https://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation#let-s-start…> Before You Start. This example assumes that the network adapter where is connected freeradius have the following settings: auto eth1 iface eth1 inet static address 192.168.10.1 netmask 255.255.255.0 network 192.168.10.0 broadcast 192.168.10.255 wiki.freeradius.org Thanks, Kabin

2 7

EAP-TTLS works for MacOS supplicants but not Win10
by Evan Sharp 08 Oct '20

08 Oct '20

Hi List, This is my first message so please advise me of any participation gafs. I have a working 801.2x wifi termination with Aruba APs binding Google LDAP users via FreeRADIUS 3.0.21 using EAP-TTLS. It is only successful with MacOS supplicants though. When I start debugging Windows 10 clients, the connection fails somewhere. Comparing debug outputs, the win10 exchange just seems to stop, with no errors thrown, where the mac flow otherwise continues. Pastebin of a successful bind (mac) <https://pastebin.com/wfpDxpMH> Pastebin to a failed bind (win) <https://pastebin.com/BneBgPAN> Although the users for testing are different, there is no explicit Auth-reject to tell me that's the issue. I'd be very grateful for help understanding what's going on! Evan

5 10

Freeradius latest rpm on centos7
by Ammad Ali 06 Oct '20

06 Oct '20

Hi, I have installed latest RPM of freeradius from https://packetfence.org/downloads/PacketFence/CentOS7/devel/x86_64/RPMS/ on centos 7. Below are the list of installed RPMs. freeradius-mysql-3.0.21-8.1.x86_64 freeradius-config-3.0.21-8.1.x86_64 freeradius-unixODBC-3.0.21-8.1.x86_64 freeradius-utils-3.0.21-8.1.x86_64 freeradius-3.0.21-8.1.x86_64 freeradius-perl-3.0.21-8.1.x86_64 After fresh install when I start radius in debug mode, it gives me below errors of auth and acct protocol. Mon Sep 28 16:34:26 2020 : Debug: Created signal pipe. Read end FD 5, write end FD 6 Mon Sep 28 16:34:26 2020 : Debug: radiusd: #### Opening IP addresses and Ports #### Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = * Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct with path: /usr/lib64/freeradius/proto_acct.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct failed: /usr/lib64/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "acct" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = * Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipv6addr = :: Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct with path: /usr/lib64/freeradius/proto_acct.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct failed: /usr/lib64/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "acct" Mon Sep 28 16:34:26 2020 : Debug: ipv6addr = :: Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = 127.0.0.1 Mon Sep 28 16:34:26 2020 : Debug: port = 18120 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address * port 1812 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on acct address * port 1813 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address :: port 1812 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on acct address :: port 1813 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Mon Sep 28 16:34:26 2020 : Debug: Opened new proxy socket 'proxy address * port 34165' Mon Sep 28 16:34:26 2020 : Debug: Listening on proxy address * port 34165 Mon Sep 28 16:34:26 2020 : Debug: Opened new proxy socket 'proxy address :: port 59302' Mon Sep 28 16:34:26 2020 : Debug: Listening on proxy address :: port 59302 Mon Sep 28 16:34:26 2020 : Info: Ready to process requests Need your advise. --

3 10

sending multiple Class attributes in Rest POST
by Mark Grayson (mgrayson) 01 Oct '20

01 Oct '20

Hi there Is there a way to be able to POST multiple Class attributes using Rest? I am currently testing returning multiple class attributes and can see they are being sent in the accounting-request trace: (10) Framed-IP-Address = 10.192.230.1 (10) Class = 0x31323334353637383957424149443d64756d6d792e6d656d6265723a5553 (10) Class = 0x37334a773b51793453716c44264e5548405929 Is there a way I can pass both received class attributes in a rest POST? It looks like the Rest %{Class} simply picks the first one. Cheers, Mark

3 6

Radius and LDAP permissions
by lingctam 30 Sep '20

30 Sep '20

Hello, Currently, my radius server is configured to use ldap. Would there be an issue if the radius and ldap daemons are ran with a different id group? Radius: ran by user (w/o root privilege) LDAP: ran by root If this would cause an issue, what would resolve the issue of radius requests not being able to go through the ldap server? Thanks.

2 1

Getting more info on radpostauth
by Andrés Gómez 29 Sep '20

29 Sep '20

Hi Alan and dear list. Currently I use freeradius 3 to authenticate wifi users using SQL module. After each authentication request I can see a new entry on radpostauth table in my database.... Everything OK. Radpostauth table has the information about username, pass, reply message and authdate. I need a record about the callingstationid parameter that is arriving in each request. So, If I create a new row in that table, how can I modify the SQL query in order to insert the callingstationid in that table? Thanks a lot -- *C. Andrés Gómez R.*

3 3

Perl script error when testing locally
by HORMAZABAL PI�ONES BARBARA FRANCISCA 28 Sep '20

28 Sep '20

Hello again, I'm trying to follow the tutorial from this site <https://kerker.website/freeradiusgmail802-1x%E8%A8%AD%E5%AE%9Apop3s/> (it's in chinese but it's pretty understandable if you translate it) basically using a perl script for authentication against gmail accounts using POP3. So far I have reached to the part where it tests the script locally and the error occurs, I haven't yet reached to the part where it configures the eap file to EAP-GTC for the 802.1X. Even though it's not in the tutorial I still added the user in the users file anyway and the error is still there. This is the output I get when doing radtest locally: (0) Received Access-Request Id 63 from 127.0.0.1:41319 to 127.0.0.1:1812 length 93 (0) User-Name = "pruebaucnperl(a)gmail.com" (0) User-Password = "password" (0) NAS-IP-Address = 146.83.124.26 (0) NAS-Port = 0 (0) Message-Authenticator = 0xf081ea4e44b9ed006a1316a93828157f (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "gmail.com" for User-Name = " pruebaucnperl(a)gmail.com" (0) suffix: Found realm "gmail.com" (0) suffix: Adding Realm = "gmail.com" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) if (!control:Auth-Type && User-Password){ (0) if (!control:Auth-Type && User-Password) -> TRUE (0) if (!control:Auth-Type && User-Password) { (0) update control { (0) Auth-Type := Perl (0) } # update control = noop (0) } # if (!control:Auth-Type && User-Password) = noop (0) } # authorize = ok (0) Found Auth-Type = Perl (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type Perl { (0) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> ' pruebaucnperl(a)gmail.com' (0) perl: $RAD_REQUEST{'User-Password'} = &request:User-Password -> 'password' (0) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '146.83.124.26' (0) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '0' (0) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'sep 22 2020 18:33:00 -03' (0) perl: $RAD_REQUEST{'Message-Authenticator'} = &request:Message-Authenticator -> '0xf081ea4e44b9ed006a1316a93828157f' (0) perl: $RAD_REQUEST{'Realm'} = &request:Realm -> 'gmail.com' (0) perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'Perl' (0) perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'Perl' POP3 <- +OK Gpop ready for requests from 146.83.124.26 d17mb25011424qvc at /etc/freeradius/3.0/mods-config/perl/pop3.pl line 149. POP3 -> QUIT at /etc/freeradius/3.0/mods-config/perl/pop3.pl line 149. POP3 <- +OK Bye d17mb25011424qvc at /etc/freeradius/3.0/mods-config/perl/pop3.pl line 149. (0) perl: &request:Realm = $RAD_REQUEST{'Realm'} -> 'gmail.com' (0) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> ' pruebaucnperl(a)gmail.com' (0) perl: &request:Message-Authenticator = $RAD_REQUEST{'Message-Authenticator'} -> '0xf081ea4e44b9ed006a1316a93828157f' (0) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '0' (0) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '146.83.124.26' (0) perl: &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'password' (0) perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'sep 22 2020 18:33:00 -03' (0) perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'Perl' (0) [perl] = reject (0) } # Auth-Type Perl = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Delaying response for 1.000000 seconds Waking up in 0.9 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 63 from 127.0.0.1:1812 to 127.0.0.1:41319 length 20 Thank you in advance.

2 5

Re: External trigger for CoA
by vcargats＠cisco.com 27 Sep '20

27 Sep '20

Hi I have been able to implement this approach with coa-relay and it mostly working, but there are a couple of issues with that. Here are my observations (note I am talking about FR 3.0.x branch): 1) We may specify Packet-DST-IP-Address/Packet-Dst-IPv6-Address or Home-Server-Pool to be able to forward CoA request to the particular NAS. 2) If Packet-DST-IP-Address is specified then FR searches the home_server by port type UDP and this is hardcoded. Of course, if I have configured the home_server with RADSEC/TCP FR cannot find it. But at this step that would not be such a big issue if I would be able to specify the NAS via Home-Server-Pool. 3) If Home-Server-Pool is used, FR still cannot find the home_server. Moreover, it is crashed with SIGSEGV. The reason for this is: a) listener is set to null in request_coa_originate in process.c coa->listener = NULL; /* copied here by request_alloc_fake(), but not needed */ here is the git ref: https://github.com/FreeRADIUS/freeradius-server/commit/d9dd706503897a4c271b… b) listener type is checked in home_server_ldb in realms.c if ((request->listener->type == RAD_LISTEN_DETAIL) && (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) && (fr_ipaddr_cmp(&home->ipaddr, &request->packet->src_ipaddr) == 0)) { continue; } Here the listener is NULL and hence the SIGSEGV. Once I deleted the "coa->listener = NULL;" The flow started to be working as expected. Also, if I check if the listener is NULL before checking its type in home_server_ldb - that also worked. The questions are: 1) May you recall the reason for "coa->listener = NULL;" in request_coa_originate? 2) Is it safe to remove that line, essentially to revert the commit referenced above? 3) Alternatively, will that be better to check for the listener is NULL just to avoid the crash in home_server_ldb? Thanks, Vadim _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com

2 1