November 2023 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Can I use diffrent root CA certificates while dynamic loading certificate chains?
by James Fan 28 Oct '24

28 Oct '24

Hi, we have a case that, with multi-tenancy, there will be multiple CA certificates in our FreeRadius server, so we need to load the certificate chains dynamically. But when I use the statements below, I can't include the CA certificates in the certificate files I set. The TLS-Session-Cert-File looks like it is only for the server certificate and intermediate CA certificates. Is there any chance of dynamic loading certificate chains with root CA certificates? Thanks. authenticate { ... Auth-Type eap { if ("%{unpack:&EAP-Message 4 byte}" == 1) { update control { TLS-Session-Cert-File := "${certdir}/realms/%{Realm}" } } eap } ... }

4 8

(no subject)
by Deepansha Gaur 04 Dec '23

04 Dec '23

Hi Team, We are in the process of migrating from radiator to freeradius. I have a test freeradius server built on Ubuntu. When I am authenticating locally, radtest is successful. I added a wireless controller client and when I try to connect to the wifi using that client and freeradius authentication, it keeps failing. I see requests from the client to freeradius server but no response from freeradius. Below are the logs for reference: a2:01:00:00:01:70 > 00:50:56:a2:64:59, IPv4, length 336: WIRELESS_IP.32778 > RADIUS_IP.1812: UDP, length 294 There's no response from the radius server. Below are the firewall rules: nft add rule ip filter input udp dport 1812 counter accept nft add rule ip filter input udp dport 1813 counter accept Please let me know if you need any further information. Thanks. Regards, Deepansha Gaur

6 8

Proxy Server Deployment - Duplication of Radacct entries in the DB
by Gabriel Marais 30 Nov '23

30 Nov '23

Hi Guys, I need some advice on setting up Proxies (correctly). Currently, I have two freeRadius servers in the EU and two proxies in Africa. The proxies are configured in a fail-over scenario pointing to the two freeRadius servers in the EU. We receive accounting packets from an upstream carrier which has a fail-over, and in some cases have a load-balance configuration on their side pointing to our proxies. Our proxies receive those packets and they are forwarded to the radius servers in the EU where all the "processing" takes place. The radius servers in the EU are connected to a MySQL cluster where we make use of accounting information for session and capping purposes. The problem now, as far as I can ascertain, is the duplication of sessions in some cases for the same "user name" and as far as I can tell this happens when a proxy server sends the accounting start packet to radius server 1 in the EU - the radius server adds the information to the DB with an unique accounting session id. When the interim update is received by the proxies and that interim update packet is sent to radius server 2 in the EU, the server then creates a new radacct entry in the DB with a new unique accounting id since it cannot find an existing session in the DB with the unique accounting id created by the radius server that first received the start packet. Is there some specific way I need to modify my queries.conf files on the radius servers in the EU or some specific way I need to configure my proxies for them to better handle cases like this? My queries.conf file is the standard out-the-box config apart from adding some relevant 3GPP values to be written on accounting start and interim update packets into the DB as received from the carrier. Thanks in advance. Regards, Gabriel

3 2

real-time graphical tool User debugging
by Giovanni Trapasso 30 Nov '23

30 Nov '23

Hello, We are in the process of migrating from Radiator to FreeRadius. One of the tools we use for debugging user authentication issues is the Radiator tool called Radar, https://radiatorsoftware.com/products/radar/. I have been searching for a similar tool for FreeRadius. My question is what do people use to debug client authentications? It looks like there is the raddebug tool where you can use with varius switches raddebug -c ’Calling-Station-Id == "xx-xx-xx-xx-xx-xx"’ Or raddebug -u <username> both from https://networkradius.com/doc/FreeRADIUS-Implementation-Ch11.pdf Anything with a Graphical interface so that others can debug users without giving them cli access? -- _______________________________________________________________ Giovanni Trapasso _______________________________________________________________

2 1

Removing spaces from User-Name
by Daniel Ryšlink 30 Nov '23

30 Nov '23

Hello, There are NAS devices (Mikrotik) in our network that generate incorrect User-Names in Access-Request packets containing spaces - example: User-Name = "MK-TRA eth 0/9:269.ether8" These packets are refused and invalid by the radius server: Invalid user (Rejected: User-Name contains whitespace): [MK-TRA eth 0/9:269.ether8] The question is - is there a way/how to do a preprocessing on the radius server to remove the whitespace characters from the User-Name? I know that the most correct solution would be to generate valid radius packets on the client side, but I already looked into the RouterOS documentation and there seem to be no fine control on how the packet is generated (User-Name is obviously constructed from configuration items, separated by said whitespaces). Any practical advice would be greatly appreciated, thank you very much in advance. -- Regards, Daniel Ryšlink

2 3

Multiple server certificates for eap with virtual servers?
by alvalon＠web.de 28 Nov '23

28 Nov '23

1 0

Empty timestamp in linelog
by Ashraf Al-Basti 27 Nov '23

27 Nov '23

Hi, I have configured Linelog to log the accept/reject messages but I'm facing an issue if the username has "@". if the username has "@" the timestamp will become empty. below the conf and the debug for both cases linelog llog-auth-reject { filename = /log/authentication/auth-reject-%Y%m%d.csv escape_filenames = no permissions = 0640 format = "" reference = "messages.%{%{reply:Packet-Type}:-default}" messages { default = "Unknown packet type %{Packet-Type}" Access-Accept = "%{Event-Timestamp},%{User-Name},%{NAS-Identifier},%{reply:Packet-Type},%l,%{NAS-IP-Address},%{ERX-Dhcp-Mac-Addr},%{reply:Reply-Message}" Access-Reject = "%{Event-Timestamp},%{User-Name},%{NAS-Identifier},%{reply:Packet-Type},%l,%{NAS-IP-Address},%{ERX-Dhcp-Mac-Addr},%{reply:Reply-Message}" Access-Challenge = "" } } *Username with @* (0) Received Access-Request Id 25 from 192.168.1.21:61062 to 192.168.1.157:1812 length 153 (0) User-Name = "test@wifi" (0) User-Password = "yyyyyyy" (0) NAS-Port = 25 (0) Service-Type = Login-User (0) NAS-IP-Address = 10.129.10.50 (0) Connect-Info = "1|10" (0) Calling-Station-Id = "11-33-44-55-a5-11" (0) NAS-Identifier = "SRC" (0) Called-Station-Id = "12345" (0) ERX-Dhcp-Mac-Addr = "11-33-44-55-a5-12" (0) NAS-Port-Id = "mx480-0-re0#ae2:3500##" (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> TRUE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) update request { (0) &Module-Failure-Message += 'Rejected: Realm does not have at least one dot separator' (0) } # update request = noop (0) [reject] = reject (0) } # if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) = reject (0) } # if (&User-Name) = reject (0) } # policy filter_username = reject (0) } # authorize = reject *(0) Invalid user (Rejected: Realm does not have at least one dot separator): [test@wifi] (from client test1 port 25 cli 11-33-44-55-a5-11)* (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) llog-auth-reject: EXPAND messages.%{%{reply:Packet-Type}:-default} (0) llog-auth-reject: --> messages.Access-Reject (0) llog-auth-reject: EXPAND %{Event-Timestamp},%{User-Name},%{NAS-Identifier},%{reply:Packet-Type},%l,%{NAS-IP-Address},%{ERX-Dhcp-Mac-Addr},%{reply:Reply-Message} (0) llog-auth-reject: --> ,test@wifi ,SRC,Access-Reject,1701103042,10.129.10.50,11-33-44-55-a5-12, (0) llog-auth-reject: EXPAND /log/authentication/auth-reject-%Y%m%d.csv (0) llog-auth-reject: --> /log/authentication/auth-reject-20231127.csv (0) [llog-auth-reject] = ok (0) } # Post-Auth-Type REJECT = ok (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 25 from 192.168.1.157:1812 to 192.168.1.21:61062 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 25 with timestamp +6 Username without "@" (1) Received Access-Request Id 26 from 192.168.1.21:56579 to 192.168.1.157:1812 length 148 (1) User-Name = "test" (1) User-Password = "yyyyyyy" (1) NAS-Port = 26 (1) Service-Type = Login-User (1) NAS-IP-Address = 10.129.10.50 (1) Connect-Info = "1|10" (1) Calling-Station-Id = "11-33-44-55-a5-11" (1) NAS-Identifier = "SRC" (1) Called-Station-Id = "12345" (1) ERX-Dhcp-Mac-Addr = "11-33-44-55-a5-12" (1) NAS-Port-Id = "mx480-0-re0#ae2:3500##" (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) sql: EXPAND %{User-Name} (1) sql: --> test (1) sql: SQL-User-Name set to 'test' rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" *rlm_sql (sql): Opening additional connection (0), 1 of 500 pending slots used* rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 8.0.30, protocol version 10 rlm_sql (sql): Reserved connection (0) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id *(1) sql: WARNING: User not found in radcheck table.* rlm_sql (sql): 1 of 1 connections in use. You may need to increase "spare" *rlm_sql (sql): Opening additional connection (1), 1 of 499 pending slots used* rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 8.0.30, protocol version 10 rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) *Need 9 more connections to reach 10 spares* *rlm_sql (sql): Opening additional connection (2), 1 of 498 pending slots used* rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 8.0.30, protocol version 10 (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (1) sql: User not found in any groups rlm_sql (sql): Released connection (0) (1) [sql] = notfound (1) [expiration] = noop (1) [logintime] = noop *(1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type* *(1) pap: WARNING: Authentication will fail unless a "known good" password is available* (1) [pap] = noop (1) } # authorize = ok *(1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject* (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) llog-auth-reject: EXPAND messages.%{%{reply:Packet-Type}:-default} (1) llog-auth-reject: --> messages.Access-Reject (1) llog-auth-reject: EXPAND %{Event-Timestamp},%{User-Name},%{NAS-Identifier},%{reply:Packet-Type},%l,%{NAS-IP-Address},%{ERX-Dhcp-Mac-Addr},%{reply:Reply-Message} (1) llog-auth-reject: --> Nov 27 2023 20:38:10 +04,test,SRC,Access-Reject,1701103090,10.129.10.50,11-33-44-55-a5-12, (1) llog-auth-reject: EXPAND /log/authentication/auth-reject-%Y%m%d.csv (1) llog-auth-reject: --> /log/authentication/auth-reject-20231127.csv (1) [llog-auth-reject] = ok (1) } # Post-Auth-Type REJECT = ok (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 26 from 192.168.1.157:1812 to 192.168.1.21:56579 length 20 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 26 with timestamp +54 -- Best regards, Ashraf Al-Basti

2 1

Apache Auth via User/OTP fails
by Vogt, Andreas 27 Nov '23

27 Nov '23

Hello, I try to authenticate via my Apache Webserver to my freeradius Server. The Apache connects successful, and provides User/OneTimePassword to the freeradius. Here I use the following Config: Auth-Type OTP_OWA { update control { SECRET := `/usr/bin/php /freeradius_scripts/getSecretFromDB.php --username=%{User-Name} ` LAST_USED_PIN := `/usr/bin/php /freeradius_scripts/get_last_used_pin.php --username=%{User-Name}` PIN := `/bin/bash /freeradius_scripts/getPin %{control:SECRET}` PIN_FROM_USER := %{User-Password} ATTEMPTS := `/usr/bin/php /freeradius_scripts/get_attempts.php --username=%{User-Name}` Auth-Type := `/usr/bin/php /freeradius_scripts/check_pin_dev_log.php --username=%{User-Name} --pin=%{control:PIN} --pin_from_user=%{User-Password} --last_used_pin=%{control:LAST_USED_PIN} --attempts=%{control:ATTEMPTS}` } } Unfortunately I receive an REJECT from the freeradius: {DEBUG Output}: (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type OTP_OWA { (0) update control { (0) Executing: /usr/bin/php /freeradius_scripts/getSecretFromDB.php --username=%{User-Name} : (0) EXPAND --username=%{User-Name} (0) --> --username=USER.NAME (0) Program returned code (0) and output SECRET (0) SECRET := SECRET (0) Executing: /usr/bin/php /freeradius_scripts/get_last_used_pin.php --username=%{User-Name}: (0) EXPAND --username=%{User-Name} (0) --> --username= USER.NAME (0) Program returned code (0) and output 12346 (0) LAST_USED_PIN := 12346 (0) Executing: /bin/bash /freeradius_scripts/getPin %{control:SECRET}: (0) EXPAND %{control:SECRET} (0) --> SECRET (0) Program returned code (0) and output 12346 (0) PIN := 12346 (0) PIN_FROM_USER := %{User-Password} (0) Executing: /usr/bin/php /freeradius_scripts/get_attempts.php --username=%{User-Name}: (0) EXPAND --username=%{User-Name} (0) --> --username= USER.NAME (0) Program returned code (0) and output '0' (0) ATTEMPTS := 0 (0) Executing: /usr/bin/php /freeradius_scripts/check_pin_dev_log.php --username=%{User-Name} --pin=%{control:PIN} --pin_from_user=%{User-Password} --last_used_pin=%{control:LAST_USED_PIN} --attempts=%{control:ATTEMPTS}: (0) EXPAND --username=%{User-Name} (0) --> --username= USER.NAME (0) EXPAND --pin=%{control:PIN} (0) --> --pin=12346 (0) EXPAND --pin_from_user=%{User-Password} (0) --> --pin_from_user=12346 (0) EXPAND --last_used_pin=%{control:LAST_USED_PIN} (0) --> --last_used_pin=64321 (0) EXPAND --attempts=%{control:ATTEMPTS} (0) --> --attempts=0 (0) Program returned code (0) and output 'Accept' (0) Auth_Type_LOG := Accept (0) Executing: /usr/bin/php /freeradius_scripts/check_pin_dev_log.php --username=%{User-Name} --pin=%{control:PIN} --pin_from_user=%{User-Password} --last_used_pin=%{control:LAST_USED_PIN} --attempts=%{control:ATTEMPTS}: (0) EXPAND --username=%{User-Name} (0) --> --username= USER.NAME (0) EXPAND --pin=%{control:PIN} (0) --> --pin=12346 (0) EXPAND --pin_from_user=%{User-Password} (0) --> --pin_from_user=12346 (0) EXPAND --last_used_pin=%{control:LAST_USED_PIN} (0) --> --last_used_pin=64321 (0) EXPAND --attempts=%{control:ATTEMPTS} (0) --> --attempts=0 (0) Program returned code (0) and output 'Accept' (0) Auth-Type := Accept (0) } # update control = noop (0) update reply { (0) Reply-Message := Accept (0) } # update reply = noop (0) } # Auth-Type OTP_OWA = noop (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) update control { (0) Executing: /usr/bin/php /freeradius_scripts/write_in_log_win.php --username=%{User-Name} --auth_type=%{control:Auth_Type_LOG} --ip=%{Calling-Station-Id} --reply=Reject: (0) EXPAND --username=%{User-Name} (0) --> --username= USER.NAME (0) EXPAND --auth_type=%{control:Auth_Type_LOG} (0) --> --auth_type=Accept (0) EXPAND --ip=%{Calling-Station-Id} (0) --> --ip= (0) Program returned code (0) and output 'Reject' (0) LOG_EINTRAG := Reject (0) } # update control = noop (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> USER.NAME (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.9 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 117 from 10.1.56.3:1812 to 10.1.56.167:1026 length 28 So my .php Script checks the OTP-PIN ans returns “Accept”, but the freeradius answers Accept-Reject… Why? Thanks for any response 😉 Andreas

2 1

Freeradius is crashing while proxying a request.
by Amit P 25 Nov '23

25 Nov '23

Hi, Freeradius is crashing with signal 6 when no live homeserver is available, while proxying a request. I have only one home server in my pool and when it is marked as dead and a new access-request is received freeradius is crashed. Logs: Sat Nov 25 08:52:27 2023 : Debug: (1) No proxy response, giving up on request and marking it done Sat Nov 25 08:52:27 2023 : Proxy: Marking home server 20.0.0.4 port 1812 as zombie (it has not responded in 30.000000 seconds). Sat Nov 25 08:52:27 2023 : ERROR: (1) Failing proxied request for user "00:50:56:96:ff:32", due to lack of any response from home server 20.0.0.4 port 1812 Sat Nov 25 08:52:27 2023 : Debug: (1) Clearing existing &reply: attributes Sat Nov 25 08:52:27 2023 : Debug: (1) Found Post-Proxy-Type Fail-Authentication Sat Nov 25 08:52:27 2023 : Debug: (1) server default { Sat Nov 25 08:52:27 2023 : Debug: (1) Post-Proxy-Type sub-section not found. Ignoring. Sat Nov 25 08:52:27 2023 : Debug: (1) # Executing group from file /etc/raddb/sites-enabled/default Sat Nov 25 08:52:27 2023 : Debug: (1) } Sat Nov 25 08:52:27 2023 : Auth: (1) Login incorrect (Home Server failed to respond): [00:50:56:96:ff:32] (from client 20.0.0.1 port 2 cli 00-50-56-96-FF-32) Sat Nov 25 08:52:27 2023 : Debug: (1) There was no response configured: rejecting request Sat Nov 25 08:52:27 2023 : Debug: (1) Using Post-Auth-Type Reject Sat Nov 25 08:52:27 2023 : Debug: (1) # Executing group from file /etc/raddb/sites-enabled/default Sat Nov 25 08:52:27 2023 : Debug: (1) Post-Auth-Type REJECT { Sat Nov 25 08:52:27 2023 : Debug: (1) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Sat Nov 25 08:52:27 2023 : Debug: %{User-Name} .... Sat Nov 25 08:52:57 2023 : Debug: PING: Zombie period is over for home server remoteradius2 Sat Nov 25 08:52:57 2023 : Proxy: Marking home server 20.0.0.4 port 1812 as dead. Sat Nov 25 08:52:57 2023 : Debug: PING: Reviving home server remoteradius2 in 300 seconds Sat Nov 25 08:52:57 2023 : Debug: Waking up in 2.7 seconds. .... .... at Nov 25 08:53:56 2023 : Debug: (2) Received Access-Request Id 5 from 20.0.0.1:50918 to 20.0.0.2:1812 length 169 Sat Nov 25 08:53:56 2023 : Debug: (2) User-Name = "00:50:56:96:ff:32" Sat Nov 25 08:53:56 2023 : Debug: (2) Calling-Station-Id = "00-50-56-96-FF-32" .... Sat Nov 25 08:53:56 2023 : Debug: (2) } # authorize = updated Sat Nov 25 08:53:56 2023 : Debug: Using home pool auth for realm realm2 Sat Nov 25 08:53:56 2023 : ERROR: (2) Failed to find live home server: Cancelling proxy Sat Nov 25 08:53:56 2023 : WARNING: (2) No home server selected Sat Nov 25 08:53:56 2023 : Debug: (2) Clearing existing &reply: attributes Sat Nov 25 08:53:56 2023 : Debug: (2) Found Post-Proxy-Type Fail-Authentication Sat Nov 25 08:53:56 2023 : Error: ASSERT FAILED src/main/process.c[2485]: request->home_server != NULL CAUGHT SIGNAL: Aborted Backtrace of last 12 frames: /usr/lib/libfreeradius-radius.so.0(fr_fault+0x144)[0xffff81bc0d64] /usr/lib/libfreeradius-server.so.0(rad_assert_fail+0x2c)[0xffff81c219fc] radiusd[0x42f648] radiusd[0x436490] # radiusd -v radiusd: FreeRADIUS Version 3.0.20 (git #d94c953ab), for host aarch64-cnos-linux-gnu, built on Mar 9 2018 at 12:34:56 FreeRADIUS Version 3.0.20 Thanks & Regards, Amit

2 1

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

LDAPS - where to start from?
by little-nemo＠virgilio.it 23 Nov '23

23 Nov '23

Hello, members. I followed the upgrading suggestion. Now working on Freeradius 3.2.1 (on Debian 11.5). I'm also using some personalized templates of the Eduroam/GARR consortium. Trying to setup LDAP filtering. To get an idea on how to do it, I read the tread "LDAP groups and how to filter" (https://lists.freeradius.org/pipermail/freeradius-users/2020-February/09743…) Is it still up to date? Is it a feasible solution? I'm still not understanding if this solution also requires the memberof/membership settings in the mods-available/ldap module. Does it? Now my main concern is the LDAPS binding, which is not working. Debug last rows: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldaps://dc1.testuni.it:636 rlm_ldap (ldap): Bind with CN=reader-freeradius,OU=ServiceUsers,OU=ServicePeople,DC=testuni,DC=it to ldaps://dc1.testuni.it:636 failed: Can't contact LDAP server rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" I tried to bind, manually, using the general command: ldapsearch -D ${identity} -w ${password} -H ${server} -b 'CN=user,${base_dn}' and it worked. In mods-available/ldap, at line 77, I read the suggestion: ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base_dn}' which did not work (the "-h" parameter is not supported anymore?). I don't think that this is the exact command used by freeradius, so the cause is elsewhere, likely in my configuration files. What am I supposed to check? Do you need the full debug? Thanks in advance, Pietro

3 11

Can we re-order the authorization queries in the SQL module?
by James Fan 23 Nov '23

23 Nov '23

We have a case that needs to prioritize the group reply attributes more than the user reply attributes in the same attribute. However, I found a fixed order for the authorization queries in the source code as below. radcheck -> radreply -> radgroupcheck -> radgroupreply If I change the orders in queries.conf, the query order is not changed while authorizing. So I wonder if we can re-order the authorization queries by any configuration to make higher priority for the group reply? Thanks.

4 6

Request Authenticator value made available to a Perl module
by Brandon Miller 21 Nov '23

21 Nov '23

Hi Everyone, I am working on a Perl module that requires access to the Request Authenticator value for each Access-Request. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code | Identifier | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | Request Authenticator <----------- I need this value passed to my Perl module | | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Attributes ... +-+-+-+-+-+-+-+-+-+-+-+-+- I combed through the docs and found the Request-Authenticator Runtime variable (https://wiki.freeradius.org/config/run_time_variables) I tried to dynamically assign this variable (%V) to a Radius-Request variable in my site definition file, but the server won't start with error: /etc/raddb/sites-enabled/myPerlSite[17]: Failed parsing expanded string: /etc/raddb/sites-enabled/myPerlSite[17]: %V /etc/raddb/sites-enabled/myPerlSite[17]: ^ Invalid variable expansion It seems this variable has been deprecated in v3. Is there any way to get at this variable in another way? I am running v3.0.13. Thanks in advance, Brandon

2 13

Issues with vendor 3375 (F5) and FreeRADIUS
by Coy Hile (BLOOMBERG/ 919 3RD A) 21 Nov '23

21 Nov '23

Good morning, We're running into issues with F5 devices and authorization against FreeRADIUS. Our network team have included the following dictionary (which is loaded via a $INCLUDE directive in /etc/raddb/dictionary): VENDOR f5 3375 BEGIN-VENDOR f5 ATTRIBUTE F5-LTM-User-Role 1 integer ATTRIBUTE F5-LTM-User-Role-Universal 2 integer # enable/disable ATTRIBUTE F5-LTM-User-Partition 3 string ATTRIBUTE F5-LTM-User-Console 4 integer # enable/disable ATTRIBUTE F5-LTM-User-Shell 5 string # supported values are disable and tmsh ATTRIBUTE F5-LTM-User-Context-1 10 integer ATTRIBUTE F5-LTM-User-Context-2 11 integer ATTRIBUTE F5-LTM-User-Info-1 12 string ATTRIBUTE F5-LTM-User-Info-2 13 string ATTRIBUTE F5-LTM-Audit-Msg 14 string # F5OS vendor-specific-attributes ATTRIBUTE F5-F5OS-UID 21 integer ATTRIBUTE F5-F5OS-GID 22 integer ATTRIBUTE F5-F5OS-HOMEDIR 23 string ATTRIBUTE F5-F5OS-SHELL 24 string ATTRIBUTE F5-F5OS-USERINFO 25 string VALUE F5-LTM-User-Role Administrator 0 VALUE F5-LTM-User-Role Resource-Admin 20 VALUE F5-LTM-User-Role User-Manager 40 VALUE F5-LTM-User-Role Auditor 80 VALUE F5-LTM-User-Role Manager 100 VALUE F5-LTM-User-Role App-Editor 300 VALUE F5-LTM-User-Role Advanced-Operator 350 VALUE F5-LTM-User-Role Operator 400 VALUE F5-LTM-User-Role Firewall-Manager 450 VALUE F5-LTM-User-Role Fraud-Protection-Manager 480 VALUE F5-LTM-User-Role Certificate-Manager 500 VALUE F5-LTM-User-Role IRule-Manager 510 VALUE F5-LTM-User-Role Guest 700 VALUE F5-LTM-User-Role Web-Application-Security-Administrator 800 VALUE F5-LTM-User-Role Web-Application-Security-Editor 810 VALUE F5-LTM-User-Role Web-Application-Security-Operation-Administrator 820 VALUE F5-LTM-User-Role Acceleration-Policy-Editor 850 VALUE F5-LTM-User-Role No-Access 900 VALUE F5-LTM-User-Role-Universal Disabled 0 VALUE F5-LTM-User-Role-Universal Enabled 1 VALUE F5-LTM-User-Console Disabled 0 VALUE F5-LTM-User-Console Enabled 1 END-VENDOR f5 Further, Shane has configured the server to return the following VSAs for a superuser: Tue Nov 14 13:51:39 2023 Packet-Type = Access-Accept F5-LTM-User-Role = Administrator F5-F5OS-GID = 9000 F5-F5OS-UID = 1001 Timestamp = 1699987899 However, tcpdump shows the following: radcas-rr-641 /root # tcpdump -i bond0 -n -vvv host 10.91.250.120 tcpdump: listening on bond0, link-type EN10MB (Ethernet), capture size 262144 bytes 13:51:39.232624 IP (tos 0x0, ttl 55, id 19394, offset 0, flags [DF], proto UDP (17), length 115) 10.91.250.120.54996 > 10.124.134.47.radius-new: [udp sum ok] RADIUS, length: 87 Access-Request (1), id: 0x1f, Authenticator: 314fd8be32430e77a584870ba696ba64 User-Name Attribute (1), length: 10, Value: sedelman 0x0000: 7365 6465 6c6d 616e User-Password Attribute (2), length: 18, Value: 0x0000: 612c f40e 6250 6c36 fd6e ca89 0853 028f NAS-IP-Address Attribute (4), length: 6, Value: 100.65.6.2 0x0000: 6441 0602 NAS-Identifier Attribute (32), length: 15, Value: password-auth 0x0000: 7061 7373 776f 7264 2d61 7574 68 NAS-Port Attribute (5), length: 6, Value: 7692 0x0000: 0000 1e0c NAS-Port-Type Attribute (61), length: 6, Value: Virtual 0x0000: 0000 0005 Service-Type Attribute (6), length: 6, Value: Authenticate Only 0x0000: 0000 0008 13:51:39.278923 IP (tos 0x0, ttl 64, id 21787, offset 0, flags [none], proto UDP (17), length 84) 10.124.134.47.radius-new > 10.91.250.120.54996: [bad udp cksum 0x95d0 -> 0x3ad8!] RADIUS, length: 56 Access-Accept (2), id: 0x1f, Authenticator: 61df1ce227ff006987a4d9f0506a2cd9 Vendor-Specific Attribute (26), length: 12, Value: Vendor: Unknown (3375) Vendor Attribute: 1, Length: 4, Value: .... 0x0000: 0000 0d2f 0106 0000 0000 Vendor-Specific Attribute (26), length: 12, Value: Vendor: Unknown (3375) Vendor Attribute: 22, Length: 4, Value: ..#( 0x0000: 0000 0d2f 1606 0000 2328 Vendor-Specific Attribute (26), length: 12, Value: Vendor: Unknown (3375) Vendor Attribute: 21, Length: 4, Value: .... 0x0000: 0000 0d2f 1506 0000 03e9 Why is the vendor showing up as "unknown (3375)" when 3375 is the vendor ID for F5? The attributes that FreeRADIUS says it's sending back actually match the vendor attributes, but they're all jumbled. -c

3 2

authorize with other variable
by Florian Traxler (mieX GmbH) 20 Nov '23

20 Nov '23

Hello! I would like to authenticate with Agent Remote ID instead of using MAC as the user name. Can this be solved with "Based on PIN Code" when creating a new user in FreeRadius. In which file can the variable be adjusted to check the agent remote ID instead of the user name and send access-accept. (0) Received Access-Request Id 42 from xxx.xxx.xxx.xxx:57848 to xxx.xxx.xxx.xxx:1812 length 202 (0) NAS-Port-Type = Ethernet (0) NAS-Port = 2207262241 (0) Calling-Station-Id = "cisco-8c94.8s77.dd97-Et0.34" (0) Called-Station-Id = "dhcp1" (0) User-Name = "8C:94:1F:34:EE:89" (0) User-Password = "" (0) Agent-Remote-Id = 0x393734302d31323434313932357c31344d7c35303530343938347c7c (0) Agent-Circuit-Id = 0x4c493732383730322d5045494c5354454930312065746820312f312f31372f31313a3334 (0) NAS-Identifier = "xxx" (0) NAS-IP-Address = xxx.xxx.xxx.xxx (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { Thank you for your help

1 0

TOTP module
by João Miguel Regateiro 16 Nov '23

16 Nov '23

Hello, I was testing my freeRadius server and I found out that a user can authenticate with the same TOTP multiple times within the 30 seconds period. From reading the RFC 6238 I understand that this must not be possible as the One Time Password is for one time use only. Here is my code: authorize { ldap if ((ok || updated)) { if (User-Password !~ /^(.*)([0-9]{6})$/) { reject } update request { User-Password := "%{1}" TOTP-Password := "%{2}" } # gets shared secret from ldap if ( &control:totp_teste =~ /([A-Za-z0-9]+),/ ) { update control { TOTP-Secret := "%{1}" } } totp.authenticate if (!ok) { reject } update control { Auth-Type := ldap } } } authenticate { Auth-Type ldap { ldap } } Could you please provide me some guidance on what I am doing wrong here? Thanks, Miguel

3 3

Auth with Agent Remote ID
by Florian Traxler (mieX GmbH) 16 Nov '23

16 Nov '23

Hello! I use FreeRADIUS version 3.0.20 and would like to allow the user to authenticate using "Agent Remote ID". Is there a way to supplement the configuration according to this parameter "access-accept". Thanks for the support.

2 3

set up tls configuration
by Andrei Katsuk 14 Nov '23

14 Nov '23

Hi, I want to set ca_file in the tls config section to env variable as follows: tls { ca_file = $ENV{LDAP_CERT} } and skip it if $ENV{LDAP_CERT} is empty. If it is empty FreeRADIUS shows next error: =========== Unable to check file "": No such file or directory /etc/raddb/mods-enabled/ldap[488]: Failed parsing configuration item "ca_file" ================ How can I skip it in this case? Andrei

2 1

EAP-TLS with CRLs broken on RHEL 8.8
by Fraser Hess 13 Nov '23

13 Nov '23

We have a working FreeRADIUS implementation. It is configured for EAP-TLS. Our production systems use stock rpms for FreeRADIUS and OpenSSL on CentOS 7.9. Current RPMs: freeradius-3.0.13-15.el7.x86_64 and openssl-1.0.2k-26.el7_9.x86_64 We are moving to Red Hat Enterprise Linux 8.8. We built a test system from scratch, installed our RADIUS config and our tests failed. The RPMs in RHEL 8.8 are: freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.x86_64 and openssl-1.1.1k-9.el8_7.x86_64 The failure occurs in CRL checking. With check_crl = yes and check_all_crl = yes, FreeRADIUS is unable to find our root CA's CRL to validate the intermediate CA. Setting either check_crl or check_all_crl to no resolves the issue. (8) eap_tls: TLS-Cert-Serial := "XXX" (8) eap_tls: TLS-Cert-Expiration := "250901211201Z" (8) eap_tls: TLS-Cert-Subject := "/C=US/O=Organization/CN=Organization Intermediate CA" (8) eap_tls: TLS-Cert-Issuer := "/C=US/O=Organization/CN=Organization Root CA" (8) eap_tls: TLS-Cert-Common-Name := "Organization Intermediate CA" (8) eap_tls: ERROR: SSL says error 3 : unable to get certificate CRL (8) eap_tls: >>> send TLS 1.2 [length 0002] (8) eap_tls: ERROR: TLS Alert write:fatal:unknown CA tls: TLS_accept: Error in error (8) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (8) eap_tls: ERROR: System call (I/O) error (-1) (8) eap_tls: ERROR: TLS receive handshake failed during operation (8) eap_tls: ERROR: [eaptls process] = fail (8) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed Checking the leaf certificate against the intermediate CA appears to work. All of the certificates in /etc/raddb/certs have the correct hashed symlinks. We have tried setting tls_min_version = 1.2 and auto_chain = no, adding the intermediate CA certificate to the certificate_file. The same error results. I can break our production servers in the same manner by removing the hash symlink to the root CA's CRL file. In our test system, it's as if the hash symlink doesn't exist. The permissions on the files are correct - radiusd can read them all. Thank you for any help/suggestions Fraser Hess Workstation Engineer Pinnacol Assurance -- This communication and any attachments are for the sole use of the intended recipient and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer.

2 1

Reg: Freeradius 4.0 TACACS testing support
by shalini arivazhagan 10 Nov '23

10 Nov '23

Hi, I recently downloaded the 4.0 freeradius version to start my TACACS authentication. But I am facing an issue in authentication Added a new client in tacacs file. Add added a user<test> in the /etc/raddb/users file. But authentication is failed, it is giving error "No "known good" password found for user". Kindly help me on the TACACS testing. Where to add users for TACACS authentication in conf file. Thanks, Salini

2 1

Odd behavior on authentication
by Philip Prindeville 10 Nov '23

10 Nov '23

Hi, I had a test client (Ubuntu 22.04) set up, and I was running tcpdump on the server (also Ubuntu, running Freeradius 3.0). I had created a username & password on the Radius server, and if I tried to log into the client with those credentials, it failed. But as soon as I created a "cut out" on the client (same username, but '*' password in the shadow file), I could log in because the server was no longer rejecting the authorization request. I don't get it. How would the server know if there was a local user or not? Nothing in the messages seems to be different, other than the things you'd expect (the message id, and the random seed that the password gets hashed with). All other parts of the message looked to be identical. How was the client conveying to the server that there wasn't a local account present? Also, I've run "pam-auth-update --enable radius" to get pam_radius_auth.so plugged into the PAM stack, but how do I integrate it into /etc/nsswitch.conf as well? This is on Ubuntu so I don't have authconfig/authselect which are RedHat only. Thanks

3 5

deployment with two completely different sets of certificates
by Marek Zarychta 08 Nov '23

08 Nov '23

Dear List, I am considering use case with two completely different sets of certificates (different keys, certificates signed by different CAs). First, original set, will be used for clients without the realm and clients from old.realm. The new set, signed by well-know CA, will be used for TTLS-EAP and PEAP authentications only for the new.realm. If such a scenario requires deploying anther instance of FreeRADIUS, then please let me know, but most likely current instance could be configured to handle it. So far I have extended mods-enabled/eap and have there: eap eap1 { old realm / without realm settings } eap eap2 { new realm settings } eap { old realm / without realm settings } then added to sites-enabled/old.realm: if ((User-Name =~ /new\.realm$/) || ( Inner-Realm-Name =~ /new\.realm$/)) { update control { Auth-Type := eap2 } } but the authentications though successful, are still handled by eap1: (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "new.realm" for User-Name = "anonymous(a)new.realm" (0) suffix: Found realm "new.realm" (0) suffix: Adding Stripped-User-Name = "anonymous" (0) suffix: Adding Realm = "new.realm" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) eap1: Peer sent EAP Response (code 2) ID 130 length 29 (0) eap1: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap1] = ok (0) } # authorize = ok (0) Found Auth-Type = eap2 (0) Found Auth-Type = eap1 (0) ERROR: Warning: Found 2 auth-types on request for user 'anonymous' (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/old.realm (0) authenticate { (0) eap1: Peer sent packet with method EAP Identity (1) (0) eap1: Calling submodule eap_peap to process data (0) eap_peap: (TLS) Initiating new session (0) eap1: Sending EAP Request (code 1) ID 131 length 6 (0) eap1: EAP session adding &reply:State = 0x16f700fc167419f8 (0) [eap1] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge So I am stuck. Please, any clues helping to proceed this further will be appreciated. Cheers ! -- Marek Zarychta

2 2