July 2021 - Freeradius-Users - lists.freeradius.org

Using REST Module for Adding NAS
by Mohammad Mahefooz 03 Jul '21

03 Jul '21

We are designing a radius billing software and will be using REST module instead of SQL. Entire AAA stack is perfectly working with REST module, but stuck at adding NAS section. As far as I know Freeradius uses SQL to load clients. Is there any way we can do this via REST instead of SQL?- Mohammad Mahefooz

2 4

eap work but attributes not in reply
by Bill Schoolfield 02 Jul '21

02 Jul '21

I can see bits and pieces in the docs but can't quite make sense of it. How do I setup so all attributes are returned in a auth success response? I have copy_request_to_tunnel = yes which I guess gets me half way there. Bill

1 1

networkradius pkg depo key problem
by Jure Simšič 02 Jul '21

02 Jul '21

Hi, I tried to add the PGP key for freeradius pkg depo on https://networkradius.com/packages/ for Deebian10 and got this error: # apt-key adv --keyserver keys.gnupg.net --recv-key 0x41382202 Executing: /tmp/apt-key-gpghome.TGxQPJUuh5/gpg.1.sh --keyserver keys.gnupg.net --recv-key 0x41382202 gpg: keyserver receive failed: No name Quick search on the net returned this answer https://stackoverflow.com/questions/66217436/gpg-keyserver-receive-failed-n… and the working version for me was # apt-key adv --keyserver pgp.mit.edu --recv-key 0x41382202 Executing: /tmp/apt-key-gpghome.VvjetTwBbW/gpg.1.sh --keyserver pgp.mit.edu --recv-key 0x41382202 gpg: key BE18FC5A41382202: public key "Network RADIUS Support (package signing) <packages(a)networkradius.com>" imported gpg: Total number processed: 1 gpg: imported: 1 It seems keys.gnupg.net is deprecated.. Cheers, Jure

3 2

2 LDAP Severs with FreeRADIUS and Azure AD Free
by P.Thirunavukkarasu 02 Jul '21

02 Jul '21

Hi all, Already configured the FreeRADIUS with the support the our users with G Suite LDAP with a domain (example.com) that is registered with G Suite LDAP I need to add the one more LDAP with the domain name (example.net) in the FreeRADIUS. Can anyone plz guide or send the configuration method for the above setup? *LDAP - G Suite LDAP - example.com <http://example.com> - Done with the support of freeRADIUS users* *How to configure the following in freeRADIUS?* *1. LDAP - XXXX LDAP - example.net <http://example.net> * *2. Azure AD Free for Office 365 - example.org <http://example.org>* Thanks in advance..... Regards, *P.Thirunavukkarasu*

1 0

Freeradius 3.X with motp module
by Jonathan C 01 Jul '21

01 Jul '21

Hi everyone, I'm trying to reproduce the same setup that I have actually with CentOS (6.10) but with Debian (10.10) and I encounter a strange behaviour that I didn't have before with the same configuration. - The version of freeradius i use on CentOS is 2.2.6-7 - The version of freeradius i use on Debian is 3.0.17 It seems the 3.X version of freeradius doesn't know the output "ACCEPT" of the otpverify.sh script but I'm not sure and I don't know what i'm supposed to do to make it work like it's supposed to do. Anyone already have this problem? Kind regards Below the full output of debug : FreeRADIUS Version 3.0.17 > Copyright (C) 1999-2017 The FreeRADIUS server project and contributors > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License > For more information about these matters, see the file named COPYRIGHT > Starting - reading configuration files ... > including dictionary file /usr/share/freeradius/dictionary > including dictionary file /usr/share/freeradius/dictionary.dhcp > including dictionary file /usr/share/freeradius/dictionary.vqp > including dictionary file /etc/freeradius/3.0/dictionary > including configuration file /etc/freeradius/3.0/radiusd.conf > including configuration file /etc/freeradius/3.0/proxy.conf > including configuration file /etc/freeradius/3.0/clients.conf > including files in directory /etc/freeradius/3.0/mods-enabled/ > including configuration file /etc/freeradius/3.0/mods-enabled/always > including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter > including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap > including configuration file /etc/freeradius/3.0/mods-enabled/chap > including configuration file /etc/freeradius/3.0/mods-enabled/detail > including configuration file /etc/freeradius/3.0/mods-enabled/detail.log > including configuration file /etc/freeradius/3.0/mods-enabled/digest > including configuration file > /etc/freeradius/3.0/mods-enabled/dynamic_clients > including configuration file /etc/freeradius/3.0/mods-enabled/eap > including configuration file /etc/freeradius/3.0/mods-enabled/echo > including configuration file /etc/freeradius/3.0/mods-enabled/exec > including configuration file /etc/freeradius/3.0/mods-enabled/expiration > including configuration file /etc/freeradius/3.0/mods-enabled/expr > including configuration file /etc/freeradius/3.0/mods-enabled/files > including configuration file /etc/freeradius/3.0/mods-enabled/linelog > including configuration file /etc/freeradius/3.0/mods-enabled/logintime > including configuration file /etc/freeradius/3.0/mods-enabled/mschap > including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth > including configuration file /etc/freeradius/3.0/mods-enabled/pap > including configuration file /etc/freeradius/3.0/mods-enabled/passwd > including configuration file /etc/freeradius/3.0/mods-enabled/preprocess > including configuration file /etc/freeradius/3.0/mods-enabled/radutmp > including configuration file /etc/freeradius/3.0/mods-enabled/realm > including configuration file /etc/freeradius/3.0/mods-enabled/replicate > including configuration file /etc/freeradius/3.0/mods-enabled/soh > including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp > including configuration file /etc/freeradius/3.0/mods-enabled/unix > including configuration file /etc/freeradius/3.0/mods-enabled/unpack > including configuration file /etc/freeradius/3.0/mods-enabled/utf8 > including files in directory /etc/freeradius/3.0/policy.d/ > including configuration file /etc/freeradius/3.0/policy.d/abfab-tr > including configuration file /etc/freeradius/3.0/policy.d/accounting > including configuration file /etc/freeradius/3.0/policy.d/canonicalization > including configuration file /etc/freeradius/3.0/policy.d/control > including configuration file /etc/freeradius/3.0/policy.d/cui > including configuration file /etc/freeradius/3.0/policy.d/debug > including configuration file /etc/freeradius/3.0/policy.d/dhcp > including configuration file /etc/freeradius/3.0/policy.d/eap > including configuration file /etc/freeradius/3.0/policy.d/filter > including configuration file > /etc/freeradius/3.0/policy.d/moonshot-targeted-ids > including configuration file /etc/freeradius/3.0/policy.d/operator-name > including files in directory /etc/freeradius/3.0/sites-enabled/ > including configuration file /etc/freeradius/3.0/sites-enabled/default > including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel > main { > security { > allow_core_dumps = no > } > name = "freeradius" > prefix = "/usr" > localstatedir = "/var" > logdir = "/var/log/freeradius" > run_dir = "/var/run/freeradius" > } > main { > name = "freeradius" > prefix = "/usr" > localstatedir = "/var" > sbindir = "/usr/sbin" > logdir = "/var/log/freeradius" > run_dir = "/var/run/freeradius" > libdir = "/usr/lib/freeradius" > radacctdir = "/var/log/freeradius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 16384 > pidfile = "/var/run/freeradius/freeradius.pid" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = yes > auth = yes > auth_badpass = yes > auth_goodpass = yes > colourise = yes > msg_denied = "You are already logged in - access denied" > } > resources { > } > security { > max_attributes = 200 > reject_delay = 1.000000 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = <<< secret >>> > response_window = 20.000000 > response_timeouts = 1 > max_outstanding = 65536 > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > check_timeout = 4 > num_answers_to_alive = 3 > revive_interval = 120 > limit { > max_connections = 16 > max_requests = 0 > lifetime = 0 > idle_timeout = 0 > } > coa { > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = <<< secret >>> > shortname = "localhost" > nas_type = "other" > proto = "*" > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > client devVM { > ipaddr = 192.168.Y.Z > require_message_authenticator = no > secret = <<< secret >>> > shortname = "devVM" > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > Debugger not attached > # Creating Auth-Type = External > # Creating Auth-Type = PAP > # Creating Auth-Type = CHAP > # Creating Auth-Type = MS-CHAP > # Creating Post-Auth-Type = Client-Lost > # Creating Auth-Type = mschap > # Creating Auth-Type = eap > radiusd: #### Instantiating modules #### > modules { > # Loaded module rlm_exec > # Loading module "motp" from file /etc/freeradius/3.0/radiusd.conf > exec motp { > wait = yes > program = "/usr/sbin/otpverify.sh %{User-Name} %{User-Password} > %{reply:Secret} %{reply:PIN} %{reply:Offset}" > input_pairs = "request" > output_pairs = "reply" > shell_escape = yes > } > # Loaded module rlm_always > # Loading module "reject" from file > /etc/freeradius/3.0/mods-enabled/always > always reject { > rcode = "reject" > simulcount = 0 > mpp = no > } > # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always > always fail { > rcode = "fail" > simulcount = 0 > mpp = no > } > # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always > always ok { > rcode = "ok" > simulcount = 0 > mpp = no > } > # Loading module "handled" from file > /etc/freeradius/3.0/mods-enabled/always > always handled { > rcode = "handled" > simulcount = 0 > mpp = no > } > # Loading module "invalid" from file > /etc/freeradius/3.0/mods-enabled/always > always invalid { > rcode = "invalid" > simulcount = 0 > mpp = no > } > # Loading module "userlock" from file > /etc/freeradius/3.0/mods-enabled/always > always userlock { > rcode = "userlock" > simulcount = 0 > mpp = no > } > # Loading module "notfound" from file > /etc/freeradius/3.0/mods-enabled/always > always notfound { > rcode = "notfound" > simulcount = 0 > mpp = no > } > # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always > always noop { > rcode = "noop" > simulcount = 0 > mpp = no > } > # Loading module "updated" from file > /etc/freeradius/3.0/mods-enabled/always > always updated { > rcode = "updated" > simulcount = 0 > mpp = no > } > # Loaded module rlm_attr_filter > # Loading module "attr_filter.post-proxy" from file > /etc/freeradius/3.0/mods-enabled/attr_filter > attr_filter attr_filter.post-proxy { > filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" > key = "%{Realm}" > relaxed = no > } > # Loading module "attr_filter.pre-proxy" from file > /etc/freeradius/3.0/mods-enabled/attr_filter > attr_filter attr_filter.pre-proxy { > filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" > key = "%{Realm}" > relaxed = no > } > # Loading module "attr_filter.access_reject" from file > /etc/freeradius/3.0/mods-enabled/attr_filter > attr_filter attr_filter.access_reject { > filename = > "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" > key = "%{User-Name}" > relaxed = no > } > # Loading module "attr_filter.access_challenge" from file > /etc/freeradius/3.0/mods-enabled/attr_filter > attr_filter attr_filter.access_challenge { > filename = > "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" > key = "%{User-Name}" > relaxed = no > } > # Loading module "attr_filter.accounting_response" from file > /etc/freeradius/3.0/mods-enabled/attr_filter > attr_filter attr_filter.accounting_response { > filename = > "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" > key = "%{User-Name}" > relaxed = no > } > # Loaded module rlm_cache > # Loading module "cache_eap" from file > /etc/freeradius/3.0/mods-enabled/cache_eap > cache cache_eap { > driver = "rlm_cache_rbtree" > key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" > ttl = 15 > max_entries = 0 > epoch = 0 > add_stats = no > } > # Loaded module rlm_chap > # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap > # Loaded module rlm_detail > # Loading module "detail" from file > /etc/freeradius/3.0/mods-enabled/detail > detail { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > escape_filenames = no > log_packet_header = no > } > # Loading module "auth_log" from file > /etc/freeradius/3.0/mods-enabled/detail.log > detail auth_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > escape_filenames = no > log_packet_header = no > } > # Loading module "reply_log" from file > /etc/freeradius/3.0/mods-enabled/detail.log > detail reply_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > escape_filenames = no > log_packet_header = no > } > # Loading module "pre_proxy_log" from file > /etc/freeradius/3.0/mods-enabled/detail.log > detail pre_proxy_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > escape_filenames = no > log_packet_header = no > } > # Loading module "post_proxy_log" from file > /etc/freeradius/3.0/mods-enabled/detail.log > detail post_proxy_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > escape_filenames = no > log_packet_header = no > } > # Loaded module rlm_digest > # Loading module "digest" from file > /etc/freeradius/3.0/mods-enabled/digest > # Loaded module rlm_dynamic_clients > # Loading module "dynamic_clients" from file > /etc/freeradius/3.0/mods-enabled/dynamic_clients > # Loaded module rlm_eap > # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 16384 > } > # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo > exec echo { > wait = yes > program = "/bin/echo %{User-Name}" > input_pairs = "request" > output_pairs = "reply" > shell_escape = yes > } > # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > timeout = 10 > } > # Loaded module rlm_expiration > # Loading module "expiration" from file > /etc/freeradius/3.0/mods-enabled/expiration > # Loaded module rlm_expr > # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr > expr { > safe_characters = > "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: > /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" > } > # Loaded module rlm_files > # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files > files { > filename = "/etc/freeradius/3.0/mods-config/files/authorize" > acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" > preproxy_usersfile = > "/etc/freeradius/3.0/mods-config/files/pre-proxy" > } > # Loaded module rlm_linelog > # Loading module "linelog" from file > /etc/freeradius/3.0/mods-enabled/linelog > linelog { > filename = "/var/log/freeradius/linelog" > escape_filenames = no > syslog_severity = "info" > permissions = 384 > format = "This is a log message for %{User-Name}" > reference = "messages.%{%{reply:Packet-Type}:-default}" > } > # Loading module "log_accounting" from file > /etc/freeradius/3.0/mods-enabled/linelog > linelog log_accounting { > filename = "/var/log/freeradius/linelog-accounting" > escape_filenames = no > syslog_severity = "info" > permissions = 384 > format = "" > reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" > } > # Loaded module rlm_logintime > # Loading module "logintime" from file > /etc/freeradius/3.0/mods-enabled/logintime > logintime { > minimum_timeout = 60 > } > # Loaded module rlm_mschap > # Loading module "mschap" from file > /etc/freeradius/3.0/mods-enabled/mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = yes > passchange { > } > allow_retry = yes > winbind_retry_with_normalised_username = no > } > # Loading module "ntlm_auth" from file > /etc/freeradius/3.0/mods-enabled/ntlm_auth > exec ntlm_auth { > wait = yes > program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN > --username=%{mschap:User-Name} --password=%{User-Password}" > shell_escape = yes > } > # Loaded module rlm_pap > # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap > pap { > normalise = yes > } > # Loaded module rlm_passwd > # Loading module "etc_passwd" from file > /etc/freeradius/3.0/mods-enabled/passwd > passwd etc_passwd { > filename = "/etc/passwd" > format = "*User-Name:Crypt-Password:" > delimiter = ":" > ignore_nislike = no > ignore_empty = yes > allow_multiple_keys = no > hash_size = 100 > } > # Loaded module rlm_preprocess > # Loading module "preprocess" from file > /etc/freeradius/3.0/mods-enabled/preprocess > preprocess { > huntgroups = > "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" > hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > # Loaded module rlm_radutmp > # Loading module "radutmp" from file > /etc/freeradius/3.0/mods-enabled/radutmp > radutmp { > filename = "/var/log/freeradius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > permissions = 384 > caller_id = yes > } > # Loaded module rlm_realm > # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm > realm IPASS { > format = "prefix" > delimiter = "/" > ignore_default = no > ignore_null = no > } > # Loading module "suffix" from file > /etc/freeradius/3.0/mods-enabled/realm > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > # Loading module "realmpercent" from file > /etc/freeradius/3.0/mods-enabled/realm > realm realmpercent { > format = "suffix" > delimiter = "%" > ignore_default = no > ignore_null = no > } > # Loading module "ntdomain" from file > /etc/freeradius/3.0/mods-enabled/realm > realm ntdomain { > format = "prefix" > delimiter = "\\" > ignore_default = no > ignore_null = no > } > # Loaded module rlm_replicate > # Loading module "replicate" from file > /etc/freeradius/3.0/mods-enabled/replicate > # Loaded module rlm_soh > # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh > soh { > dhcp = yes > } > # Loading module "sradutmp" from file > /etc/freeradius/3.0/mods-enabled/sradutmp > radutmp sradutmp { > filename = "/var/log/freeradius/sradutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > permissions = 420 > caller_id = no > } > # Loaded module rlm_unix > # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix > unix { > radwtmp = "/var/log/freeradius/radwtmp" > } > Creating attribute Unix-Group > # Loaded module rlm_unpack > # Loading module "unpack" from file > /etc/freeradius/3.0/mods-enabled/unpack > # Loaded module rlm_utf8 > # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 > instantiate { > # Instantiating module "expiration" from file > /etc/freeradius/3.0/mods-enabled/expiration > # Instantiating module "logintime" from file > /etc/freeradius/3.0/mods-enabled/logintime > } > # Instantiating module "reject" from file > /etc/freeradius/3.0/mods-enabled/always > # Instantiating module "fail" from file > /etc/freeradius/3.0/mods-enabled/always > # Instantiating module "ok" from file > /etc/freeradius/3.0/mods-enabled/always > # Instantiating module "handled" from file > /etc/freeradius/3.0/mods-enabled/always > # Instantiating module "invalid" from file > /etc/freeradius/3.0/mods-enabled/always > # Instantiating module "userlock" from file > /etc/freeradius/3.0/mods-enabled/always > # Instantiating module "notfound" from file > /etc/freeradius/3.0/mods-enabled/always > # Instantiating module "noop" from file > /etc/freeradius/3.0/mods-enabled/always > # Instantiating module "updated" from file > /etc/freeradius/3.0/mods-enabled/always > # Instantiating module "attr_filter.post-proxy" from file > /etc/freeradius/3.0/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/3.0/mods-config/attr_filter/post-proxy > # Instantiating module "attr_filter.pre-proxy" from file > /etc/freeradius/3.0/mods-enabled/attr_filter > reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy > # Instantiating module "attr_filter.access_reject" from file > /etc/freeradius/3.0/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/3.0/mods-config/attr_filter/access_reject > [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item > "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". > [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item > "FreeRADIUS-Response-Delay-USec" found in filter list for realm > "DEFAULT". > # Instantiating module "attr_filter.access_challenge" from file > /etc/freeradius/3.0/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/3.0/mods-config/attr_filter/access_challenge > # Instantiating module "attr_filter.accounting_response" from file > /etc/freeradius/3.0/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/3.0/mods-config/attr_filter/accounting_response > # Instantiating module "cache_eap" from file > /etc/freeradius/3.0/mods-enabled/cache_eap > rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) > loaded and linked > # Instantiating module "detail" from file > /etc/freeradius/3.0/mods-enabled/detail > # Instantiating module "auth_log" from file > /etc/freeradius/3.0/mods-enabled/detail.log > rlm_detail (auth_log): 'User-Password' suppressed, will not appear in > detail output > # Instantiating module "reply_log" from file > /etc/freeradius/3.0/mods-enabled/detail.log > # Instantiating module "pre_proxy_log" from file > /etc/freeradius/3.0/mods-enabled/detail.log > # Instantiating module "post_proxy_log" from file > /etc/freeradius/3.0/mods-enabled/detail.log > # Instantiating module "eap" from file > /etc/freeradius/3.0/mods-enabled/eap > # Linked to sub-module rlm_eap_md5 > # Linked to sub-module rlm_eap_leap > # Linked to sub-module rlm_eap_gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > # Linked to sub-module rlm_eap_tls > tls { > tls = "tls-common" > } > tls-config tls-common { > verify_depth = 0 > ca_path = "/etc/freeradius/3.0/certs" > pem_file_type = yes > private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" > certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" > ca_file = "/etc/ssl/certs/ca-certificates.crt" > private_key_password = <<< secret >>> > dh_file = "/etc/freeradius/3.0/certs/dh" > fragment_size = 1024 > include_length = yes > auto_chain = yes > check_crl = no > check_all_crl = no > cipher_list = "DEFAULT" > cipher_server_preference = no > ecdh_curve = "prime256v1" > tls_max_version = "" > tls_min_version = "1.0" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > verify { > skip_if_ocsp_ok = no > } > ocsp { > enable = no > override_cert_url = yes > url = "http://127.0.0.1/ocsp/" > use_nonce = yes > timeout = 0 > softfail = no > } > } > # Linked to sub-module rlm_eap_ttls > ttls { > tls = "tls-common" > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > require_client_cert = no > } > tls: Using cached TLS configuration from previous invocation > # Linked to sub-module rlm_eap_peap > peap { > tls = "tls-common" > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > soh = no > require_client_cert = no > } > tls: Using cached TLS configuration from previous invocation > # Linked to sub-module rlm_eap_mschapv2 > mschapv2 { > with_ntdomain_hack = no > send_error = no > } > # Instantiating module "files" from file > /etc/freeradius/3.0/mods-enabled/files > reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize > [/etc/freeradius/3.0/mods-config/files/authorize]:7 Check item "Secret" > found in reply item list for user "user1". This attribute MUST go > on the first line with the other check items > [/etc/freeradius/3.0/mods-config/files/authorize]:7 Check item "PIN" > found in reply item list for user "user1". This attribute MUST go on the > first line with the other check items > [/etc/freeradius/3.0/mods-config/files/authorize]:7 Check item "Offset" > found in reply item list for user "user1". This attribute MUST go > on the first line with the other check items > [/etc/freeradius/3.0/mods-config/files/authorize]:12 Check item "Secret" > found in reply item list for user "user2". This attribute MUST > go on the first line with the other check items > [/etc/freeradius/3.0/mods-config/files/authorize]:12 Check item "PIN" > found in reply item list for user "user2". This attribute MUST go on > the first line with the other check items > [/etc/freeradius/3.0/mods-config/files/authorize]:12 Check item "Offset" > found in reply item list for user "user2". This attribute MUST > go on the first line with the other check items > reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting > reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy > # Instantiating module "linelog" from file > /etc/freeradius/3.0/mods-enabled/linelog > # Instantiating module "log_accounting" from file > /etc/freeradius/3.0/mods-enabled/linelog > # Instantiating module "mschap" from file > /etc/freeradius/3.0/mods-enabled/mschap > rlm_mschap (mschap): using internal authentication > # Instantiating module "pap" from file > /etc/freeradius/3.0/mods-enabled/pap > # Instantiating module "etc_passwd" from file > /etc/freeradius/3.0/mods-enabled/passwd > rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no > # Instantiating module "preprocess" from file > /etc/freeradius/3.0/mods-enabled/preprocess > reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups > reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints > # Instantiating module "IPASS" from file > /etc/freeradius/3.0/mods-enabled/realm > # Instantiating module "suffix" from file > /etc/freeradius/3.0/mods-enabled/realm > # Instantiating module "realmpercent" from file > /etc/freeradius/3.0/mods-enabled/realm > # Instantiating module "ntdomain" from file > /etc/freeradius/3.0/mods-enabled/realm > } # modules > radiusd: #### Loading Virtual Servers #### > server { # from file /etc/freeradius/3.0/radiusd.conf > } # server > server default { # from file /etc/freeradius/3.0/sites-enabled/default > # Loading authenticate {...} > # Loading authorize {...} > # Loading preacct {...} > # Loading accounting {...} > Ignoring "sql" (see raddb/mods-available/README.rst) > # Loading post-proxy {...} > # Loading post-auth {...} > } # server default > server inner-tunnel { # from file > /etc/freeradius/3.0/sites-enabled/inner-tunnel > # Loading authenticate {...} > # Loading authorize {...} > Ignoring "ldap" (see raddb/mods-available/README.rst) > # Loading session {...} > # Loading post-proxy {...} > # Loading post-auth {...} > # Skipping contents of 'if' as it is always 'false' -- > /etc/freeradius/3.0/sites-enabled/inner-tunnel:61 > } # server inner-tunnel > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = * > port = 0 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > listen { > type = "acct" > ipaddr = * > port = 0 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > listen { > type = "auth" > ipaddr = 127.0.0.1 > port = 18120 > } > Listening on auth address * port 1812 bound to server default > Listening on acct address * port 1813 bound to server default > Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel > Listening on proxy address * port 48955 > Ready to process requests > > (0) Received Access-Request Id 69 from 192.168.Y.Z:55087 to > 192.168.Y.Z:1812 length 88 > (0) User-Name = "user2" > (0) User-Password = "e0462c" > (0) NAS-IP-Address = 127.0.1.1 > (0) NAS-Identifier = "sshd" > (0) NAS-Port = 18078 > (0) NAS-Port-Type = Virtual > (0) Service-Type = Authenticate-Only > (0) Calling-Station-Id = "192.168.Y.Z" > (0) # Executing section authorize from file > /etc/freeradius/3.0/sites-enabled/default > (0) authorize { > (0) [preprocess] = ok > (0) [chap] = noop > (0) [mschap] = noop > (0) [digest] = noop > (0) suffix: Checking for suffix after "@" > (0) suffix: No '@' in User-Name = "user2", looking up realm NULL > (0) suffix: No such realm "NULL" > (0) [suffix] = noop > (0) files: users: Matched entry DEFAULT at line 4 > (0) files: users: Matched entry user2 at line 12 > (0) [files] = ok > (0) [expiration] = noop > (0) [logintime] = noop > (0) pap: WARNING: No "known good" password found for the user. Not > setting Auth-Type > (0) pap: WARNING: Authentication will fail unless a "known good" password > is available > (0) [pap] = noop > (0) } # authorize = ok > (0) Found Auth-Type = External > (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (0) Auth-Type External { > (0) motp: Executing: /usr/sbin/otpverify.sh %{User-Name} %{User-Password} > %{reply:Secret} %{reply:PIN} %{reply:Offset}: > (0) motp: EXPAND %{User-Name} > (0) motp: --> user2 > (0) motp: EXPAND %{User-Password} > (0) motp: --> e0462c > (0) motp: EXPAND %{reply:Secret} > (0) motp: --> MYSECRET > (0) motp: EXPAND %{reply:PIN} > (0) motp: --> MYPIN > (0) motp: EXPAND %{reply:Offset} > (0) motp: --> 0 > (0) motp: ERROR: Failed parsing output from: /usr/sbin/otpverify.sh > %{User-Name} %{User-Password} %{reply:Secret} %{reply:PIN} %{reply:Offset}: > Expecting operator > (0) motp: ERROR: Program returned code (0) and output 'ACCEPT' > (0) [motp] = fail > (0) } # Auth-Type External = fail > (0) Failed to authenticate the user > (0) Using Post-Auth-Type Reject > (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (0) Post-Auth-Type REJECT { > (0) attr_filter.access_reject: EXPAND %{User-Name} > (0) attr_filter.access_reject: --> user2 > (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 > (0) [attr_filter.access_reject] = updated > (0) [eap] = noop > (0) policy remove_reply_message_if_eap { > (0) if (&reply:EAP-Message && &reply:Reply-Message) { > (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE > (0) else { > (0) [noop] = noop > (0) } # else = noop > (0) } # policy remove_reply_message_if_eap = noop > (0) } # Post-Auth-Type REJECT = updated > (0) Login incorrect (motp: Failed parsing output from: > /usr/sbin/otpverify.sh %{User-Name} %{User-Password} %{reply:Secret} > %{reply:PIN} %{reply:Offset}: Expecting operator): [user2/e0462c] (from > client devVM port 18078 cli 192.168.Y.Z) > (0) Delaying response for 1.000000 seconds > Waking up in 0.1 seconds. > Waking up in 0.8 seconds. > (0) Sending delayed response > (0) Sent Access-Reject Id 69 from 192.168.Y.Z:1812 to 192.168.Y.Z:55087 > length 20 > Waking up in 3.9 seconds. > (0) Cleaning up request packet ID 69 with timestamp +32 > Ready to process requests

2 1

Initial design question
by Jure Simšič 01 Jul '21

01 Jul '21

Hi, I'm trying to configure radius for an edu organisation that has the following needs: a1. staff wifi (edu employees) a2. eduroam wifi a3. network devices auth for admins a4. eth 802.1X auth in future There are a couple of backends I need to authenticate to: b1. staff is in MS AD - staffAD b2. students have another AD not part of same AD domain, I need to auth them separately - studAD b3. visiting students/lecturers get their auth via eduroam delegation to their home organisations Additionally I have special needs for a3 that apart from the u/p I need to check if they are members of a particular group. I've already set up the basics for b1 via winbind and it seems to be working via radtest. What I've managed to read in the various docs is that I can only authenticate to one AD via AD membership / winbind and also if I want to check group membership it has to be done via LDAP (can do it via ldapsearch). So I have a couple of questions on what is the correct way to set up all this: 1. should I make a separate server instance in sites-available for b1-3 (or even two for b1 if I need to do a separate LDAP auth for a3) and put each one on a separate port? 2. how to deal with eduroam wifi - a user can be from several realms - 1) @edu auth b1, 2) @student.edu auth b2, @anything_else delegate. Where should this actually be done? In a server configuration or in proxy.conf or where? 3. I've already started editing files in mods-available (namely ldap) but it feels wrong to do it there on the master files. Should I make a copy for each LDAP server in mods and reference it somewhere or how do I make separate copies for different backends and ldap filters.. And how&where do I call the correct module for different ldap backends? So am I correct in the assumption that I will need the following servers: 1. one winbind for a1 and a2 @edu realm that authenticate to b1 2. one ldap for a2 for @student.edu to b2 3. one ldap for a3 (and a4) to b1 4. one forwarder/proxy for a2 for @other Thanks a lot for any pointers. I'm starting to get the feeling if I don't do this the proper way from the start I'm going to get entangled in a messy knot rather soon.. Cheers, Jure

2 3

ERROR: TLS Alert write:fatal:protocol version
by Christoph Litauer 01 Jul '21

01 Jul '21

Dear freeradius-users, after googling, reading and debugging for about 3 days now, maybe the community is able to help: Since moving our radius to ubuntu 20.0.4 some of our users are not able to authenticate using peap. The error message in radius.log is kind of Mon Jun 28 16:02:17 2021 : ERROR: (370) eap_peap: ERROR: TLS Alert write:fatal:protocol version Mon Jun 28 16:02:17 2021 : Error: tls: TLS_accept: Error in error Mon Jun 28 16:02:17 2021 : Auth: (370) Login incorrect (eap_peap: TLS Alert write:fatal:protocol version): [eduroam(a)uni-koblenz.de] (from client Unifi AccessPoints port 0 cli ... Most of these client seem to be very old (macOS El Capitan, iOS 10.x) but not all of them. My suggestion is, that these clients try to use TLS 1.0. So I excerpted a debug log with freeradius -X (attached). Indeed I can see (197) eap_peap: <<< recv TLS 1.3 [length 0062] (197) eap_peap: >>> send TLS 1.0 Alert [length 0002], fatal protocol_version So I changed the following lines in mods-enables/eap: # disable_tlsv1_2 = no # disable_tlsv1_1 = yes # disable_tlsv1 = yes tls_min_version = "1.0" tls_max_version = "1.2" Restarted radius, but no change at all. Any help is greatly appreciated! Thanks in advance! -- Kind regards Christoph _________________________________________ Uni Koblenz, Computing Centre, Office A 022 Postfach 201602, 56016 Koblenz Fon: +49 261 287-1311, Fax: -100 1311

6 8