August 2023 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

freeradius windows machine authentication
by Härtl, Calvin 04 Sep '23

04 Sep '23

Hi all, first of all thanks for your great help in my past questions! Sadly, I have yet another one, that I can not quite figure out. Maybe I missed something, I don’t know. I tried looking for past list-threads, to no avail. When my Windows client connects to the WiFi and subsequently to the FreeRADIUS server, it first authenticates via machine authentication (host/HOSTNAME.MYDOMAIN.COM) This fails and the client cannot connect to the WiFi: (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) eap_mschapv2: authenticate { (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: Client is using MS-CHAPv2 (6) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (6) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (6) mschap: --> --username=host/HOSTNAME.DOMAIN.COM (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (6) mschap: --> --challenge=ef98e59da6aea4aa (6) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (6) mschap: --> --nt-response=1e7106295666480efb781446f97f618e57e09017da042590 (6) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)' (6) mschap: External script failed (6) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) (6) mschap: ERROR: MS-CHAP2-Response is incorrect (6) eap_mschapv2: [mschap] = reject (6) eap_mschapv2: } # authenticate = reject However, if I manually configure the WiFi on my Windows device to only use user authentication, it works flawlessly (as expected): (14) eap_mschapv2: authenticate { (14) mschap: Creating challenge hash with username: calvin.haertl (14) mschap: Client is using MS-CHAPv2 (14) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (14) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (14) mschap: --> --username=MYUSERNAME (14) mschap: Creating challenge hash with username: MYUSERNAME (14) mschap: Program returned code (0) (14) mschap: Adding MS-CHAPv2 MPPE keys (14) eap_mschapv2: [mschap] = ok (14) eap_mschapv2: } # authenticate = ok (14) eap_mschapv2: MSCHAP Success (14) eap: Sending EAP Request (code 1) ID 9 length 51 My FreeRADIUS server is connected to our Active Directory via SAMBA and winbind, and I checked that the users can authenticate via radtest. Is FreeRADIUS natively capable of doing machine authentication via AD, do I have to configure some additional files or are there any modules that I can install to do this for me? Kind regards, Calvin

4 5

VLAN Assignment
by Rodrigo Abrantes Antunes 31 Aug '23

31 Aug '23

Hello, is there a guide to configure vlan assignment on freeradius? I searched the documentation and didn't find. Thanks.

5 6

Re: compilation problem deprecated: Since OpenSSL 3.0
by Joost Ringoot 29 Aug '23

29 Aug '23

Thanks for the suggestion. Meanwhile I found the eapoltest is available in debian as separate package, and it appears to function https://packages.debian.org/bookworm/eapoltest I have other questions however: Is there an upgrade or current documentation that handles EAP-TTLS? Can you provide a link? because this is all I can find on your site about it, all the searches and throughclicking seem to lead to this same PDF from 2014 (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) >> chapter 6 -EAP authentication, Pg 46,47) Further I read everywhere on internet that mschap and also mschapv2 is flawed microsoft advises not to use it https://learn.microsoft.com/en-us/windows/security/identity-protection/cred… some security sites show how to walk trough it's defense. https://www.kitploit.com/2021/09/assless-chaps-crack-mschapv2.html https://securityonline.info/assless-chaps-crack-mschapv2-challenge-response… Thanks, Joost ----- Original Message ----- > From: "Alan DeKok" <aland(a)deployingradius.com> > To: "Joost Ringoot" <joost.ringoot(a)meteo.be>, "hostap" <hostap(a)lists.infradead.org> > Sent: Thursday, 15 June, 2023 14:31:19 > Subject: Re: compilation problem deprecated: Since OpenSSL 3.0 > On Jun 15, 2023, at 6:30 AM, Joost Ringoot <joost.ringoot(a)meteo.be> wrote: >> I am trying to compile eampol_test >> >> "make eapol_test" >> >> (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) >> chapter 6 -EAP authentication, Pg 46,47) > > That guide was written long before OpenSSL3 came out. It is very likely that's > it's not relevant here. > > I suggest looking at the hostap source. > > $ git grep -i openssl3 > > That may be instructive. > > Alan DeKok.

2 1

Realm Config
by Carlos Botejara 25 Aug '23

25 Aug '23

I need to configure 2 realms, and validate users depending on the realm from which they connect, I need specific rules for each site (with different sql queries). The users are in a mysql database. I configured the Realms in the proxy.conf file as follows (because I don't have domain) realm1 { nostrip } realm2 { nostrip } The realm is configured in the Mikrotik router of each site. The Realm attribute for Mikrotik is Mikrotik-Realm [image: image.png] Could you help me with this?

2 6

Freeradius Authentification with active directory
by Etienne CREMILLIEUX 23 Aug '23

23 Aug '23

Hello, I try a connection my freeradius with active directory. the command sudo freeradius -X return this : *(1) ldap: --> Authenticated at 2023-08-23 17:16:46rlm_ldap (ldap): Reserved connection (1)(1) ldap: EXPAND (sAMAccountName=%{Stripped-User-Name}%{user-name}})(1) ldap: --> (sAMAccountName=wifirst_test(a)prodges.local})(1) ldap: Performing search in "ou=Utilisateurs,dc=prodges,dc=local" with filter "(sAMAccountName=login_test@**domain* *.local})", scope "sub"(1) ldap: Waiting for search result...(1) ldap: Search returned no resultsrlm_ldap (ldap): Released connection (1)Need more connections to reach 10 sparesrlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots usedrlm_ldap (ldap): Connecting to ldaps://172.19.16.7:636 <http://172.19.16.7:636>* I have a FreeRADIUS Version 3.2.1 on Debian GNU/Linux 12 (bookworm) My conf /etc/freeradius/3.0/mods-enabled/ldap : *ldap { # Note that this needs to match the name(s) in the LDAP server # certificate, if you're using ldaps. See OpenLDAP documentation # for the behavioral semantics of specifying more than one host. # # Depending on the libldap in use, server may be an LDAP URI. # In the case of OpenLDAP this allows additional the following # additional schemes: # - ldaps:// (LDAP over SSL) # - ldapi:// (LDAP over Unix socket) # - ldapc:// (Connectionless LDAP) server = 'ldaps://172.19.16.7 <http://172.19.16.7>'# server = 'ldap.rrdns.example.org <http://ldap.rrdns.example.org>'# server = 'ldap.rrdns.example.org <http://ldap.rrdns.example.org>' # Port to connect on, defaults to 389, will be ignored for LDAP URIs. port = 636 # Administrator account for searching and possibly modifying. # If using SASL + KRB5 these should be commented out. identity = 'login_sync(a)domain.local' password = 'password123' # Unless overridden in another section, the dn from which all # searches will start from. base_dn = 'DC=**domain* *,DC=local'* * user { # Where to start searching in the tree for users base_dn = "ou=Utilisateurs,dc=**domain* *,dc=local" # Filter for user objects, should be specific enough # to identify a single user object. # # For Active Directory, you should use # "samaccountname=" instead of "uid=" # # filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" filter = "(sAMAccountName=%{Stripped-User-Name}%{user-name}})" # filter = "(UserPrincipalName=%{Stripped-User-Name}:%{user-name}})" # For Active Directory nested group, you should comment out the previous 'filter = ...' # and use the below. Where 'group' is the group you are querying for. # # NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP_MATCHING_RULE_IN_CHAIN. # This applies only to DN attributes. This is an extended match operator that walks # the chain of ancestry in objects all the way to the root until it finds a match. # This reveals group nesting. It is available only on domain controllers with # Windows Server 2003 SP2 or Windows Server 2008 (or above). # # See: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-dir… <https://social.technet.microsoft.com/wiki/contents/articles/5392.active-dir…> # # filter = "(&(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf:1.2.840.113556.1.4.1941:=ou=Utilisateurs,dc=* *domain* *,dc=local))" # SASL parameters to use for user binds # # When we're prompted by the SASL library, these control # the responses given. # # Any of the config items below may be an attribute ref # or and expansion, so different SASL mechs, proxy IDs # and realms may be used for different users.* Regards Etienne -- *Ce message et toutes les pièces jointes (ci-après le "message") sont établis à l’intention exclusive des destinataires désignés. Il contient des informations confidentielles et pouvant être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de détruire le message. Toute utilisation de ce message non conforme à sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse de l'émetteur*

1 0

Fwd: AUTO AND MANUAL DISCONNECT NOT WORK FREE RADIUS-DALO RADIUSS
by King Slaver 23 Aug '23

23 Aug '23

---------- Forwarded message --------- From: King Slaver <nandishchauhan.ssstd9(a)gmail.com> Date: Sat, 19 Aug, 2023, 2:01 pm Subject: AUTO AND MANUAL DISCONNECT NOT WORK FREE RADIUS-DALO RADIUSS To: <freeradius-users-owner(a)lists.freeradius.org> Greetings, I have my local CentOS 7 VM, WITH FREE Radius version 3.0.22, and daloradius 1.3 All the things are configured correctly with openvpn, All accounting is working. But when accessperiod reaches, it sends a coa disconnect request, which results in recv- coa And disconnect ACK but the user still connected, if it loggot manualy on next login it gets error of plan reached. However fot me it is also not working manual radius -x disconnect, it does same send and gets received, user still got connected. It's been too long I been doing rnd, help me for it. I am waiting for answer soon. As I hope.

3 2

Regarding LDAP Module
by Vinit Bhosle 23 Aug '23

23 Aug '23

Dear Support, I have installed Freeradius 3.2.2. but I am getting an error while using LDAP module. Following is the error /usr/local/etc/raddb/mods-enabled/ldap[8]: Failed to link to module 'rlm_ldap': /usr/local/lib/rlm_ldap.so: cannot open shared object file: No such file or directory I am using CentOS Linux release 8.4.2105. How to load rlm_ldap ? Regards Vinit

2 1

FreeRadius 3.2.3 not starting due to missing MongoDB driver
by Ibrahim Al Mahfooz 22 Aug '23

22 Aug '23

Hello All, We are unable to start FreeRadius with MongoDB sql driver enabled on sql module, it is stating: Could not link driver rlm_sql_mongo: /usr/lib64/freeradius/rlm_sql_mongo.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld /etc/raddb/mods-enabled/sql[27]: Instantiation failed for module "sql" We installed Freeradius v3.2.3 using the official repo of Rocky Linux 8 below: http://packages.networkradius.com/freeradius-3.2/rocky/ # dnf install freeradius Appreciate your help of what could be missing from the installation steps to make it work Best regards

2 5

freeradius and postgres - why needs to restart freeradius every nas table change?
by Jarosław Kłopotek 22 Aug '23

22 Aug '23

Hi guys, 1. I added "disabled" boolean type column to nas table. 2. I added "disabled IS NOT TRUE" as WHERE condition in /etc/freeradius/3.0/mods-config/sql/main/postgresql/queries.conf I run SQL query: UPDATE nas SET disabled = true WHERE id = 2000; I expect: "no login anymore" I get: "I can login" After restarting freeradius - I get what I want. Is is normal? -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

2 2

DPSK in 3.2
by Alan DeKok 22 Aug '23

22 Aug '23

I've just pushed patches to make DPSK work in 3.2. The module configuration is available on GitHub: https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-avai… The work isn't quite done yet, but the module works. The one remaining piece is to cache the identity associated with the PSK. As background, some AP vendors permit dynamic PSKs for WiFi access. This uses WPA-PSK, but the PSK is permitted to be different for different users on the same SSID. There are some issues with DPSK. In short, don't use it. It usually requires the server to try all possible PSKs before finding one that works. This process can be ver very slow. i.e. a reasonable modern system can do 100,000 of these PSK tests per second. So if you have 100,000 individual PSKs, then it can only handle one packet per second before the CPU maxes out. If you have 100 PSKs, then you're limited to 1000 packets per second. And that's doing nothing other than PSK checks. So the numbers are likely to be much lower than that in practice. To help with this performance issue, the module can cache PSK entries in memory. The first time it finds an unknown MAC, it has to brute-force the PSK. But once the PSK is found, the module caches the MAC+SSID+PSK. The next time it receives a packet for that MAC+SSID, the module finds the cache entry, and uses it. We've made it as good as possible considering the limitations of DPSK. But we still recommend that people don't use it. The DPSK functionality is simply broken, and there is really no way to make it efficient. Please see the module configuration for more details. Alan DeKok.

2 2

Accounting Start Time in Interim-Update of queries.conf is written differently between MySQL and Postgresql
by Ibrahim Al Mahfooz 18 Aug '23

18 Aug '23

Hello, I'm working on migrating from MySQL to Postgresql and during the process of customization of accounting section inside queries.conf file of Postgresql, I found a discrepancy in the accounting start time of the Interim-Update section made me wondering if there is any reason why not written in the same logic as MySQL queries.conf file, here is what I'm referring to: FR Version: 3.2.3 File paths: 1. Postgresql: /etc/raddb/mods-config/sql/main/postgresql/queries.conf 2. MySQL/etc/raddb/mods-config/sql/main/mysql/queries.conf The differences are in the accounting start time inside the interim-update section: - In mysql it is written as: FROM_UNIXTIME(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \ - While in postgresql it is: ${....event_timestamp}, \ I found that the line in postgresql queries actually causing the start to be inaccurate since it will reflect current time while it should reflect the elapsed time (current time - accounting session time) Having this, I had to change the line to this and it seems to be working: TO_TIMESTAMP(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \ Any reason why it is not written with the same logic of MySQL queries file? Will the change I made impose any risks or issues down the road? Thanks.

2 1

New and better documentation is now online
by Alan DeKok 18 Aug '23

18 Aug '23

We have put new documentation online at https://freeradius.org/documentation/freeradius-server/3.2.4/ The files are automatically generated from the "doc" directory in the source tree. We are using Antora (https://antora.org/) as the underlying layout tool. The result is not only improved documentation, but also documentation which is easier to navigate. Even better, for v4 (coming soon, really!) we have worked hard at documenting just about everything which can be documented. All of the features of "unlang" are documented, with syntax and examples. Almost every configuration file is available in the same documentation tree, with cross-links to modules, unlang, etc. I hope that this effort makes the server easier to use and configure. Alan DeKok.

6 6

How "bind as user" mode works?
by Rodrigo Abrantes Antunes 17 Aug '23

17 Aug '23

Hi, I was following this thread https://lists.freeradius.org/pipermail/freeradius-users/2020-May/098077.html There, is said this: "Check the help in the ldap module. There are update control Auth type lines inside that set the Auth type to ldap and will Auth with bind instead of reading the password from ldap". I have followed this guide and it works with radtest but not with wifi. https://www.nasirhafeez.com/freeradius-with-ldaps-on-azure-ad-domain-servic… Do I need to have access to the user password in active directory to allow wifi authentication with freeradius? I don't have this access and I thought the "bind as user" mode would solve this (bind with the logging in user, just like ldapsearch) but I think it is not what I thought. How can achieve that? Am I restricted to mschap?

3 13

raddebug
by Gerald Vogt 16 Aug '23

16 Aug '23

Hi! For whatever reason "raddebug" doesn't work on our new radius servers. On the old ones I could simply run "raddebug" or "raddebug -t 0" to capture the current debug logs. On the new one it shows nothing. It simply runs without any output. Running freeradius-3.2.3-1.el9.x86_64 on AlmaLinux 9. All the prerequisites mentioned in the raddebug(8) are met: * radmin is in the path. * I start raddebug as root thus permissions shouldn't matter. * control socket is configured in mode rw and is accessible. * It creates a file like "/var/log/radius/radmin.debug.101128" which remains empty as well. * I don't run multiple raddebug processes. So I don't understand why it's not working... Regards, Gerald

2 4

Initial simple test fails. Ver 3.0.20 from Ubuntu
by Pavel Aronsky 16 Aug '23

16 Aug '23

Dear experts, I'm very sorry for a lame help request but really don't know what else to do. I want to try the simplest setup for some small (embedded) client. So decided to begin with MD5 and username-password. Installed freeradius in Win11 WSL environment, Ubuntu 20.04.6 LTS, via apt install as usual. It brings version 3.0.20. As advised in "getting started" docum, made no changes anywhere besides adding a user and a client. In /etc/freeradius/3/0/users: at beginning: (which is symlnk to mods-config/files/authorize) JIG46 Cleartext-Password := "secret" In /etc/freeradius/3/0/clients.conf: after the existing localhost: client myswitch { ipaddr = 10.183.0.110 secret = testing123 require_message_authenticator = no proto = * nas_type = other } Then started the server on localohst and port 1645 (because the default port appears to be busy): sudo freeradius -X -xx -p 1645 -i localhost Then run : radtest -x -t eap-md5 JIG46 secret localhost:1645 0 testing123 Output: Loading input data... including dictionary file /usr/share/freeradius/dictionaryReading input vps from stdin Read 1 element(s) from input: stdin Loaded: 1 input element(s). Adding new socket: src: 0.0.0.0:0, dst: 127.0.0.1:1645 Added new socket: 5 (num sockets: 1) Transaction: 0, sending packet: 0 (id: 151)... Sent Access-Request Id 151 from 0.0.0.0:59783 to 127.0.0.1:1645 length 69 User-Name = "JIG46" Cleartext-Password = "secret" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 EAP-Code = Response EAP-Type-Identity = 0x4a49473436 EAP-Message = 0x024d000a014a49473436 Timeout for transaction: 0, tries (so far): 1 (max: 3)Transaction: 0, sending packet: 1 (id: 151)... ............ two more tries...... Timeout for transaction: 0, tries (so far): 3 (max: 3)No response for transaction: 0, giving upDeallocating (sockfd: 5, id: 151) Main loop: done. The server refuses to start EAP handshake - I don't see any errors due to unknown usernames or wrong passwords? Exactly the same outcome with a real client (a managed switch, with the client id myswitch, defined above). *** The complete log is here. https://gist.github.com/pavel-a/7b0c0c230ad28627218eade7fb0d1c61 Please advise? Is this because of WSL or something wrong in the configuration?? *** Windows firewall is OFF. - ddbug

2 5

freeradius exec module only works in debug mode (freeradius -X)
by Härtl, Calvin 14 Aug '23

14 Aug '23

Hi all, first of all, thank you for all the time and effort you have put into the Freeradius project! Sadly, I have run into a small issue, that I cannot figure out why it happens: In my sites-enabled/default file, I have written a small „Info Mail“ script, which basically just sends out an email with the rejected MAC address of a client: #First I check if the device MAC address is in my database, if not, send out a mail and reject the Access-Request if("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0){ %{exec:/usr/bin/sh -c "echo Unknown device '%{Calling-Station-ID}' at '%{Called-Station-ID}'. This device received a timeout of 5 minutes! | mailx -a 'From:radius001@stud.hs-coburg.de' -s '*** Security-Message ***' Calvin.haertl(a)stud.hs-coburg.de;echo NAC was activated!"} reject } In the debug mode (freeradius -X) everything works out great, and the mail gets sent out: rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) rlm_sql (sql): Reserved connection (2) rlm_sql (sql): Released connection (2) rlm_sql (sql): Reserved connection (3) (0) Executing select query: SELECT COUNT(*) FROM hw WHERE macad1 = '54:99:63:c0:11:4a' OR macad2 = '54:99:63:c0:11:4a' OR macad3 = '54:99:63:c0:11:4a' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (3) (0) EXPAND %{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'} (0) --> 0 (0) if ("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0) -> TRUE (0) if ("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0) { (0) Executing: /usr/bin/sh -c " echo Unknown device '%{Calling-Station-ID}' at '%{Called-Station-ID}'. This device received a timeout of 5 minutes! | mailx -a 'From:radius001@stud.hs-coburg.de' -s '***Security-Message***' Calvin.haertl(a)stud.hs-coburg.de;echo NAC was activated!“: (0) Program returned code (0) and output 'NAC was activated!' (0) EXPAND %{exec:/usr/bin/sh -c "echo Unknown device '%{Calling-Station-ID}' at '%{Called-Station-ID}'. This device received a timeout of 5 minutes! | mailx -a 'From:radius001@stud.hs-coburg.de' -s '*** Security-Message ***' Calvin.haertl(a)stud.hs-coburg.de;echo NAC was activated!"} (0) --> NAC was activated! (0) [reject] = reject (0) } # if ("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0) = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> asd (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap: Request was previously rejected, inserting EAP-Failure (0) eap: Sending EAP Failure (code 4) ID 1 length 4 (0) [eap] = updated (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 92 from 10.11.1.17:1812 to 10.11.17.249:60492 length 44 (0) EAP-Message = 0x04010004 (0) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. However, as soon as I exit the debug mode and run freeradius as a daemon (systemctl start freeradius), freeradius still works as expected, but the mail no longer gets sent out. Everything else works just fine (users can hop onto the WiFi, etc.). Am I missing something here? Any help is appreciated! Best regards, Calvin

3 3

Issue with dynamic home servers in 3.2.3
by James Wood 10 Aug '23

10 Aug '23

I am trying to add OpenRoaming support via dynamic DNS lookups to FreeRADIUS 3.2.3 As per the doc at freeradius-server-3.2.3/doc/configuration/dynamic_home_servers.md it states you need to do the following: 1. Enable the control socket 2. Enable dynamic = true and set the directory = ${raddb}/home_servers/ in proxy.conf 3. Ensure the /mods-config/realm/freeradius-naptr-to-home-server.sh is present in order to perform real-time DNS lookups unknown realms. So far so good. The doc gives an example of what to use inside the authorize {} block. Here is my config (added the "aaa+auth:radius.tls.tcp" to the script's third parameter... if (User-Name =~ /(a)(.*)$/) { switch "%{home_server_dynamic:%{1}}" { case "1" { # Proxy to this one particular home server update control { &Home-Server-Name := "%{1}" } } case "0" { # Proxy with home server pool, failover, etc. update control { &Proxy-To-Realm := "%{1}" } } case { # no home server exists, ask DNS update control { # you can add a parameter for the NAPTR tag to look up, e.g. "aaa+auth:radius.tls.tcp" (RFC7585, OpenRoaming) # if the third parameter is omitted, it defaults to "x-eduroam:radius.tls" &Temp-Home-Server-String := `%{config:confdir}/mods-config/realm/freeradius-naptr-to-home-server.sh -d %{config:confdir} %{1} aaa+auth:radius.tls.tcp` } if ("%{control:Temp-Home-Server-String}" == "" ) { update control { &Home-Server-Name := "%{1}" } } else { reject } } } } When testing this, I can see that it is performing the DNS lookup and adding a dynamic home server to the home_servers folder, but it still fails and doesn't actually proxy the request to the dynamically discovered server: (0) if (User-Name =~ /(a)(.*)$/) { (0) if (User-Name =~ /(a)(.*)$/) -> TRUE (0) if (User-Name =~ /(a)(.*)$/) { (0) switch %{home_server_dynamic:%{1}} { (0) EXPAND %{home_server_dynamic:%{1}} (0) --> (0) case { (0) update control { (0) Executing: %{config:confdir}/mods-config/realm/freeradius-naptr-to-home-server.sh -d %{config:confdir} %{1} aaa+auth:radius.tls.tcp: (0) EXPAND confdir (0) --> confdir (0) EXPAND %{config:confdir}/mods-config/realm/freeradius-naptr-to-home-server.sh (0) --> /usr/local/etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh (0) EXPAND confdir (0) --> confdir (0) EXPAND %{config:confdir} (0) --> /usr/local/etc/raddb (0) EXPAND %{1} (0) --> openroaming.goog Waking up in 0.3 seconds. ... new connection request on command socket Listening on command file /usr/local/var/run/radiusd/radiusd.sock Waking up in 0.2 seconds. radmin> add home_server file /usr/local/etc/raddb/home_servers/openroaming.goog including configuration file /usr/local/etc/raddb/home_servers/openroaming.goog including configuration file /usr/local/etc/raddb/home_servers/tls.conf home_server openroaming.goog { nonblock = no ipaddr = radsec.openroaming.goog IPv4 address [146.148.44.172] port = 2083 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } Waking up in 0.1 seconds. ... shutting down socket command file /usr/local/var/run/radiusd/radiusd.sock ... cleaning up socket command file /usr/local/var/run/radiusd/radiusd.sock Waking up in 0.1 seconds. (0) Program returned code (0) and output '' (0) &Temp-Home-Server-String := (0) } # update control = noop (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) if ("%{control:Temp-Home-Server-String}" == "" ) -> TRUE (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) [reject] = reject (0) } # if ("%{control:Temp-Home-Server-String}" == "" ) = reject (0) } # case = reject (0) } # switch %{home_server_dynamic:%{1}} = reject (0) } # if (User-Name =~ /(a)(.*)$/) = reject It seems if ("%{control:Temp-Home-Server-String}" == "" ) { is the offending line. Even though the naptr script succeeds and returns a code 0, it's marking it as failed. So, i reversed the if statement so I could at least test further: if ("%{control:Temp-Home-Server-String}" == "" ) { update control { &Home-Server-Name := "%{1}" } } else { reject } I now get the following: (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) if ("%{control:Temp-Home-Server-String}" == "" ) -> TRUE (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) update control { (0) EXPAND %{1} (0) --> openroaming.goog (0) &Home-Server-Name := openroaming.goog (0) } # update control = noop (0) } # if ("%{control:Temp-Home-Server-String}" == "" ) = noop (0) ... skipping else: Preceding "if" was taken (0) } # case = noop (0) } # switch %{home_server_dynamic:%{1}} = noop (0) } # if (User-Name =~ /(a)(.*)$/) = noop (0) Proxying due to Home-Server-Name (0) There was no response configured: rejecting request Any thoughts on this? P.S. I think there is a bug in the freeradius-naptr-to-home-server.sh script, because it doesn't add the lines "secret" and "type" when it dynamically generates the home_server block. I had to modify it to add these lines in, else the radmin command failed to dynamically load it. Thanks

2 3

radtest No "known good" password
by thenderson＠system.de 10 Aug '23

10 Aug '23

Have done much Googling/Binging, cant find a similar situation. Debian 11. Installed with apt-get install freeradius freeradius-mysql freeradius-utils. Added to /etc/freeradius/mods-config/files/authorize: testing Cleartext-Password := password During that process I had to create the folder /etc/freeradius/mods-config/files, it was not already present. Naturally due to this, the authorize file is empty other than the one line I added. Then I: radtest testing password 127.0.0.1 0 testing123 Outputs are: On Terminal A: Sent Access-Request Id 29 from 0.0.0.0:53848 to 127.0.0.1:1812 length 77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "password" Received Access-Reject Id 29 from 127.0.0.1:1812 to 127.0.0.1:53848 length 20 (0) -: Expected Access-Accept got Access-Reject Debug from Terminal B: (8) Received Access-Request Id 29 from 127.0.0.1:53848 to 127.0.0.1:1812 length 77 (8) User-Name = "testing" (8) User-Password = "password" (8) NAS-IP-Address = 127.0.1.1 (8) NAS-Port = 0 (8) Message-Authenticator = 0xbf1bb85fcdf0c1a4fbc4c65ff5c466b0 (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "testing", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: No EAP-Message, not doing EAP (8) [eap] = noop (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = ok (8) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> testing (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 29 from 127.0.0.1:1812 to 127.0.0.1:53848 length 20 Waking up in 3.9 seconds. (8) Cleaning up request packet ID 29 with timestamp +2957 Random thought: is the MySQL package making FreeRadius expect a different configuration method? I thought it was required to install but Im not using any MySQL as far as I know, Im doing a very basic setup, authorizing some Cisco vIOS routers/switches. Im probably missing something fairly obvious. Please help? -- Tristan Henderson Network Support Engineer <mailto:thenderson@system.de> thenderson(a)system.de system.de System & Project GmbH Knesebeckstr. 96, 10623 Berlin <http://www.system.de/> www.system.de T +49 30 2902315 350 F +49 30 2902315 440 Amtsgericht Berlin-Charlottenburg: HRB 53740 Geschäftsführer: Peter Schulte, Wilhelm Boeddinghaus Think before you print!

4 7

Certificate chain untrusted
by Maciej Kowalka 10 Aug '23

10 Aug '23

Hi, I've got configures freeradius 3.2 with eap tls, and working certificates, users can be authorized to network but I get warnings every time : Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /C=PL/ST=MyState/O=MyOrg/CN=Intermediate CA (TLS) untrusted certificate with depth [0] subject name /C=PL/ST=MyState/O=MyOrg/CN=client Is there solution to this or so I have to ignore it, and live with it? Maciej

5 23

crl cache refresh
by Peter Lee 08 Aug '23

08 Aug '23

Hi, A couple of questions regarding the crl cache auto refresh settings with fr release 3.2.2 check_crl = yes ca_path = ${cadir} ca_path_reload_interval = 86400 1. Does the reloading interval timer reset each time freeradius restart? 2. Is there a way to set an initial crl start time so that reloading at each interval can happen at expected time regardless when freeradius starts/restart? To make sure the crl update and fr reloading are in-sync. 3. Can ca_path_reload_interval interval be dynamically updated without restarting freeradius? Thanks.

2 1

Fwd: RADSEC / TLS errors but not sure why
by James Wood 08 Aug '23

08 Aug '23

Hi All, I'm currently testing out RADSEC/TLS on the latest version, 3.2.3, with openssl 3.0 on Ubuntu 22.04. The key, certificate and CA are correct and have been validated to match before using in the Freeradius config. When I start the daemon there are no errors indicating the key/cert don't match so I assume all is well. However, when a client connects over RADSEC/TLS (port 2083), Freeradius displays an SSL error. I've also tried the openssl s_client command and the same error is thrown. openssl s_client -showcerts -connect radius.hostname:2083 The key/cert is secp384r1 based. mods-enabled/eap: --------------------------- tls-config tls-common { private_key_password = whatever private_key_file = ${certdir}/my_key.key certificate_file = ${certdir}/my_key.crt ca_file = ${certdir}/my_key.ca dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "secp384r1" } --------------------------- sites-enabled/tls: --------------------------- listen { ipaddr = * port = 2083 type = auth+acct proto = tcp virtual_server = default clients = radsec limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } tls { private_key_password = whatever private_key_file = ${certdir}/my_key.key certificate_file = ${certdir}/my_key.key ca_file = ${certdir}/my_key.key dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no require_client_cert = no } } clients radsec { client all { ipaddr = 0.0.0.0/0 proto = tls secret = radsec } } home_server tls { ipaddr = 127.0.0.1 port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { private_key_password = whatever private_key_file = ${certdir}/purple.key certificate_file = ${certdir}/purple.crt ca_file = ${certdir}/purple.ca dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" } } home_server_pool tls { type = fail-over home_server = tls } realm tls { auth_pool = tls } --------------------------- radius debug: [snip] Listening on auth+acct proto tcp address * port 2083 (TLS) bound to server default Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 40253 Ready to process requests ... new connection request on TCP socket Listening on auth+acct from client (1.2.3.4, 38639) -> (*, 2083, virtual-server=default) Waking up in 0.9 seconds. (0) (TLS) Initiating new session (0) (TLS) Handshake state - before/accept initialization (0) (TLS) Handshake state - Server before/accept initialization (0) (TLS) recv TLS 1.2 Handshake, ClientHello (0) (TLS) send TLS 1.2 Alert, fatal handshake_failure (0) ERROR: (TLS) Alert write:fatal:handshake failure (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 38639 If I query a public radsec radius server on port 2083 using the openssl s_client command it returns the certificate list correctly etc. Is it a problem with my key/cert, openssl, or the client? Thanks

3 17

Restricting access for some devices to some groups
by Jarosław Kłopotek 07 Aug '23

07 Aug '23

Hi, I would like to restrict access to some devices (using ipaddresses). How do You assign group privileges with freeradius? (I tried to find some docs but without good results) I try: In SQL database: 1. I added table "nasgrouprestrictions" (id, nasname, groupname), Example DB results: (1, 10.100.0.1, superadm) (2, 10.100.0.1, users) (3, 10.100.0.2, superadm) (4, 10.100.0.3, users) 2. I created group "superadm" and assigned users in table radusergroup, login1, login2 are in "users" group login3 is in "superadm" and "users" group How to allow: login3 to login into all 10.100.0.{1,2,3} hosts and login1, login2 to login into only 10.100.0.{1,3} hosts ? But where to put SQL query? -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

3 4

Freeradius+AD - Login with EmployeeID
by Rodrigo Abrantes Antunes 07 Aug '23

07 Aug '23

Hello, I have a freeradius server authenticating users with active directory, the users login with the samaccountname. This is the ldap filter: (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}}) Now I need to enable the users to login with the employeeID. This is the ldap filter I tried: (employeeID=%{mschap_default:User-Name:-%{User-Name}})" The filter works in ldapsearch but not in freeradius. # Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group authorize { Mon Aug 7 10:23:44 2023 : Debug: [ad_all] performing user authorization for 1638828 Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: (employeeID=%{mschap_default:User-Name:-%{User-Name}}) -> (employeeID=1638828) Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: DC=xx,DC=xx,DC=xx,DC=xx -> DC=xx,DC=xx,DC=xx,DC=xx Mon Aug 7 10:23:44 2023 : Debug: ++[ad_all] = fail Mon Aug 7 10:23:44 2023 : Debug: +} # group authorize = fail Mon Aug 7 10:23:44 2023 : Debug: Using Post-Auth-Type REJECT Mon Aug 7 10:23:44 2023 : Debug: # Executing group from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group REJECT { Mon Aug 7 10:23:44 2023 : Debug: [attr_filter.access_reject] expand: %{User-Name} -> 1638828 Mon Aug 7 10:23:44 2023 : Debug: ++[attr_filter.access_reject] = updated Mon Aug 7 10:23:44 2023 : Debug: +} # group REJECT = updated Why freeradius can't filter with the employeeID attribute? Thanks.

2 5

Linelog and get rid of No Failure Reason
by TS 03 Aug '23

03 Aug '23

Hello, I am trying to consolidate logs and have only one log file with all needed data in it. This setup with Freeradius 3.2.3 with OpenLDAP 2.5.15. We are using EAP + MSCHAPv2, LDAP contains an attribute with NT Password. I am trying to get rid of "No Failure Reason" value of "reply:Reply-Message" variable in cases where: 1. user not found in LDAP 2. user's password is incorrect 3. user has Phase1 (EAP/TLS/...) or Phase2 (MSCHAPv2/GTC/...) misconfigured. I have pretty default configuration with small changes. I know I should modify Reply-Message but in which file and within which section(s)? Snippet from my custom linelog: reference = "inner_auth_log.%{%{reply:Packet-Type}:-format}" inner_auth_log { Access-Accept = "%d.%m.%Y@%H:%G|RESULT=OK |USER=%{User-Name}|WIFI_AP_IP=%{NAS-IP-Address}|CLIENT_MAC_ADDR=%{%{Calling-Station-Id}:-Unknown Caller Id}" Access-Reject = "%d.%m.%Y@%H:%G|RESULT=ERR|USER=%{User-Name}|WIFI_AP_IP=%{NAS-IP-Address}|CLIENT_MAC_ADDR=%{%{Calling-Station-Id}:-Unknown Caller Id}|MSG=%{%{reply:Reply-Message}:-No Failure Reason}" }

2 1

Samba radius authentication
by Jarosław Kłopotek 02 Aug '23

02 Aug '23

Hi, Is it possible to login in into samba share by using freeradius and get propper group assignment? I try switch as much authorize mechanizm as I could to freeradius. Tried to find native mechanizm in samba documentation but no info there :( -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

2 5

status-server
by Anatoliy 02 Aug '23

02 Aug '23

Hi team , when I am try to query status server for specific client I receive global stats and stats for specific client Is this expected behavior for FR , or it should return only stats for client ? For example # echo "Message-Authenticator = 0x00,FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-Number = 3" | radclient -x localhost:18121 status adminsecret Sent Status-Server Id 112 from 0.0.0.0:d5a0 to 127.0.0.1:18121 length 62 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = 35 FreeRADIUS-Stats-Client-Number = 3 Received Access-Accept Id 112 from 127.0.0.1:46c9 to 127.0.0.1:54688 length 476 FreeRADIUS-Total-Access-Requests = 430666 <<<<<<<<<< global stats for FR FreeRADIUS-Total-Access-Accepts = 679 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 679 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Auth-Conflicts = 0 FreeRADIUS-Total-Accounting-Requests = 1518800 FreeRADIUS-Total-Accounting-Responses = 1518800 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Acct-Conflicts = 0 FreeRADIUS-Stats-Client-Number = 3 FreeRADIUS-Stats-Client-IP-Address = 100.64.0.2 <<<<<<<< after this line , stats for this client. FreeRADIUS-Total-Access-Requests = 0 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 2404 FreeRADIUS-Total-Accounting-Responses = 2404 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0

2 2

Freeradius 2FA
by Jarosław Kłopotek 02 Aug '23

02 Aug '23

Hi guys, go a question - Is it possible to use freeradius with some 2FA somehow? Most perfect scenario would be: - try to log in on remote hosts, - remote server communicates with freeradius, - radius gives a question to some phone 2FA app, - then we get click "ALLOW" on the mobile 2FA app, - tadam we are logged in, -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

3 7