October 2023 - Freeradius-Users - lists.freeradius.org

Allow requests even if the MAC is not allowed?
by Florian Traxler (mieX GmbH) 30 Oct '23

30 Oct '23

Hello! Can you allow requests via DHCP in FreeRadius 3.0.20 even if the MAC is not allowed? Example: () sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:00:00:AA:BB:CC' ORDER BY id () sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:00:00:AA:BB:CC' ORDER BY id () sql: WARNING: User not found in radcheck table. Can I still assign an IP from the IP pool to this MAC? Thanks

2 1

checkrad alternative
by Igor Smitran 30 Oct '23

30 Oct '23

Hi list, I have a new Cisco ASR. There is no SNMP OID on it for checking simultaneous use with checkrad. Is there an alternative? Am i able to use COA instead of checkrad? If so, any help would be appreciated. Thanx

4 11

auto scaling freeradius instance on openshift and state-ID problem
by Mesut GULNAZ 29 Oct '23

29 Oct '23

I was able to run freeradius instance on kubernetes / openshift. and I am using 2FA via freeradius. my problem is; when I auto-scale the freeradius to more than 1, openshift platform is unable to send the response coming from the client side with state-ID to the correct radius POD. The other radius pod is rejecting the reply coming from the client because of the state created by the other radius POD. is there a solution or workaround for this case? best regards.

4 8

Connect sql with eap-PEAP /MSchapv2
by Laurent Estévez 27 Oct '23

27 Oct '23

hello I have a functional configuration with ntlm_auth link in EAP-PEAP/MSchapv2. I would like to add an sql database as a source, is this possible ? I've done some tests OK with EAP-TTLS, but not with my current configuration, Thanks in advance, Laurent --

3 3

Updating/overwriting attribute with rlm_python
by Norman Elton 26 Oct '23

26 Oct '23

I’m using rlm_python, returning a tuple to update attributes in the reply. I’ve noticed that if the request already has a value for that attribute, it is not overwritten. That is, my operation becomes a no-op. I suppose this matches the behavior of the “=“ operator. Is there a way to behave like the “:=“ operator, overwriting the existing value? Or should I strip the value prior to invoking my python module? Thanks, Norman

2 1

PEAP/mschapv2 password fail log guestion
by 박지연 25 Oct '23

25 Oct '23

1 0

Stuck at "More than 50 roundtrips"
by thomas＠habets.se 24 Oct '23

24 Oct '23

Hi. I'm trying to set up EAP-TLS with certificates with an Android Pixel 7 Pro, latest OS, via a Unifi U6 Pro, using FreeRadius 3.0.17 on a raspberry pi 4. I took the default config, and changed as little as possible: clients.conf, added: client wifi_aps { ipaddr = 192.168.123.0/24 secret = radiuspasswordhere } In case it would help, I also added a user. PEAP auth with username/password works. wifi Cleartext-Password := "XXXXXXX" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "13", Reply-Message = "Hello there!" Made the certificates by editing the .cnf files and doing "make ca.pem", "make server.pem", and "make client.pem". I loaded the .p12 on the Android phone, and changed the paths in mod-enabled/eap. I changed default_eap_type to tls, and added use_tunneled_reply to tls-config. Here's a selection of the output of freeradius -X: First access request in packet 1: (1) Received Access-Request Id 61 from 192.168.XX.Z:59545 to 192.168.XX.Y:1812 length 216 SSL handshake done by packet 8: (8) eap_tls: SSL Connection Established (with client cert details shown) After that there's just a bunch of apparently empty-ish repeating Access-Request/Access-Challenge[1], and it's stuck that way until: (52) eap: ERROR: rlm_eap (EAP): Aborting! More than 50 roundtrips made in session with state 0x8e36e001bc25ed47 What am I doing wrong? In this example I'm putting "wifi" as identity, in case it helps that it's present in the user config. I expect that at some point the server should reply Accepted, instead of a new challenge. I guess the client cert was not enough auth? Is there a config I need to change so that cert is sufficient? I'd appreciate any help. Thanks. [1] (14) Received Access-Request Id 74 from 192.168.XX.Z:59545 to 192.168.XX.Y:1812 length 231 (14) User-Name = "wifi" (14) NAS-IP-Address = 192.168.XX.Z (14) NAS-Identifier = "xxx" (14) Called-Station-Id = "xx-xx-xx-xx-xx-xx:secnet2" (14) NAS-Port-Type = Wireless-802.11 (14) Service-Type = Framed-User (14) Calling-Station-Id = "xx-xx-xx-xx-xx-xx" (14) Connect-Info = "CONNECT 0Mbps 802.11b" (14) Acct-Session-Id = "3E1F2B0282D15C98" (14) Acct-Multi-Session-Id = "3870EEE1F7155662" (14) WLAN-Pairwise-Cipher = 1027076 (14) WLAN-Group-Cipher = 1027076 (14) WLAN-AKM-Suite = 1027073 (14) Framed-MTU = 1400 (14) EAP-Message = 0x02ed00060d00 (14) State = 0x8e36e00182dbed476556c84932fcf3de (14) Message-Authenticator = 0x03a0ae965bd12781a50f91cd3ac1aaf6 (14) session-state: No cached attributes (14) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (14) authorize { (14) policy filter_username { (14) if (&User-Name) { (14) if (&User-Name) -> TRUE (14) if (&User-Name) { (14) if (&User-Name =~ / /) { (14) if (&User-Name =~ / /) -> FALSE (14) if (&User-Name =~ /@[^@]*@/ ) { (14) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (14) if (&User-Name =~ /\.\./ ) { (14) if (&User-Name =~ /\.\./ ) -> FALSE (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (14) if (&User-Name =~ /\.$/) { (14) if (&User-Name =~ /\.$/) -> FALSE (14) if (&User-Name =~ /(a)\./) { (14) if (&User-Name =~ /(a)\./) -> FALSE (14) } # if (&User-Name) = notfound (14) } # policy filter_username = notfound (14) [preprocess] = ok (14) [chap] = noop (14) [mschap] = noop (14) [digest] = noop (14) suffix: Checking for suffix after "@" (14) suffix: No '@' in User-Name = "wifi", looking up realm NULL (14) suffix: No such realm "NULL" (14) [suffix] = noop (14) eap: Peer sent EAP Response (code 2) ID 237 length 6 (14) eap: No EAP Start, assuming it's an on-going EAP conversation (14) [eap] = updated (14) files: users: Matched entry wifi at line 90 (14) [files] = ok (14) [expiration] = noop (14) [logintime] = noop (14) pap: WARNING: Auth-Type already set. Not setting to PAP (14) [pap] = noop (14) } # authorize = updated (14) Found Auth-Type = eap (14) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (14) authenticate { (14) eap: Expiring EAP session with state 0x8e36e00182dbed47 (14) eap: Finished EAP session with state 0x8e36e00182dbed47 (14) eap: Previous EAP request found for state 0x8e36e00182dbed47, released from the list (14) eap: Peer sent packet with method EAP TLS (13) (14) eap: Calling submodule eap_tls to process data (14) eap_tls: Continuing EAP-TLS (14) eap_tls: Peer ACKed our handshake fragment (14) eap_tls: [eaptls verify] = request (14) eap_tls: [eaptls process] = handled (14) eap: Sending EAP Request (code 1) ID 238 length 10 (14) eap: EAP session adding &reply:State = 0x8e36e00183d8ed47 (14) [eap] = handled (14) } # authenticate = handled (14) Using Post-Auth-Type Challenge (14) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (14) Challenge { ... } # empty sub-section is ignored (14) Sent Access-Challenge Id 74 from 192.168.XX.Y:1812 to 192.168.XX.Z:59545 length 0 (14) Tunnel-Type = VLAN (14) Tunnel-Medium-Type = IEEE-802 (14) Tunnel-Private-Group-Id = "13" (14) Reply-Message = "Hello there!" (14) EAP-Message = 0x01ee000a0d8000000000 (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x8e36e00183d8ed476556c84932fcf3de (14) Finished request -- typedef struct me_s { char name[] = { "Thomas Habets" }; char email[] = { "thomas(a)habets.se" }; char kernel[] = { "Linux" }; char *pgpKey[] = { "http://www.habets.pp.se/pubkey.txt" }; char pgp[] = { "9907 8698 8A24 F52F 1C2E 87F6 39A4 9EEA 460A 0169" }; char coolcmd[] = { "echo '. ./_&. ./_'>_;. ./_" }; } me_t;

2 3

Identify the site in logging
by Stephane Bourque 24 Oct '23

24 Oct '23

Hello, We have a need to be able to identify the virtual-server that is generating the log messages. How would you approach this? - Is there a way to get a different logging configuration per server? - Is there a way to add the server name in logging statements? We are not too sure of how to proceed. Thanks for your guidance. -- *Stephane Bourque* *CEO & Founder* *Arilia Wireless Inc.* *"Everything connected"* stephane.bourque(a)arilia.com +1(778)558-3524 *www.arilia.com <http://www.arilia.com>*

3 3

Unable to start freeradius as service - Couldn't connect to MySQL server
by vira vva 24 Oct '23

24 Oct '23

root@ngw40:/etc/freeradius/mods-enabled# freeradius -v radiusd: FreeRADIUS Version 3.2.3 (git #db3d1924d), for host x86_64-pc-linux-gnu FreeRADIUS Version 3.2.3 running on terminal without any issue *freeradius -X* Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 44685 Listening on proxy address :: port 57364 *run as as service always failed with sql connection issue* Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: # Instantiating module "sql" from file /etc/freeradius/mods-enabled/sql Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Info: rlm_sql_mysql: libmysql version: 8.0.34 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: mysql { Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: tls { Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011ca_file = "/etc/ssl/certs/my_ca.crt" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011ca_path = "/etc/ssl/certs/" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011certificate_file = "/etc/ssl/certs/private/client.crt" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011private_key_file = "/etc/ssl/certs/private/client.key" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011cipher = "DHE-RSA-AES256-SHA:AES128-SHA" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011tls_required = yes Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011check_cert = no Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011check_cert_cn = no Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Warning: /etc/freeradius/mods-enabled/sql[94]: The item 'tls_check_cert' is defined, but is unused by the configuration Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Warning: /etc/freeradius/mods-enabled/sql[95]: The item 'tls_check_cert_cn' is defined, but is unused by the configuration Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: } Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011warnings = "auto" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: } Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Info: rlm_sql (sql): Attempting to connect to database "radius" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql): Initialising connection pool Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: pool { Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011start = 5 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011min = 3 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011max = 32 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011spare = 10 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011uses = 0 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011lifetime = 0 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011cleanup_interval = 30 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011idle_timeout = 60 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011retry_delay = 30 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011max_retries = 5 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011spread = no Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: } Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql): Processing generate_sql_clients Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Info: rlm_sql (sql): Opening additional connection (0), 1 of 1 pending slots used Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql_mysql: Starting connect to MySQL server Oct 24 14:42:43 ngw40 freeradius[168957]: WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: rlm_sql_mysql: Couldn't connect to MySQL server radius@localhost:radius Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: rlm_sql_mysql: MySQL error: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql_mysql: Socket destructor called, closing socket Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: rlm_sql (sql): Opening connection failed (0) Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: Failed to load clients from SQL Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: /etc/freeradius/mods-enabled/sql[27]: Instantiation failed for module "sql"

2 1

How to match Vendor specific attribute
by Vishnu 23 Oct '23

23 Oct '23

Hi, I am using freeradius as a proxy, I want to match the VSA with the if statement and add another VSA based on that. Below mentioned is my custom policy config. custom_policy { if (NAS-Identifier =~ /DUBDC1-EX2200-*/) { if (%{Switch-User-Policy} =~ /.*switch-superuser.*/) update reply { Juniper-Local-User-Name = "switch-superuser" } } } } if i use .* instead of /.*switch-superuser.*/ it works. but i want to match the string. Please let me know how i can achieve this. Below is the Access accept message. (0) Sent Access-Accept Id 203 from 10.108.25.102:1812 to 10.108.25.29:56849 length 44 (0) Switch-User-Policy = "switch-superuser" Thanks, Vishnu

2 1