April 2023 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

traffic quota control
by ReZa Esfahani 02 May '23

02 May '23

hi I want to control traffic quota for users in freeradius, for example, I want to set a monthly 20GB traffic quota for a specific group. How can I do that ? and after the traffic quota is reached , freeradius disconnects the user? and my last question is rlm_quota module in freeradius for this or do we have to do it in another way? thank you

3 3

radperf and radius returns challenge
by Mesut GULNAZ 29 Apr '23

29 Apr '23

I am trying to make a performance test for a radius server that sends challenge instead of Access-Accepted but radperf marks all responses as fail Total failed : 100 this is the command I used. radperf -q -s -a pap -c 100 -T test.rad -f user.csv -p 100 -r 1 -t 60 localhost:1812 auth testing123 what can I do? any help is highly appreciated.

2 1

FW: Need help with EAP-AKA configuration
by Mrudul Dighe 26 Apr '23

26 Apr '23

Hello, I am trying to configure EAP-AKA virtual-server in FreeRADIUS to perform authentication of multiple sim cards we own. We have followed the documentation and configured below in sites-enabled/eap-aka-sim and able to authenticate successful with EAPOL_TEST tool using same Ki and OPc: <<<<<<<<<<<<<<<<<<<<<<<<<<<< send Challenge-Request { &control.SIM-Ki := 0x465b5ce8b199b49faa5f0a2ee238a6bc &control.SIM-Opc := 0xcd63cb71954a9f4e48a5994e37a02baf &control.SIM-SQN := 3 } >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> However, this helps in authenticating only the imsi with above Ki/OPc. But our requirement is to authenticate multiple such IMSIs/SIMs with their Ki/OPc whose values we are aware of. May I know how to specify the list of imsi/Users and make it work instead of hardcoding like above? We tried adding following line in 'users' file in raddb/ folder and removed above hardcoding in Challenge-Response part of eap-aka-sim virtual-server configuration : "315010000000002(a)wlan.mnc010.mcc315.3gppnetwork.org<mailto:315010000000002@wlan.mnc010.mcc315.3gppnetwork.org> SIM-Ki := 770db7f9275c47eb3d12b2024caa3548, SIM-Opc := 6245aedadf3ebbb82b0f62df52e0de12, SIM-SQN := 3" But it's not working. I have attached the radiusd Logs with the mail. Where I see following error - """ (0.0) eap-aka-sim - WARNING: Could not find or derive data for UMTS vector (0.0) eap-aka-sim - ERROR: Failed retrieving UMTS vectors """ Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Any help would be greatly appreciated. Thank you in advance. Best regards, Mrudul Dighe.

2 1

"switch" statement": would you know a more compact statement?
by Alex Zetaeffesse 26 Apr '23

26 Apr '23

Hi FR people, Is there a more compact way to state what follows? switch { ("%{User-Name}" =~ /(a)tenant101\.bic\.local/) {update control{Proxy-To-Realm := "tenant101"} ("%{User-Name}" =~ /(a)tenant102\.bic\.local/) {update control{Proxy-To-Realm := "tenant102"} ("%{User-Name}" =~ /(a)tenant103\.bic\.local/) {update control{Proxy-To-Realm := "tenant103"} ("%{User-Name}" =~ /(a)tenant104\.bic\.local/) {update control{Proxy-To-Realm := "tenant104"} ("%{User-Name}" =~ /(a)tenant105\.bic\.local/) {update control{Proxy-To-Realm := "tenant105"} ("%{User-Name}" =~ /(a)tenant106\.bic\.local/) {update control{Proxy-To-Realm := "tenant106"} ("%{User-Name}" =~ /(a)tenant107\.bic\.local/) {update control{Proxy-To-Realm := "tenant107"} .... ("%{User-Name}" =~ /(a)tenant170\.bic\.local/) {update control{Proxy-To-Realm := "tenant170"} } Eventually, I may get the value of the Proxy-To-Realm variable, by stripping the 2nd and top level domain and there would not need to repeat the case. Thanks, Alex

2 4

Does eapol_test lie about the data it exchanges with FreeRADIUS?
by Joe Garcia 22 Apr '23

22 Apr '23

I've been debugging an embedded RADIUS client, specifically one that does PEAP auth, using eapol_test, or at least trying to, however I can't see how it could work using the messages it claims to be exchanging with FreeRADIUS. In particular eapol_test claims it replies to the initial identity request with an EAP, not PEAP, message: EAP-PEAP: Encrypting Phase 2 data - hexdump(len=12): 02 a5 00 0c 01 74 65 73 74 33 32 31 when it should be just PEAP, 01 74 65 73 74 33 32 31. Looking at the FreeRADIUS code that handles this (3.2.x, the current version shipping with various Linux distros), src/modules/rlm_eap/types/ rlm_eap_peap:eappeap_process() calls eapmessage_verify() which, for an EAP Response (type = 2) only allows an EAP-TLV and nothing else, in particular not an EAP Identity message as eapol_test claims it's sending. I've verified this by sending the message that eapol_test claims it's sending and getting: eap_peap: Received unexpected EAP-Response, rejecting the session. eap_peap: ERROR: Tunneled data is invalid which is exactly what you'd expect from the code in eapmessage_verify(). So does eapol_test invisibly convert messages to and from EAP/PEAP format when communicating with FreeRADIUS and report the EAP form while using the PEAP form? Further evidence in support of this is what it reports on read of a PEAP Identity Request: EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=1): 01 EAP-PEAP: received Phase 2: code=1 identifier=165 length=5 The first line reports it's read a PEAP message (which is indeed what's being sent) and on the second line it's magically converted itself into an EAP message, which isn't actually sent. Does this mean that eapol_test is an unreliable source of information when it comes to debugging auth issues? JG.

2 2

Freeradius4 DHCPv6 configuration
by Ľudovít Mikula 21 Apr '23

21 Apr '23

Hi experts! I am trying to configure DHCPv6 in freeradius 4. I'd like to be able to assign an IP address from a pool based on Option82 (Remote-Id + Circuit-Id). My problem is that I seem to be unable to find a decent client for testing this setup. There are plenty of test DHCPv4 clients, but not many DHCPv6 clients which also can send custom DHCP options. Any recommendations (ideally linux CLI client/script)? If somebody already did such configuration, I'd be very grateful for any hints. Ludo

2 1

Re: Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

OK. I think I understand. Thanks for the details From: Freeradius-Users <freeradius-users-bounces+daniel.e.white=nasa.gov(a)lists.freeradius.org> on behalf of Alan DeKok <aland(a)deployingradius.com> Reply-To: FreeRADIUS ML <freeradius-users(a)lists.freeradius.org> Date: Thursday, April 20, 2023 at 08:20 To: FreeRADIUS ML <freeradius-users(a)lists.freeradius.org> Subject: [BULK] Re: [EXTERNAL] Mailing list is being Spam Filtered by O-365 On Apr 20, 2023, at 8:14 AM, Noel Butler <noel.butler(a)ausics.net<mailto:noel.butler@ausics.net>> wrote: That is not a freeradius.org server that I can see, completely different network even... /var/mail/corp/n/o/e/noel.butler/Maildir/.Lists.FreeRadius/cur# grep "63.88.93.251" * | wc -l 0 Messages in folder 28047 $ host 63.88.93.251 251.93.88.63.in-addr.arpa domain name pointer smtp.e3a.verizonbusiness.com. i.e. someone is routing mail through internal systems, and then complaining that mail is being routed through internal systems. This is our problem, not under our control, and there is nothing we can do about it. CC'd F/R ML since you also posting this issue over there On 20/04/2023 21:47, White, Daniel E. (GSFC-770.0)[AEGIS] via users wrote: How about this: Received: from BL0GCC02FT019.eop-gcc02.prod.protection.outlook.com (2a01:111:f400:7d05::201) by CYXPR09CA0020.outlook.office365.com (2603:10b6:930:d4::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via Frontend Transport; Thu, 20 Apr 2023 11:27:54 +0000 Authentication-Results: spf=fail (sender IP is 63.88.93.251) <------------------------- smtp.mailfrom=lists.freeradius.org; dkim=none (message not signed) header.d=none;dmarc=fail action=oreject header.from=lists.freeradius.org;compauth=none reason=452 Received-SPF: Fail (protection.outlook.com: domain of lists.freeradius.org <------------------------- does not designate 63.88.93.251 as permitted sender) receiver=protection.outlook.com; client-ip=63.88.93.251; helo=vsmtpx-e100-01.localdomain; -- Regards, Noel Butler

1 0

Re: [EXTERNAL] Re: Mailing list is being Spam Filtered by O-365
by Noel Butler 20 Apr '23

20 Apr '23

That is not a freeradius.org server that I can see, completely different network even... /var/mail/corp/n/o/e/noel.butler/Maildir/.Lists.FreeRadius/cur# grep "63.88.93.251" * | wc -l 0 Messages in folder 28047 CC'd F/R ML since you also posting this issue over there On 20/04/2023 21:47, White, Daniel E. (GSFC-770.0)[AEGIS] via users wrote: > How about this: > > Received: from BL0GCC02FT019.eop-gcc02.prod.protection.outlook.com > (2a01:111:f400:7d05::201) by CYXPR09CA0020.outlook.office365.com > (2603:10b6:930:d4::27) with Microsoft SMTP Server (version=TLS1_2, > cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via > Frontend > Transport; Thu, 20 Apr 2023 11:27:54 +0000 > Authentication-Results: spf=fail (sender IP is 63.88.93.251) > <------------------------- > smtp.mailfrom=lists.freeradius.org; dkim=none (message not signed) > header.d=none;dmarc=fail action=oreject > header.from=lists.freeradius.org;compauth=none reason=452 > Received-SPF: Fail (protection.outlook.com: domain of > lists.freeradius.org <------------------------- > does not designate 63.88.93.251 as permitted sender) > receiver=protection.outlook.com; client-ip=63.88.93.251; > helo=vsmtpx-e100-01.localdomain; -- Regards, Noel Butler This Email, including attachments, may contain legally privileged information, therefore at all times remains confidential and subject to copyright protected under international law. You may not disseminate this message without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message.

2 1