June 2023 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

DPSK in 3.2
by Alan DeKok 22 Aug '23

22 Aug '23

I've just pushed patches to make DPSK work in 3.2. The module configuration is available on GitHub: https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-avai… The work isn't quite done yet, but the module works. The one remaining piece is to cache the identity associated with the PSK. As background, some AP vendors permit dynamic PSKs for WiFi access. This uses WPA-PSK, but the PSK is permitted to be different for different users on the same SSID. There are some issues with DPSK. In short, don't use it. It usually requires the server to try all possible PSKs before finding one that works. This process can be ver very slow. i.e. a reasonable modern system can do 100,000 of these PSK tests per second. So if you have 100,000 individual PSKs, then it can only handle one packet per second before the CPU maxes out. If you have 100 PSKs, then you're limited to 1000 packets per second. And that's doing nothing other than PSK checks. So the numbers are likely to be much lower than that in practice. To help with this performance issue, the module can cache PSK entries in memory. The first time it finds an unknown MAC, it has to brute-force the PSK. But once the PSK is found, the module caches the MAC+SSID+PSK. The next time it receives a packet for that MAC+SSID, the module finds the cache entry, and uses it. We've made it as good as possible considering the limitations of DPSK. But we still recommend that people don't use it. The DPSK functionality is simply broken, and there is really no way to make it efficient. Please see the module configuration for more details. Alan DeKok.

2 2

802.1x with GoDaddy Certificates EAP-TTLS
by Torsten Wilms 22 Jul '23

22 Jul '23

I have a little question. I am not sure but does clients need to resolve AAA Server via DNS and need to reach AAA Server if I use EAP-TTLS with GoDaddy x509 Certificates to verify the certificate on e.g. Mobile Devices or does the client need in any other case to reach some endpoint to validate the certificates common name? I have a AAA Server in a separate Network installed which is only reachable for the authenticator (Wireless Controller). The Clients communicate with the AccessPoint. A hand full devices like Android are not able to connect the wireless because of certificate validation error. The other devices has no problems. You see the certificate of the server and after accept, the connection will be established. The AAA Server sends the full chain like RootCA, Intermediate and server certificate. BR. Torsten

6 17

Errors when building binary RPM on OL9
by Linus Hicks 30 Jun '23

30 Jun '23

I have downloaded the 3.2.3 tar file from the freeradius site and trying to build the binary RPM on an Oracle Linux 9 system. I copied the redhat/freeradius.spec file into the SPECS directory but needed to make a couple of changes to get it this far. 1. I got a file not found error on SOURCES/freeradius-tmpfiles-conf. That file is in the redhat/ directory but I couldn't figure out how to change where it is looking for it so just put a copy where it is looking. 2. I have installed postgresql-15 from binary RPM on their site and the paths to the /lib and /include directories don't match the paths searched in the build, now resolved. 3. Now I'm getting: RPM build errors: line 51: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-devel line 52: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-libs Macro expanded in comment on line 602: %{_mandir}/man5/rlm_idn.5.gz} File listed twice: /etc/raddb/certs/bootstrap File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/queries.conf File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/cisco_h323_db_schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf Installed (but unpackaged) file(s) found: /etc/raddb/mods-config/python/example.py /etc/raddb/mods-config/python/radiusd.py /usr/lib/debug/usr/lib64/freeradius/rlm_python.so-3.2.3-1.el9.x86_64.debug /usr/lib64/freeradius/rlm_python.so It did not create the RPM and I believe the last set of files listed as "Installed (but unpackaged)" need to be resolved. I know there's a way to ignore the error and continue, but that could leave me with a broken RPM. Any help is appreciated. C. Linus Hicks Please access the attached hyperlink for Highstreet’s electronic communications disclaimer: http://www.highstreetit.com/Email_Disclaimer.htm

2 5

Migrating DHCP configuration from v3 to v4
by Ľudovít Mikula 30 Jun '23

30 Jun '23

I am migrating my dhcp setup from freeradius v3 into v4 and have some questions. In v3 there was a dedicated dhcp and dhcp-ippool mods-config/sql setup, where the sql_user_name was set to: sql_user_name = "%{control:DHCP-SQL-Option-Identifier}" and in my processing sections I have set the "control:DHCP-SQL-Option-Identifier" based on some custom logic. In v4 there is no such configuration, but the comments in ippool queries seem to suggest it can now all be done in one config. However when using ippool module in DHCP request processing, the %{User-Name} attribute (configured in sql_user_name) is not known and I have not found an alternative to DHCP-SQL-Option-Identifier attribute. What is the recommended way of migrating such configuration from v3 into v4? Thank you. -- Ludo Mikula

2 4

Problem using hased passwords
by Michael Schwartzkopff 30 Jun '23

30 Jun '23

Hi, I am trying to use a hased password, but I get the error: pap: ERROR: SHA1 digest does not match "known good" digest from the eap_gtc module. According to the compatibility matrix this should work. My setup: users file: user SHA-Password := "<SHA sum of the password, not salted>" Log: (31) files: users: Matched entry misch3 at line 101 (31) [files] = ok (...) (31) pap: Normalizing SHA-Password from hex encoding, 40 bytes -> 20 bytes (31) pap: WARNING: Auth-Type already set. Not setting to PAP (31) [pap] = noop (31) } # authorize = updated (31) eap_gtc: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (31) eap_gtc: Auth-Type PAP { (31) pap: Login attempt with password (31) pap: Comparing with "known-good" SHA-Password (31) pap: ERROR: SHA1 digest does not match "known good" digest (31) pap: Passwords don't match (31) eap_gtc: [pap] = reject (31) eap_gtc: } # Auth-Type PAP = reject Any ideas? I double checked the passwords and the SHA sum on both ends. Michael.

2 4

EAP TLS fatal protocol version
by roudi＠rjbsoft.co.za 25 Jun '23

25 Jun '23

Hi, I recently got a VPS for my RADIUS server as I am having issues keeping my local server online due to prolonged rolling blackouts. My new server is Ubuntu 22.04.2 and I have installed the latest FreeRADIUS v3.2.3 and I am using MySQL. My FreeRADIUS server is working perfectly for PPPoE authentication on Mikrotik. My problem comes in on my Ubiquiti Sectors where I have WPA2-Enterprise Authentication on the WiFi devices. My old server is running Ubuntu 18 with FreeRadius v3.0, and on that server my WPA2-Enterprise authentication is working perfectly. The error I am getting on the new server looks like this in the log file: (6) eap: Calling submodule eap_peap to process data (6) eap_peap: (TLS) EAP Peer says that the final record size will be 62 bytes (6) eap_peap: (TLS) EAP Got all data (62 bytes) (6) eap_peap: (TLS) Handshake state - before SSL initialization (6) eap_peap: (TLS) Handshake state - Server before SSL initialization (6) eap_peap: (TLS) Handshake state - Server before SSL initialization (6) eap_peap: (TLS) recv TLS 1.3 Handshake, ClientHello (6) eap_peap: (TLS) send TLS 1.0 Alert, fatal protocol_version (6) eap_peap: ERROR: (TLS) Alert write:fatal:protocol version (6) eap_peap: ERROR: (TLS) Server : Error in error (6) eap_peap: ERROR: (TLS) Failed reading from OpenSSL: error:0A000102:SSL routines::unsupported protocol (6) eap_peap: ERROR: (TLS) System call (I/O) error (-1) (6) eap_peap: ERROR: (TLS) EAP Receive handshake failed during operation (6) eap_peap: ERROR: [eaptls process] = fail (6) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (6) eap: Sending EAP Failure (code 4) ID 1 length 4 (6) eap: Failed in EAP select (6) [eap] = invalid (6) } # authenticate = invalid (6) Failed to authenticate the user The problem looks like the client is sending a TLS 1.3 Handshake, and FreeRADIUS is replying with a TLS 1.0 reply. I have also noticed that Ubuntu 22 is using OpenSSL 3.0.2 15 and Ubuntu 18 was using OpenSSL 1.1.1. And this is where, I suspect, my problem is, but I am unsure how to get around this. What I have tried: * Setting TLS Max version to 1.3 in eap config * Removing OpenSSL v3.0 and installing OpenSSL v1.1.1 on ubuntu 22, but this broke and removed a lot of stuff. * Downgraded to FreeRADIUS 3.0, same problem. I could just get a VPS with Ubuntu 18, but this realy defeats the point as Ubuntu 18 is almost at end of life, and having the latest OS would be a good option. Is there anyone out there that got WPA2-Enterprise authentication working on FreeRADIUS 3.0 or 3.2 on Ubuntu 22? Thanks Roudi

2 1

Changing radacct logs path
by Can Paçacı 23 Jun '23

23 Jun '23

Hi, I changed the radacct log directory location (radacctdir = /aaa/logs/radacct) in the radiud.conf file and also changed the owner of the destination directory and premission but it didn't work. Why? How can I do that. Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

4 5

Vendor specific attributes format eapol_test
by nabble＠felix.world 23 Jun '23

23 Jun '23

Hello, I know it’s not FreeRADIUS related but you may be able to help me to understand how vendor specific attributes work and how to correctly send them with eapol_test. Vendor specific attributes are in the RADIUS attribute 26 So with eapol_test the following flag `-N 26:x:00009f680305010000` would be in detail: 00009f68 = Vendor-Id in hex 03 = Vendor attribute id 05 = length 010000 = Value 05 should be the length if I understand it correctly. But after playing around a bit it confuses me more and more. Why is 010000 of length 05 and e.g. 11000342342342 of length 09? BR, Lineconnect

2 1