July 2023 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

DPSK in 3.2
by Alan DeKok 22 Aug '23

22 Aug '23

I've just pushed patches to make DPSK work in 3.2. The module configuration is available on GitHub: https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-avai… The work isn't quite done yet, but the module works. The one remaining piece is to cache the identity associated with the PSK. As background, some AP vendors permit dynamic PSKs for WiFi access. This uses WPA-PSK, but the PSK is permitted to be different for different users on the same SSID. There are some issues with DPSK. In short, don't use it. It usually requires the server to try all possible PSKs before finding one that works. This process can be ver very slow. i.e. a reasonable modern system can do 100,000 of these PSK tests per second. So if you have 100,000 individual PSKs, then it can only handle one packet per second before the CPU maxes out. If you have 100 PSKs, then you're limited to 1000 packets per second. And that's doing nothing other than PSK checks. So the numbers are likely to be much lower than that in practice. To help with this performance issue, the module can cache PSK entries in memory. The first time it finds an unknown MAC, it has to brute-force the PSK. But once the PSK is found, the module caches the MAC+SSID+PSK. The next time it receives a packet for that MAC+SSID, the module finds the cache entry, and uses it. We've made it as good as possible considering the limitations of DPSK. But we still recommend that people don't use it. The DPSK functionality is simply broken, and there is really no way to make it efficient. Please see the module configuration for more details. Alan DeKok.

2 2

Certificate chain untrusted
by Maciej Kowalka 10 Aug '23

10 Aug '23

Hi, I've got configures freeradius 3.2 with eap tls, and working certificates, users can be authorized to network but I get warnings every time : Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /C=PL/ST=MyState/O=MyOrg/CN=Intermediate CA (TLS) untrusted certificate with depth [0] subject name /C=PL/ST=MyState/O=MyOrg/CN=client Is there solution to this or so I have to ignore it, and live with it? Maciej

5 23

help with changing to use named instance of sql module
by Matt Zagrabelny 31 Jul '23

31 Jul '23

Greetings FR-users, Running freeradius 3.0.21+dfsg-2.2+deb11u1. The default FR configs (obviously!) work wonderfully. Thank you for making a robust system. I am attempting to deviate from those defaults and am hitting a snag. I would like to use multiple databases (within the sql module), thus I am attempting to change: sql { } to sql foo { } After successfully adding "foo", I can then add "bar". >From running -X it appears that I am connecting to "foo" correctly: (0) foo: EXPAND %{User-Name} (0) foo: --> mzagrabe (0) foo: SQL-User-Name set to 'mzagrabe' rlm_sql (foo): Reserved connection (0) (0) foo: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) foo: --> SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = 'mzagrabe' ORDER BY id (0) foo: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = 'mzagrabe' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) foo: User found in radcheck table (0) foo: Conditional check items matched, merging assignment check items (0) foo: Crypt-Password := "REDACTED" (0) foo: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) foo: --> SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = 'mzagrabe' ORDER BY id (0) foo: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = 'mzagrabe' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (foo): Reserved connection (1) rlm_sql (foo): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (foo): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='foo' host='foo-dev.example.com' user='radius_user' password='REDACTED' application_name='FreeRADIUS 3.0.21 - radiusd (foo)' Connected to database 'foo' on 'foo-dev.example.com' server version 130011, protocol version 3, backend PID 1378924 (0) foo: EXPAND SELECT GroupName FROM radius_user_group WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) foo: --> SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority (0) foo: Executing select query: SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 1 (0) foo: User found in the group table (0) foo: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = '%{foo-SQL-Group}' ORDER BY id (0) foo: --> SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = 'network-admin' ORDER BY id (0) foo: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = 'network-admin' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) foo: Group "network-admin": Conditional check items matched (0) foo: Group "network-admin": Merging assignment check items (0) foo: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = '%{foo-SQL-Group}' ORDER BY id (0) foo: --> SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = 'network-admin' ORDER BY id (0) foo: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = 'network-admin' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) foo: Group "network-admin": Merging reply items rlm_sql (foo): Released connection (0) (0) [foo] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) if ("%{client:group}" == 'two-factor-authentication-group') { (0) EXPAND %{client:group} (0) --> network-infrastructure (0) if ("%{client:group}" == 'two-factor-authentication-group') -> FALSE (0) else { (0) update control { (0) Proxy-To-Realm := 'default-authentication-realm' (0) } # update control = noop (0) } # else = noop (0) } # authorize = updated (0) Starting proxy to home server 10.0.0.1 port 1812 (0) server default { (0) } The above -X output is generally the same output as the working default sql configuration output. However, the default working sql configuration does not match the following -X output when I change the configs to use "sql foo {". I am not seeing correct behavior in the post-auth section of sites-enabled/default: [...] (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if ("%{client:group}" == 'network-infrastructure') { (0) EXPAND %{client:group} (0) --> network-infrastructure (0) if ("%{client:group}" == 'network-infrastructure') -> TRUE (0) if ("%{client:group}" == 'network-infrastructure') { (0) if (foo:SQL-Group == 'network-admin') { (0) if (foo:SQL-Group == 'network-admin') -> FALSE (0) else { I am expecting the last FALSE to be TRUE, as in the -X output with the default sql configuration: (0) if (SQL-Group == 'network-admin') { (0) sql_groupcmp (0) EXPAND %{User-Name} (0) --> mzagrabe (0) SQL-User-Name set to 'mzagrabe' rlm_sql (sql): Reserved connection (5) rlm_sql (sql): Reserved connection (6) rlm_sql (sql): Released connection (6) (0) EXPAND SELECT GroupName FROM radius_user_group WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) --> SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority (0) Executing select query: SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 1 (0) sql_groupcmp finished: User is a member of group network-admin rlm_sql (sql): Released connection (5) (0) if (SQL-Group == 'network-admin') -> TRUE Here is what I have added to the top of my post-auth section: post-auth { if ("%{client:group}" == 'network-infrastructure') { if (foo:SQL-Group == 'network-admin') { update reply { APC-Service-Type = Admin # Set user type for Eaton UPS's Service-Type = Administrative-User } } else { reject } } I have also tried changing (in the same post-auth section) the -sql to -foo but it was not successful. Any hints or ideas about where to look next would be very appreciated. Thank you for your time! -m

2 2

Fetch ACL attributes from LDAP groups
by João Miguel Regateiro 31 Jul '23

31 Jul '23

Hello, I have a freeradius connected to openldap and i am testing applying ACL's fetched from LDAP attributes. The attributes are custom from ldap with the syntax as shown in the configuration below. With the following configurations i have managed to fetch the attributes from the user. mods-available/ldap update { control:Password-With-Header += 'userPassword' ... reply:DACL +="acl-entry-001, acl-entry-002 ... acl-entry-255" } dictionary ATTRIBUTE DACL 3000 string sites-available/default foreach &reply:DACL { update reply { cisco-avpair += "%{Foreach-Variable-0}" } Now I am attempting to do the same, but fetching the attributes from the User groups(to avoid writing the same ACL's on different users). I have done some research and tests, but have not managed to fetch any attribute from the groups. For example, I know that the group acl-admins has these attributes. If the user logging in has memberships acl-admins and network-admins. I want to fetch all the attributes "acl-entry-001, acl-entry-002 ... acl-entry-255" from the acl-admins to be able to update the reply with the foreach shown above. Could you provide some guidance in this matter? Best regards, Miguel

1 0

@ \ and " characters in password in freeradius
by Mesut GULNAZ 28 Jul '23

28 Jul '23

isn't it possible to use "@", "\" and " in the password in freeradius? -- İyi çalışmalar... Mesut GÜLNAZ

2 3

Help to increment freeradius wait timeout in
by Kamal Majaiti 28 Jul '23

28 Jul '23

Problem: Good morning, I am trying to perform a 2FA after a correct validation with MSCHAP against active directory, the postauth executes a script that sends an email with a link to confirm and authorize access, when the link is clicked, access is authorized based on data meanwhile the script with a while waits for the access to be confirmed but freeradius doesn't wait and gives me the following error: (0) Executing: /bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}: (0) EXPAND %{User-Name} (0) --> xxx Child PID 17681 is taking too much time: forcing failure and killing child. (0) ERROR: Failed to read from child output Debug output: (0) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (0) mschap: --> --username=xxx (0) mschap: mschap1: 76 (0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (0) mschap: --> --challenge=7698262ed349f8f8 (0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (0) mschap: --> --nt-response=d3ad349cc72bd9f1e9e835f73294102da06097b5f6158d4c (0) mschap: Program returned code (0) and output 'NT_KEY: D0ACA7FDF078A8FEBD326F3E18523349' (0) mschap: adding MS-CHAPv1 MPPE keys (0) [mschap] = ok (0) } # authenticate = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) update control { (0) Session-Timeout := 7200 (0) Executing: /bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}: (0) EXPAND %{User-Name} (0) --> xxx Child PID 17593 is taking too much time: forcing failure and killing child. (0) ERROR: Failed to read from child output (0) } # update control = fail (0) } # post-auth = fail (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> xxx (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop Config section: # Post-Authentication once we KNOW that the user has been authenticated, there are additional steps we can take.and get timeout error. post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY Session-Timeout := 7200 } } update { &reply: += &session-state: } -sql exec update control { Session-Timeout := 7200 Auth-Type := `/bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}` } remove_reply_message_if_eap Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject # Insert EAP-Failure message if the request was # rejected by policy instead of because of an # authentication failure eap # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap } # # Filter access challenges. # Post-Auth-Type Challenge { # remove_reply_message_if_eap # attr_filter.access_challenge.post-auth } Post-Auth-Type Client-Lost { } if (EAP-Key-Name && &reply:EAP-Session-Id) { update reply { &EAP-Key-Name := &reply:EAP-Session-Id } } } Regards, Kamal

2 1

Can't include a Dictionary referenced in radiusd.conf
by Scott Reeve 27 Jul '23

27 Jul '23

Created a new Ubuntu server VM (Ubuntu 22.04.2 LTS) and did 'apt get' for freeradius. All was fine until I tried to pull in a standard dictionary file like I've done many times in the past. It's the Mellanox dictionary file: VENDOR Mellanox 33049 BEGIN-VENDOR Mellanox ATTRIBUTE Local-User-Name 1 string END-VENDOR Mellanox It never complained about lack of braces before, but now I get this: including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnelincluding configuration file /etc/freeradius/3.0/sites-enabled/defaultincluding configuration file /root/mellanoxDictionary/root/mellanoxDictionary[11]: Expecting section start brace '{' after "VENDOR Mellanox"Errors reading or parsing /etc/freeradius/3.0/radiusd.conf Having the same message/error with another dictionary that I also have had no problem with in the past - only recently. (h3cDictionary). I added this line to the bottom of /etc/freeradius/3.0/radiusd.conf: $INCLUDE /root/mellanoxDictionary This has worked fine for years for me, but either the latest Ubuntu and/or the latest FreeRadius somehow do things a bit differently, it seems. Any suggestions?

2 1

Allow update statement to fail
by nabble＠felix.world 26 Jul '23

26 Jul '23

Hi there, is there a way to allow the update statement to fail and just proceed? For example if you want to update a attribute which is "just" for logging pruposes in the authorize section and the update statement failed it returnes 'failed' and stops processing other stuff and resulting in a failed authentication. In the documentation there is the option to rewrite return codes for modules but it seems that the update statement is not really a module or do i missunderstood something here? And i can't find a way in the documentation how to do it. As an example, is there a way to let the following authorize section be processed until the end even if the first update statement is not allowed? I know that it’s not allowed to update the outer request in that context. Just for illustration authorize { update { &outer.request:MyLogAttr := "It would nice to have it in the log but it's ok if not" } eap auth_log } Best regards, lineconnect

1 0