December 2022 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

IKEv2 VPN clients and 2FA
by Markus Winkler 22 Mar '23

22 Mar '23

Hi all, I hope I may ask you regarding this topic. I have a test setup of OPNsense firewall, FreeRADIUS 3.2.0 and using Linux, Mac and especially Windows 10 (with the native Windows client) IKEv2 VPN clients. OPNsense / Phase 1 is configured to use EAP-RADIUS (i.e. FreeRADIUS) which is authenticating the VPN users against Active Directory. The VPN clients are using IKEv2 and EAP-MSCHAPv2 with (AD-) username and password. I use winbind for authentication (https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind) and do an additional check if the user is member of a special AD group (via LDAP). These are the key points. And so far it's working fine. But: I have the demand to use 2FA (especially OTP) to increase the security of the VPN access. And that's my very question: I searched around, read tons of articles etc. if that's possible and if yes, what would be the best way to achive this goal. Among others I found this: https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy and would like to ask if someone has such an environment with Windows 10 clients and used it with e.g. privacyIDEA, OpenOTP or similar systems (other than the mentioned Gemalto Safenet Authentication Services)? It would be the best if the OTP system is running on-prem. Could this work and is it worth the effort to setup such a system? Any feedback is highly appreciated. Thank you and best regards, Markus

4 5

RADIUS failing to start correctly when remote DB is unavailable.
by Sea Gull 31 Jan '23

31 Jan '23

Hi, Good afternoon! I have a setup where RADIUS is set to write to multiple DBs simultaneously. I have set this as follows: 1. Copied the SQL instance in /etc/raddb/mods-enabled/sql and had it renamed and configured accordingly. 2. Called them both 3. In the pool, I have set start=0 4. Set read_client to no Although from debug these seem to be correctly set, I am still getting the message that RADIUS is trying to connect to the DB when it is unavailable. After quite a number of minutes and 3 retries, RADIUS fails to start. I have attached the full debug and included some explanation too along the way. Thanks in advance. Kind Regards, SG

3 9

Wi-Fi WPA EAP type negotiation question
by d tbsky 29 Dec '22

29 Dec '22

Hi: I had used freeradius EAP-PEAP-MSCHAPv2 + EAP-PEAP-GTC with Wi-Fi for several years. I had a concept in mind (which seems wrong) that a client would send EAP requests blindly. so client and server should set up correct EAP type parameters before connection. When I found that Win10 supports EAP-TTLS natively, I tried to use it. and I found that when I switch EAP-PEAP/EAP-TTLS settings at freeradius, Win10 and IOS/MacOS would detect it automatically and use the correct EAP type. I use "radiusd -X" to monitor the traffic, it seems freeradius would send something to the client at first response, although I don't know what's inside the EAP Message. I found Win10 will auto detect/support EAP-PEAP-MSCHAPv2/PEAP-TTLS-GTC/PEAP-TTLS-PAP. IOS/MacOS will auto detect/support EAP-PEAP-MSCHAPv2/EAP-PEAP-GTC/EAP-TTLS-GTC. but IOS/MacOS didn't detect EAP-TTLS-PAP. so I don't know if "default_eap_type = pap" is a correct parameter under the ttls section. Win10/Win11 will auto detect and accept PEAP-TTLS-GTC as PEAP-TTLS-PAP which seems strange but a good thing to me.Android seems lazy and doesn't auto-detect anything and just wants the user to input EAP parameters manually. Is there documents about what's behind the scene? Can I decode the EAP Message to know what information is exchanged between client and server? Thanks a lot for the clarification!! Regards, tbskyd

3 2

Centralized accounting and coa/disconnect
by BuzzSaw Code 28 Dec '22

28 Dec '22

We have several distributed RADIUS servers that have been using the robust-proxy-accounting model to centrally log accounting information into a mysql database. Now we want to use that info for coa/disconnects. In the coa virtual server example, the RADIUS server gets a coa packet, then looks up the required data to form the coa packet to send to the NAS. Is there a way to have the centralized accounting server receive the disconnect packet, lookup the info in that mysql instance, then proxy that to the right source RADIUS server, so that server can send the coa (or disconnect) to the NAS ? Some vendors either only allow one or two RADIUS servers and those servers must be used for auth/accounting. We really don't want that central accounting server performing auth for everything, thus why we want to proxy it locally to the right instance for the NAS. So can something like that work or do we need to come up with plan B ?

4 8

ippool: not found -> not sending reply
by Volodymyr Litovka 27 Dec '22

27 Dec '22

Hi, I have in 'users' two kinds of users - one with static IP assignments (Framed-IP-Address) and one with ippool. The issues comes with those 'static' users - when accounting stop happens, ippool behaves in the following way: (16) main_pool: EXPAND %{NAS-IP-Address} %{NAS-Port} (16) main_pool: --> xxx.xxx.xx.xx 892625506 (16) main_pool: MD5 on 'key' directive maps to: bc959cb51c2c3d41c93f922f572ee1d9 (16) main_pool: Searching for an entry for key: 'xxx.xxx.xx.xx 892625506' (16) main_pool: Entry not found (16) [main_pool] = notfound (16) } # accounting = notfound *(16) Not sending reply to client.* it _looks_ as it has no consequences except timeouts and resends on NAS side, but I don't like error-like behaviour. So I was able to fix this with the following statement in 'accounting' section (which is responsible for freeing the lease): redundant { main_pool ok } so regardless of main_pool's error, always return ok. But I have a question - while this is not leasing, but freeing of the lease, whether such rough override can impact something else? Whether it's make sense to add more granular control like "if main_pool returns notfound then it's ok" ? And, sorry for this - how it can be written using unlang? Thank you. -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison

2 2

modify NAS-Port in incoming messages
by Volodymyr Litovka 27 Dec '22

27 Dec '22

Hi colleagues, I'm trying to use Freeradius with Strongswan and have an issue with "registering" user sessions. In short, upon IPSec session reconfiguring (to be more precise - IKE_SA rekeying) Strongswan changes NAS-Port attribute and, thus, FreeRadius upon receiving of next Interim-Update with another NAS-Port value, consider it as a new session and create new entry in radutmp db, so finally I have the following (TTY is NAS-Port received from NAS): root@vpn01:/etc/freeradius/3.0# radwho Login Name What TTY When From Location doka doka shell S3 Sun 22:44 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S4 Sun 22:53 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S5 Sun 23:03 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S6 Sun 23:12 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S12 Sun 23:27 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S15 Sun 23:35 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S18 Sun 23:40 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S19 Sun 23:51 xxx.xxx.xx.xx 100.100.2.1 which makes it impossible to use Simultaneous-Use. There is attribute which do not change during IKE_SA rekey - Acct-Session-Id and I'd like to use it instead of Nas-Port to identify this session, but have two issues: - the statement (added to preacct section of 'default' site): update request { NAS-Port = %{integer:%{base64:&Acct-Session-Id}} } gives an error: /etc/freeradius/3.0/sites-enabled/default[610]: Unknown or invalid value "%{integer:%{base64:&Acct-Session-Id}}" for attribute NAS-Port while if using double quotes `... = "%{integer...}"` converts the value improperly: (3) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (3) preacct { (3) [preprocess] = ok (3) update request { *(3) EXPAND %{integer:%{base64:&Acct-Session-Id}}* (3) --> *(3) NAS-Port = 0* (3) } # update request = noop - and nevertheless, in second case accounting records in 'details' file contains the original NAS-Port value: Mon Dec 26 00:17:19 2022 Acct-Status-Type = Interim-Update Acct-Session-Id = "1672007843-24" Class = 0x70667367726f7570 NAS-Port-Type = Virtual Service-Type = Framed-User *NAS-Port = 25* and radutmp continues to expand the list of connections with original NAS-Port value: doka doka shell *S24* Mon 00:14 xxx.xxx.xx.xx 100.100.2.1 doka doka shell *S25* Mon 00:24 xxx.xxx.xx.xx 100.100.2.1 So, there are two questions: - what is correct way to uniquely convert string to integer? - whether it's possible to mangle NAS-Port attribute to achieve what I need? Thank you! Have a nice holidays and happy next year :-) -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison

2 4

radclient test data
by vaiost SSSS 27 Dec '22

27 Dec '22

Hi,I'm using freeradius 3.2.1 just to log Accounting requests (preferably through linelog module) so as to process data later with an external process.The problem is that when stress freeradius using radclient, many requests are not logged both using linelog or detail modules. I believe that there is something wrong with my test data that is stored in a simple file(i.e. acct_test.txt).Thank you in advanceRegards radclient -f acct_test.txt -c 5000 -t 1 -x -p 10 172.19.185.60 acct m2msdp2022|grep Accounting-Response|wc -lTue Dec 27 13:38:11 EET 2022radclient: Received reply to request we did not send. (id=21 socket 4)radclient: Received reply to request we did not send. (id=59 socket 4)5000 acct_test.txtAcct-Status-Type=StopAcct-Session-Id="testing"NAS-IP-Address=10.95.142.77#User-Name=vaiosCalled-Station-Id=306974028024Framed-IP-Address=10.37.236.170Event-Timestamp=1667211238Acct-Session-Id=C110DB4B857B4FB3Service-Type=FramedFramed-Protocol=PPTP3GPP-IMSI=2020109233950123GPP-Charging-ID=2239451059

2 1

sql ldap simultaneous-use
by mcury 23 Dec '22

23 Dec '22

Hi, I'm new to freeradius, currently trying to enforce simultaneous-use = 1 in my wireless network but it is not working. unifi access point > freeradius > samba-ad-dc mysql> SELECT COUNT(*) FROM radacct WHERE username = 'vanessa' AND acctstoptime IS NULL; +----------+ | COUNT(*) | +----------+ | 2 | +----------+ 1 row in set (0.00 sec) I'm using LDAP for authentication through post-auth section in sites-available/default file using Unlang and its working perfectly. (11) if (LDAP-Group == "wifi_users" && NAS-IP-Address == "172.16.200.3") -> TRUE (11) if (LDAP-Group == "wifi_users" && NAS-IP-Address == "172.16.200.3") { (11) update { (11) control:Simultaneous-Use := 1 (11) reply:Class := 0x776966695f7573657273 (11) } # update = noop (11) [noop] = noop (11) } # if (LDAP-Group == "wifi_users" && NAS-IP-Address == "172.16.200.3") = noop (11) ... skipping elsif: Preceding "if" was taken (11) } # post-auth = ok (11) Sent Access-Accept Id 77 from 192.168.255.241:1812 to 172.16.200.3:38173 length 187 LDAP attribute map as per below: mods-available/ldap: update { ... control:Simultaneous-Use += 'radiusSimultaneousUse = 1' sql is included inside session { section as per documentation. Any tips, perhaps I forgot something? Thanks in advance

2 2