June 2023 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

DPSK in 3.2
by Alan DeKok 22 Aug '23

22 Aug '23

I've just pushed patches to make DPSK work in 3.2. The module configuration is available on GitHub: https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-avai… The work isn't quite done yet, but the module works. The one remaining piece is to cache the identity associated with the PSK. As background, some AP vendors permit dynamic PSKs for WiFi access. This uses WPA-PSK, but the PSK is permitted to be different for different users on the same SSID. There are some issues with DPSK. In short, don't use it. It usually requires the server to try all possible PSKs before finding one that works. This process can be ver very slow. i.e. a reasonable modern system can do 100,000 of these PSK tests per second. So if you have 100,000 individual PSKs, then it can only handle one packet per second before the CPU maxes out. If you have 100 PSKs, then you're limited to 1000 packets per second. And that's doing nothing other than PSK checks. So the numbers are likely to be much lower than that in practice. To help with this performance issue, the module can cache PSK entries in memory. The first time it finds an unknown MAC, it has to brute-force the PSK. But once the PSK is found, the module caches the MAC+SSID+PSK. The next time it receives a packet for that MAC+SSID, the module finds the cache entry, and uses it. We've made it as good as possible considering the limitations of DPSK. But we still recommend that people don't use it. The DPSK functionality is simply broken, and there is really no way to make it efficient. Please see the module configuration for more details. Alan DeKok.

2 2

802.1x with GoDaddy Certificates EAP-TTLS
by Torsten Wilms 22 Jul '23

22 Jul '23

I have a little question. I am not sure but does clients need to resolve AAA Server via DNS and need to reach AAA Server if I use EAP-TTLS with GoDaddy x509 Certificates to verify the certificate on e.g. Mobile Devices or does the client need in any other case to reach some endpoint to validate the certificates common name? I have a AAA Server in a separate Network installed which is only reachable for the authenticator (Wireless Controller). The Clients communicate with the AccessPoint. A hand full devices like Android are not able to connect the wireless because of certificate validation error. The other devices has no problems. You see the certificate of the server and after accept, the connection will be established. The AAA Server sends the full chain like RootCA, Intermediate and server certificate. BR. Torsten

6 17

Errors when building binary RPM on OL9
by Linus Hicks 30 Jun '23

30 Jun '23

I have downloaded the 3.2.3 tar file from the freeradius site and trying to build the binary RPM on an Oracle Linux 9 system. I copied the redhat/freeradius.spec file into the SPECS directory but needed to make a couple of changes to get it this far. 1. I got a file not found error on SOURCES/freeradius-tmpfiles-conf. That file is in the redhat/ directory but I couldn't figure out how to change where it is looking for it so just put a copy where it is looking. 2. I have installed postgresql-15 from binary RPM on their site and the paths to the /lib and /include directories don't match the paths searched in the build, now resolved. 3. Now I'm getting: RPM build errors: line 51: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-devel line 52: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-libs Macro expanded in comment on line 602: %{_mandir}/man5/rlm_idn.5.gz} File listed twice: /etc/raddb/certs/bootstrap File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/queries.conf File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/cisco_h323_db_schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf Installed (but unpackaged) file(s) found: /etc/raddb/mods-config/python/example.py /etc/raddb/mods-config/python/radiusd.py /usr/lib/debug/usr/lib64/freeradius/rlm_python.so-3.2.3-1.el9.x86_64.debug /usr/lib64/freeradius/rlm_python.so It did not create the RPM and I believe the last set of files listed as "Installed (but unpackaged)" need to be resolved. I know there's a way to ignore the error and continue, but that could leave me with a broken RPM. Any help is appreciated. C. Linus Hicks Please access the attached hyperlink for Highstreet’s electronic communications disclaimer: http://www.highstreetit.com/Email_Disclaimer.htm

2 5

Migrating DHCP configuration from v3 to v4
by Ľudovít Mikula 30 Jun '23

30 Jun '23

I am migrating my dhcp setup from freeradius v3 into v4 and have some questions. In v3 there was a dedicated dhcp and dhcp-ippool mods-config/sql setup, where the sql_user_name was set to: sql_user_name = "%{control:DHCP-SQL-Option-Identifier}" and in my processing sections I have set the "control:DHCP-SQL-Option-Identifier" based on some custom logic. In v4 there is no such configuration, but the comments in ippool queries seem to suggest it can now all be done in one config. However when using ippool module in DHCP request processing, the %{User-Name} attribute (configured in sql_user_name) is not known and I have not found an alternative to DHCP-SQL-Option-Identifier attribute. What is the recommended way of migrating such configuration from v3 into v4? Thank you. -- Ludo Mikula

2 4

Problem using hased passwords
by Michael Schwartzkopff 30 Jun '23

30 Jun '23

Hi, I am trying to use a hased password, but I get the error: pap: ERROR: SHA1 digest does not match "known good" digest from the eap_gtc module. According to the compatibility matrix this should work. My setup: users file: user SHA-Password := "<SHA sum of the password, not salted>" Log: (31) files: users: Matched entry misch3 at line 101 (31) [files] = ok (...) (31) pap: Normalizing SHA-Password from hex encoding, 40 bytes -> 20 bytes (31) pap: WARNING: Auth-Type already set. Not setting to PAP (31) [pap] = noop (31) } # authorize = updated (31) eap_gtc: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (31) eap_gtc: Auth-Type PAP { (31) pap: Login attempt with password (31) pap: Comparing with "known-good" SHA-Password (31) pap: ERROR: SHA1 digest does not match "known good" digest (31) pap: Passwords don't match (31) eap_gtc: [pap] = reject (31) eap_gtc: } # Auth-Type PAP = reject Any ideas? I double checked the passwords and the SHA sum on both ends. Michael.

2 4

EAP TLS fatal protocol version
by roudi＠rjbsoft.co.za 25 Jun '23

25 Jun '23

Hi, I recently got a VPS for my RADIUS server as I am having issues keeping my local server online due to prolonged rolling blackouts. My new server is Ubuntu 22.04.2 and I have installed the latest FreeRADIUS v3.2.3 and I am using MySQL. My FreeRADIUS server is working perfectly for PPPoE authentication on Mikrotik. My problem comes in on my Ubiquiti Sectors where I have WPA2-Enterprise Authentication on the WiFi devices. My old server is running Ubuntu 18 with FreeRadius v3.0, and on that server my WPA2-Enterprise authentication is working perfectly. The error I am getting on the new server looks like this in the log file: (6) eap: Calling submodule eap_peap to process data (6) eap_peap: (TLS) EAP Peer says that the final record size will be 62 bytes (6) eap_peap: (TLS) EAP Got all data (62 bytes) (6) eap_peap: (TLS) Handshake state - before SSL initialization (6) eap_peap: (TLS) Handshake state - Server before SSL initialization (6) eap_peap: (TLS) Handshake state - Server before SSL initialization (6) eap_peap: (TLS) recv TLS 1.3 Handshake, ClientHello (6) eap_peap: (TLS) send TLS 1.0 Alert, fatal protocol_version (6) eap_peap: ERROR: (TLS) Alert write:fatal:protocol version (6) eap_peap: ERROR: (TLS) Server : Error in error (6) eap_peap: ERROR: (TLS) Failed reading from OpenSSL: error:0A000102:SSL routines::unsupported protocol (6) eap_peap: ERROR: (TLS) System call (I/O) error (-1) (6) eap_peap: ERROR: (TLS) EAP Receive handshake failed during operation (6) eap_peap: ERROR: [eaptls process] = fail (6) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (6) eap: Sending EAP Failure (code 4) ID 1 length 4 (6) eap: Failed in EAP select (6) [eap] = invalid (6) } # authenticate = invalid (6) Failed to authenticate the user The problem looks like the client is sending a TLS 1.3 Handshake, and FreeRADIUS is replying with a TLS 1.0 reply. I have also noticed that Ubuntu 22 is using OpenSSL 3.0.2 15 and Ubuntu 18 was using OpenSSL 1.1.1. And this is where, I suspect, my problem is, but I am unsure how to get around this. What I have tried: * Setting TLS Max version to 1.3 in eap config * Removing OpenSSL v3.0 and installing OpenSSL v1.1.1 on ubuntu 22, but this broke and removed a lot of stuff. * Downgraded to FreeRADIUS 3.0, same problem. I could just get a VPS with Ubuntu 18, but this realy defeats the point as Ubuntu 18 is almost at end of life, and having the latest OS would be a good option. Is there anyone out there that got WPA2-Enterprise authentication working on FreeRADIUS 3.0 or 3.2 on Ubuntu 22? Thanks Roudi

2 1

Changing radacct logs path
by Can Paçacı 23 Jun '23

23 Jun '23

Hi, I changed the radacct log directory location (radacctdir = /aaa/logs/radacct) in the radiud.conf file and also changed the owner of the destination directory and premission but it didn't work. Why? How can I do that. Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

4 5

Vendor specific attributes format eapol_test
by nabble＠felix.world 23 Jun '23

23 Jun '23

Hello, I know it’s not FreeRADIUS related but you may be able to help me to understand how vendor specific attributes work and how to correctly send them with eapol_test. Vendor specific attributes are in the RADIUS attribute 26 So with eapol_test the following flag `-N 26:x:00009f680305010000` would be in detail: 00009f68 = Vendor-Id in hex 03 = Vendor attribute id 05 = length 010000 = Value 05 should be the length if I understand it correctly. But after playing around a bit it confuses me more and more. Why is 010000 of length 05 and e.g. 11000342342342 of length 09? BR, Lineconnect

2 1

Re: FW: FreeRadius TOTP authenticate fail passcode validation
by João Miguel Regateiro 23 Jun '23

23 Jun '23

Hi there, Thanks for the previous response. Now I came across with two different problems, the first is with building the rlm_totp module and the second is during decoding the totp secret. I was able to get the correct totp and authenticate successfully even though the make totp returned some errors. The passcode was indeed incorrect because the module was generating the totp based on the system time. I changed the mods-available/date and set utc=yes and that fixed the problem (that was a misconfiguration on Universal Time vs System Time). I tried to build the rlm_totp (make totp) and got the following errors on undefined references ("fr_hmac_sha1" and "fr_digest_cmp"): rlm_totp.c: In function ‘main’: rlm_totp.c:336:44: warning: format ‘%llu’ expects argument of type ‘long long unsigned int *’, but argument 3 has type ‘uint64_t *’ {aka ‘long unsigned int *’} [-Wformat=] 336 | (void) sscanf(argv[2], "%llu", &now); | ~~~^ ~~~~ | | | | | uint64_t * {aka long unsigned int *} | long long unsigned int * | %lu At top level: rlm_totp.c:50:32: warning: ‘method_env’ defined but not used [-Wunused-const-variable=] 50 | static const call_method_env_t method_env = { | ^~~~~~~~~~ /bin/ld: /tmp/cccE8qoD.o: in function `totp_cmp': /home/mfa/freeradius-server/src/modules/rlm_totp/rlm_totp.c:209: undefined reference to `fr_hmac_sha1' /bin/ld: /home/mfa/freeradius-server/src/modules/rlm_totp/rlm_totp.c:229: undefined reference to `fr_digest_cmp' collect2: error: ld returned 1 exit status make: *** [Makefile:25: totp] Error 1 ------------------------------------------------------------------------------------------ In the last email I was using a standard shared secret just for testing purposes but my TOTP generator creates a 56 characters secret so I am using that and getting this message - “totp: TOTP-Secret cannot be decoded”. I’ve tried smaller secrets and it is always able to decode the secret which made me wonder if you have any restrictions on the secret length? Secret: 3R4VOYWSOR3YWEVRX74HRVXYXLMACQN3A457C24GS2OYG7EINHMBPQZO Base32 encoded: GNJDIVSPLFLVGT2SGNMVORKWKJMDONCIKJLFQWKYJRGUCQ2RJYZUCNBVG5BTENCHKMZE6WKHG5CUSTSIJVBFAUK2J4====== Fri Jun 23 11:42:00 2023 : Info: Ready to process requests Fri Jun 23 11:42:04 2023 : Debug: (2) Received Access-Request Id 192 from 10.56.143.110:59496 to 10.56.143.110:1812 length 73 Fri Jun 23 11:42:04 2023 : Debug: (2) User-Name = "bob" Fri Jun 23 11:42:04 2023 : Debug: (2) User-Password = "testing123123456" Fri Jun 23 11:42:04 2023 : Debug: (2) NAS-IP-Address = 10.56.143.110 Fri Jun 23 11:42:04 2023 : Debug: (2) NAS-Port = 1812 Fri Jun 23 11:42:04 2023 : Debug: (2) Message-Authenticator = 0x7641368bcad58c3250dd31f0e46e76d4 Fri Jun 23 11:42:04 2023 : Debug: (2) session-state: No State attribute Fri Jun 23 11:42:04 2023 : Debug: (2) # Executing section authorize from file /etc/raddb/sites-enabled/default Fri Jun 23 11:42:04 2023 : Debug: (2) authorize { Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authorize]: calling files (rlm_files) Fri Jun 23 11:42:04 2023 : Debug: (2) files: users: Matched entry bob at line 1 Fri Jun 23 11:42:04 2023 : Debug: Hello %{User-Name} Fri Jun 23 11:42:04 2023 : Debug: Parsed xlat tree: Fri Jun 23 11:42:04 2023 : Debug: literal --> Hello Fri Jun 23 11:42:04 2023 : Debug: attribute --> User-Name Fri Jun 23 11:42:04 2023 : Debug: literal --> Fri Jun 23 11:42:04 2023 : Debug: (2) files: EXPAND Hello %{User-Name} Fri Jun 23 11:42:04 2023 : Debug: (2) files: --> Hello bob Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authorize]: returned from files (rlm_files) Fri Jun 23 11:42:04 2023 : Debug: (2) [files] = ok Fri Jun 23 11:42:04 2023 : Debug: (2) if (User-Password !~ /^(.*)([0-9]{6})$/) { Fri Jun 23 11:42:04 2023 : Debug: (2) if (User-Password !~ /^(.*)([0-9]{6})$/) -> FALSE Fri Jun 23 11:42:04 2023 : Debug: (2) update request { Fri Jun 23 11:42:04 2023 : Debug: (2) EXPAND %{1} Fri Jun 23 11:42:04 2023 : Debug: (2) --> testing123 Fri Jun 23 11:42:04 2023 : Debug: (2) User-Password := testing123 Fri Jun 23 11:42:04 2023 : Debug: (2) Overwriting value "testing123123456" with "testing123" Fri Jun 23 11:42:04 2023 : Debug: (2) EXPAND %{2} Fri Jun 23 11:42:04 2023 : Debug: (2) --> 123456 Fri Jun 23 11:42:04 2023 : Debug: (2) TOTP-Password := 123456 Fri Jun 23 11:42:04 2023 : Debug: (2) } # update request = noop Fri Jun 23 11:42:04 2023 : Debug: (2) if (&User-Name == "bob") { Fri Jun 23 11:42:04 2023 : Debug: (2) if (&User-Name == "bob") -> TRUE Fri Jun 23 11:42:04 2023 : Debug: (2) if (&User-Name == "bob") { Fri Jun 23 11:42:04 2023 : Debug: (2) update control { Fri Jun 23 11:42:04 2023 : Debug: (2) TOTP-Secret := GNJDIVSPLFLVGT2SGNMVORKWKJMDONCIKJLFQWKYJRGUCQ2RJYZUCNBVG5BTENCHKMZE6WKHG5CUSTSIJVBFAUK2J4====== Fri Jun 23 11:42:04 2023 : Debug: (2) } # update control = noop Fri Jun 23 11:42:04 2023 : Debug: (2) } # if (&User-Name == "bob") = noop Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authenticate]: calling totp (rlm_totp) Fri Jun 23 11:42:04 2023 : Debug: (2) totp: TOTP-Secret cannot be decoded Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authenticate]: returned from totp (rlm_totp) Fri Jun 23 11:42:04 2023 : Debug: (2) [totp.authenticate] = fail Fri Jun 23 11:42:04 2023 : Debug: (2) } # authorize = fail Fri Jun 23 11:42:04 2023 : Debug: (2) Using Post-Auth-Type Reject Fri Jun 23 11:42:04 2023 : Debug: (2) Post-Auth-Type sub-section not found. Ignoring. Fri Jun 23 11:42:04 2023 : Debug: (2) # Executing group from file /etc/raddb/sites-enabled/default Fri Jun 23 11:42:04 2023 : Debug: (2) Delaying response for 1.000000 seconds Fri Jun 23 11:42:04 2023 : Debug: Waking up in 0.3 seconds. Fri Jun 23 11:42:04 2023 : Debug: Waking up in 0.6 seconds. Fri Jun 23 11:42:05 2023 : Debug: (2) Sending delayed response Fri Jun 23 11:42:05 2023 : Debug: (2) Sent Access-Reject Id 192 from 10.56.143.110:1812 to 10.56.143.110:59496 length 32 Fri Jun 23 11:42:05 2023 : Debug: (2) Reply-Message = "Hello bob " Fri Jun 23 11:42:05 2023 : Debug: Waking up in 3.9 seconds. Fri Jun 23 11:42:09 2023 : Debug: (2) Cleaning up request packet ID 192 with timestamp +32 due to cleanup_delay was reached Fri Jun 23 11:42:09 2023 : Info: Ready to process requests Thank you! Best regards, Miguel luis teixeira <luis.carlosteixeira(a)outlook.com> escreveu no dia sexta, 23/06/2023 à(s) 12:19: > > > ------------------------------ > *De:* Freeradius-Users <freeradius-users-bounces+luis.carlosteixeira= > hotmail.com(a)lists.freeradius.org> em nome de Alan DeKok < > aland(a)deployingradius.com> > *Enviado:* 20 de junho de 2023 14:50 > *Para:* FreeRadius users mailing list < > freeradius-users(a)lists.freeradius.org> > *Assunto:* Re: FreeRadius TOTP authenticate fail passcode validation > > On Jun 20, 2023, at 5:06 AM, João Miguel Regateiro <jmregateiro(a)gmail.com> > wrote:, > > > > > > I am working on a TOTP authentication method setup with FreeRadius. For > > starters I created the user “bob” on raddb/users and defined a password > to > > authenticate against the server > > I have got it to work with just normal user and password but when I try > to > > configure the TOTP module and testing using radiusd -X it shows the > > totp.authenticate the return fail. I have made sure that the date time is > > the same UTC +00 on all the environments, and generate the TOTP token > with > > sha-1, 6 digits code and 30seconds time frame. [Generate token in base > 32 = > > JJBFGV2ZGNCFARKIKBFTGUCYKA====== ] and [Generate default token = > > JBSWY3DPEHPK3PXP ] > > If it fails, then the short answer is that the TOTP doesn't match. > There isn't really much else which can go wrong. > > I've pushed changes to the v3.2.x branch which let you do "radiusd -Xx", > and the totp module will now print out the TOTP it expected, and the one it > received. You'll have to download and build v3.2.x in order to use it, > though. > > You can also build a command-line program to test the TOTP. Build the > source as normal, and then do: > > $ cd src/modules/rlm_totp > $ make totp > > And then can use the above key: > > $ ./totp totp 1687268891 JBSWY3DPEHPK3PXP 601664 > Time 1687268891 > Expected 601664 > Received 601664 > > or: > > $ ./totp totp now JBSWY3DPEHPK3PXP 123456 > Time 1687269000 > Expected 895298 > Received 123456 > Fail > > My guess is that the TOTP you're giving it is wrong. But increased > debug output will let you know exactly what's going on. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freer… > <http://www.freeradius.org/list/users.html> >

2 2

Problem building current master
by Ľudovít Mikula 22 Jun '23

22 Jun '23

I am having problem compiling current master (tried on fresh clone): CC src/lib/tls/conf.c src/lib/tls/conf.c:47:12: warning: ‘tls_conf_parse_cache_mode’ used but never defined 47 | static int tls_conf_parse_cache_mode(TALLOC_CTX *ctx, void *out, void *parent, CONF_ITEM *ci, CONF_PARSER const *rule); | ^~~~~~~~~~~~~~~~~~~~~~~~~ and later it fails with: LINK build/lib/libfreeradius-eap-aka-sim.la CC src/lib/server/pair_server_tests.c /usr/bin/ld: build/lib/local/.libs/libfreeradius-tls.so: undefined reference to `tls_conf_parse_cache_mode' collect2: error: ld returned 1 exit status make: *** [scripts/boiler.mk:731: build/bin/local/pair_server_tests] Error 1 Configured with: ./configure --prefix=/opt/freeradius Library configure status report ------------------------------- curl .................... OK eap ..................... OK eap_aka_sim ............. OK io ...................... OK json .................... OK kafka ................... skipping (requires rdkafka.h libhirdkafka) ldap .................... skipping (requires libldap (with async support) lber ldap.h) redis ................... OK server .................. OK sim ..................... OK tls ..................... OK unlang .................. OK util .................... OK Module configure status report ------------------------------ rlm_always .............. OK rlm_attr_filter ......... OK rlm_cache ............... OK rlm_cache_memcached ..... OK rlm_cache_rbtree ........ OK rlm_cache_redis ......... OK rlm_chap ................ OK rlm_cipher .............. OK rlm_client .............. OK rlm_couchbase ........... skipping (requires couchbase.h libcouchbase) rlm_csv ................. OK rlm_date ................ OK rlm_delay ............... OK rlm_detail .............. OK rlm_dhcpv4 .............. OK rlm_dict ................ OK rlm_digest .............. OK rlm_eap ................. OK rlm_eap_aka ............. OK rlm_eap_aka_prime ....... OK rlm_eap_fast ............ OK rlm_eap_gtc ............. OK rlm_eap_md5 ............. OK rlm_eap_mschapv2 ........ OK rlm_eap_peap ............ OK rlm_eap_pwd ............. OK rlm_eap_sim ............. OK rlm_eap_tls ............. OK rlm_eap_ttls ............ OK rlm_escape .............. OK rlm_exec ................ OK rlm_files ............... OK rlm_icmp ................ OK rlm_idn ................. OK rlm_imap ................ OK rlm_isc_dhcp ............ OK rlm_json ................ OK rlm_kafka ............... OK rlm_krb5 ................ OK rlm_ldap ................ OK rlm_linelog ............. OK rlm_logintime ........... OK rlm_logtee .............. OK rlm_lua ................. skipping (requires lua.h) rlm_mruby ............... skipping (requires mruby.h mruby/compile.h mruby/array.h libmruby libm) rlm_mschap .............. OK ... without opendirectory support without direct winbind support rlm_ocsp ................ OK rlm_opendirectory ....... skipping (requires membership.h) rlm_pam ................. OK rlm_pap ................. OK rlm_passwd .............. OK rlm_perl ................ OK rlm_python .............. OK rlm_radius .............. OK rlm_radutmp ............. OK rlm_redis ............... OK rlm_redis_ippool ........ OK rlm_rediswho ............ OK rlm_rest ................ OK rlm_securid ............. skipping (requires acexport.h libaceclnt) rlm_sigtran ............. skipping (requires osmocom/core/msgb.h osmocom/sccp/sccp.h libosmocore libsccp libxua libmtp) rlm_smtp ................ OK rlm_sometimes ........... OK rlm_sql ................. OK rlm_sql_cassandra ....... skipping (requires libcassandra (>= 2.0) cassandra.h) rlm_sql_db2 ............. skipping (requires libdb2 sqlcli.h) rlm_sql_firebird ........ skipping (requires libfbclient ibase.h) rlm_sql_freetds ......... skipping (requires ctpublic.h libct) rlm_sql_mysql ........... OK rlm_sql_null ............ OK rlm_sql_oracle .......... skipping (requires oci.h libclntsh libnnz[9-12]) rlm_sql_postgresql ...... skipping (requires libpq-fe.h libpq) rlm_sql_sqlite .......... skipping (requires libsqlite3 sqlite.h) rlm_sql_unixodbc ........ skipping (requires libodbc sql.h) rlm_sqlcounter .......... OK rlm_sqlippool ........... OK rlm_stats ............... OK rlm_tacacs .............. OK rlm_test ................ OK rlm_totp ................ OK rlm_unbound ............. OK rlm_unix ................ OK rlm_unpack .............. OK rlm_utf8 ................ OK rlm_wimax ............... OK rlm_winbind ............. skipping (requires wbclient.h core/ntstatus.h) rlm_yubikey ............. OK ... without yubikey token decryption support without yubicloud support -- Ludo

2 2

FreeRadius TOTP authenticate fail passcode validation
by João Miguel Regateiro 20 Jun '23

20 Jun '23

Hello, I am working on a TOTP authentication method setup with FreeRadius. For starters I created the user “bob” on raddb/users and defined a password to authenticate against the server I have got it to work with just normal user and password but when I try to configure the TOTP module and testing using radiusd -X it shows the totp.authenticate the return fail. I have made sure that the date time is the same UTC +00 on all the environments, and generate the TOTP token with sha-1, 6 digits code and 30seconds time frame. [Generate token in base 32 = JJBFGV2ZGNCFARKIKBFTGUCYKA====== ] and [Generate default token = JBSWY3DPEHPK3PXP ] This is the configuration file for sites-enable/default: authorize{ #TOTP Authorize if (User-Password !~ /^(.*)([0-9]{6})$/) { reject } update request { User-Password := "%{1}" TOTP-Password := "%{2}" } #Example Use BOB if (&User-Name == "bob") { update control { TOTP-Secret := JJBFGV2ZGNCFARKIKBFTGUCYKA====== } } totp.authenticate if (!ok) { reject } pap } authenticate { Auth-Type PAP { pap } } This is the configuration file of clients.conf : Client network-device { ipaddr = 192.168.1.0/24 secret = testing123 } Note: I have test to send the TOTP-Secret via update control or update request, and that gave me different output when call TOTP.authenticate returns fail or noop . Radius client test: radtest -t pap bob password123456 192.168.1.10:1812 1812 testing123 output radiusd -X Ready to process requests (0) Received Access-Request Id 38 from 192.168.1.10:48110 to 192.168.1.10:1812 length 73 (0) User-Name = "bob" (0) User-Password = "password" (0) NAS-IP-Address = 192.168.1.10 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x66c57ad78dea99a37b8edcf8c79ab46d (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/radius/radacct/ 192.168.1.10/auth-detail-20230619 (0) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.10/auth-detail-20230619 (0) auth_log: EXPAND %t (0) auth_log: --> Mon Jun 19 16:05:09 2023 (0) [auth_log] = ok (0) files: users: Matched entry bob at line 1 (0) files: EXPAND Hello %{User-Name} THE BUILDER :D (0) files: --> Hello bob THE BUILDER :D (0) [files] = ok (0) if (User-Password !~ /^(.*)([0-9]{6})$/) { (0) if (User-Password !~ /^(.*)([0-9]{6})$/) -> TRUE (0) if (User-Password !~ /^(.*)([0-9]{6})$/) { (0) [reject] = reject (0) } # if (User-Password !~ /^(.*)([0-9]{6})$/) = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> bob (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 38 from 192.168.1.10:1812 to 192.168.1.10:48110 length 47 (0) Reply-Message = "Hello bob THE BUILDER :D " Waking up in 3.9 seconds. (0) Cleaning up request packet ID 38 with timestamp +3 due to cleanup_delay was reached Ready to process requests Please let me know if you can help me on this 🙂 Thank you! Best regards, Miguel

2 2

Re: google_ldap and google-ldap-auth
by Mathias Maes 19 Jun '23

19 Jun '23

Hi Alan Thanks for your reply. Disabling the "filter_inner_tunnel' policy does indeed work. I am rather sure I didn't deliberately enable it and rechecked. But It was enabled in the example configuration script, check here on Github: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/sites-ava… I tried to follow the comments in the example Google configuration scripts. It went pretty good up until that point. Now I will try to expand with custom attributes. Thanks! Met vriendelijke groet Mathias Maes ICT-Coördinator Maerlant Atheneum

4 4

google_ldap and google-ldap-auth
by Mathias Maes 19 Jun '23

19 Jun '23

Hello I am trying to get google-ldap-auth working in conjuction with google-ldap. I have enabled the site and the module, also enabled cache-auth and ldap. Configured google-ldap with the right credentials. I changed as little as possible to the Google config (no groups, custom attributes, etc) freeradius -X starts without errors. I have not altered the default or inner-tunnel sites. I keep the example user 'bob" with password "hello" enabled to check if I did not mess anything up. radtest bob hello 127.0.0.1 0 testing123 is working. radtest mathias.maes(a)maerlantatheneum.be mypassword 127.0.0.1:18123 0 testing123 fails. It seems that "User-Name" is required for tunneled authentication. But on the second line of the logs, User-Name is available. and if(&User-Name) returns TRUE However, if (!&outer.request:User-Name || !&User-Name) returns TRUE, I'm not a software developer, but it seems that the User-Name is missing from the outer.request. So my question is, how to test the outer.request.User-name with radtest? Or if I understand the logs totally wrong: Any ideas on what might be happening? Thanks a bunch. Error log: (1) Received Access-Request Id 171 from 127.0.0.1:43929 to 127.0.0.1:18123 length 102 (1) User-Name = "mathias.maes(a)maerlantatheneum.be" (1) User-Password = "mypassword" (1) NAS-IP-Address = 127.0.1.1 (1) NAS-Port = 0 (1) Message-Authenticator = 0x50109b513ed143e12cacfa804d48b950 (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) policy filter_inner_identity { (1) if (!&outer.request:User-Name || !&User-Name) { (1) if (!&outer.request:User-Name || !&User-Name) -> TRUE (1) if (!&outer.request:User-Name || !&User-Name) { (1) update request { (1) Module-Failure-Message = "User-Name is required for tunneled authentication" (1) } # update request = noop (1) [reject] = reject (1) } # if (!&outer.request:User-Name || !&User-Name) = reject (1) } # policy filter_inner_identity = reject (1) } # authorize = reject (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> mathias.maes(a)maerlantatheneum.be (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) if (&control:Auth-Type == ldap) { (1) ERROR: Failed retrieving values required to evaluate condition (1) update control { (1) &Cache-TTL := 0 (1) } # update control = noop (1) cache_ldap_user_dn: EXPAND %{Stripped-User-Name} (1) cache_ldap_user_dn: --> (1) cache_ldap_user_dn: ERROR: Zero length key string is invalid (1) [cache_ldap_user_dn] = invalid (1) } # Post-Auth-Type REJECT = invalid (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 171 from 127.0.0.1:18123 to 127.0.0.1:43929 length 20 Met vriendelijke groet Mathias Maes ICT-Coördinator Maerlant Atheneum

2 1

Python Or Perl Module for Auth and Accounting
by Imdad Hasan 18 Jun '23

18 Jun '23

Hi All, Which module is better from perl and python if doing whole auth and accounting code in native language without using socket or any other language. like perl native code or python native code. Thanks Imdad

2 1

Debian 12 Bookworm packages available
by Matthew Newton 16 Jun '23

16 Jun '23

We've added Debian 12 Bookworm to the Network RADIUS package builds. Both FreeRADIUS 3.2.3 and 3.0.26 are now available. Instructions are on the packages site as usual: https://packages.networkradius.com/ -- Matthew

2 1

Automated XIoT device management GoldenPath
by Michael Maymann 16 Jun '23

16 Jun '23

Hi list, first Q, so please be nice ;) If I am in the wrong list, please just let me know where to ask :) I am in the process of figuring out the architecture of how to automate XIoT device management best possible, and thought the following functionality in Radius would be a good approach. Are these something that is already supported in FreeRadius? Suggestions for better alternatives or guides/links on how to best achieve this are much appreciated :) "ZeroConf" XIoT info: - [MUD](https://datatracker.ietf.org/doc/rfc8520) retrieval (-> asset management system -> XIoTType ACL creation/approval -> provisioning) - [SBOM](https://cyclonedx.org/specification/overview) retrieval (-> asset management system -> continuous lightweight vulnerability scanning -> proactive compromisation actions) ZeroTrust XIoT PNAC 802.1x EAP-TLS authentication: - [FDO](https://github.com/fido-device-onboard) - [KeyLime](https://github.com/keylime) - [Akri](https://github.com/project-akri/akri) ZeroTouch XIoT provisioning: - [AWS IoT Greengrass](https://github.com/aws-greengrass) - [Tinkerbell](https://github.com/tinkerbell/proposals/issues/66) Thanks in advance :) Br. Michael

2 2

Fwd: compilation problem deprecated: Since OpenSSL 3.0
by Joost Ringoot 15 Jun '23

15 Jun '23

I am crossposting this, first on hostap, but some of you may have encountered/resolved this as well. I will crosspost the solution as well, when I have it. I forgot to mention, I tried the wpa_supplicant-2.10 as found on https://w1.fi/wpa_supplicant/ ----- Forwarded Message ----- > To: "hostap" <hostap(a)lists.infradead.org> > Sent: Thursday, 15 June, 2023 12:30:47 > Subject: compilation problem deprecated: Since OpenSSL 3.0 > Hello all, > > I am trying to compile eampol_test > > "make eapol_test" > > (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) > chapter 6 -EAP authentication, Pg 46,47) > > I've set > > "CONFIG_EAPOL_TEST=y" > > in the .config > > I get plenty of "deprecated: Since OpenSSL 3.0" errors. (on Ubuntu 22.04.2 LTS) > The full output is below. > > Thanks in advance for your advice, > > Joost > > =======Start compilation > output========================================================================================================= > > CC config.c > CC notify.c > CC bss.c > CC eap_register.c > CC ../src/utils/common.c > CC ../src/utils/config.c > CC ../src/utils/wpa_debug.c > CC ../src/utils/wpabuf.c > CC ../src/utils/bitfield.c > CC ../src/utils/ip_addr.c > CC ../src/utils/crc32.c > CC op_classes.c > CC rrm.c > CC twt.c > CC robust_av.c > CC wmm_ac.c > CC ../src/utils/os_unix.c > CC ../src/utils/eloop.c > CC config_file.c > CC ../src/rsn_supp/wpa_ft.c > CC ../src/common/sae.c > CC ../src/common/dpp.c > CC ../src/common/dpp_auth.c > CC ../src/common/dpp_backup.c > CC ../src/common/dpp_crypto.c > CC ../src/common/dpp_pkex.c > CC ../src/common/dpp_reconfig.c > CC ../src/common/dpp_tcp.c > CC dpp_supplicant.c > CC ../src/rsn_supp/tdls.c > CC ../src/rsn_supp/wpa.c > CC ../src/rsn_supp/preauth.c > CC ../src/rsn_supp/pmksa_cache.c > CC ../src/rsn_supp/wpa_ie.c > CC ../src/common/wpa_common.c > CC ibss_rsn.c > CC p2p_supplicant.c > CC p2p_supplicant_sd.c > CC ../src/p2p/p2p.c > CC ../src/p2p/p2p_utils.c > CC ../src/p2p/p2p_parse.c > CC ../src/p2p/p2p_build.c > CC ../src/p2p/p2p_go_neg.c > CC ../src/p2p/p2p_sd.c > CC ../src/p2p/p2p_pd.c > CC ../src/p2p/p2p_invitation.c > CC ../src/p2p/p2p_dev_disc.c > CC ../src/p2p/p2p_group.c > CC ../src/ap/p2p_hostapd.c > CC wifi_display.c > CC hs20_supplicant.c > CC interworking.c > CC ../src/eap_peer/eap_tls.c > CC ../src/eap_peer/eap_peap.c > CC ../src/eap_common/eap_peap_common.c > CC ../src/eap_peer/eap_ttls.c > CC ../src/eap_peer/eap_md5.c > CC ../src/eap_peer/eap_mschapv2.c > CC ../src/eap_peer/mschapv2.c > CC ../src/eap_peer/eap_gtc.c > CC ../src/eap_peer/eap_otp.c > CC ../src/eap_peer/eap_leap.c > CC ../src/eap_peer/eap_fast.c > CC ../src/eap_peer/eap_fast_pac.c > CC ../src/eap_common/eap_fast_common.c > CC ../src/eap_peer/eap_pax.c > CC ../src/eap_common/eap_pax_common.c > CC ../src/eap_peer/eap_sake.c > CC ../src/eap_common/eap_sake_common.c > CC ../src/eap_peer/eap_gpsk.c > CC ../src/eap_common/eap_gpsk_common.c > CC ../src/eap_peer/eap_pwd.c > CC ../src/eap_common/eap_pwd_common.c > CC wps_supplicant.c > CC ../src/utils/uuid.c > CC ../src/eap_peer/eap_wsc.c > CC ../src/eap_common/eap_wsc_common.c > CC ../src/wps/wps.c > CC ../src/wps/wps_common.c > CC ../src/wps/wps_attr_parse.c > CC ../src/wps/wps_attr_build.c > CC ../src/wps/wps_attr_process.c > CC ../src/wps/wps_dev_attr.c > CC ../src/wps/wps_enrollee.c > CC ../src/wps/wps_registrar.c > CC ../src/eap_peer/eap_ikev2.c > CC ../src/eap_peer/ikev2.c > CC ../src/eap_common/eap_ikev2_common.c > CC ../src/eap_common/ikev2_common.c > CC ../src/eap_peer/eap_tnc.c > CC ../src/eap_peer/tncc.c > CC wpas_kay.c > CC ../src/pae/ieee802_1x_cp.c > CC ../src/pae/ieee802_1x_kay.c > CC ../src/pae/ieee802_1x_key.c > CC ../src/pae/ieee802_1x_secy_ops.c > CC ../src/ap/wpa_auth_kay.c > CC ../src/eapol_supp/eapol_supp_sm.c > CC ../src/eap_peer/eap.c > CC ../src/eap_peer/eap_methods.c > CC ap.c > CC ../src/ap/hostapd.c > CC ../src/ap/wpa_auth_glue.c > CC ../src/ap/utils.c > CC ../src/ap/authsrv.c > CC ../src/ap/ap_config.c > CC ../src/ap/sta_info.c > CC ../src/ap/tkip_countermeasures.c > CC ../src/ap/ap_mlme.c > CC ../src/ap/ieee802_1x.c > CC ../src/eapol_auth/eapol_auth_sm.c > CC ../src/ap/ieee802_11_auth.c > CC ../src/ap/ieee802_11_shared.c > CC ../src/ap/drv_callbacks.c > CC ../src/ap/ap_drv_ops.c > CC ../src/ap/beacon.c > CC ../src/ap/bss_load.c > CC ../src/ap/eap_user_db.c > CC ../src/ap/neighbor_db.c > CC ../src/ap/rrm.c > CC ../src/ap/ieee802_11_ht.c > CC ../src/ap/ieee802_11_vht.c > CC ../src/ap/ctrl_iface_ap.c > CC ../src/eap_server/eap_server.c > CC ../src/eap_server/eap_server_identity.c > CC ../src/eap_server/eap_server_methods.c > CC ../src/ap/wmm.c > CC ../src/ap/ap_list.c > CC ../src/ap/ieee802_11.c > CC ../src/ap/hw_features.c > CC ../src/ap/dfs.c > CC ../src/ap/wps_hostapd.c > CC ../src/eap_server/eap_server_wsc.c > CC ../src/ap/dpp_hostapd.c > CC ../src/ap/gas_query_ap.c > CC ../src/ap/gas_serv.c > CC ../src/ap/hs20.c > CC ../src/ap/wpa_auth.c > CC ../src/ap/wpa_auth_ie.c > CC ../src/ap/pmksa_cache_auth.c > CC ../src/common/dragonfly.c > CC ../src/crypto/ms_funcs.c > CC ../src/eap_common/chap.c > CC ../src/eap_peer/eap_tls_common.c > ../src/crypto/tls_openssl.c: In function ‘tls_engine_load_dynamic_generic’: > ../src/crypto/tls_openssl.c:799:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 799 | engine = ENGINE_by_id(id); > | ^~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:814:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 814 | engine = ENGINE_by_id(dynamic_id); > | ^~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:825:17: error: ‘ENGINE_ctrl_cmd_string’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 825 | if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == > 0) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:479:5: note: declared here > 479 | int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char > *arg, > | ^~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:829:25: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 829 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:839:9: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 839 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:841:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 841 | engine = ENGINE_by_id(id); > | ^~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:850:17: error: ‘ENGINE_ctrl_cmd_string’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 850 | if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == > 0) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:479:5: note: declared here > 479 | int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char > *arg, > | ^~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:854:25: error: ‘ENGINE_remove’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 854 | ENGINE_remove(engine); > | ^~~~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:332:27: note: declared here > 332 | OSSL_DEPRECATEDIN_3_0 int ENGINE_remove(ENGINE *e); > | ^~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:855:25: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 855 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:860:9: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 860 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_init’: > ../src/crypto/tls_openssl.c:1089:9: error: ‘ENGINE_load_builtin_engines’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 1089 | ENGINE_load_builtin_engines(); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:358:28: note: declared here > 358 | OSSL_DEPRECATEDIN_3_0 void ENGINE_load_builtin_engines(void); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_engine_init’: > ../src/crypto/tls_openssl.c:1213:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1213 | conn->engine = ENGINE_by_id(engine_id); > | ^~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1219:9: error: ‘ENGINE_init’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1219 | if (ENGINE_init(conn->engine) != 1) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:620:27: note: declared here > 620 | OSSL_DEPRECATEDIN_3_0 int ENGINE_init(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1228:9: error: ‘ENGINE_ctrl_cmd_string’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 1228 | if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == > 0) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:479:5: note: declared here > 479 | int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char > *arg, > | ^~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1245:17: error: ‘ENGINE_load_private_key’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 1245 | conn->private_key = ENGINE_load_private_key(conn->engine, > | ^~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:638:11: note: declared here > 638 | EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id, > | ^~~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1268:17: error: ‘ENGINE_ctrl’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1268 | if (!ENGINE_ctrl(conn->engine, > ENGINE_CTRL_GET_CMD_FROM_NAME, > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:429:27: note: declared here > 429 | OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1281:17: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1281 | ENGINE_free(conn->engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_engine_deinit’: > ../src/crypto/tls_openssl.c:1307:17: error: ‘ENGINE_finish’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1307 | ENGINE_finish(conn->engine); > | ^~~~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:628:27: note: declared here > 628 | OSSL_DEPRECATEDIN_3_0 int ENGINE_finish(ENGINE *e); > | ^~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_engine_get_cert’: > ../src/crypto/tls_openssl.c:3605:9: error: ‘ENGINE_ctrl_cmd’ is deprecated: > Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3605 | if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL", > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:450:27: note: declared here > 450 | OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name, > | ^~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_connection_private_key’: > ../src/crypto/tls_openssl.c:3827:17: error: ‘SSL_use_RSAPrivateKey_ASN1’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3827 | if (SSL_use_RSAPrivateKey_ASN1(conn->ssl, > | ^~ > In file included from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/ssl.h:1652:12: note: declared here > 1652 | __owur int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, > | ^~~~~~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_connection_dh’: > ../src/crypto/tls_openssl.c:3966:9: error: ‘PEM_read_bio_DHparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3966 | dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); > | ^~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:469:1: note: declared here > 469 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DHparams, DH) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:3977:17: error: ‘PEM_read_bio_DSAparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3977 | dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); > | ^~~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:455:1: note: declared here > 455 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DSAparams, DSA) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:3987:17: error: ‘DSA_dup_DH’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 3987 | dh = DSA_dup_DH(dsa); > | ^~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:198:27: note: declared here > 198 | OSSL_DEPRECATEDIN_3_0 DH *DSA_dup_DH(const DSA *r); > | ^~~~~~~~~~ > ../src/crypto/tls_openssl.c:3988:17: error: ‘DSA_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 3988 | DSA_free(dsa); > | ^~~~~~~~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:127:28: note: declared here > 127 | OSSL_DEPRECATEDIN_3_0 void DSA_free(DSA *r); > | ^~~~~~~~ > ../src/crypto/tls_openssl.c:4007:17: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4007 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > ../src/crypto/tls_openssl.c:4010:9: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4010 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_global_dh’: > ../src/crypto/tls_openssl.c:4041:9: error: ‘PEM_read_bio_DHparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 4041 | dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); > | ^~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:469:1: note: declared here > 469 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DHparams, DH) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:4052:17: error: ‘PEM_read_bio_DSAparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 4052 | dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); > | ^~~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:455:1: note: declared here > 455 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DSAparams, DSA) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:4062:17: error: ‘DSA_dup_DH’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4062 | dh = DSA_dup_DH(dsa); > | ^~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:198:27: note: declared here > 198 | OSSL_DEPRECATEDIN_3_0 DH *DSA_dup_DH(const DSA *r); > | ^~~~~~~~~~ > ../src/crypto/tls_openssl.c:4063:17: error: ‘DSA_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4063 | DSA_free(dsa); > | ^~~~~~~~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:127:28: note: declared here > 127 | OSSL_DEPRECATEDIN_3_0 void DSA_free(DSA *r); > | ^~~~~~~~ > ../src/crypto/tls_openssl.c:4082:17: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4082 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > ../src/crypto/tls_openssl.c:4085:9: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4085 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > cc1: all warnings being treated as errors > make: *** [../src/build.rules:86: > /root/radiusconfig/wpa_supplicant-2.10/build/wpa_supplicant/src/crypto/tls_openssl.o] > Error 1 > > ======End compilation > output============================================================================================================== > > _______________________________________________ > Hostap mailing list > Hostap(a)lists.infradead.org > http://lists.infradead.org/mailman/listinfo/hostap

2 2

Log some errors to file or database
by Fabricio Viana 15 Jun '23

15 Jun '23

Hello! When running freeradius -X to debug network problems I got three type of messages: Received Accounting-Request Id 2 from x.x.x.x:1813 to y.y.y.y:1813 length 416. Dropping packet without response because of error: Received Accounting-Request packet from client x.x.x.x with invalid Request Authenticator! (Shared secret is incorrect.) Ignoring request to acct address * port 1813 bound to server default from unknown client x.x.x.x port 58428 proto udp Ignoring request to auth address * port 1812 bound to server default from unknown client x.x.x.x port 36350 proto udp I know how to solve these problems. But to catch these errors I need to enter debug mode (freeradius -X). This sometimes takes some time as it requires someone with shell access to the server. Is it possible to log these messages into a file or database without having to enter debug mode? Thanks! Fabricio

2 1

Using libkqueue, how stable it is with freeradius 3.x?
by work vlpl 15 Jun '23

15 Jun '23

Hi, I want to try to use freeradius 3.2.x which is compiled with libkquueue. In my tests, it is working fine. But I also see the list of know issues https://github.com/mheily/libkqueue/blob/master/BUGS.md of libkqueue and just want to double-check if I should not use it. But I hope that since freeradius 4.x by default will use it the library integration is fine and the listed issues are not affecting freeradius 4.x or 3.x. Best regards, Vladimir

2 7

DHCP Radius proxy (IPv4 and IPv6)
by Ľudovít Mikula 09 Jun '23

09 Jun '23

Hi all, I have a relay-agent which does only DHCP and is not capable of talking to RADIUS server (using auth/acct). However the requirement is to be able to use freeradius with it for the additional functionalities and configurability, over both IPv4 and IPv6. The "authentication" should be done only by checking Option82 circuit-id/remote-id against configured user in freeradius. What are the options for configuring it over IPv6? Probably some dhcp to radius proxy able to do message conversion like: DHCP Discover/Solicit -> RADIUS Access-Request RADIUS Access-Accept -> DHCP Offer/Advertise What would be the best approach to handle this use case (unfortunately I cannot change the hardware). Regards -- Ludo Mikula

2 8

EAP-TLS unable to get local issuer certificate
by MH 08 Jun '23

08 Jun '23

Hello, I am trying to setup EAP-TLS and I am getting radius server error "eap_tls: (TLS) OpenSSL says error 20 : unable to get local issuer certificate", "send TLS 1.2 Alert, fatal unknown_ca" Test client is wpa_supplicant 2.1 built on Ubuntu Linux 22.04.2. All tests are done locally on FreeRadius server 3.2.3 (Ubuntu Linux 22.04.2) When I test "client.crt" with "openssl verify ./client.crt" I get "OK". Specifying -CAFile OpenSSL parameter with chained CA cert also produces "OK". All CA certificates (there is also an intermediate certificate) are in /etc/freeradius/certs, /etc/freeradius/certs_eaptls and also /usr/lib/ssl/cert. One certificate per file. FreeRadius's EAP-TLS stanza is cadir = ${certdir}/certs_eaptls private_key_file = ${certdir}/rad.key certificate_file = ${certdir}/rad.crt auto_chain = no Server and client certificates are signed by different commercial CA. All certificates have intermediate CA. eapol_test config file for EAP-TLS is network={ key_mgmt=WPA-EAP eap=TLS identity="blabla(a)domain.tld" ca_cert="/etc/ssl/certs/chain.crt" client_cert="client.crt" private_key="client.key" private_key_passwd="blabla" } AppArmor disabled. Permissions for all certs are r--r--r-- (at least). OpenSSL rehash done. I have no idea what could be wrong.

3 10

TEAP support
by Natarajan M 07 Jun '23

07 Jun '23

> Is EAP-FAST & TEAP are same? I couldn't find a way to configure freeradius > for TEAP, some mentioned EAP-FAST & TEAP may be similar and TEAP is like > EAP-FASTv2, any pointers will help on configuring TEAP on freeradius if it > is supported. > > Thanks > Natarajan >

2 1

rlm_perl module crash on high load, need to restart service
by Imdad Hasan 05 Jun '23

05 Jun '23

Thanks Alen, This is my perl script code which is a socket client for the swoole TCP socket server. use strict; use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use IO::Socket; use locale; use POSIX; use JSON; use Sys::Syslog; # our (%RAD_REQUEST, %RAD_REPLY, %RAD_CHECK, %RAD_STATE); setlocale(LC_ALL, 'C'); use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ my $swoole; my $answer; sub logs { my $err2 = @_[0]; &radiusd::radlog(1, $err2); # uncomment to logs to syslog # syslog('info', $err2); } sub rtrim { my $s = shift; $s =~ s/\s+$//; return $s }; sub socket_init { &logs("Opening connection to swoole\n"); my $swoole = new IO::Socket::INET ( PeerAddr => '127.0.0.1', PeerPort => '26312', Proto => 'tcp' ); # setsockopt($swoole, SOL_SOCKET, SO_KEEPALIVE, 1); &logs("Connect to swoole finish with error: $!\n") unless $swoole; return $swoole; } sub CLONE { &logs('Cloning...'); $swoole=&socket_init; } sub check_connection() { # swoole connection check... if ((not defined $swoole) || (!$swoole->connected())) { &logs("Try to reconnect to swoole\n"); $swoole=&socket_init; } if ((not defined $swoole) || (!$swoole->connected())) { return 0; } else { return 1; } } sub authorize { if (!check_connection()) { return RLM_MODULE_REJECT; } print $swoole "::authorization::\n" .encode_json(\%RAD_REQUEST) . "\n" .encode_json(\%RAD_REPLY) ."\n" .encode_json(\%RAD_CHECK); $answer=<$swoole>; $answer=rtrim($answer); &logs("ans:".$answer); $answer=decode_json($answer); if ($answer->{radreply} ne "") { my $radreply = $answer->{radreply}; %RAD_REPLY=%{$radreply}; } if($answer->{radcheck} ne "") { my $radcheck = $answer->{radcheck}; %RAD_CHECK=%{$radcheck}; } if ($answer->{response} ne "accept") { return RLM_MODULE_REJECT; } return RLM_MODULE_OK; } sub authenticate { if ($RAD_REPLY{'Packet-Type'} eq "Access-Reject") { return RLM_MODULE_REJECT; } else { return RLM_MODULE_OK; } } sub preacct { return RLM_MODULE_OK; } sub accounting { if (!check_connection()) { return RLM_MODULE_OK; } print $swoole "::accounting::\n" . encode_json(\%RAD_REQUEST); $answer=<$swoole>; $answer=rtrim($answer); &logs("Accounting:".$answer); return RLM_MODULE_OK; } sub checksimul { return RLM_MODULE_OK; } sub pre_proxy { return RLM_MODULE_OK; } sub post_proxy { return RLM_MODULE_OK; } sub post_auth { return RLM_MODULE_OK; } Guide me if i made a mistake here.. Thanks Imdad

2 1