May 2023 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

DHCP Radius proxy (IPv4 and IPv6)
by Ľudovít Mikula 09 Jun '23

09 Jun '23

Hi all, I have a relay-agent which does only DHCP and is not capable of talking to RADIUS server (using auth/acct). However the requirement is to be able to use freeradius with it for the additional functionalities and configurability, over both IPv4 and IPv6. The "authentication" should be done only by checking Option82 circuit-id/remote-id against configured user in freeradius. What are the options for configuring it over IPv6? Probably some dhcp to radius proxy able to do message conversion like: DHCP Discover/Solicit -> RADIUS Access-Request RADIUS Access-Accept -> DHCP Offer/Advertise What would be the best approach to handle this use case (unfortunately I cannot change the hardware). Regards -- Ludo Mikula

2 8

Modifying outgoing device name attribute
by Kenny Simpson 02 Jun '23

02 Jun '23

Hi all, New to freeradius and need a little help which has stumped me and a colleague. We are using freeradius to proxy authentication from Fortinet to freeradius to cisco acs. We are now stumped on how to get it to authenticate properly. We can see in the Cisco ACS logs that the device is being authenticated and that it is matching the appropriate access service but it is failing on shared secret even though we know that the shared secret is correct and that the password for the user is correct. Looking at the logs its says that the client is the incoming proxy server with its name and ip address as this is what is in the client. It has the NAS IP correctly defined but I am thinking that because the device name and ip are different to the NAS IP then its failing as the actual proxied connection has a different secret. Is there anyway of modifying the out going "device name attribute and ip" to match that of the client configuration. I hope this makes sense hahah Thanks Kenny

2 1

Weird behaviour of sqlcounter / dailycounter
by Robert Senger 31 May '23

31 May '23

Hi all, tonight I've seen some weird behaviour during tests of sqlcounter module. Please see the output below. The situation is that the station trying to connect is allowed a Max- Daily-Session of 300 seconds. The counter is at 299, so sqlcounter correctly sets Session-Timeout = 1, and the station is allowed access for one second remaining... However, this connection is terminated immediately by the Wifi AP (running hostapd 2.due to Session-Timeout = 1. The counter never gets increased, the station retries and is allowed access, and every 5 seconds or so this repeats and repeats and repeats... The logs get flooded and there's useless load on the AP and freeradius. The station (Linux machine with NetworkManager) stopped trying to connect after half an hour or so... This behaviour is reproduceable. Every time the station's Max-Daily- Session value is reached and it get's kicked off by the AP, it get's into this loop. The number of retries until the station finally is giving up is significantly higher if more than one AP with the same SSID is reachable (>30 minutes). This behaviour also occurs if the "counter" module is used rather than the "sqlcounter" module. Freeradius version is 3.0.21, hostapd version is 2.10-8. Did I configure something wrong, or what happens here? Thank you for help! Robert freeradius -X output: <...> (3090) dailycounter: EXPAND %{User-Name} (3090) dailycounter: --> testtesttest (3090) dailycounter: SQL-User-Name set to 'testtesttest' rlm_sql (sql): Reserved connection (297) (3090) dailycounter: Executing select query: SELECT SUM(acctsessiontime - GREATEST((1685484000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'testtesttest' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1685484000' rlm_sql (sql): Released connection (297) (3090) dailycounter: EXPAND %{sql:SELECT SUM(acctsessiontime -GREATEST((1685484000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1685484000'} (3090) dailycounter: --> 299 (3090) dailycounter: Allowing user, &control:Max-Daily-Session value (300) is greater than counter value (299) (3090) dailycounter: Setting &reply:Session-Timeout value to 1 (3090) [dailycounter] = ok (3090) [expiration] = noop <...> (2499) Login OK: [testtesttest] (from client pherkad_ipv6 port 1 cli A0-88-B4-B5-47-C0) (2499) Sent Access-Accept Id 250 from [fd10:2842:f0d1:101::2]:1812 to [fd10:2842:f0d1:101:20d:b9ff:fe0d:c9c0]:56722 length 0 (2499) MS-MPPE-Recv-Key = 0x5006b02549aab2d72a020f8a17a16052e8c967bf253791d93f8a904d72bc8ec8 (2499) MS-MPPE-Send-Key = 0x98b138434cfd1cc09198086179c52dce065bde4d2634520098c6bf70e92aa0c2 (2499) EAP-Message = 0x03a90004 (2499) Message-Authenticator = 0x00000000000000000000000000000000 (2499) User-Name = "testtesttest" (2499) Session-Timeout += 1 (2499) Acct-Interim-Interval = 600 <...> -- Robert Senger

3 7

Migrate from "files" to "sql" with multiple DEFAULT users
by Robert Senger 31 May '23

31 May '23

Hi there, I am trying to migrate from wifi users stored in the 'authorize' file to wifi users stored in a mysql database. The 'sites-available/default' configuration file says: "The schema of the database is meant to mirror the 'users' file." Ok, this is fine with single users with known username. But what to do if there is more than one DEFAULT user? The 'authorize' file says, that it is processed by order, but this will not work in a database. My config is like this, to allow different sets of passwords for different SSIDs (staff and guests): <...> DEFAULT Auth-Type := ACCEPT, Called-Station-Id != "02-A5-04-3D-96- 13:Cassiopeia", Called-Station-Id != "02-A5-04-3D-96-23:Cassiopeia" Tunnel-Password = "passwordforuser1", Tunnel-Password = "passwordforuser2", Tunnel-Password = "passwordforuser3" DEFAULT Auth-Type := ACCEPT, Called-Station-Id == "02-A5-04-3D-96- 13:Cassiopeia" Tunnel-Password = "passwordforguest1", Tunnel-Password = "passwordforguest2", Tunnel-Password = "passwordforguest3" DEFAULT Auth-Type := ACCEPT, Called-Station-Id == "02-A5-04-3D-96- 23:Cassiopeia" Tunnel-Password = "passwordforguest1", Tunnel-Password = "passwordforguest2", Tunnel-Password = "passwordforguest3" DEFAULT Auth-Type := Reject <EOF> I have no idea how to build this in the mysql database... Any suggestions? Thank you! Robert -- Robert Senger

3 4

PPPoE User Suddenly internet is not working even user is connected
by Imdad Hasan 31 May '23

31 May '23

Hi All, One of my clients is complaining to me sometimes, a pppoe user suddenly showing no internet at the user side but the user is connected with mikrotik pppoe server.. when he disconnects it from mikrotik and after re-connection, that user's internet is working fine at the user side.. So, is this related to the radius accounting response or something? Because this issue is not there when he is connected to a local user which is created in mikrotik without radius. Thanks Imdad

5 5

Redundant best practices
by Adam Taylor 30 May '23

30 May '23

Is there a site/page that has the best practices to setting up a redundant/failover Freeradius server? I have two set up and they both work independently, but when I add them to my wireless system config as primary/secondary, I get weird EAP session not matching at random times and the client just keeps trying to connect. Remove the "secondary" Radius entry and everything starts working again. If I flip the primary to secondary.....the secondary by itself has no more problems. It only happens if I list two Radius servers. I have now seen this on two completely different wireless systems, so it has made me want to make sure I am not doing something stupid on the Freeradius side that is causing this. As always, thanks for the help. BTW, we are running 3.2.1 currently. Adam

2 1

Freeradius proxy times out after 14 seconds
by raido.rattameister＠gmail.com 29 May '23

29 May '23

Hey, How to set Freeradius to wait for longer than 14 second for home server to reply? My config is: Firewall > Freeradius > Home server Home server performs 2FA so I need to give users some time to accept push notification on their phones. With default config Freeradius will wait only 14 seconds before it times out and sends login failure back to firewall. I added "response_window" setting to clients.conf file. If response_window setting is below 14 then timeout will be reduced to whatever response_window value is. If response_window is more than 14 then timeout is always 14. Is there any way to override this setting and expand timeout to 30 seconds? Log snippet from freeradius -X Proxying request to home server 192.168.1.10 port 1812 timeout 14.000000 Sent Access-Request Id 155 from 0.0.0.0:59777 to 192.168.1.10:1812 length 113 User-Name = "test(a)example.com <mailto:test@example.com> " User-Password = "password" NAS-Identifier = "RADIUS" NAS-IP-Address = 192.168.1.1 Event-Timestamp = "May 27 2023 20:33:05 EDT" Message-Authenticator := 0x00 Proxy-State = 0x3437 Waking up in 0.3 seconds. Expecting proxy response no later than 13.667138 seconds from now Waking up in 13.6 seconds. No proxy response, giving up on request and marking it done Marking home server 192.168.1.10 port 1812 as zombie (it has not responded in 14.000000 seconds). ERROR: Failing proxied request for user "test(a)example.com <mailto:test@example.com> ", due to lack of any response from home server 192.168.1.10 port 1812 Clearing existing &reply: attributes Found Post-Proxy-Type Fail-Authentication server default { Post-Proxy-Type sub-section not found. Ignoring. Executing group from file /etc/freeradius/3.0/sites-enabled/default Best, Raido

2 1

Determine REST connect URI dynamically
by Matthew McTague 29 May '23

29 May '23

Hi there, Would it be possible to determine the REST connect URI dynamically using dynamic-clients or similar, without needing to check again for each request? Warm Regards, .[cid:vg-email_e752d47f-182a-48d0-8808-3796b2df8d4a.png]<https://www.vetta.nz> .[cid:058_line_9bae9502-1e3a-48a3-ba5e-34ed9cd44185.png] Matthew McTague Head of Infrastructure [cid:bea-finalist-email_2ddba0ed-b9bb-4ab9-b680-84aa7f54077f.png] [cid:bea-winner-banner-email_590096c3-05a6-4c98-b071-1c4d748c3534.png] . D +64 3 222 6013<tel:+64%203%20222%206013> | P +64 3 684 5770 E matthew.mctague(a)vetta.nz<mailto:matthew.mctague@vetta.nz> | W www.vetta.nz<https://www.vetta.nz> Vetta Group Ltd and its subsidiaries accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company, its subsidiaries, partners or contractors. .

3 2

Version 3.2.3 has been released
by Matthew Newton 28 May '23

28 May '23

We have released version 3.2.3. This is the latest stable v3 "feature" release. There are a number of features and bug fixes included in this version. Notably: - A notable bug occasionally causing connections to stall when using RADSEC has been fixed. - rlm_ldap and rlm_sql now have a "max_retries" option to limit the number of connection retries due to failure. - Several locking issues and small memory leaks fixed. - A number of dictionary updates, as usual. as well as several other fixes and updates as shown in the ChangeLog. Of importance please note: - Python users Debian/Ubuntu packages now have "freeradius-python2" and "freeradius-python3" packages. Previously the python module was included in the main "freeradius" package. If you are upgrading using the Network RADIUS packages and use python, please make sure you now also install the correct python package for your system. The "freeradius" package recommends both new python packages which will hopefully pull them in on upgrade, but you should check to be certain. Previously the python package built depended on the which version of python was available by default on the OS, which was e.g. python3 on Ubuntu22, but python2 on Debian11 - both options are now available. - Checkrad If anyone is still using the "checkrad" script, it is now passed NAS-Port-Id when called from SQL simultaneous use, rather than "NAS-Port". This fixes the script (the SQL queries always used NAS-Port-Id), but may break installations where the an invalid value such as 0 was previously passed, and is now the correct string. Download from all the usual places: https://freeradius.org/releases/ https://freeradius.org/ftp/pub/freeradius/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_3 Packages are available from Network RADIUS: https://packages.networkradius.com/ (Note that packages are no longer built for Debian 9 Stretch as it is EoL.) Docker images are available on Dockerhub: https://hub.docker.com/r/freeradius/freeradius-server -- Matthew

3 2

Debug logs kill radiusd on AlmaLinux 9.2 with SIGSEGV
by Gerald Vogt 26 May '23

26 May '23

Hi! I am in the process of setting up freeradius-3.0.21-37.el9.x86_64 on a new AlmaLinux 9.2 server to migrate from our old centos 7 servers. I have noticed that the server crashes with a segmentation fault if I enable debug logs (e.g. radiusd -X or with raddebug) and run a test with EAP-TLS. The test works fine and succeeds without debug logging. So it's something which only happens during debug logging. gdb backtrace from the core dump is #0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74 #1 0x00007ff611284268 in __vfprintf_internal (s=s@entry=0x7ffcc44437e0, format=format@entry=0x564c843544b8 "(TLS) Creating attributes from %s certificate", ap=ap@entry=0x7ffcc44439c0, mode_flags=mode_flags@entry=2) at vfprintf-internal.c:1647 #2 0x00007ff61129487a in __vsnprintf_internal (string=0x7ffcc4443a20 "(TLS) Creating attributes from ServerHelloDone\"\n", maxlen=<optimized out>, format=0x564c843544b8 "(TLS) Creating attributes from %s certificate", args=0x7ffcc44439c0, mode_flags=2) at vsnprintf.c:114 #3 0x00007ff611bec5dc in vsnprintf (__ap=0x7ffcc44439c0, __fmt=0x564c843544b8 "(TLS) Creating attributes from %s certificate", __n=10240, __s=0x7ffcc4443a20 "(TLS) Creating attributes from ServerHelloDone\"\n") at /usr/include/bits/stdio2.h:68 #4 vradlog_request (type=L_DBG, lvl=<optimized out>, request=0x564c85de2a30, msg=0x564c843544b8 "(TLS) Creating attributes from %s certificate", ap=0x7ffcc4446270) at src/main/log.c:695 #5 0x00007ff611bec801 in radlog_request (type=<optimized out>, lvl=<optimized out>, request=<optimized out>, msg=<optimized out>) at src/main/log.c:787 #6 0x0000564c8433b992 in ?? () #7 0x0000564c85c96368 in ?? () #8 0x0000564c85bf5aa0 in ?? () #9 0x3232363000000001 in ?? () #10 0x0000564c85c962d0 in ?? () #11 0x0000000000000003 in ?? () #12 0x3461626338663361 in ?? () #13 0x0000564c85d87380 in ?? () #14 0x0000564c85c96328 in ?? () #15 0x3039363639633635 in ?? () #16 0x6566323131383235 in ?? () #17 0x3563666364323264 in ?? () #18 0x0000000000000000 in ?? () It happens during handshake: (11) Auth-Type eap { (11) eap: Expiring EAP session with state 0x923d2dbc9836205f (11) eap: Finished EAP session with state 0x923d2dbc9836205f (11) eap: Previous EAP request found for state 0x923d2dbc9836205f, released from the list (11) eap: Peer sent packet with method EAP TLS (13) (11) eap: Calling submodule eap_tls to process data (11) eap_tls: (TLS) EAP Got final fragment (24 bytes) (11) eap_tls: (TLS) EAP Done initial handshake (11) eap_tls: (TLS) Handshake state - Server SSLv3/TLS write server done (11) eap_tls: (TLS) recv TLS 1.2 Handshake, Certificate Segmentation fault (core dumped) Tested with two different client certificates... Regards, Gerald

3 5

Need help on eap-cache
by deepika parmar 22 May '23

22 May '23

Hello, I have configured *EAP-AKA virtual-server in FreeRADIUS to perform authentication. I have enabled eap cache so that fast reauth will work and session data will be stored in cache. However during store session even if session data is there in session state, in cache while storing session data its null. Logs are like: Debug : (0.0) h9-auth-server - store session { Debug : (0.0) h9-auth-server - | debug_attr INFO : (0.0) h9-auth-server - Attributes matching "&session-state" INFO : (0.0) h9-auth-server - &session-State.session-State = { INFO : (0.0) h9-auth-server - Permanent-Identity = 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org INFO : (0.0) h9-auth-server - SIM-Ki = 0x465b5ce8b199b49faa5f0a2ee238a6bc INFO : (0.0) h9-auth-server - SIM-OPc = 0xcd63cb71954a9f4e48a5994e37a02baf INFO : (0.0) h9-auth-server - SIM-SQN = 640 INFO : (0.0) h9-auth-server - Identity = 2TGUFSvpAG13Ugm INFO : (0.0) h9-auth-server - Session-Data = 0x2d9b493ceda56d4b440d6a6b011c06b2f54ffd51 >>>>>>>>>>>>>>>>>>>>>>>>>>>> Session data is present INFO : (0.0) h9-auth-server - Counter = 0 INFO : (0.0) h9-auth-server - } Debug : (0.0) h9-auth-server - | %(debug_attr:{&session-state}) Debug : (0.0) h9-auth-server - | --> (null) Debug : (0.0) h9-auth-server - &session-state.SIM-Ki := 0x2d9b493ceda56d4b440d6a6b011c06b2f54ffd51 Debug : (0.0) eap_aka_cache - | eap-aka-sim.Session-ID Debug : (0.0) eap_aka_cache - | %{eap-aka-sim.Session-ID} Debug : (0.0) eap_aka_cache - | --> 0x345043774142776875516d30353132 Debug : (0.0) eap_aka_cache - --> 0x345043774142776875516d30353132 Debug : (0.0) eap_aka_cache - No cache entry found for "0x345043774142776875516d30353132" Debug : (0.0) eap_aka_cache - Creating new cache entry Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Permanent-Identity} Debug : (0.0) eap_aka_cache - | session-state.Permanent-Identity Debug : (0.0) eap_aka_cache - | %{session-state.Permanent-Identity} Debug : (0.0) eap_aka_cache - | --> 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org Debug : (0.0) eap_aka_cache - --> 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org Debug : (0.0) eap_aka_cache - &session-State[0].Permanent-Identity := "10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org" Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Session-Data} >>>>>>>>> Session data not available Debug : (0.0) eap_aka_cache - | session-state.Session-Data Debug : (0.0) eap_aka_cache - | %{session-state.Session-Data} Debug : (0.0) eap_aka_cache - | --> Debug : (0.0) eap_aka_cache - --> Debug : (0.0) eap_aka_cache - &session-State[0].Session-Data := 0x Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Encr-Data.Counter} Debug : (0.0) eap_aka_cache - | session-state.Encr-Data.Counter Debug : (0.0) eap_aka_cache - | %{session-state.Encr-Data.Counter} Store session setting in virtual server: store session { "%(debug_attr:&session-state)" eap_aka_cache "%(debug_attr:&session-state)" ok } Eap cache: cache eap_aka_cache { # # key:: Cache key. # key = "%{eap-aka-sim.Session-ID}" # # ttl:: TTL for cache entries. # ttl = 150 # # update <section> { ... }:: # update session-state { &Permanent-Identity := "%{session-state.Permanent-Identity}" &Session-Data := "%{session-state.Session-Data}" &Encr-Data.Counter := "%{session-state.Encr-Data.Counter}" } } Can anyone help? Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Thanks, Deepika

2 1

cacheable groups for ldap
by dextá 22 May '23

22 May '23

Hello, Is there any limit on how many groups can be cached via ldap module? I ask because I have some users who have 80 groups in their profile. This is because we use AD + Moodle to manage the courses. This particular user is unable to connect to the Wi-Fi. I suspect that the reason might be having too many groups in their profile. ldap module ---------------- ldap haproxy-dc { server = 172.16.7.230 port = 389 identity = 'CN=Administrator,CN=Users,dc=mydc,dc=net' password = ****** base_dn = 'dc=mydc,dc=net' group_dn = 'OU=GRUPOS,dc=mydc,dc=net' user { base_dn = "OU=USUARIOS,${..base_dn}" filter = "(samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' access_positive = yes } group { base_dn = "OU=GRUPOS,${..base_dn}" filter = "(objectClass=group)" scope = 'base' name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = 'memberOf' cacheable_name = 'no' cacheable_dn = 'yes' cache_attribute = 'LDAP-Group' } options { chase_referrals = yes rebind = yes res_timeout = 20 srv_timelimit = 20 net_timeout = 10 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } freeradius version: 3.2

3 3

rlm_cache_redis driver
by dextá 21 May '23

21 May '23

hi, I have installed freeradius via packages.networkradius.com. At first I thought the "freeradius-redis" package would include the rlm_cache_redis driver, but it doesn't. I get the output below: rlm_ldap (dc4): Bind successful # Instantiating module "redis" from file /etc/freeradius/mods-enabled/redis rlm_redis (redis): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 2 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_redis (redis): Opening additional connection (0), 1 of 10 pending slots used rlm_redis (redis): Opening additional connection (1), 1 of 9 pending slots used rlm_redis (redis): Opening additional connection (2), 1 of 8 pending slots used rlm_redis (redis): Opening additional connection (3), 1 of 7 pending slots used rlm_redis (redis): Opening additional connection (4), 1 of 6 pending slots used # Instantiating module "cache" from file /etc/freeradius/mods-enabled/cache /etc/freeradius/mods-enabled/cache[23]: Could not link driver rlm_cache_redis: (null) /etc/freeradius/mods-enabled/cache[23]: Make sure it (and all its dependent libraries!) are in the search path of your system's ld /etc/freeradius/mods-enabled/cache[23]: Instantiation failed for module "cache" In the path /usr/lib/freeradius there is no rlm_cache_redis.so root@freeradiusv3dev:/usr/lib/freeradius# ls rlm_cache rlm_cache.so rlm_cache_rbtree.so root@freeradiusv3dev:/usr/lib/freeradius# ls rlm_cache Checking the output of ldconfig -v I also found nothing about rlm_cache_redis. Which package includes the rlm_cache_redis driver? Or do I need to compile this driver?

2 4

Access-challenge with new line
by Mesut GULNAZ 20 May '23

20 May '23

How can I reply access-challenge with new line to achieve something like this below? -- İyi çalışmalar... Mesut GÜLNAZ

2 1

Re: Getting Freeradius working with LLDAP
by Matthew Macdonald-Wallace 17 May '23

17 May '23

On May 17, 2023, freeradius-users-request(a)lists.freeradius.org wrote: Message: 3 Date: Wed, 17 May 2023 07:20:27 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Getting Freeradius working with LLDAP Message-ID: <EFC4B512-AB04-4A03-A59A-F1503D781E60(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii >> My LDAP server is https://github.com/lldap/lldap and that *does not* >> expose a "plain text password" field. > Then you need to set "Auth-Type = LDAP". See the comments in sites- available/default. Done this and it's working, thanks.

1 0

Getting Freeradius working with LLDAP
by Matthew Macdonald-Wallace 17 May '23

17 May '23

Hi all, I'm new to Freeradius but want to get it working for our local hack/makerspace to ensure we can provide decent QoS on the WiFi for our members. My LDAP server is https://github.com/lldap/lldap and that *does not* expose a "plain text password" field. I am running Freeradius via docker and I've uploaded my config at https://gist.github.com/proffalken/a6213dc7266a6a9800432b3c0e1b264d (passwords and domains have been changed to protect the innocent!) As you can see from the log below, the LDAP lookup works, however the authentication request is rejected because the "Auth-Type" is not found. I'm sure this is an obvious fix, but I've not been able to find an answer in my searching! I'm using the following command to test: radtest mmw pass1234 10.x.x.5 0 testing123 and this is the log: -=-=-=-=-=-=-=-=-=-= freeradius_1 | rlm_ldap (ldap): Reserved connection (0) freeradius_1 | (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User- Name}}) freeradius_1 | (0) ldap: --> (uid=mmw) freeradius_1 | (0) ldap: Performing search in "ou=people,dc=auth,dc=mydomain,dc=co,dc=uk" with filter "(uid=mmw)", scope "sub" freeradius_1 | (0) ldap: Waiting for search result... freeradius_1 | (0) ldap: User object found at DN "uid=mmw,ou=people,dc=auth,dc=mydomain,dc=co,dc=uk" freeradius_1 | (0) ldap: Processing user attributes freeradius_1 | (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute freeradius_1 | (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) freeradius_1 | rlm_ldap (ldap): Released connection (0) freeradius_1 | (0) [ldap] = ok freeradius_1 | (0) [expiration] = noop freeradius_1 | (0) [logintime] = noop freeradius_1 | (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type freeradius_1 | (0) pap: WARNING: Authentication will fail unless a "known good" password is available freeradius_1 | (0) [pap] = noop freeradius_1 | (0) } # authorize = ok freeradius_1 | (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject freeradius_1 | (0) Failed to authenticate the user freeradius_1 | (0) Using Post-Auth-Type Reject freeradius_1 | (0) # Executing group from file /opt/etc/raddb/sites- enabled/default freeradius_1 | (0) Post-Auth-Type REJECT { freeradius_1 | (0) attr_filter.access_reject: EXPAND %{User-Name} freeradius_1 | (0) attr_filter.access_reject: --> mmw freeradius_1 | (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 freeradius_1 | (0) [attr_filter.access_reject] = updated freeradius_1 | (0) [eap] = noop freeradius_1 | (0) policy remove_reply_message_if_eap { freeradius_1 | (0) if (&reply:EAP-Message && &reply:Reply- Message) { freeradius_1 | (0) if (&reply:EAP-Message && &reply:Reply- Message) -> FALSE freeradius_1 | (0) else { freeradius_1 | (0) [noop] = noop freeradius_1 | (0) } # else = noop freeradius_1 | (0) } # policy remove_reply_message_if_eap = noop freeradius_1 | (0) } # Post-Auth-Type REJECT = updated -=-=-=-=-=-=-=-=-=-=- Thanks in advance! Matt

2 1

The problem when I run freeRadius server 4.0 in master: Failed adding new socket to network event loop: Failed inserting filters for FD 15: EFAULT: Bad address with libkqueue v2.6.1-28
by Baudouin MESMIN DES VAUX 16 May '23

16 May '23

Hi guys, I try to run freeradius V4.0 for tacas+. I clone the master and do, without issue, the ./configure, make and make install. I’m on Ubuntu 2304 up-to-date with libkqueue v2.6.1-28. When I do the radius -X, I got this error : #### Opening listener interfaces #### Network - Failed adding new socket to network event loop: Failed inserting filters for FD 17: EFAULT: Bad address /usr/local/etc/raddb/sites-enabled/default[209]: Opening radius I/O interface failed I checked the config files, but cannot find the cause. Could anyone help to tell me how to do, thank you very much. Thks, Baudouin The complete log radiusd -X: IInfo : Copyright 1999-2022 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/usr/local/etc/raddb/dictionary" gctx 0x55be4a150e40 report internal refs src/lib/server/main_config.c (1) internal refs src/lib/server/request.c (1) internal refs src/lib/tls/base.c (1) including configuration file /usr/local/etc/raddb/radiusd.conf Including files in directory "/usr/local/etc/raddb/template.d/" including configuration file /usr/local/etc/raddb/template.d/default including configuration file /usr/local/etc/raddb/clients.conf Including files in directory "/usr/local/etc/raddb/global.d/" including configuration file /usr/local/etc/raddb/global.d/ldap Including files in directory "/usr/local/etc/raddb/mods-enabled/" including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/client including configuration file /usr/local/etc/raddb/mods-enabled/delay including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/eap_inner including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/escape including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/stats including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/utf8 Including files in directory "/usr/local/etc/raddb/policy.d/" including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/canonicalisation including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/tacacs including configuration file /usr/local/etc/raddb/policy.d/time including configuration file /usr/local/etc/raddb/policy.d/vendor Including files in directory "/usr/local/etc/raddb/sites-enabled/" including configuration file /usr/local/etc/raddb/sites-enabled/default Loaded module process_radius including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Parsing security rules to bootstrap UID / GID / chroot / etc. main { prefix = \/usr\/local security { allow_core_dumps = no allow_vulnerable_openssl = no openssl_fips_mode = no } name = radiusd local_state_dir = "/usr/local/var" run_dir = \/usr\/local\/var\/run\/radiusd } Parsing main configuration main { server default { namespace = radius radius { Access-Request { log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } session { timeout = 15 max = 4096 } } } Loaded module proto_radius listen { type = Access-Request type = Status-Server transport = udp Loaded module proto_radius_udp udp { ipv4addr = 10.0.100.11 port = 1812 networks { allow = 127/8 allow = 46.192.0.0/15 } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 60.0 nak_lifetime = 30.0 max_connections = 256 max_clients = 256 max_pending_packets = 256 } priority { Access-Request = high Accounting-Request = low CoA-Request = normal Disconnect-Request = low Status-Server = now } } listen tcp_auth { type = Access-Request type = Status-Server transport = tcp Loaded module proto_radius_tcp tcp { ipaddr = * port = 1812 networks { allow = 127/8 allow = 192.0.2/24 } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 } priority { Access-Request = high Accounting-Request = low CoA-Request = normal Disconnect-Request = low Status-Server = now } } listen udp_acct { type = Accounting-Request transport = udp udp { ipaddr = * port = 1813 networks { } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 } priority { Access-Request = high Accounting-Request = low CoA-Request = normal Disconnect-Request = low Status-Server = now } } } server inner-tunnel { namespace = radius radius { Access-Request { log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } session { timeout = 15 max = 4096 } } } listen { type = Access-Request transport = udp udp { ipaddr = 127.0.0.1 port = 18120 networks { } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 } priority { Access-Request = high Accounting-Request = low CoA-Request = normal Disconnect-Request = low Status-Server = now } } } security { } sbin_dir = "/usr/local/sbin" logdir = \/usr\/local\/var\/log\/radius radacctdir = \/usr\/local\/var\/log\/radius\/radacct reverse_lookups = no hostname_lookups = yes max_request_time = 30 pidfile = \/usr\/local\/var\/run\/radiusd\/radiusd.pid debug_level = 0 max_requests = 16384 log { colourise = yes } resources { } thread pool { num_networks = 1 num_workers = 0 Setting thread.workers = 2 openssl_async_pool_init = 64 openssl_async_pool_max = 1024 } migrate { } interpret { } } Switching to configured log settings radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 secret = <<< secret >>> require_message_authenticator = no proto = * limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30s } } Debugger not attached trigger { ... } subsection not found, triggers will be disabled #### Instantiating libraries #### #### Bootstrapping process modules #### Bootstrapping process_radius "default" Creating Auth-Type = pap Creating Auth-Type = chap Creating Auth-Type = mschap Creating Auth-Type = digest Creating Auth-Type = ldap Creating Auth-Type = eap Bootstrapping process_radius "inner-tunnel" #### Bootstrapping protocol modules #### Bootstrapping proto_radius "default.radius" client localhost { ipaddr = 192.0.2.1 secret = <<< secret >>> shortname = sample limit { max_connections = 16 lifetime = 0 idle_timeout = 30s } } Bootstrapping proto_radius "default.tcp_auth" Bootstrapping proto_radius "default.udp_acct" Bootstrapping proto_radius "inner-tunnel.radius" #### Instantiating libraries #### #### Bootstrapping modules #### modules { Loaded module rlm_always always reject { rcode = reject simulcount = 0 mpp = no } always fail { rcode = fail simulcount = 0 mpp = no } always ok { rcode = ok simulcount = 0 mpp = no } always handled { rcode = handled simulcount = 0 mpp = no } always invalid { rcode = invalid simulcount = 0 mpp = no } always disallow { rcode = disallow simulcount = 0 mpp = no } always notfound { rcode = notfound simulcount = 0 mpp = no } always noop { rcode = noop simulcount = 0 mpp = no } always updated { rcode = updated simulcount = 0 mpp = no } Loaded module rlm_attr_filter attr_filter attr_filter.pre-proxy { filename = \/usr\/local\/etc\/raddb\/mods-config\/attr_filter\/pre-proxy key = "%{Realm}" relaxed = no } attr_filter attr_filter.post-proxy { filename = \/usr\/local\/etc\/raddb\/mods-config\/attr_filter\/post-proxy key = "%{Realm}" relaxed = no } attr_filter attr_filter.access_reject { filename = \/usr\/local\/etc\/raddb\/mods-config\/attr_filter\/access_reject key = "%{User-Name}" relaxed = no } attr_filter attr_filter.access_challenge { filename = \/usr\/local\/etc\/raddb\/mods-config\/attr_filter\/access_challenge key = "%{User-Name}" relaxed = no } attr_filter attr_filter.accounting_response { filename = \/usr\/local\/etc\/raddb\/mods-config\/attr_filter\/accounting_response key = "%{User-Name}" relaxed = no } Loaded module rlm_cache cache cache_eap { driver = rbtree Loaded module rlm_cache_rbtree key = %{%{control.State}:-%{%{reply.State}:-%{State}}} ttl = 15 max_entries = 0 epoch = 0 add_stats = no } Loaded module rlm_chap Loaded module rlm_client Loaded module rlm_delay delay { delay = 1.0s relative = no force_reschedule = no } delay delay_reject { delay = "%{%{reply.FreeRADIUS-Response-Delay}:-1}" relative = yes force_reschedule = no } Loaded module rlm_detail detail { filename = \/usr\/local\/var\/log\/radius\/radacct\/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}\/detail-%Y-%m-%d header = %t permissions = 0600 locking = no escape_filenames = no log_packet_header = no } detail auth_log { filename = \/usr\/local\/var\/log\/radius\/radacct\/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}\/auth-detail-%Y-%m-%d header = %t permissions = 0600 locking = no escape_filenames = no log_packet_header = no } detail reply_log { filename = \/usr\/local\/var\/log\/radius\/radacct\/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}\/reply-detail-%Y-%m-%d header = %t permissions = 0600 locking = no escape_filenames = no log_packet_header = no } detail pre_proxy_log { filename = \/usr\/local\/var\/log\/radius\/radacct\/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}\/pre-proxy-detail-%Y-%m-%d header = %t permissions = 0600 locking = no escape_filenames = no log_packet_header = no } detail post_proxy_log { filename = \/usr\/local\/var\/log\/radius\/radacct\/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}\/post-proxy-detail-%Y-%m-%d header = %t permissions = 0600 locking = no escape_filenames = no log_packet_header = no } Loaded module rlm_digest Loaded module rlm_eap eap { require_identity_realm = nai type = md5 Loaded module rlm_eap_md5 type = gtc Loaded module rlm_eap_gtc gtc { challenge = "Password: " auth_type = PAP } type = tls Loaded module rlm_eap_tls tls { tls = tls-common require_client_cert = yes include_length = yes } type = ttls Loaded module rlm_eap_ttls ttls { tls = tls-common virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } type = mschapv2 Loaded module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no auth_type = mschap send_error = no } type = peap Loaded module rlm_eap_peap peap { tls = tls-common virtual_server = "inner-tunnel" soh = no require_client_cert = no } ignore_unknown_eap_types = no } eap inner-eap { require_identity_realm = nai default_eap_type = mschapv2 type = md5 type = gtc gtc { challenge = "Password: " auth_type = PAP } type = mschapv2 mschapv2 { with_ntdomain_hack = no auth_type = mschap send_error = no } type = tls tls { tls = tls-peer require_client_cert = yes include_length = yes } ignore_unknown_eap_types = no } Loaded module rlm_exec exec echo { wait = yes program = "/bin/echo Tmp-String-\0 := %{User-Name}" input_pairs = &request output_pairs = &reply shell_escape = yes env_inherit = no } Loaded module rlm_escape escape { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } exec { wait = yes input_pairs = &request shell_escape = yes env_inherit = no timeout = 10 } Loaded module rlm_files files { filename = \/usr\/local\/etc\/raddb\/mods-config\/files\/authorize acctusersfile = \/usr\/local\/etc\/raddb\/mods-config\/files\/accounting key = %{%{Stripped-User-Name}:-%{User-Name}} } Loaded module rlm_linelog linelog { destination = file delimiter = "\n" format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply.Packet-Type}:-default}" file { filename = \/usr\/local\/var\/log\/radius\/linelog permissions = 0600 escape_filenames = no } syslog { severity = "info" } unix { } tcp { server = localhost port = 514 timeout = 2.0 } udp { server = localhost port = 514 timeout = 2.0 } } linelog log_accounting { destination = file delimiter = "\n" format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" file { filename = \/usr\/local\/var\/log\/radius\/linelog-accounting permissions = 0600 escape_filenames = no } syslog { severity = "info" } unix { } tcp { timeout = 1000 } udp { timeout = 1000 } } Loaded module rlm_logintime logintime { minimum_timeout = 60 } Loaded module rlm_mschap mschap { normalise = yes use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind { } } exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%(mschap:User-Name) --password=%{User-Password}" shell_escape = yes env_inherit = no } Loaded module rlm_pap pap { normalise = yes } Loaded module rlm_passwd passwd etc_passwd { filename = \/etc\/passwd format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } Loaded module rlm_radutmp radutmp { filename = \/usr\/local\/var\/log\/radius\/radutmp username = %{User-Name} check_with_nas = yes permissions = 0600 caller_id = no } Loaded module rlm_soh soh { dhcp = yes } radutmp sradutmp { filename = \/usr\/local\/var\/log\/radius\/sradutmp username = "%{User-Name}" check_with_nas = yes permissions = 0644 caller_id = no } Loaded module rlm_stats stats { } Loaded module rlm_unix unix { } Loaded module rlm_unpack Loaded module rlm_utf8 #### Bootstrapping rlm modules #### Bootstrapping rlm_cache "cache_eap" Bootstrapping rlm_delay "delay" Bootstrapping rlm_delay "delay_reject" Bootstrapping rlm_always "disallow" Bootstrapping rlm_eap "eap" Bootstrapping rlm_exec "echo" Bootstrapping rlm_escape "escape" Bootstrapping rlm_exec "exec" Bootstrapping rlm_always "fail" Bootstrapping rlm_always "handled" Bootstrapping rlm_eap "inner-eap" Bootstrapping rlm_always "invalid" Bootstrapping rlm_linelog "linelog" Bootstrapping rlm_linelog "log_accounting" Bootstrapping rlm_mschap "mschap" Bootstrapping rlm_always "noop" Bootstrapping rlm_always "notfound" Bootstrapping rlm_exec "ntlm_auth" Bootstrapping rlm_always "ok" Bootstrapping rlm_always "reject" Bootstrapping rlm_soh "soh" Bootstrapping rlm_unix "unix" Creating attribute Unix-Group Bootstrapping rlm_unpack "unpack" Bootstrapping rlm_always "updated" } # modules #### Instantiating listeners #### Compiling policies in server default { ... } Instantiating proto_radius "default.radius" Instantiating proto_radius "default.tcp_auth" Instantiating proto_radius "default.udp_acct" Instantiating process_radius "default" Compiling policies in - recv Access-Request {...} /usr/local/etc/raddb/sites-enabled/default[793]: Ignoring "-sql" as the "sql" module is not enabled. /usr/local/etc/raddb/sites-enabled/default[809]: Ignoring "-ldap" as the "ldap" module is not enabled. Compiling policies in - send Access-Accept {...} /usr/local/etc/raddb/sites-enabled/default[1115]: Ignoring "-sql" as the "sql" module is not enabled. Compiling policies in - send Access-Challenge {...} Compiling policies in - send Access-Reject {...} /usr/local/etc/raddb/sites-enabled/default[1228]: Ignoring "-sql" as the "sql" module is not enabled. Compiling policies in - recv Accounting-Request {...} Compiling policies in - send Accounting-Response {...} /usr/local/etc/raddb/sites-enabled/default[1443]: Ignoring "-sql" as the "sql" module is not enabled. Compiling policies in - recv Status-Server {...} Compiling policies in - authenticate pap {...} Compiling policies in - authenticate chap {...} Compiling policies in - authenticate mschap {...} Compiling policies in - authenticate digest {...} Compiling policies in - authenticate ldap {...} /usr/local/etc/raddb/sites-enabled/default[978]: Ignoring "-ldap" as the "ldap" module is not enabled. Compiling policies in - authenticate eap {...} Compiling policies in - accounting Start {...} Compiling policies in - accounting Stop {...} Compiling policies in - accounting Alive {...} Compiling policies in - accounting Accounting-On {...} Compiling policies in - accounting Accounting-Off {...} Compiling policies in - accounting Failed {...} /usr/local/etc/raddb/sites-enabled/default[80]: radius { ... } section is unused Compiling policies in server inner-tunnel { ... } Instantiating proto_radius "inner-tunnel.radius" Instantiating process_radius "inner-tunnel" Compiling policies in - recv Access-Request {...} /usr/local/etc/raddb/sites-enabled/inner-tunnel[124]: Ignoring "-sql" as the "sql" module is not enabled. /usr/local/etc/raddb/sites-enabled/inner-tunnel[134]: Ignoring "-ldap" as the "ldap" module is not enabled. Compiling policies in - send Access-Accept {...} /usr/local/etc/raddb/sites-enabled/inner-tunnel[267]: Ignoring "-sql" as the "sql" module is not enabled. Compiling policies in - send Access-Reject {...} /usr/local/etc/raddb/sites-enabled/inner-tunnel[302]: Ignoring "-sql" as the "sql" module is not enabled. Compiling policies in - authenticate pap {...} Compiling policies in - authenticate chap {...} Compiling policies in - authenticate mschap {...} Compiling policies in - authenticate eap {...} src/lib/server/virtual_servers.c[311]: radius { ... } section is unused #### Instantiating rlm modules #### Instantiating rlm_attr_filter "attr_filter.access_challenge" Reading file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge Instantiating rlm_attr_filter "attr_filter.access_reject" Reading file /usr/local/etc/raddb/mods-config/attr_filter/access_reject Instantiating rlm_attr_filter "attr_filter.accounting_response" Reading file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response Instantiating rlm_attr_filter "attr_filter.post-proxy" Reading file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy Instantiating rlm_attr_filter "attr_filter.pre-proxy" Reading file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy Instantiating rlm_detail "auth_log" auth_log - 'User-Password' suppressed, will not appear in detail output Instantiating rlm_cache "cache_eap" Instantiating rlm_chap "chap" Instantiating rlm_detail "detail" Instantiating rlm_digest "digest" Instantiating rlm_always "disallow" Instantiating rlm_eap "eap" Instantiating rlm_exec "echo" Instantiating rlm_passwd "etc_passwd" Instantiating rlm_exec "exec" Instantiating rlm_always "fail" Instantiating rlm_files "files" Reading file /usr/local/etc/raddb/mods-config/files/authorize Reading file /usr/local/etc/raddb/mods-config/files/accounting Instantiating rlm_always "handled" Instantiating rlm_eap "inner-eap" inner-eap - Failed to find 'authenticate inner-eap {...}' section. EAP authentication will likely not work Instantiating rlm_always "invalid" Instantiating rlm_linelog "linelog" Instantiating rlm_linelog "log_accounting" Instantiating rlm_logintime "logintime" Instantiating rlm_mschap "mschap" mschap - Using internal authentication Instantiating rlm_always "noop" Instantiating rlm_always "notfound" Instantiating rlm_exec "ntlm_auth" Instantiating rlm_always "ok" Instantiating rlm_pap "pap" Instantiating rlm_detail "post_proxy_log" Instantiating rlm_detail "pre_proxy_log" Instantiating rlm_always "reject" Instantiating rlm_detail "reply_log" Instantiating rlm_stats "stats" Instantiating rlm_always "updated" Instantiating _cache_rbtree "cache_eap.rbtree" Instantiating _eap_mschapv2 "eap.mschapv2" Instantiating _eap_peap "eap.peap" tls-config tls-common { chain rsa { format = pem certificate_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/server.pem private_key_password = <<< secret >>> private_key_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/server.key ca_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/ca.pem verify_mode = hard include_root_ca = no } verify_depth = 0 ca_path = \/usr\/local\/etc\/raddb\/certs ca_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/ca.pem dh_file = \/usr\/local\/etc\/raddb\/certs\/dh fragment_size = 1024 cipher_list = "DEFAULT" cipher_server_preference = yes allow_renegotiation = no ecdh_curve = prime256v1 tls_min_version = 1.2 session { mode = auto name = "%{EAP-Type}%{Virtual-Server}" lifetime = 1d require_extended_master_secret = yes require_perfect_forward_secrecy = no } verify { mode = all attribute_mode = client-and-issuer check_crl = no } } tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless" Instantiating _eap_tls "eap.tls" tls - Using cached TLS configuration from previous invocation Instantiating _eap_ttls "eap.ttls" tls - Using cached TLS configuration from previous invocation Instantiating _eap_mschapv2 "inner-eap.mschapv2" Instantiating _eap_tls "inner-eap.tls" tls-config tls-peer { chain { format = pem certificate_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/server.pem private_key_password = <<< secret >>> private_key_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/server.key ca_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/ca.pem verify_mode = hard include_root_ca = no } verify_depth = 0 ca_path = \/usr\/local\/etc\/raddb\/certs ca_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/ca.pem dh_file = \/usr\/local\/etc\/raddb\/certs\/dh fragment_size = 16384 cipher_server_preference = yes allow_renegotiation = no ecdh_curve = "prime256v1" tls_min_version = 1.2 session { mode = auto name = "%{EAP-Type}%{Virtual-Server}" lifetime = 1d require_extended_master_secret = yes require_perfect_forward_secrecy = no } verify { mode = all attribute_mode = client-and-issuer check_crl = no } } tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless" Scheduler created in single-threaded mode #### Opening listener interfaces #### Network - Failed adding new socket to network event loop: Failed inserting filters for FD 17: EFAULT: Bad address /usr/local/etc/raddb/sites-enabled/default[209]: Opening radius I/O interface failed -- *Ce message et toutes les pièces jointes (ci-après le "message") sont établis à l’intention exclusive des destinataires désignés. Il contient des informations confidentielles et pouvant être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de détruire le message. Toute utilisation de ce message non conforme à sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse de l'émetteur*

2 1

Potential issue with compiling on the HEAD of the branch
by work vlpl 15 May '23

15 May '23

Hi, for my own needs, I am building freeradius from the HEAD (d84dacda2d67fcffedb0dd75e97c71185eec37cb) of 3.0.x branch on amazonlinux2. Because of that, I am not sure if this is a real problem or just state between releases so I am not opening the issue in GitHub. The commit that is working for me is 9acf21e62de151918743de541567d13cd3e61f9a Can you say if it is a real issue? If yes I will create a proper issue in github. ``` In file included from src/main/threads.c:34:0: src/main/threads.c: In function 'ssl_locking_function': src/main/threads.c:256:28: error: invalid operands to binary != (have 'pthread_mutex_t {aka union <anonymous>}' and 'void *') rad_assert(ssl_mutexes[n] != NULL); ~~~~~~~~~~~~~~ ^ src/freeradius-devel/rad_assert.h:38:13: note: in definition of macro 'rad_assert' ((void) ((expr) ? (void) 0 : \ ^~~~ make: *** [build/objs/src/main/threads.lo] Error 1 ``` Best regards, Vladimir

2 1

FreeRadius with Redis
by Pramesh Tiwari 15 May '23

15 May '23

Hi, Anyone have tried freeradius with redis? I am not getting data in redis database after client being authenticated on my server. I have enabled both redis and rediswho modules. I have configured redis module to connect to redis server. Upon checking in my redis server , i see no updates in redis-server.log file, however while checking on redis-cli and running monitor . I see my radius server has send AUTH and Password . But no further. Can anyone help me on this? Best Regards, Pramesh Tiwari

2 1

dot1x authentication doesn't work
by Семенюк Александр Петро вич 14 May '23

14 May '23

Hello, guys! Unfortunately, I completely don’t understand how it should work. I’ve read a lot of successful stories about “how to configure” Freeradius with Samba and MS domain, Cisco Catalyst switch and Windows 10 PC in order to perform dot1x authentication for users in the LAN with their MS domain accounts. Suddenly it even worked some time ago. But now – no, it doesn’t. May be my logs can help you to help me - to show me what exactly should I fix and where. Could you, please? I can show in addition, if there a reason: - Switch port config - Win PC network authentication config --------------------------------------- Best regards, Alexander Semenyuk

2 1

How long does the Server cache session-state attributes?
by Daniel Finger 11 May '23

11 May '23

Hi! I am currently implementing a 2-Factor authentication with a TOTP Challenge which looks very promising so far. As there is user interaction, the Access-Request after my first Access-Challenge can take some time. I wondered for how long does the server cache the session-state Attributes and what happens if the server never receives a new request for this particular state. Is this related to max_request_time? Daniel Finger

2 1

How to escape values in radclient?
by rany 08 May '23

08 May '23

Hi, I am planning on using radclient in a quick authentication script until I could fix an authentication library. I thought of using radclient in a shell script for the authentication task as it seemed fairly simple, however I wasn't able to figure out how to escape values that are set by the user; namely User-Name and User-Password. I tried checking the manual page but I haven't had any luck with that. It doesn't seem to have been mentioned, but I'm fairly sure this scenario was considered. TIA, rany

2 19

cache module
by Anatoliy 06 May '23

06 May '23

Hi team , can somebody share example of using a cache module ? I need to cache values from very simple sql table, like this one. ______________ |_n1__|_ 100___| |_n2__|__110___| |_n3__|__55____| And I want to cache these values for 30min to decrease number of query to DB,

1 0

Need help with EAP AKA Fast reauth
by deepika parmar 05 May '23

05 May '23

Hello, I have configured *EAP-AKA virtual-server in FreeRADIUS to perform authentication. * *I could successfully authenticate the Users, However facing an issue with fast reauth.* *I have used eap cache to store the session state. I could load the session state properly * *On receiving a fast reauth ID. Still reauth is not continued, rather it fails saying * *can't calculate re-auth keys and falling back to full auth.* I could see following logs : .. Debug : (2) eap - Peer sent EAP-Identity. Returning 'ok' so we can short-circuit the rest of authorize Debug : (2) eap - Setting &control.Auth-Type = eap Debug : (2) eap (ok) Debug : (2) } # recv Access-Request (ok) Debug : (2) default - Running 'authenticate eap' from file /usr/local/etc/raddb/sites-enabled/default Debug : (2) default - authenticate eap { Debug : (2) eap - New EAP session started Debug : (2) eap - Peer sent packet with EAP method Identity (1) Debug : (2) eap - Calling submodule eap_aka Debug : (2) eap - subrequest { Debug : (2.0) h9-auth-server - recv Identity-Response { Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # recv Identity-Response (ok) Debug : (2.0) h9-auth-server - New EAP-AKA session Debug : (2.0) h9-auth-server - Changed state INIT -> REAUTHENTICATION Debug : (2.0) h9-auth-server - load session { Debug : (2.0) eap_aka_cache - | eap-aka-sim.Session-ID Debug : (2.0) eap_aka_cache - | %{eap-aka-sim.Session-ID} Debug : (2.0) eap_aka_cache - | --> 0x346844533743546c516f736a376d62 Debug : (2.0) eap_aka_cache - --> 0x346844533743546c516f736a376d62 Debug : (2.0) eap_aka_cache - Found entry for "0x346844533743546c516f736a376d62" Debug : (2.0) eap_aka_cache - Merging cache entry into request Debug : (2.0) eap_aka_cache - &session-State[0].Permanent-Identity := '10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org' Debug : (2.0) eap_aka_cache - &session-State[0].Session-Data := 0xab32a5be4d8309d4a40938e425ef1714d71cf87a Debug : (2.0) eap_aka_cache - &session-State[0].Encr-Data.Counter := 0 Debug : (2.0) h9-auth-server - eap_aka_cache (updated) Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # load session (updated) Debug : (2.0) h9-auth-server - send Reauthentication-Request { Debug : (2.0) h9-auth-server - &reply.Encr-Data.Next-Reauth-Id := Debug : (2.0) h9-auth-server - &reply.Encr-Data.Next-Pseudonym := Debug : (2.0) h9-auth-server - | debug_attr INFO : (2.0) h9-auth-server - Attributes matching "&session-state" INFO : (2.0) h9-auth-server - &session-State.session-State = { INFO : (2.0) h9-auth-server - Permanent-Identity = 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org INFO : (2.0) h9-auth-server - Session-Data = 0xab32a5be4d8309d4a40938e425ef1714d71cf87a INFO : (2.0) h9-auth-server - Counter = 0 INFO : (2.0) h9-auth-server - } Debug : (2.0) h9-auth-server - | %(debug_attr:{&session-state}) Debug : (2.0) h9-auth-server - | --> (null) Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # send Reauthentication-Request (ok) Debug : (2.0) h9-auth-server - Generating new session keys Debug : (2.0) h9-auth-server - Neither &session-state.Session-Data or &session-state.MK attributes found, can't calculate re-auth keys >>>>>>>>>>>>>>>>>>>>> Getting this error, however I could see session-state has Session-Data loaded. Debug : (2.0) h9-auth-server - Composing EAP-Request/Reauthentication failed. Clearing reply attributes and requesting additional Identity Debug : (2.0) h9-auth-server - Changed state REAUTHENTICATION -> AKA-IDENTITY Debug : (2.0) h9-auth-server - send Identity-Request { Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # send Identity-Request (ok) And then it falls back to full authentication... Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Any help would be greatly appreciated. Thank you in advance. Thanks, Deepika

1 0

Which module is listening to udp port 52894
by Yuriy Ivkin 02 May '23

02 May '23

Greetings! Could you please tell me, which module cal listening to udp port 52894 ? Grepping of configs gives nothing as well as googling and searching in the sources repository. Freeradius installed from the ubuntu package repository. Listening port output: #lsof -Pi4 ... freeradiu 89399 freerad 16u IPv4 124336 0t0 UDP *:52894 ... -- Best regards, Yuriy Ivkin

3 5

traffic quota control
by ReZa Esfahani 02 May '23

02 May '23

hi I want to control traffic quota for users in freeradius, for example, I want to set a monthly 20GB traffic quota for a specific group. How can I do that ? and after the traffic quota is reached , freeradius disconnects the user? and my last question is rlm_quota module in freeradius for this or do we have to do it in another way? thank you

3 3

Is it possible to query freeradius' certificate expiration remotely?
by Matt H 02 May '23

02 May '23

Is it possible to query freeradius' certificate expiration date remotely for the cert in /etc/raddb/certs? I'm trying to set up an alert so there's notification when the cert is <60 days from requiring renewal. I'm trying the following but the command returns connection refused on all of the ports I expected it to work on: openssl s_client -servername rad2.domain.com -connect rad2.domain.com:1813 | openssl x509 -noout -dates I've tried ports 443, 8080, 88, 1812, 1813, 1645, 1646, and everything else I can find that might be listening, to no avail. Thanks for any guidance /mh

5 4