March 2023 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

PacketFence -FreeRADIUS - Azure AD - No Auth-Type found
by P.Thirunavukkarasu 07 Apr '23

07 Apr '23

Hi Team, *Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject)* EAP: TTLS-PAP How to fix this? Any help is greatly appreciated. Regards, Thirunavukkarasu

3 3

check user device mac address without doing mac-auth
by Eby Mani 05 Apr '23

05 Apr '23

Is it possible to check mac address of user device when doing standard 802.1x authentication and allow access without doing mac-auth + 802.1x ?. The requirement is to restrict users from connecting from other devices(say BYOD) other than IT approved device allocated to user. When using mac-auth-802.1x, server have no way of knowing which device the user is mapped to and user can connect from any authorised device in the list. Questions, 1, Is there a guide on how to achieve this with mysql integration ?. 2a, Is it recommended to add new columns to include mac-addr in radcheck table ?. 2b, If so, will freeradius automatically check new columns values and do access-accept/reject automatically ?. Any hints will be helpful. Thanks,

2 10

Request for assistance: FreeRadius configuration for split accounting of users into groups
by Ahmad Gharib 04 Apr '23

04 Apr '23

Dear FreeRadius Mailing List, I hope this email finds you well. I am reaching out to request assistance with a technical issue that my team and I have been facing while configuring FreeRadius for our OpenVPN setup. We have configured OpenVPN with the OpenVPN Radius Plugin for authentication and accounting, and we have connected it to a FreeRadius server. Our aim is to split users into two groups, Premium and Limited, and configure bandwidth throttling for them depending on their group. For Premium users, we would like to provide unlimited bandwidth without any throttling. However, for Limited users, we want to provide free 1GB/day and then throttle their connection if they exceed the limit. To achieve this, we have configured the PERL module as an External Scripting functionality to check daily consumption and other metrics of the user in "Acct-Interim-Updates." We use this functionality to control the user's group by switching them from Premium to Limited and vice versa. Additionally, we apply throttling to the OpenVPN server using tc. We also allow users to purchase tokens to top up their allowed bandwidth. If a user exceeds their daily limit, their purchased credits allow them to continue their internet usage without any additional throttling. However, we are facing issues with the accounting per user group. Specifically, we have noticed that if a user is now in the Limited group and consuming traffic on a throttled connection, the daily_consumption metric continues to add up, even if they have already exceeded their allowed daily bandwidth. For example, let's say a user has consumed 0.5 GB in addition to their allowed 1 GB per day, which makes their total consumption 1.5 GB/day. If the user then purchases extra credits worth 0.2 GB, their total allowed consumption would be 1.2. GB/Day, however, their actual. total daily consumption would still be 1.5 GB/day, which renders the user in the same `limited` group and breaks the accounting purposes. To address this issue, we would like to have split accounting for each group. In other words, once a user is throttled, we want to ignore the bandwidth recorded and only calculate the bandwidth consumed during their Premium group connection. It is important to note that the `acctinputoctets` and `acctoutputoctets` values are pushed by OpenVPN-Radius Plugin as total incremented values of the connection , and not interval values during each `Acct-Interim-Updates`. We would greatly appreciate any assistance or guidance on how to achieve this goal. Thank you in advance for your time and expertise. Best regards, Ahmad R. Gharib -- ~ ~ *Ahmad R. Gharib* *Linux Systems Administrator at Securealm SARL* *Mobile: +961 71953385*

2 2

Multiple questions about the way FreeRADIUS works
by florentvercourt＠gmail.com 30 Mar '23

30 Mar '23

Hello everyone, I want to thank you in advance for taking the time to help me, as well as apologize if I ask bogus questions or questions that have already been answered. Ive been trying to implement a FreeRADIUS service inside of a University for the past 3 months, Ive read as much documentation as possible (books : FreeRADIUS Beginner guide and Authentication réseau avec RADIUS, all resources on freeradius <https://wiki.freeradius.org/Home> and networkradius <https://networkradius.com/doc/3.0.10/index.html> ) before asking questions. Im implementing 802.1X protocol on our wired network using EAP-TTLS/PAP protocol for communications between supplicants and our radius server. Were using LDAP as our main user storage, and a file with rlm_files modules for devices which doesnt support EAP. My radius infrastructure is composed as following: I got 2 VM running FreeRADIUS version 3.2.1 I have several questions: I- Session-State : 1. What is the purpose of the State attribute defined in RFC2865 (I read it but doesnt fully understand the purpose of this attribute), and is it linked in any way to the Session-State list? Also, Is there any documentation about the Session-State list? 2. Are attributes stored in Session-State list automatically retrieved when a new request is incoming and added to the Request list? 3. Does attributes stored in Session-State list persist between all packets of a conversation (from the first Access-request to the Access-Accept/Reject), and does the same Session-State list still exist for the accounting, or is it reinitialize once an Access-Accept/Reject has been sent? II- Attributes : I would like to have some information about those attributes to know, what they are supposed to store and how they are supposed to be used: 1) Session-Type: What does it refer? 2) Allow-Session-Resumption: Does this attribute is set to Yes by default, or does it have to be added somewhere, and what is the difference with EAP-Session-Resumed? 3) Cached-Session-Policy: For applying a policy to the cache, do I have to store the file path to the policy, or just the name of the policy that I want to apply? 4) SSHA2-256-Password: my passwords are stored in my LDAP with a salt and a sha256 hash, does it will be stored in Password-With-Header or also in SSHA2-256-Password ? 5) EAP : a. EAP-Session-Id : Does this value is set automatically the value of this attribute the ID of the EAP-Session will be the same, b. What is the difference between EAP-Id and EAP-Session-Id? 6) TLS : a. TLS-Cache-Method : Does the value of this attribute trigger instantiation of the module rlm_cache defined inside of tls-cache virtual server? b. TLS-Session-Data : Can I retrieve data from this attribute, or does it exist simply to store data that pass through my TLS tunnel? c. TLS-Cache-Filename : What is the difference between this attribute and Cached-Session-Policy? III- TLS : 1. When were setting virtual_server = "inner-tunnel" inside of module rlm_eap, is it just that the module rlm_eap knows when the TLS tunnel is set up and then for the inner exchange itll use this one or is it considerate as a proxy to the inner-tunnel server from the default server? IV- Cache : Because were a university I want to implement the fast resumption of sessions, I want to cache living sessions for a duration of 6 hours, so if a user doesnt re-authenticate during this period it will have to perform a complete re-authentication. 1. Does the cache section inside of the module rlm_eap, automatically store (session-Id, User-Name, Stripped-User-Name, Cached-Session-Policy), how can the session be resumed from this entry? 2. What is the difference between module rlm_cache and the session-state list in the persistence of information stored? V- Log : 1. I use the cui attribute as follows to have a unique identifier for a user inside of my TTLS tunnel (I know the attribute is originally designed to serve as an alias identifier of the username identity according to rfc4372) : %{sha1:${policy.cui_hash_key}%{request:Stripped-User-Name}%{ request:Operator-Name}%{request:User-Password}}, with policy.cui_hash_key which is a salt added to the hash 2. In order to retrieve my cache session, I plan to use CUI as my key, is there a better way to do so? 3. Once a device has been granted access to the network and once it retrieves an IP address, does the IP address will be included in the accounting packets? VI- Charge of the server : 1. Is there a way to know the live charge of a radius server as a String expansion to decide whether or not to proxy the request to another radius server (I dont know if the parameter max_requests is designed for this purpose)? 2. To do load-balancing between my VMs, is possible natively with FreeRADIUS or do I have to use an external load-balancer? VII- Home server : I got the following proxy.conf file: proxy server { default_fallback = no dynamic = no } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 1812 proto = udp secret = << secret >> response_window = 20 zombie_period = 40 status_check = status-server check_interval = 10 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 65536 } home_server ru-freeradius-as2 { type = auth ipaddr = 10.101.0.10 port = 1812 proto = udp secret = << secret >> response_window = 20 zombie_period = 40 status_check = status-server check_interval = 10 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 32268 } home_server_pool my_auth_failover { type = fail-over home_server = localhost home_server = ru-freeradius-as2 virtual_server = pre_post_proxy_for_pool } realm my.realm { auth_pool = my_auth_failover } If I use the suffix instance of the module rlm_realm in the configuration of the default server in the authorize section, and the given User-Name is user@my.realm 1. Does my request will be passed through the my_auth_failover pool, and so being proxied to the home_server localhost server and set Proxy-To-Realm = LOCAL. Is this server to which the request is being proxy the default server? Again, Thank you for reading this long message with many questions, and for your help! I really appreciate it. Florent VERCOURT

2 1

How safely update from 3.0 to 3.2 (Debian Bullseye)
by Thiago Martins 30 Mar '23

30 Mar '23

Hi! I'm trying to find a step by step to safely update from 3.0 to 3.2. The usual "apt-get update" says I'm in the latest version... I did not find any source about this yet, just to update from 2.x to 3.x. Do you guys can help me? Thanks a lot! -- TGM -- <https://www.itaueira.com/> Siga nossas redes sociais @itaueirareialimentos <https://www.instagram.com/itaueirareialimentos/> @melaorei <https://www.instagram.com/melaorei/> @pimentaorei <https://www.instagram.com/pimentaorei/> @melanciadamagali <https://www.instagram.com/melanciadamagali/> Esta mensagem é endereçada exclusivamente ao seu destinatário e poderá conter informações confidenciais. O uso não autorizado de tais informações é proibido e estará sujeito às penalidades cabíveis. *This message is intended exclusively for its addressee and may contain information that is confidential. * *Unauthorized use of such information is prohibited and subject to applicable penalties.*

2 1

Machine authentication with client certificate to Samba DC
by Tim ODriscoll 30 Mar '23

30 Mar '23

Dear All, I'm trying to set up my radiusd server to authenticate Windows 11 machines using their computer name and a client certificate (deployed through GPO), and then put them in a specific VLAN based on either machine name or group membership. I'm running Rocky OS and Samba as an AD (separate machines). ldapsearch is working well using the DC's certificate from the radiusd box. The plan is to have one WiFi SSID with every domain-joined laptop automatically joining it using a deployed CA and client cert and the machine credentials. If possible, it would be good to allow BYOD on the same SSID using a users AD credentials as long as they have both the CA and client cert installed. I've got the radiusd self-generated CA deployed via GPO and I've got the WiFi GPO deployed and sending out the machine name. I see the machine trying to authenticate and fail. I try with a username/password and I get my VLAN accept packet. How can I get the machine to authenticate, and how do I enforce the client certificate and install it through a GPO? I've done the CA, but the client certificate doesn't have an obvious place? Attached is the debug output from a failed machine auth session, which tells me that there is no machine password in the access request...? It all goes wrong around packet 7, lines 1962 - 1986. Thank you, Tim

3 11

Certificate issue after upgrade in the LDAP module - Let's Encrypt certs not working either
by Kaya Saman 29 Mar '23

29 Mar '23

Hi everyone, it's been ages!! Unfortunately my health took a downturn and I have not been keeping up with anything and now finding myself needing to upgrade many almost archaic builds now. What was working on a previous version of FR seems to have stopped and now FR is complaining at me :-( I'm using StartTLS in OpenLDAP so FR got provisioned eons ago with a working setup which has been flawless for may years, I created an raddb/ldap folder where I put my ldap TLS certs. I performed an upgrade recently and then noticed that some services had gone down. This is the relevant output of radiusd -X: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://fqdn:389 TLS certificate verification: Error, self signed certificate TLS: can't connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed certificate). rlm_ldap (ldap): Could not start TLS: Connect error rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap" my ldap module in FR contains these lines: start_tls = yes #ca_file = /etc/ssl/cert.crt ca_file = /usr/local/etc/raddb/ldap/cert.pem #ca_path = /etc/ssl/ ca_path = /usr/local/etc/raddb/ldap/ #certificate_file = /etc/ssl/cert.crt certificate_file = /usr/local/etc/raddb/ldap/cert.pem #private_key_file = /etc/ssl/cert.key private_key_file = /usr/local/etc/raddb/ldap/privkey.pem Originally I had a cert.crt and cert.key file which I believe I generated using openssl? Judging from the records in the shell history I think it was something like this that I used: cd /etc/ssl openssl genrsa -out cert.key 1024 openssl req -new -key cert.key -out cert.csr openssl x509 -req -in cert.csr -days 365 -signkey cert.key -out cert.crt openssl x509 -req -in cert.csr -days 365 -signkey cert.key -out cert.crt of which I tried regenerating using the exact same lines as I thought originally that the cert had expired. From the radd -X error it's obvious that it doesn't like the certificate as it was self signed. As I'm not using a certificate provider since this is in my home lab, I thought about using Let's Encrypt so I manually generated certificates using the certbot tool. Unfortunately the error from radd -X is the same and is calling the certificate "self signed". I think the culprit is that LE doesn't have a CA associated with it. Does anyone have any advice on how to either get FR working with my certificates or would my only options be to either turn TLS in OpenLDAP off or to use an authoritative signing body? Many thanks in advance. Kaya

2 3

Freeradius giving certificate error
by Dhanushka Parakrama 29 Mar '23

29 Mar '23

Hi All . We are running freeradius 2.1.10 with WPA Enterprise authentication with EAP-TTLS and setup is working is fine Then we have regenerated the new certificates via .*/bootstrap *command Then we tried to login to WIFI . but our freeradius stared to throw the below error Wed Mar 29 20:26:02 2023 : Error: TLS Alert read:fatal:bad certificate Wed Mar 29 20:26:02 2023 : Error: TLS_accept: failed in SSLv3 read client certificate A Wed Mar 29 20:26:02 2023 : Error: rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Wed Mar 29 20:26:02 2023 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. Wed Mar 29 20:26:02 2023 : Auth: Login incorrect (TLS Alert read:fatal:bad certificate): [user(a)email.com] (from client ManagementAPs port 1 cli e8-84-a5-e0-49-d0) Is there any reason for the above error ? How can I fix it ? , Please advice Thank You Dhanushka

3 2