January 2021 - Freeradius-Users - lists.freeradius.org

Lists other than request in rlm_rest
by Nathan Ward 16 Jan '21

16 Jan '21

Hi all, I’d like to get control and reply attributes in to rlm_rest requests - we use control attributes for results of various bits of logic which we then translate in to reply attributes in post-auth if relevant - and it’d be useful to get those control attributes in to rest. Reply attributes in there would be useful as well, so we can “log" to a rest endpoint and include the request and reply (and control!) - a slightly different use case but same “tool”. >From what I can see, there doesn’t seem to be a way to have rlm_rest send attributes in the body (in JSON, let’s say) other than request attributes - the code I can see (rest_encode_json etc.) seems to be always looking at the request (request_t->packet->vps). Is there a clever way I haven’t thought of to get control and reply attributes in to rest requests? -- Nathan Ward

3 6

reply_log not happening on failures
by Dan M 14 Jan '21

14 Jan '21

Is there a known issue with rejected requests not generating a reply log entry. For a successful request the reply log is always written. Is it an order thing maybe in some section?

4 6

Cache user access on eap-ttls with ldap as authenticate system
by André 14 Jan '21

14 Jan '21

Hello, I'm using EAP-TTLS + LDAP with okta, all is working fine. But I would like to use the cache system of freeradius in case the internet goes down, if no internet access to contact the ldap server is it possible to use a cache? (21) Received Access-Request Id 117 from 192.168.31.239:32773 to 192.168.31.183:1812 length 294 (21) User-Name = "leon.wolf(a)domain.local" (21) Chargeable-User-Identity = 0x00 (21) Location-Capable = Civic-Location (21) Calling-Station-Id = "90-78-41-4f-dd-73" (21) Called-Station-Id = "00-b7-71-86-b8-80:testrd" (21) NAS-Port = 1 (21) Cisco-AVPair = "audit-session-id=c0a81fef0001f1c46000318e" (21) Acct-Session-Id = "60003186/90:78:41:4f:dd:73/237979" (21) NAS-IP-Address = 192.168.31.239 (21) NAS-Identifier = "WLC1" (21) Airespace-Wlan-Id = 3 (21) Service-Type = Framed-User (21) Framed-MTU = 1300 (21) NAS-Port-Type = Wireless-802.11 (21) Tunnel-Type:0 = VLAN (21) Tunnel-Medium-Type:0 = IEEE-802 (21) Tunnel-Private-Group-Id:0 = "96" (21) EAP-Message = 0x020500061500 (21) State = 0xcab4fefcc8b1eb3813f65861255465ba (21) Message-Authenticator = 0x29f8146d52be66b41004b4ed9a6d1296 (21) session-state: No cached attributes (21) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (21) authorize { (21) policy filter_username { (21) if (&User-Name) { (21) if (&User-Name) -> TRUE (21) if (&User-Name) { (21) if (&User-Name =~ / /) { (21) if (&User-Name =~ / /) -> FALSE (21) if (&User-Name =~ /@[^@]*@/ ) { (21) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (21) if (&User-Name =~ /\.\./ ) { (21) if (&User-Name =~ /\.\./ ) -> FALSE (21) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (21) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (21) if (&User-Name =~ /\.$/) { (21) if (&User-Name =~ /\.$/) -> FALSE (21) if (&User-Name =~ /(a)\./) { (21) if (&User-Name =~ /(a)\./) -> FALSE (21) } # if (&User-Name) = notfound (21) } # policy filter_username = notfound (21) [preprocess] = ok (21) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (21) auth_log: --> /var/log/freeradius/radacct/ 192.168.31.239/auth-detail-20210114 (21) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.31.239/auth-detail-20210114 (21) auth_log: EXPAND %t (21) auth_log: --> Thu Jan 14 12:58:17 2021 (21) [auth_log] = ok (21) eap: Peer sent EAP Response (code 2) ID 5 length 6 (21) eap: Continuing tunnel setup (21) [eap] = ok (21) } # authorize = ok (21) Found Auth-Type = eap (21) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (21) Auth-Type eap { (21) eap: Expiring EAP session with state 0xcab4fefcc8b1eb38 (21) eap: Finished EAP session with state 0xcab4fefcc8b1eb38 (21) eap: Previous EAP request found for state 0xcab4fefcc8b1eb38, released from the list (21) eap: Peer sent packet with method EAP TTLS (21) (21) eap: Calling submodule eap_ttls to process data (21) eap_ttls: Authenticate (21) eap_ttls: Continuing EAP-TLS (21) eap_ttls: Peer ACKed our handshake fragment (21) eap_ttls: [eaptls verify] = request (21) eap_ttls: [eaptls process] = handled (21) eap: Sending EAP Request (code 1) ID 6 length 957 (21) eap: EAP session adding &reply:State = 0xcab4fefcc9b2eb38 (21) [eap] = handled (21) if (handled && (Response-Packet-Type == Access-Challenge)) { (21) EXPAND Response-Packet-Type (21) --> Access-Challenge (21) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (21) if (handled && (Response-Packet-Type == Access-Challenge)) { (21) attr_filter.access_challenge: EXPAND %{User-Name} (21) attr_filter.access_challenge: --> leon.wolf(a)domain.local (21) attr_filter.access_challenge: Matched entry DEFAULT at line 12 (21) [attr_filter.access_challenge.post-auth] = updated (21) [handled] = handled (21) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (21) } # Auth-Type eap = handled (21) Using Post-Auth-Type Challenge (21) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (21) Post-Auth-Type Challenge { (21) policy remove_reply_message_if_eap { (21) if (&reply:EAP-Message && &reply:Reply-Message) { (21) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (21) else { (21) [noop] = noop (21) } # else = noop (21) } # policy remove_reply_message_if_eap = noop (21) attr_filter.access_challenge: EXPAND %{User-Name} (21) attr_filter.access_challenge: --> leon.wolf(a)domain.local (21) attr_filter.access_challenge: Matched entry DEFAULT at line 12 (21) [attr_filter.access_challenge.post-auth] = updated (21) } # Post-Auth-Type Challenge = updated (21) Sent Access-Challenge Id 117 from 192.168.31.183:1812 to 192.168.31.239:32773 length 0 (21) EAP-Message = 0x010603bd158000000b9f03020186304b06082b06010505070101043f303d303b06082b06010505073002862f687474703a2f2f617070732e6964656e74727573742e636f6d2f726f6f74732f647374726f6f74636178332e703763301f0603551d23041830168014c4a7b1a47b2c71fadbe14b9075ffc4156085891030540603551d20044d304b3008060667810c010201303f060b2b0601040182df130101013030302e06082b060105050702011622687474703a2f2f6370732e726f6f742d78312e6c657473656e63727970742e6f7267303c0603551d1f043530333031a02fa02d862b687474703a2f2f63726c2e6964656e74727573742e636f6d2f445354524f4f544341583343524c2e63726c301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100d94ce0c9f584883731dbbb13e2b3fc8b6b62126c58 (21) Message-Authenticator = 0x00000000000000000000000000000000 (21) State = 0xcab4fefcc9b2eb3813f65861255465ba (21) Finished request Waking up in 4.9 seconds. (22) Received Access-Request Id 118 from 192.168.31.239:32773 to 192.168.31.183:1812 length 424 (22) User-Name = "leon.wolf(a)domain.local" (22) Chargeable-User-Identity = 0x00 (22) Location-Capable = Civic-Location (22) Calling-Station-Id = "90-78-41-4f-dd-73" (22) Called-Station-Id = "00-b7-71-86-b8-80:testrd" (22) NAS-Port = 1 (22) Cisco-AVPair = "audit-session-id=c0a81fef0001f1c46000318e" (22) Acct-Session-Id = "60003186/90:78:41:4f:dd:73/237979" (22) NAS-IP-Address = 192.168.31.239 (22) NAS-Identifier = "WLC1" (22) Airespace-Wlan-Id = 3 (22) Service-Type = Framed-User (22) Framed-MTU = 1300 (22) NAS-Port-Type = Wireless-802.11 (22) Tunnel-Type:0 = VLAN (22) Tunnel-Medium-Type:0 = IEEE-802 (22) Tunnel-Private-Group-Id:0 = "96" (22) EAP-Message = 0x0206008815800000007e160303004610000042410436fe757ae06837679e32e33eef46449bfb57126ab725fbc270219624e528203360ee7521080563eb18d57ed754f7079e1bf3c4423f5975e1d2aedd7597251c87140303000101160303002800000000000000009b5217d1d18538b885d7f88ff00291a7d352e5b47e9b660c263b64b9f36067dd (22) State = 0xcab4fefcc9b2eb3813f65861255465ba (22) Message-Authenticator = 0x6e609bd8d4caf0c99454c818de75af99 (22) session-state: No cached attributes (22) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (22) authorize { (22) policy filter_username { (22) if (&User-Name) { (22) if (&User-Name) -> TRUE (22) if (&User-Name) { (22) if (&User-Name =~ / /) { (22) if (&User-Name =~ / /) -> FALSE (22) if (&User-Name =~ /@[^@]*@/ ) { (22) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (22) if (&User-Name =~ /\.\./ ) { (22) if (&User-Name =~ /\.\./ ) -> FALSE (22) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (22) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (22) if (&User-Name =~ /\.$/) { (22) if (&User-Name =~ /\.$/) -> FALSE (22) if (&User-Name =~ /(a)\./) { (22) if (&User-Name =~ /(a)\./) -> FALSE (22) } # if (&User-Name) = notfound (22) } # policy filter_username = notfound (22) [preprocess] = ok (22) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (22) auth_log: --> /var/log/freeradius/radacct/ 192.168.31.239/auth-detail-20210114 (22) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.31.239/auth-detail-20210114 (22) auth_log: EXPAND %t (22) auth_log: --> Thu Jan 14 12:58:17 2021 (22) [auth_log] = ok (22) eap: Peer sent EAP Response (code 2) ID 6 length 136 (22) eap: Continuing tunnel setup (22) [eap] = ok (22) } # authorize = ok (22) Found Auth-Type = eap (22) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (22) Auth-Type eap { (22) eap: Expiring EAP session with state 0xcab4fefcc9b2eb38 (22) eap: Finished EAP session with state 0xcab4fefcc9b2eb38 (22) eap: Previous EAP request found for state 0xcab4fefcc9b2eb38, released from the list (22) eap: Peer sent packet with method EAP TTLS (21) (22) eap: Calling submodule eap_ttls to process data (22) eap_ttls: Authenticate (22) eap_ttls: Continuing EAP-TLS (22) eap_ttls: Peer indicated complete TLS record size will be 126 bytes (22) eap_ttls: Got complete TLS record (126 bytes) (22) eap_ttls: [eaptls verify] = length included (22) eap_ttls: TLS_accept: SSLv3/TLS write server done (22) eap_ttls: <<< recv TLS 1.2 [length 0046] (22) eap_ttls: TLS_accept: SSLv3/TLS read client key exchange (22) eap_ttls: TLS_accept: SSLv3/TLS read change cipher spec (22) eap_ttls: <<< recv TLS 1.2 [length 0010] (22) eap_ttls: TLS_accept: SSLv3/TLS read finished (22) eap_ttls: >>> send TLS 1.2 [length 0001] (22) eap_ttls: TLS_accept: SSLv3/TLS write change cipher spec (22) eap_ttls: >>> send TLS 1.2 [length 0010] (22) eap_ttls: TLS_accept: SSLv3/TLS write finished (22) eap_ttls: Serialising session 36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f, and storing in cache (22) eap_ttls: WARNING: Wrote session 36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f to /var/log/freeradius/tlscache/36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f.asn1 (139 bytes) (22) eap_ttls: (other): SSL negotiation finished successfully (22) eap_ttls: TLS - Connection Established (22) eap_ttls: Attr-156.7 = 0x45434448452d5253412d4145533235362d47434d2d534841333834 (22) eap_ttls: Attr-155.7 = 0x544c5320312e32 (22) eap_ttls: TLS - got 51 bytes of data (22) eap_ttls: [eaptls process] = handled (22) eap: Sending EAP Request (code 1) ID 7 length 61 (22) eap: EAP session adding &reply:State = 0xcab4fefcceb3eb38 (22) [eap] = handled (22) if (handled && (Response-Packet-Type == Access-Challenge)) { (22) EXPAND Response-Packet-Type (22) --> Access-Challenge (22) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (22) if (handled && (Response-Packet-Type == Access-Challenge)) { (22) attr_filter.access_challenge: EXPAND %{User-Name} (22) attr_filter.access_challenge: --> leon.wolf(a)domain.local (22) attr_filter.access_challenge: Matched entry DEFAULT at line 12 (22) [attr_filter.access_challenge.post-auth] = updated (22) [handled] = handled (22) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (22) } # Auth-Type eap = handled (22) Using Post-Auth-Type Challenge (22) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (22) Post-Auth-Type Challenge { (22) policy remove_reply_message_if_eap { (22) if (&reply:EAP-Message && &reply:Reply-Message) { (22) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (22) else { (22) [noop] = noop (22) } # else = noop (22) } # policy remove_reply_message_if_eap = noop (22) attr_filter.access_challenge: EXPAND %{User-Name} (22) attr_filter.access_challenge: --> leon.wolf(a)domain.local (22) attr_filter.access_challenge: Matched entry DEFAULT at line 12 (22) [attr_filter.access_challenge.post-auth] = updated (22) } # Post-Auth-Type Challenge = updated (22) session-state: Saving cached attributes (22) TLS-Cache-Filename = "/var/log/freeradius/tlscache/36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f.asn1" (22) Attr-156.7 = 0x45434448452d5253412d4145533235362d47434d2d534841333834 (22) Attr-155.7 = 0x544c5320312e32 (22) Sent Access-Challenge Id 118 from 192.168.31.183:1812 to 192.168.31.239:32773 length 0 (22) EAP-Message = 0x0107003d158000000033140303000101160303002836d8a1ff6b2afaae621fc261218f4483f1c4545f86a9b8fe41deae7225f2324e15c977fd19b170a0 (22) Message-Authenticator = 0x00000000000000000000000000000000 (22) State = 0xcab4fefcceb3eb3813f65861255465ba (22) Finished request Waking up in 4.9 seconds. (23) Received Access-Request Id 119 from 192.168.31.239:32773 to 192.168.31.183:1812 length 387 (23) User-Name = "leon.wolf(a)domain.local" (23) Chargeable-User-Identity = 0x00 (23) Location-Capable = Civic-Location (23) Calling-Station-Id = "90-78-41-4f-dd-73" (23) Called-Station-Id = "00-b7-71-86-b8-80:testrd" (23) NAS-Port = 1 (23) Cisco-AVPair = "audit-session-id=c0a81fef0001f1c46000318e" (23) Acct-Session-Id = "60003186/90:78:41:4f:dd:73/237979" (23) NAS-IP-Address = 192.168.31.239 (23) NAS-Identifier = "WLC1" (23) Airespace-Wlan-Id = 3 (23) Service-Type = Framed-User (23) Framed-MTU = 1300 (23) NAS-Port-Type = Wireless-802.11 (23) Tunnel-Type:0 = VLAN (23) Tunnel-Medium-Type:0 = IEEE-802 (23) Tunnel-Private-Group-Id:0 = "96" (23) EAP-Message = 0x0207006315800000005917030300540000000000000001e70b56177cd34eacf86e9bd90e8fe557e020b9f6d814adddf9bde349e67f3e9a1dda72f8fd14224098f24cae3410220287d1814b3984a577db30a8289bd48a898a69c25b4667f3cc93b0ab0b (23) State = 0xcab4fefcceb3eb3813f65861255465ba (23) Message-Authenticator = 0x19e54adcb4aeb90d8bcb07f5984056ec (23) Restoring &session-state (23) &session-state:TLS-Cache-Filename = "/var/log/freeradius/tlscache/36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f.asn1" (23) &session-state:Attr-156.7 = 0x45434448452d5253412d4145533235362d47434d2d534841333834 (23) &session-state:Attr-155.7 = 0x544c5320312e32 (23) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (23) authorize { (23) policy filter_username { (23) if (&User-Name) { (23) if (&User-Name) -> TRUE (23) if (&User-Name) { (23) if (&User-Name =~ / /) { (23) if (&User-Name =~ / /) -> FALSE (23) if (&User-Name =~ /@[^@]*@/ ) { (23) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (23) if (&User-Name =~ /\.\./ ) { (23) if (&User-Name =~ /\.\./ ) -> FALSE (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (23) if (&User-Name =~ /\.$/) { (23) if (&User-Name =~ /\.$/) -> FALSE (23) if (&User-Name =~ /(a)\./) { (23) if (&User-Name =~ /(a)\./) -> FALSE (23) } # if (&User-Name) = notfound (23) } # policy filter_username = notfound (23) [preprocess] = ok (23) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (23) auth_log: --> /var/log/freeradius/radacct/ 192.168.31.239/auth-detail-20210114 (23) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.31.239/auth-detail-20210114 (23) auth_log: EXPAND %t (23) auth_log: --> Thu Jan 14 12:58:17 2021 (23) [auth_log] = ok (23) eap: Peer sent EAP Response (code 2) ID 7 length 99 (23) eap: Continuing tunnel setup (23) [eap] = ok (23) } # authorize = ok (23) Found Auth-Type = eap (23) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (23) Auth-Type eap { (23) eap: Expiring EAP session with state 0xcab4fefcceb3eb38 (23) eap: Finished EAP session with state 0xcab4fefcceb3eb38 (23) eap: Previous EAP request found for state 0xcab4fefcceb3eb38, released from the list (23) eap: Peer sent packet with method EAP TTLS (21) (23) eap: Calling submodule eap_ttls to process data (23) eap_ttls: Authenticate (23) eap_ttls: Continuing EAP-TLS (23) eap_ttls: Peer indicated complete TLS record size will be 89 bytes (23) eap_ttls: Got complete TLS record (89 bytes) (23) eap_ttls: [eaptls verify] = length included (23) eap_ttls: [eaptls process] = ok (23) eap_ttls: Session established. Proceeding to decode tunneled attributes (23) eap_ttls: Got tunneled request (23) eap_ttls: User-Name = "leon.wolf(a)domain.local" (23) eap_ttls: User-Password = "scN3VXa4XZvm7N4!" (23) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (23) eap_ttls: Sending tunneled request (23) Virtual server default received request (23) User-Name = "leon.wolf(a)domain.local" (23) User-Password = "scN3VXa4XZvm7N4!" (23) FreeRADIUS-Proxied-To = 127.0.0.1 (23) Chargeable-User-Identity = 0x00 (23) Location-Capable = Civic-Location (23) Calling-Station-Id = "90-78-41-4f-dd-73" (23) Called-Station-Id = "00-b7-71-86-b8-80:testrd" (23) NAS-Port = 1 (23) Cisco-AVPair = "audit-session-id=c0a81fef0001f1c46000318e" (23) Acct-Session-Id = "60003186/90:78:41:4f:dd:73/237979" (23) NAS-IP-Address = 192.168.31.239 (23) NAS-Identifier = "WLC1" (23) Airespace-Wlan-Id = 3 (23) Service-Type = Framed-User (23) Framed-MTU = 1300 (23) NAS-Port-Type = Wireless-802.11 (23) Tunnel-Type:0 = VLAN (23) Tunnel-Medium-Type:0 = IEEE-802 (23) Tunnel-Private-Group-Id:0 = "96" (23) Event-Timestamp = "Jan 14 2021 12:58:17 WET" (23) WARNING: Outer and inner identities are the same. User privacy is compromised. (23) server default { (23) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (23) authorize { (23) policy filter_username { (23) if (&User-Name) { (23) if (&User-Name) -> TRUE (23) if (&User-Name) { (23) if (&User-Name =~ / /) { (23) if (&User-Name =~ / /) -> FALSE (23) if (&User-Name =~ /@[^@]*@/ ) { (23) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (23) if (&User-Name =~ /\.\./ ) { (23) if (&User-Name =~ /\.\./ ) -> FALSE (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (23) if (&User-Name =~ /\.$/) { (23) if (&User-Name =~ /\.$/) -> FALSE (23) if (&User-Name =~ /(a)\./) { (23) if (&User-Name =~ /(a)\./) -> FALSE (23) } # if (&User-Name) = notfound (23) } # policy filter_username = notfound (23) [preprocess] = ok (23) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (23) auth_log: --> /var/log/freeradius/radacct/ 192.168.31.239/auth-detail-20210114 (23) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.31.239/auth-detail-20210114 (23) auth_log: EXPAND %t (23) auth_log: --> Thu Jan 14 12:58:17 2021 (23) [auth_log] = ok (23) eap: No EAP-Message, not doing EAP (23) [eap] = noop (23) [expiration] = noop (23) [logintime] = noop (23) update control { (23) Cache-Status-Only = yes (23) } # update control = noop (23) cache: EXPAND %{User-Name} (23) cache: --> leon.wolf(a)domain.local (23) cache: Found entry for "leon.wolf(a)domain.local" (23) [cache] = ok (23) if (notfound) { (23) if (notfound) -> FALSE (23) if (User-Password) { (23) if (User-Password) -> TRUE (23) if (User-Password) { (23) update control { (23) Auth-Type := LDAP (23) } # update control = noop (23) } # if (User-Password) = noop (23) cache: EXPAND %{User-Name} (23) cache: --> leon.wolf(a)domain.local (23) cache: Found entry for "leon.wolf(a)domain.local" (23) cache: Merging cache entry into request (23) cache: &reply:Reply-Message += "Cache last updated at Thu Jan 14 11:57:02 2021" (23) cache: &reply:Class := 0x4b703872434c46586d6c6c6953624238735a644a42746459576945614b2e4e65 (23) [cache] = ok (23) } # authorize = ok (23) Found Auth-Type = LDAP (23) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (23) Auth-Type LDAP { rlm_ldap (ldap): Closing connection (9): Hit idle_timeout, was idle for 162 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (10): Hit idle_timeout, was idle for 160 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (11), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://jumia.ldap.idp.com:389 rlm_ldap (ldap): Could not start TLS: Can't contact LDAP server rlm_ldap (ldap): Opening connection failed (11) (23) [ldap] = fail (23) } # Auth-Type LDAP = fail (23) Failed to authenticate the user (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (23) Post-Auth-Type REJECT { (23) attr_filter.access_reject: EXPAND %{User-Name} (23) attr_filter.access_reject: --> leon.wolf(a)domain.local (23) attr_filter.access_reject: Matched entry DEFAULT at line 11 (23) [attr_filter.access_reject] = updated (23) [eap] = noop (23) policy remove_reply_message_if_eap { (23) if (&reply:EAP-Message && &reply:Reply-Message) { (23) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (23) else { (23) [noop] = noop (23) } # else = noop (23) } # policy remove_reply_message_if_eap = noop (23) } # Post-Auth-Type REJECT = updated (23) } # server default (23) Virtual server sending reply (23) Reply-Message = "Cache last updated at Thu Jan 14 11:57:02 2021" (23) eap_ttls: Got tunneled Access-Reject tls: Removing session 36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f from the cache (23) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (23) eap: Sending EAP Failure (code 4) ID 7 length 4 (23) eap: Failed in EAP select (23) [eap] = invalid (23) } # Auth-Type eap = invalid (23) Failed to authenticate the user (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (23) Post-Auth-Type REJECT { (23) attr_filter.access_reject: EXPAND %{User-Name} (23) attr_filter.access_reject: --> leon.wolf(a)domain.local (23) attr_filter.access_reject: Matched entry DEFAULT at line 11 (23) [attr_filter.access_reject] = updated (23) [eap] = noop (23) policy remove_reply_message_if_eap { (23) if (&reply:EAP-Message && &reply:Reply-Message) { (23) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (23) else { (23) [noop] = noop (23) } # else = noop (23) } # policy remove_reply_message_if_eap = noop (23) } # Post-Auth-Type REJECT = updated (23) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (23) Sending delayed response (23) Sent Access-Reject Id 119 from 192.168.31.183:1812 to 192.168.31.239:32773 length 44 (23) EAP-Message = 0x04070004 (23) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (18) Cleaning up request packet ID 114 with timestamp +3690 (19) Cleaning up request packet ID 115 with timestamp +3690 (20) Cleaning up request packet ID 116 with timestamp +3690 (21) Cleaning up request packet ID 117 with timestamp +3690 (22) Cleaning up request packet ID 118 with timestamp +3690 (23) Cleaning up request packet ID 119 with timestamp +3690 Ready to process requests ***** Config for sites-enabled/default ****** server default { listen { type = auth ipaddr = 192.168.31.183 port = 0 limit { # # Limit the number of simultaneous TCP connections to the socket # # The default is 16. # Setting this to 0 means "no limit" max_connections = 16 # The per-socket "max_requests" option does not exist. # # The lifetime, in seconds, of a TCP connection. After # this lifetime, the connection will be closed. # # Setting this to 0 means "forever". lifetime = 0 # # The idle timeout, in seconds, of a TCP connection. # If no packets have been received over the connection for # this time, the connection will be closed. # # Setting this to 0 means "no timeout". # # We STRONGLY RECOMMEND that you set an idle timeout. # idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { # Only for "proto = tcp". These are ignored for "udp" sockets. # } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { filter_username preprocess auth_log eap { ok = return updated = return } expiration logintime update control { Cache-Status-Only = 'yes' } cache if (notfound) { ldap } if (User-Password) { # <- when using cache this it's here with True update control { Auth-Type := ldap } } cache } authenticate { Auth-Type PAP { #pap ldap # eap-ttls comes here for authentication } Auth-Type LDAP { ldap } Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter } } } preacct { preprocess acct_unique suffix } accounting { detail -sql attr_filter.accounting_response } session { } post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY } } update { &reply: += &session-state: } remove_reply_message_if_eap Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject # Insert EAP-Failure message if the request was # rejected by policy instead of because of an # authentication failure eap # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap } Post-Auth-Type Challenge { remove_reply_message_if_eap attr_filter.access_challenge.post-auth } } pre-proxy { } post-proxy { eap } } ****** eap config **** eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} md5 { } leap { } gtc { auth_type = PAP } tls-config tls-common { private_key_file = /etc/freeradius/3.0/certs/rsa/fullchain2.key certificate_file = /etc/freeradius/3.0/certs/rsa/fullchain2.pem ca_file = /etc/ssl/certs/ca-certificates.crt ca_file = /etc/freeradius/3.0/certs/rsa/rootDSTX3.pem dh_file = ${certdir}/dh ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no tls_min_version = "1.2" ecdh_curve = "prime256v1" cache { enable = yes name = "EAP module" persist_dir = "${logdir}/tlscache" } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } ttls { tls = tls-common default_eap_type = gtc copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "default" } virtual_server = default }

2 12

free radius behind a load balancer?
by Coy Hile 14 Jan '21

14 Jan '21

Hi all, Has anyone tried putting the FreeRADIUS server behind a load balancer? I see dynamic-clients does queries based on the Packet-Src-IP-Address, but can one reasonably do similar based on NAS-IP-Address (assuming that the client sends that attribute? -- Coy Hile coy.hile(a)coyhile.com

4 9

Referencing a module by a ${}-Variable
by freeradius-mlist-users＠m20.kunterbunt.de 14 Jan '21

14 Jan '21

Hello all, I am trying to set up a freeradius server with several mysql databases for different sets of accounts. The distinguation of the request should happen via the 'nas' table, which points to the different virtual servers. So, in the directory "sites-enabled" I have a file defining several virtual servers: server wlan { instance_name = "wlan" $INCLUDE "../sites-available/instances_include" } and within in the "instances_include" I want to refer to a separate instance of the SQL module: authorize { filter_username filter_password preprocess sql_instance_${.instance_name} auth_log } These modules are all defined in "mods-enabled": sql sql_instance_wlan { radius_db = "raddb_wlan" $INCLUDE "../mods-available/sql_instances_include" } The problem here is, that the line "sql_instance_${.instance_name}" is not accepted during server startup: including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/instances including configuration file /etc/freeradius/3.0/sites-enabled/../sites-available/instances_include /etc/freeradius/3.0/sites-enabled/../sites-available/instances_include[10]: Parse error after ".instance_name": unexpected token "}" Errors reading or parsing /etc/freeradius/3.0/radiusd.conf First I tried to use ${.name2}, which I hoped to refer to the section name "wlan". When this didn't worked, I defined a separate variable "instance_name". I checked the files, that they have standard UNIX line termination and no additional ctrl characters. FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... Is there any possibility to refer to a module by a ${} variable? Thanks for your attention and hopefully your help! Kind regards, Michael Sievert

2 1

Problem with EAP Identity
by Michael Schwartzkopff 13 Jan '21

13 Jan '21

Hi, I stumbled upon a strange behaviour of my switches. I want to configure 802.1x. In the first packet the Switch sends: Debug: (7) Received Access-Request Id 81 from x.x.x.46:36296 to x.x.x.154:1812 length 152 Debug: (7) User-Name = "3464A9D11215" The debug goes on: Debug: (7) eap: Peer sent packet with method EAP Identity (1) Debug: (7) eap: EAP session adding &reply:State = 0x45e56b9d45e46617 Debug: (7) modsingle[authenticate]: returned from eap (rlm_eap) Debug: (7) [eap] = handled The next request from the switch is: Debug: (8) Received Access-Request Id 82 from x.x.x.46:36296 to x.x.x.154:1812 length 167 Debug: (8) User-Name = "host/test(a)xxx.xx" (...) Debug: (8) State = 0x45e56b9d45e46617718e28efb749ef6f and then the RADIUS server complains: Debug: (8) eap: Previous EAP request found for state 0x45e56b9d45e46617, released from the list Debug: (8) eap: Identity does not match User-Name. Authentication failed Debug: (8) eap: Failed in handler Can anyone explain what happens here? Does the switch change the User-Name within the RADIUS / EAP session? Is this a bug of the switch? Or does something other happen here? Thanks for any hints. Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

3 5

Wrong date of freeradius 3 recording in MySql
by Nikolai Petrov 12 Jan '21

12 Jan '21

Hello, I installed FreeRADIUS 3, Daloradius, and MySQL Debian 9. After some struggle I drove everything I had on another machine with a similar installation but with freeradius 2. I noticed a problem with accounting (wrote in db). The time is correct, but the date is 2 days ago. The problem is from freeradius. When I write from PHP in MySql my date is ok, but from accounting, it comes with a date of -2 days. *Do you any idea of where to hide the problem?* Best Regards, Nikolai Petrov

2 5

EAP-PEAP: unknown ca error
by Nick Iatsenko 08 Jan '21

08 Jan '21

Hello everyone, I successfully configured FreeRADIUS 3.0.21 on my new Opnsense firewall. Connected devices via Wi-Fi: - iOS : OK - MacOS : OK - Android : KO I found another person (Daniel Lopez) having similar issue with EAP-TLS back in 2017 but he was provided link to the resource with instructions for different clients (OS) but not Android. Root CA is used to issue Server cert (no intermediate cert is used - it's a home setup ;) ). I installed Root CA cert on my Pixel3 > Settings > Security > Encryption & Credentials > Install a certificate > CA Certificate > followed the dialog New Root CA cert is visible under Settings > Security > Encryption & Credentials > Trusted credentials > User My concern: I don't see my new Root CA cert under CA certificate section in the Wi-Fi profile and have to choose "Use system certificates" Below is the debug result. I hope it helps to confirm my hypothesis (presented Server cert is not Trusted by Android phone). Feel free to forward me to the other Android related resource if this is not the right place to ask for help with my issue. (261) Received Access-Request Id 62 from 192.168.31.2:53892 to 192.168.31.1:1812 length 183 (261) Service-Type = Framed-User (261) Framed-MTU = 1400 (261) User-Name = "Nick_Pixel3" (261) State = 0x7616a93d7e1fb07496c66d6bce81643b (261) NAS-Port-Id = "guest_WLAN" (261) NAS-Port-Type = Wireless-802.11 (261) Calling-Station-Id = "96-4D-45-A8-84-E0" (261) Called-Station-Id = "CC-2D-E0-A9-52-2A:XATA_guest" (261) EAP-Message = 0x0209001119800000000715030300020230 (261) Message-Authenticator = 0x145801a756ad058b3a78d10e7f6343f1 (261) NAS-Identifier = "MikroTik" (261) NAS-IP-Address = 192.168.31.2 (261) session-state: No cached attributes (261) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (261) authorize { (261) policy filter_username { (261) if (&User-Name) { (261) if (&User-Name) -> TRUE (261) if (&User-Name) { (261) if (&User-Name =~ / /) { (261) if (&User-Name =~ / /) -> FALSE (261) if (&User-Name =~ /@[^@]*@/ ) { (261) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (261) if (&User-Name =~ /\.\./ ) { (261) if (&User-Name =~ /\.\./ ) -> FALSE (261) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (261) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (261) if (&User-Name =~ /\.$/) { (261) if (&User-Name =~ /\.$/) -> FALSE (261) if (&User-Name =~ /(a)\./) { (261) if (&User-Name =~ /(a)\./) -> FALSE (261) } # if (&User-Name) = notfound (261) } # policy filter_username = notfound (261) [preprocess] = ok (261) [chap] = noop (261) [mschap] = noop (261) [digest] = noop (261) suffix: Checking for suffix after "@" (261) suffix: No '@' in User-Name = "Nick_Pixel3", looking up realm NULL (261) suffix: No such realm "NULL" (261) [suffix] = noop (261) eap: Peer sent EAP Response (code 2) ID 9 length 17 (261) eap: Continuing tunnel setup (261) [eap] = ok (261) } # authorize = ok (261) Found Auth-Type = eap (261) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (261) authenticate { (261) eap: Expiring EAP session with state 0x7616a93d7e1fb074 (261) eap: Finished EAP session with state 0x7616a93d7e1fb074 (261) eap: Previous EAP request found for state 0x7616a93d7e1fb074, released from the list (261) eap: Peer sent packet with method EAP PEAP (25) (261) eap: Calling submodule eap_peap to process data (261) eap_peap: Continuing EAP-TLS (261) eap_peap: Peer indicated complete TLS record size will be 7 bytes (261) eap_peap: Got complete TLS record (7 bytes) (261) eap_peap: [eaptls verify] = length included (261) eap_peap: <<< recv TLS 1.2 [length 0002] (261) eap_peap: ERROR: TLS Alert read:fatal:unknown CA (261) eap_peap: TLS_accept: Need to read more data: error (261) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (261) eap_peap: TLS - In Handshake Phase (261) eap_peap: TLS - Application data. (261) eap_peap: ERROR: TLS failed during operation (261) eap_peap: ERROR: [eaptls process] = fail (261) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (261) eap: Sending EAP Failure (code 4) ID 9 length 4 (261) eap: Failed in EAP select (261) [eap] = invalid (261) } # authenticate = invalid (261) Failed to authenticate the user (261) Using Post-Auth-Type Reject (261) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (261) Post-Auth-Type REJECT { (261) attr_filter.access_reject: EXPAND %{User-Name} (261) attr_filter.access_reject: --> Nick_Pixel3 (261) attr_filter.access_reject: Matched entry DEFAULT at line 11 (261) [attr_filter.access_reject] = updated (261) [eap] = noop (261) policy remove_reply_message_if_eap { (261) if (&reply:EAP-Message && &reply:Reply-Message) { (261) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (261) else { (261) [noop] = noop (261) } # else = noop (261) } # policy remove_reply_message_if_eap = noop (261) } # Post-Auth-Type REJECT = updated

2 1

EAP-TLS with LDAP user attribute check
by stray electron 08 Jan '21

08 Jan '21

Hello Everyone, (short) How can I check an LDAP group membership (or attribute) in an EAP-TLS setup? Any help would be appreciated. :) (long) I try to set up a Freeradius 3.0 where the client auth is done with EAP-TLS but also checks if the client is in the LDAP (and/or check some user attribute in the LDAP). If the client has a valid certificate but is not in the LDAP then he should be rejected. Since the auth is already done by EAP-TLS certificates no user bind to the LDAP should be needed, besides I don't have the user password anyway. But I have an LDAP account configured for the Radius server so it can access the user data. So far EAP-TLS works fine, I suppose the 10-times repetition of the authorize part is due to the EAP messages exchanged with the client, or am I wrong? Problem is though, that the LDAP search is done 10-times too for each client request. I think this would lead to a huge load of our LDAP server. I tried to put the ldap stanza into other places like post-auth, but then it tries to write to the LDAP, or in authenticate where the user password is required. For now I have the LDAP configured that way, that it will do all the attribute filtering/checking for the Radius. So if a user is not allowed to access the WLAN the Radius just does not find the user. But it would be also fine if the Radius itself would do the attribute checking somehow, but I do not know how to import and use these attributes. Is there a way to reduce the LDAP searches/load somehow? (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=clientname) (0) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=clientname,ou=user,o=example,c=de" (0) ldap: Processing user attributes rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.example.de:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) } # authorize = ok (0) authenticate { (0) } # authenticate = handled ...[well this repeats several times, so I shortened it a bit] (1) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (2) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (3) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (4) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (5) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (6) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (7) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (8) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (9) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" ... (10) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (10) authorize { rlm_ldap (ldap): Reserved connection (4) (10) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (10) ldap: --> (uid=clientname) (10) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (10) ldap: Waiting for search result... (10) ldap: User object found at DN "uid=clientname,ou=user,o=example,c=de" (10) ldap: Processing user attributes rlm_ldap (ldap): Released connection (4) rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.example.de:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (10) [ldap] = ok (10) } # authorize = updated (10) authenticate { (10) } # authenticate = ok (10) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (10) post-auth { (10) } # post-auth = ok Regards, Felix Freeradius3 Configuration: ------------------------------------ server eduroam { listen { type = auth ipaddr = * port = 1812 } authorize { linelog_recv_request split_username_nai if (noop || !&Stripped-User-Domain) { reject } if (&Stripped-User-Domain != "${operator_name}") { update { control:Load-Balance-Key := &Calling-Station-ID control:Proxy-To-Realm := 'eduroam_flr' request:Operator-Name := "1${operator_name}" } return } ldap if (!ok) { reject } eap { ok = return updated = return } } pre-proxy { attr_filter.pre-proxy linelog_send_proxy_request } post-proxy { attr_filter.post-proxy linelog_recv_proxy_response } authenticate { eap } post-auth { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } if (&control:Proxy-To-Realm) { update reply { Tunnel-Private-Group-ID = ${eduroam_default_guest_vlan} } } else { update reply { Tunnel-Private-Group-ID = ${eduroam_default_local_vlan} } } if (&session-state:Stripped-User-Name) { update reply { User-Name := "%{session-state:Stripped-User-Name}@%{Stripped-User-Domain}" } } linelog_send_accept Post-Auth-Type REJECT { attr_filter.access_reject linelog_send_reject } } } # Loading module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap ldap { server = "ldaps://ldap.example.de:636" identity = "cn=radius,ou=accounts,ou=admin,o=example,c=de" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "ou=user,o=example,c=de" } profile { } options { ldap_debug = 0 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { ca_file = "/etc/ssl/certs/ca-certificates.crt" start_tls = no require_cert = "demand" } }

2 1

Unable to delete unwanted attributes from Disconnect-Request
by Tasos Kotaras 08 Jan '21

08 Jan '21

Hello<https://stackoverflow.com/posts/65629171/timeline> I'm struggling to remove some unwanted attributes from the disconnect message emitted after a failure in the rest module. More specifically, in accounting mode, when I receive a Accounting-Request, I either return an Accounting-Response or Disconnect-Request, depending on the HTTP status returned in a REST interaction. Both cases work properly, the only issue is that the disconnect message also contains these attributes that nag NAS (they cause it to return a NAK): |NAS-Port Teardown-Indicator (as 3GPP VSA) | These attributes are not present in the request. If they were, I could easily remove them and this would also affect the generated disconnect. But apparently, these attributes are added at some point that I have no control. The "/update disconnect {...}/" has no effect, as I guess it is relevant only to received messages (not clear from the documentation). I understand that disconenct belongs to a different connection, so it cannot be related and handled by tampering with 'reply' or anythig that freeradius provides me as variables. Still, I badly need to somehow solve the issue, as I have no control over the NAS itself. Configuration details: _mod-enabled/rest:_ |accounting { uri = "http://x.x.x.x:yyyy/..." method = 'post' body = 'json' tls = ${..tls} } | _sites-enables/default:_ |accounting { rest # this has no effect (same if placed inside rest {...}): update disconnect { NAS-Port !* ANY Teardown-Indicator !* ANY } } | radius -X writes these: |(0) rest: Sending HTTP POST to "http://x.x.x.x:yyyy/..." (0) rest: Encoding attribute "User-Name" (0) rest: Encoding attribute "Framed-IP-Address" (0) rest: Encoding attribute "Acct-Status-Type" (0) rest: Encoding attribute "Acct-Session-Id" (0) rest: Processing response header (0) rest: Status : 503 (Service Unavailable) (0) rest: ERROR: Server returned no data rlm_rest (rest): Released connection (0) Need 5 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (5), 1 of 27 pending slots used rlm_rest (rest): Skipping pre-connect, connect_uri not specified (0) [rest] = fail (0) } # accounting = fail (0) WARNING: Unknown destination 127.0.0.1:3799 for CoA request. (0) Not sending reply to client. (0) Finished request | REST works OK and the 503 is expected for this particular case. I cannot see something wrong (the ERROR and WARNING are not a huge surprise) I wonder if there is some workaround to persuade freeradius not to add these naughty attributes, or otherwise, give me the chance to remove them?

2 1