February 2023 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

IKEv2 VPN clients and 2FA
by Markus Winkler 22 Mar '23

22 Mar '23

Hi all, I hope I may ask you regarding this topic. I have a test setup of OPNsense firewall, FreeRADIUS 3.2.0 and using Linux, Mac and especially Windows 10 (with the native Windows client) IKEv2 VPN clients. OPNsense / Phase 1 is configured to use EAP-RADIUS (i.e. FreeRADIUS) which is authenticating the VPN users against Active Directory. The VPN clients are using IKEv2 and EAP-MSCHAPv2 with (AD-) username and password. I use winbind for authentication (https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind) and do an additional check if the user is member of a special AD group (via LDAP). These are the key points. And so far it's working fine. But: I have the demand to use 2FA (especially OTP) to increase the security of the VPN access. And that's my very question: I searched around, read tons of articles etc. if that's possible and if yes, what would be the best way to achive this goal. Among others I found this: https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy and would like to ask if someone has such an environment with Windows 10 clients and used it with e.g. privacyIDEA, OpenOTP or similar systems (other than the mentioned Gemalto Safenet Authentication Services)? It would be the best if the OTP system is running on-prem. Could this work and is it worth the effort to setup such a system? Any feedback is highly appreciated. Thank you and best regards, Markus

4 5

EAP-TLS default config
by clement.legoffic＠kelio.com 08 Mar '23

08 Mar '23

Hello, I started to learn network authentication and I want to setup a litle poc with Freeradius and EAP-TLS. I have previously tested my working configuration with the bob user as in the freeradius docker example. I use freeradius docker image https://hub.docker.com/r/freeradius/freeradius-server/ in a container. The configs files have been extracted to be configured in my host system and mounted at container's start. I have follow this tutorial for the radiusd.conf file : https://www.dslreports.com/forum/r9286052-FreeRADIUS-WinXP-Authentication-S… As I use the container's default keys, the user file is just a line : user(a)example.org Auth-Type := EAP, EAP-Type := EAP-TLS On my android phone, I connect to a dlink wifi access point (DWL-2100AP) configured for 802.1X. The ca.pem has been installed on my phone in order to use it for EAP-TLS when I select it. The username I use on the phone side is "user(a)example.org", the domain is "example.org". When I click on connect on my phone, I get an access reject as shown in the debug output below. I wanted to know if I am doing wrong somewhere and possibly where ? (Freeradius Version 3.2.0) (0) Received Access-Request Id 0 from 10.17.30.60:1061 to 172.17.0.2:1812 length 212 (0) Message-Authenticator = 0x46c9071611e746712984ef9165b516eb (0) Service-Type = Framed-User (0) User-Name = "user(a)example.org" (0) Framed-MTU = 1488 (0) Called-Station-Id = "00-26-5A-84-0D-89:dlink" (0) Calling-Station-Id = "22-85-59-7C-27-7A" (0) NAS-Identifier = "D-Link Access Point" (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = "CONNECT 54Mbps 802.11g" (0) EAP-Message = 0x020000150175736572406578616d706c652e6f7267 (0) NAS-IP-Address = 10.17.30.60 (0) NAS-Port = 1 (0) NAS-Port-Id = "STA port # 1" (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "example.org" for User-Name = "user(a)example.org" (0) suffix: No such realm "example.org" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 0 length 21 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_tls to process data (0) eap_tls: (TLS) Initiating new session (0) eap_tls: (TLS) Setting verify mode to require certificate from client (0) eap: Sending EAP Request (code 1) ID 1 length 6 (0) eap: EAP session adding &reply:State = 0xbced3a8cbcec3700 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) session-state: Saving cached attributes (0) Framed-MTU = 994 (0) Sent Access-Challenge Id 0 from 172.17.0.2:1812 to 10.17.30.60:1061 length 64 (0) EAP-Message = 0x010100060d20 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xbced3a8cbcec37005a032dcfba50bf3a (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 1 from 10.17.30.60:1061 to 172.17.0.2:1812 length 215 (1) Message-Authenticator = 0x2660937420c3367bd057db626b743cc5 (1) Service-Type = Framed-User (1) User-Name = "user(a)example.org" (1) Framed-MTU = 1488 (1) State = 0xbced3a8cbcec37005a032dcfba50bf3a (1) Called-Station-Id = "00-26-5A-84-0D-89:dlink" (1) Calling-Station-Id = "22-85-59-7C-27-7A" (1) NAS-Identifier = "D-Link Access Point" (1) NAS-Port-Type = Wireless-802.11 (1) Connect-Info = "CONNECT 54Mbps 802.11g" (1) EAP-Message = 0x020100060300 (1) NAS-IP-Address = 10.17.30.60 (1) NAS-Port = 1 (1) NAS-Port-Id = "STA port # 1" (1) Restoring &session-state (1) &session-state:Framed-MTU = 994 (1) # Executing section authorize from file /etc/freeradius/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "example.org" for User-Name = "user(a)example.org" (1) suffix: No such realm "example.org" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 1 length 6 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) files: users: Matched entry user(a)example.org at line 2 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop Not doing PAP as Auth-Type is already set. (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xbced3a8cbcec3700 (1) eap: Finished EAP session with state 0xbced3a8cbcec3700 (1) eap: Previous EAP request found for state 0xbced3a8cbcec3700, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Peer NAK'd indicating it is not willing to continue (1) eap: Sending EAP Failure (code 4) ID 1 length 4 (1) eap: Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> user(a)example.org (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 1 from 172.17.0.2:1812 to 10.17.30.60:1061 length 44 (1) EAP-Message = 0x04010004 (1) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (2) Received Access-Request Id 0 from 10.17.30.60:1063 to 172.17.0.2:1812 length 212 (2) Message-Authenticator = 0x10dad86d8ca96900ee9e41a3f3215e04 (2) Service-Type = Framed-User (2) User-Name = "user(a)example.org" (2) Framed-MTU = 1488 (2) Called-Station-Id = "00-26-5A-84-0D-89:dlink" (2) Calling-Station-Id = "22-85-59-7C-27-7A" (2) NAS-Identifier = "D-Link Access Point" (2) NAS-Port-Type = Wireless-802.11 (2) Connect-Info = "CONNECT 54Mbps 802.11g" (2) EAP-Message = 0x020000150175736572406578616d706c652e6f7267 (2) NAS-IP-Address = 10.17.30.60 (2) NAS-Port = 1 (2) NAS-Port-Id = "STA port # 1" (2) # Executing section authorize from file /etc/freeradius/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: Looking up realm "example.org" for User-Name = "user(a)example.org" (2) suffix: No such realm "example.org" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 0 length 21 (2) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) authenticate { (2) eap: Peer sent packet with method EAP Identity (1) (2) eap: Calling submodule eap_tls to process data (2) eap_tls: (TLS) Initiating new session (2) eap_tls: (TLS) Setting verify mode to require certificate from client (2) eap: Sending EAP Request (code 1) ID 1 length 6 (2) eap: EAP session adding &reply:State = 0x61a7200961a62df0 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) session-state: Saving cached attributes (2) Framed-MTU = 994 (2) Sent Access-Challenge Id 0 from 172.17.0.2:1812 to 10.17.30.60:1063 length 64 (2) EAP-Message = 0x010100060d20 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x61a7200961a62df0743c98b3a07aed8f (2) Finished request Waking up in 1.9 seconds. (3) Received Access-Request Id 1 from 10.17.30.60:1063 to 172.17.0.2:1812 length 215 (3) Message-Authenticator = 0x2946bae5a640bdd89ef938aa738b4b94 (3) Service-Type = Framed-User (3) User-Name = "user(a)example.org" (3) Framed-MTU = 1488 (3) State = 0x61a7200961a62df0743c98b3a07aed8f (3) Called-Station-Id = "00-26-5A-84-0D-89:dlink" (3) Calling-Station-Id = "22-85-59-7C-27-7A" (3) NAS-Identifier = "D-Link Access Point" (3) NAS-Port-Type = Wireless-802.11 (3) Connect-Info = "CONNECT 54Mbps 802.11g" (3) EAP-Message = 0x020100060300 (3) NAS-IP-Address = 10.17.30.60 (3) NAS-Port = 1 (3) NAS-Port-Id = "STA port # 1" (3) Restoring &session-state (3) &session-state:Framed-MTU = 994 (3) # Executing section authorize from file /etc/freeradius/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: Looking up realm "example.org" for User-Name = "user(a)example.org" (3) suffix: No such realm "example.org" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 1 length 6 (3) eap: No EAP Start, assuming it's an on-going EAP conversation (3) [eap] = updated (3) files: users: Matched entry user(a)example.org at line 2 (3) [files] = ok (3) [expiration] = noop (3) [logintime] = noop Not doing PAP as Auth-Type is already set. (3) [pap] = noop (3) } # authorize = updated (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x61a7200961a62df0 (3) eap: Finished EAP session with state 0x61a7200961a62df0 (3) eap: Previous EAP request found for state 0x61a7200961a62df0, released from the list (3) eap: Peer sent packet with method EAP NAK (3) (3) eap: Peer NAK'd indicating it is not willing to continue (3) eap: Sending EAP Failure (code 4) ID 1 length 4 (3) eap: Failed in EAP select (3) [eap] = invalid (3) } # authenticate = invalid (3) Failed to authenticate the user (3) Using Post-Auth-Type Reject (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) Post-Auth-Type REJECT { (3) attr_filter.access_reject: EXPAND %{User-Name} (3) attr_filter.access_reject: --> user(a)example.org (3) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) [attr_filter.access_reject] = updated (3) [eap] = noop (3) policy remove_reply_message_if_eap { (3) if (&reply:EAP-Message && &reply:Reply-Message) { (3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) else { (3) [noop] = noop (3) } # else = noop (3) } # policy remove_reply_message_if_eap = noop (3) } # Post-Auth-Type REJECT = updated (3) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Sending delayed response (3) Sent Access-Reject Id 1 from 172.17.0.2:1812 to 10.17.30.60:1063 length 44 (3) EAP-Message = 0x04010004 (3) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.8 seconds. (0) Cleaning up request packet ID 0 with timestamp +74 due to cleanup_delay was reached (1) Cleaning up request packet ID 1 with timestamp +74 due to cleanup_delay was reached Waking up in 3.0 seconds. (4) Received Access-Request Id 0 from 10.17.30.60:1065 to 172.17.0.2:1812 length 212 (4) Message-Authenticator = 0x7e90cef35650d96b0188a6bcc9040100 (4) Service-Type = Framed-User (4) User-Name = "user(a)example.org" (4) Framed-MTU = 1488 (4) Called-Station-Id = "00-26-5A-84-0D-89:dlink" (4) Calling-Station-Id = "22-85-59-7C-27-7A" (4) NAS-Identifier = "D-Link Access Point" (4) NAS-Port-Type = Wireless-802.11 (4) Connect-Info = "CONNECT 54Mbps 802.11g" (4) EAP-Message = 0x020000150175736572406578616d706c652e6f7267 (4) NAS-IP-Address = 10.17.30.60 (4) NAS-Port = 1 (4) NAS-Port-Id = "STA port # 1" (4) # Executing section authorize from file /etc/freeradius/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: Looking up realm "example.org" for User-Name = "user(a)example.org" (4) suffix: No such realm "example.org" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 0 length 21 (4) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) authenticate { (4) eap: Peer sent packet with method EAP Identity (1) (4) eap: Calling submodule eap_tls to process data (4) eap_tls: (TLS) Initiating new session (4) eap_tls: (TLS) Setting verify mode to require certificate from client (4) eap: Sending EAP Request (code 1) ID 1 length 6 (4) eap: EAP session adding &reply:State = 0x10b8d47310b9d97a (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) session-state: Saving cached attributes (4) Framed-MTU = 994 (4) Sent Access-Challenge Id 0 from 172.17.0.2:1812 to 10.17.30.60:1065 length 64 (4) EAP-Message = 0x010100060d20 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x10b8d47310b9d97a65ed29a95486330e (4) Finished request Waking up in 1.8 seconds. (5) Received Access-Request Id 1 from 10.17.30.60:1065 to 172.17.0.2:1812 length 215 (5) Message-Authenticator = 0x4024c8a365e14657a651ceb71b9f5f61 (5) Service-Type = Framed-User (5) User-Name = "user(a)example.org" (5) Framed-MTU = 1488 (5) State = 0x10b8d47310b9d97a65ed29a95486330e (5) Called-Station-Id = "00-26-5A-84-0D-89:dlink" (5) Calling-Station-Id = "22-85-59-7C-27-7A" (5) NAS-Identifier = "D-Link Access Point" (5) NAS-Port-Type = Wireless-802.11 (5) Connect-Info = "CONNECT 54Mbps 802.11g" (5) EAP-Message = 0x020100060300 (5) NAS-IP-Address = 10.17.30.60 (5) NAS-Port = 1 (5) NAS-Port-Id = "STA port # 1" (5) Restoring &session-state (5) &session-state:Framed-MTU = 994 (5) # Executing section authorize from file /etc/freeradius/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: Looking up realm "example.org" for User-Name = "user(a)example.org" (5) suffix: No such realm "example.org" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 1 length 6 (5) eap: No EAP Start, assuming it's an on-going EAP conversation (5) [eap] = updated (5) files: users: Matched entry user(a)example.org at line 2 (5) [files] = ok (5) [expiration] = noop (5) [logintime] = noop Not doing PAP as Auth-Type is already set. (5) [pap] = noop (5) } # authorize = updated (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x10b8d47310b9d97a (5) eap: Finished EAP session with state 0x10b8d47310b9d97a (5) eap: Previous EAP request found for state 0x10b8d47310b9d97a, released from the list (5) eap: Peer sent packet with method EAP NAK (3) (5) eap: Peer NAK'd indicating it is not willing to continue (5) eap: Sending EAP Failure (code 4) ID 1 length 4 (5) eap: Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> user(a)example.org (5) attr_filter.access_reject: Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) [eap] = noop (5) policy remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) { (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else { (5) [noop] = noop (5) } # else = noop (5) } # policy remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (5) Sending delayed response (5) Sent Access-Reject Id 1 from 172.17.0.2:1812 to 10.17.30.60:1065 length 44 (5) EAP-Message = 0x04010004 (5) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.8 seconds. (2) Cleaning up request packet ID 0 with timestamp +77 due to cleanup_delay was reached (3) Cleaning up request packet ID 1 with timestamp +77 due to cleanup_delay was reached Waking up in 3.1 seconds. (4) Cleaning up request packet ID 0 with timestamp +80 due to cleanup_delay was reached (5) Cleaning up request packet ID 1 with timestamp +80 due to cleanup_delay was reached Ready to process requests Thanks, Clément Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur par e-mail. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. Les communications sur Internet n'etant pas securisees, l'expediteur informe qu'il ne peut accepter aucune responsabilite quant au contenu de ce message. This mail message and attachments (the "message") are solely intended for the addresses. It is confidential in nature. If you receive this message in error, please delete it and immediately notify the sender by e-mail. Any use other than its intended purpose, dissemination or disclosure, either whole or partial, is prohibited except if formal approval is granted. As communication on the Internet is not secure, the sender does not accept responsibility for the content of this message.

2 6

How to check the Extended Key Usage in freeradius?
by Dentzer, Daniel 01 Mar '23

01 Mar '23

I'm configuring a freeradius server for authenticating Wifi clients with EAP-TLS. The solution should check certificates with EAP-TLS and everything is working fine, but checking the "extended key usage" to reply with a specific VLAN is not working as expected. So in my site config I have: if (TLS-Client-Cert-Issuer == "/DC=de/DC=xxxxx/CN=XXX Sub CA" && TLS-Client-Cert-Subject-Alt-Name-Dns =~ /\.XY\.xxxxx\.de$/){ if(TLS-Client-Cert-X509v3-Extended-Key-Usage-OID == "1.3.6.1.4.1.311.21.8.16510850.12376249.15288979.13711710.10124257.18.15380538.1") { update reply { &Tunnel-Type = 13, &Tunnel-Medium-Type = 6, &Tunnel-Private-Group-Id = "1" } } if(TLS-Client-Cert-X509v3-Extended-Key-Usage-OID == "1.3.6.1.4.1.311.21.8.16510850.12376249.15288979.13711710.10124257.18.15210945.2") { update reply { &Tunnel-Type = 13, &Tunnel-Medium-Type = 6, &Tunnel-Private-Group-Id = "2" } } } elsif (TLS-Client-Cert-Issuer == "/DC=de/DC=xxxxx/CN=XXX Sub CA" && TLS-Client-Cert-Subject-Alt-Name-Dns =~ /\.XYZ\.xxxxx\.de$/) { if(TLS-Client-Cert-X509v3-Extended-Key-Usage-OID == "1.3.6.1.4.1.311.21.8.16510850.12376249.15288979.13711710.10124257.18.16530950.3") { update reply { &Tunnel-Type = 13, &Tunnel-Medium-Type = 6, &Tunnel-Private-Group-Id = "3" } } } else { update reply { Reply-Message := "Certificate Extended-Key-Usage with wrong or missing Group." Auth-Type := Reject } reject } In the log I see that the Attribute is in the tls-cert: freeradius | (342) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Dns := "user.XY.xxxxx.de" freeradius | (342) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, 1.3.6.1.4.1.311.21.8.16510850.12376249.15288979.13711710.10124257.18.15210945.7" freeradius | (342) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" freeradius | (342) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.4.1.311.21.8.16510850.12376249.15288979.13711710.10124257.18.15210945.2" But when I scroll down, I see that the result of the if-check is false: freeradius | (343) if (TLS-Client-Cert-Issuer == "/DC=de/DC=xxxxx/CN=XXX Sub CA" && TLS-Client-Cert-Subject-Alt-Name-Dns =~ /\.XY\.xxxxx\.de$/){ freeradius | (343) if (TLS-Client-Cert-Issuer == "/DC=de/DC=xxxxx/CN=XXX Sub CA" && TLS-Client-Cert-Subject-Alt-Name-Dns =~ /\.XY\.xxxxx\.de$/) -> TRUE freeradius | (343) if (TLS-Client-Cert-Issuer == "/DC=de/DC=xxxxx/CN=XXX Sub CA" && TLS-Client-Cert-Subject-Alt-Name-Dns =~ /\.XY\.xxxxx\.de$/) { freeradius | (343) if (TLS-Client-Cert-X509v3-Extended-Key-Usage-OID == "1.3.6.1.4.1.311.21.8.16510850.12376249.15288979.13711710.10124257.18.15380538.1") { freeradius | (343) if (TLS-Client-Cert-X509v3-Extended-Key-Usage-OID == "1.3.6.1.4.1.311.21.8.16510850.12376249.15288979.13711710.10124257.18.15380538.1") -> FALSE freeradius | (343) if (TLS-Client-Cert-X509v3-Extended-Key-Usage-OID == "1.3.6.1.4.1.311.21.8.16510850.12376249.15288979.13711710.10124257.18.15210945.2") { freeradius | (343) if (TLS-Client-Cert-X509v3-Extended-Key-Usage-OID == "1.3.6.1.4.1.311.21.8.16510850.12376249.15288979.13711710.10124257.18.15210945.2") -> FALSE ### This should be TRUE ### freeradius | (343) } # if (TLS-Client-Cert-Issuer == "/DC=de/DC=xxxxx/CN=XXX Sub CA" && TLS-Client-Cert-Subject-Alt-Name-Dns =~ /\.XY\.xxxxx\.de$/) = noop TLS-Client-Cert-X509v3-Extended-Key-Usage-OID is a list, do I have to check it in a different way? Thanks in advance. Daniel

2 4

pam_radius with only otp
by Joe Jones 27 Feb '23

27 Feb '23

Hi all, Is it possible to use the pam_radius .so module with only a otp? It works fine with a password+otp but I cannot get it working with only otp. Thanks

2 1

Dictionary question
by Igor Smitran 27 Feb '23

27 Feb '23

Hi list, Is it possible to have a dictionary describing Cisco-AVPair in more detail. If i have something like this: Cisco-AVPair += subscriber:sub-qos-policy-in=1.5Mbps Is it possible to make it look like this: Cisco-AVP-qos-policy-in += 1.5Mbps And when radius sends response to NAS it will be converted to: Cisco-AVPair += subscriber:sub-qos-policy-in=1.5Mbps Thank you

3 3

Dictionary question
by Igor Smitran 26 Feb '23

26 Feb '23

Hi list, Is it possible to have a dictionary describing Cisco-AVPair in more detail. If i have something like this: Cisco-AVPair += subscriber:sub-qos-policy-in=1.5Mbps Is it possible to make it look like this: Cisco-AVP-qos-policy-in += 1.5Mbps And when radius sends response to NAS it will be converted to: Cisco-AVPair += subscriber:sub-qos-policy-in=1.5Mbps Thank you

1 0

Compiling freeradius v3.0.x with kqueue support on ubuntu 22.04
by Prajwal Basnet 26 Feb '23

26 Feb '23

Hi all, I am trying to compile freeradius v3.0.x with kqueue support on ubuntu 22.04. I know that kqueue is not present in linux & is a feature for BSDs/OSX. So, I'm trying to use libkqueue library for compatibility (github.com/mheily/libkqueue) But every time I try to compile, during the configuration phase when I run "./configure", it checks for kqueue & it isn't found. #9 12.23 checking for kqueue... no #9 7.796 checking sys/event.h usability... no #9 7.821 checking sys/event.h presence... no #9 7.833 checking for sys/event.h... no Sincerely, Prajwal

3 3

Google LDAP auth
by Davide G. M. Salvetti 25 Feb '23

25 Feb '23

Hi, I'm trying to understand how to authenticate users with Google Secure LDAP service. I'm not sure I understood how to do it. I perused and configured mods-available/ldap_google, tried to adapt sites-available/default as per instructions there, enabled mods cache_auth, ldap_google, enabled sites default and google-ldap-auth, disabled site inner-tunnel. Since sites-available/google-ldap-auth is declared designed to be used an inner virtual server, I renamed the virtual server as "inner-tunnel". I'm not sure: did I understand it right? What's the proper way to enable google-ldap-auth? Am I supposed to set virtual-server in mod eap instead? Local radtests of the inner-tunnel seems to be successful (see log request (1)), but WiFi Enterprise EAP tests are not. I tried different protocols with a Windows laptop and an Android phone; please see the enclosed freeradius -X log, where I deleted with [...] some AP Access-Request with Service-Type = Call-Check which I think aren't relevant and anonymized test.user and my.domain. I tried to read the log, but I'm not so fluent with FreeRADIUS; could you please point me my mistakes? -- Thanks, Davide

3 2