February 2023 - Freeradius-Users - lists.freeradius.org

RE: Freeradius support for password compatibility
by florentvercourt＠gmail.com 09 Feb '23

09 Feb '23

Thanks Alan for you fast answer, I will take a look at the module man page

1 0

Freeradius support for password compatibility
by florentvercourt＠gmail.com 09 Feb '23

09 Feb '23

Hello, I would like to have some information about Freeradius supports for RADIUS protocol and password compatibility. I already looked at https://networkradius.com/articles/2021/08/23/protocols-and-password-compati bility.html. I use EAP-TTLS/PAP to authenticate my users, and I would like to know if freeradius is able to apply a hash to the cleartext password transmitted within PAP module, when passwords are stored with an SHA256 or SHA512 encryption in an LDAP; or do I have to use "ldap bind as users" instead of the PAP module to authenticate my users. Thank you for your help, Florent VERCOURT

2 1

Re: Respond with access-accept when password incorrect
by Steven Walters 09 Feb '23

09 Feb '23

Thanks for the response Alan. I tested it and it worked. Just made a small change as below to apply the accept to guest account only. I just would like to understand why (purpose) one needs to set 'reject=1'? If I remove the statement the policy doesn't work. Auth-Type PAP { pap{ reject=1 } if (reject && User-Name == "guest") { accept } } Thanks Steven On Wed, 8 Feb 2023 at 14:00, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: kqueue support (work vlpl) > 2. Re: kqueue support (Alan DeKok) > 3. Respond with access-accept when password incorrect > (Steven Walters) > 4. Re: Respond with access-accept when password incorrect > (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 7 Feb 2023 14:01:58 +0100 > From: work vlpl <thework.vlpl(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: kqueue support > Message-ID: > < > CAPt3fZjsrb3hGzMLd5+WcOsBpmwF9oskA2p5QEu9K_1PjGz18w(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > On Mon, 6 Feb 2023 at 22:05, Matthew Newton via Freeradius-Users > <freeradius-users(a)lists.freeradius.org> wrote: > > > > > You don't need kqueue for FreeRADIUS < v4, so there is no need to build > it. > > I am confused a bit, I know I don't need kqueue to compile versions > 3.0.x and 3.2.x. But can I compile it? I want to try to use kqueue > instead of select. > > > ------------------------------ > > Message: 2 > Date: Tue, 7 Feb 2023 08:07:01 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: kqueue support > Message-ID: <0CC83890-26F3-4C42-A3A4-A95A55FF6591(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 7, 2023, at 8:01 AM, work vlpl <thework.vlpl(a)gmail.com> wrote: > > I am confused a bit, I know I don't need kqueue to compile versions > > 3.0.x and 3.2.x. But can I compile it? I want to try to use kqueue > > instead of select. > > You have the source code. Go look. It's how everyone else learned. > > If you don't have time to understand the source code, then there's no > point in trying to switch FreeRADIUS to use kqueue. > > This list is for people using FreeRADIUS, not for people learning how > kqueue works. > > Alan DeKok. > > > > ------------------------------ > > Message: 3 > Date: Tue, 7 Feb 2023 23:01:58 +0200 > From: Steven Walters <steven.walters1(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Respond with access-accept when password incorrect > Message-ID: > <CALF=EMLEFyzGukeZRb45=X86= > VdrRUkBZPzT7cDhWW4tTk5XYQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi > > We have guest broadband user accounts. I would like RADIUS to respond with > access-accept on PAP even if the password is incorrect. I will then write > to the database to indicate the session has an incorrect password and allow > the PPPoE to connect to the internet. > > This will allow the agent to access the CPE to update the password. > > What is the best way to achieve this, that is to respond with an > authentication success even if the password is incorrect for a specific > username? > > Regards > Steven > > > ------------------------------ > > Message: 4 > Date: Tue, 7 Feb 2023 16:13:52 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Respond with access-accept when password incorrect > Message-ID: <1D55996B-2930-483F-9535-0D05C7CE8A84(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 7, 2023, at 4:01 PM, Steven Walters <steven.walters1(a)gmail.com> > wrote: > > > > We have guest broadband user accounts. I would like RADIUS to respond > with > > access-accept on PAP even if the password is incorrect. I will then write > > to the database to indicate the session has an incorrect password and > allow > > the PPPoE to connect to the internet. > > > > This will allow the agent to access the CPE to update the password. > > > > What is the best way to achieve this, that is to respond with an > > authentication success even if the password is incorrect for a specific > > username? > > You can just use the "accept" policy: > > authorize { > ... > accept > } > > And it will accept the user. > > If you're actually checking passwords, it will have to be a bit > different: > > authenticate { > ... > Auth-Type pap { > pap { > reject = 1 > } > > if (reject) { > accept > } > > } > > } > > Though I would strongly recommend putting these users into a limited > VLAN. They should have access to update the password, but shouldn't be > allowed to connect to the internet. > > Alan DeKok. > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 214, Issue 6 > ************************************************ > -- Warm Regards Steven Walters 0814287179

2 1

Respond with access-accept when password incorrect
by Steven Walters 07 Feb '23

07 Feb '23

Hi We have guest broadband user accounts. I would like RADIUS to respond with access-accept on PAP even if the password is incorrect. I will then write to the database to indicate the session has an incorrect password and allow the PPPoE to connect to the internet. This will allow the agent to access the CPE to update the password. What is the best way to achieve this, that is to respond with an authentication success even if the password is incorrect for a specific username? Regards Steven

2 1

kqueue support
by work vlpl 07 Feb '23

07 Feb '23

Hi, May I ask about kqueue support as library? I see in many places receipts on how to install packages on Linux. And on the official wiki page next note "libkqueue or native kqueue support (since >= v4.0.x)". Is it mean that as a library it is supported only from v4.0.x? version. Or it is a hard dependency since that version? Best regards, Vladimir

3 6

Skip authorize if proxy? Preprocess deprecated?
by contact＠brindereseau.fr 03 Feb '23

03 Feb '23

Hello, Thanks for FreeRADIUS and the incredible amount of work. The more I use it, the more I love it, especially Unlang which allows for flexible and specific pre and post processing. I just wonder about the RADIUS sequence (v3 but v4 may be also concerned): why neither the default sequence or the doc suggests to employ such a below logic? authorize { filter_username suffix if (!&control:Proxy-To-Realm) { # or check "&control.Auth-Type" in v4 sql my_super_module my_other_module # some other things... chap pap } } My point being: once we know that proxy is needed (told by "suffix" usually), it seems to me the rest of "authorize" section can be skipped *in most cases*. It would gain some time and prevent potential side effects by subsequent modules (depending on what they do, of course). Or am I wrong? Did I miss something? Also, yet not related, is "preprocess" actually deprecated in favor of a custom module in Unlang? Or is there a reason to still use it (execution time, backward compatibility)? It seems to have disappeared in v4. Thanks!

2 2

Re: Extracting a value from an LDAP attribute
by florentvercourt＠gmail.com 02 Feb '23

02 Feb '23

>If the returned value always matches the same kind of format, I would suggest using a regex to extract the relevant part, so, after the call to the ldap module something like: > >if (&reply:Tunnel-Private-Group-ID =~ /vlan:([0-9]+)/) { ??? update reply { ??? ??? &Tunnel-Private-Group-ID := "%{1}" > ??? } >} > >That's looking for any digits after vlan: in the returned value - you will have to understand the possible formats of the returned data to know whether that will work. > Thank you, I try your solution and it works

1 0

Extracting a value from an LDAP attribute
by florentvercourt＠gmail.com 02 Feb '23

02 Feb '23

Hello all, I have been looking for a way to extract a part of an LDAP attribute that I retrieved and map to the RADIUS attribute " Tunnel-Private-Group-Id". The syntax of my LDAP attribute: "schacUserStatus : urn:mace:terena.org:schac:userStatus:FR:vlan:13+mode=manuel" I want to extract the number of the vlan, to affect it to " Tunnel-Private-Group-Id" attribute. With the given example, I want to only have "13" stored in " Tunnel-Private-Group-Id". I tried that in the ldap module : update { control:Password-With-Header += 'userPassword' reply:Tunnel-Private-Group-ID := 'schacUserStatus' } However, with this solution I retrieve "urn:mace:terena.org:schac:userStatus:FR:vlan:13+mode=manuel" in " Tunnel-Private-Group-Id". I also try to split it, but its length is 1. I read all the documentations at https://networkradius.com/doc/3.0.10 and I still don't know if there is a way to do that in unlang, and if so, do I have to do it in the ldap module, or in my virtual server configuration; or if it's possible to parse the LDAP attribute using Bash commands. Thank you for your advice and help, Florent VERCOURT

2 1