August 2023 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

freeradius windows machine authentication
by Härtl, Calvin 04 Sep '23

04 Sep '23

Hi all, first of all thanks for your great help in my past questions! Sadly, I have yet another one, that I can not quite figure out. Maybe I missed something, I don’t know. I tried looking for past list-threads, to no avail. When my Windows client connects to the WiFi and subsequently to the FreeRADIUS server, it first authenticates via machine authentication (host/HOSTNAME.MYDOMAIN.COM) This fails and the client cannot connect to the WiFi: (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) eap_mschapv2: authenticate { (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: Client is using MS-CHAPv2 (6) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (6) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (6) mschap: --> --username=host/HOSTNAME.DOMAIN.COM (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (6) mschap: --> --challenge=ef98e59da6aea4aa (6) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (6) mschap: --> --nt-response=1e7106295666480efb781446f97f618e57e09017da042590 (6) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)' (6) mschap: External script failed (6) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) (6) mschap: ERROR: MS-CHAP2-Response is incorrect (6) eap_mschapv2: [mschap] = reject (6) eap_mschapv2: } # authenticate = reject However, if I manually configure the WiFi on my Windows device to only use user authentication, it works flawlessly (as expected): (14) eap_mschapv2: authenticate { (14) mschap: Creating challenge hash with username: calvin.haertl (14) mschap: Client is using MS-CHAPv2 (14) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (14) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (14) mschap: --> --username=MYUSERNAME (14) mschap: Creating challenge hash with username: MYUSERNAME (14) mschap: Program returned code (0) (14) mschap: Adding MS-CHAPv2 MPPE keys (14) eap_mschapv2: [mschap] = ok (14) eap_mschapv2: } # authenticate = ok (14) eap_mschapv2: MSCHAP Success (14) eap: Sending EAP Request (code 1) ID 9 length 51 My FreeRADIUS server is connected to our Active Directory via SAMBA and winbind, and I checked that the users can authenticate via radtest. Is FreeRADIUS natively capable of doing machine authentication via AD, do I have to configure some additional files or are there any modules that I can install to do this for me? Kind regards, Calvin

4 5

VLAN Assignment
by Rodrigo Abrantes Antunes 31 Aug '23

31 Aug '23

Hello, is there a guide to configure vlan assignment on freeradius? I searched the documentation and didn't find. Thanks.

5 6

Re: compilation problem deprecated: Since OpenSSL 3.0
by Joost Ringoot 29 Aug '23

29 Aug '23

Thanks for the suggestion. Meanwhile I found the eapoltest is available in debian as separate package, and it appears to function https://packages.debian.org/bookworm/eapoltest I have other questions however: Is there an upgrade or current documentation that handles EAP-TTLS? Can you provide a link? because this is all I can find on your site about it, all the searches and throughclicking seem to lead to this same PDF from 2014 (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) >> chapter 6 -EAP authentication, Pg 46,47) Further I read everywhere on internet that mschap and also mschapv2 is flawed microsoft advises not to use it https://learn.microsoft.com/en-us/windows/security/identity-protection/cred… some security sites show how to walk trough it's defense. https://www.kitploit.com/2021/09/assless-chaps-crack-mschapv2.html https://securityonline.info/assless-chaps-crack-mschapv2-challenge-response… Thanks, Joost ----- Original Message ----- > From: "Alan DeKok" <aland(a)deployingradius.com> > To: "Joost Ringoot" <joost.ringoot(a)meteo.be>, "hostap" <hostap(a)lists.infradead.org> > Sent: Thursday, 15 June, 2023 14:31:19 > Subject: Re: compilation problem deprecated: Since OpenSSL 3.0 > On Jun 15, 2023, at 6:30 AM, Joost Ringoot <joost.ringoot(a)meteo.be> wrote: >> I am trying to compile eampol_test >> >> "make eapol_test" >> >> (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) >> chapter 6 -EAP authentication, Pg 46,47) > > That guide was written long before OpenSSL3 came out. It is very likely that's > it's not relevant here. > > I suggest looking at the hostap source. > > $ git grep -i openssl3 > > That may be instructive. > > Alan DeKok.

2 1

Realm Config
by Carlos Botejara 25 Aug '23

25 Aug '23

I need to configure 2 realms, and validate users depending on the realm from which they connect, I need specific rules for each site (with different sql queries). The users are in a mysql database. I configured the Realms in the proxy.conf file as follows (because I don't have domain) realm1 { nostrip } realm2 { nostrip } The realm is configured in the Mikrotik router of each site. The Realm attribute for Mikrotik is Mikrotik-Realm [image: image.png] Could you help me with this?

2 6

Freeradius Authentification with active directory
by Etienne CREMILLIEUX 23 Aug '23

23 Aug '23

Hello, I try a connection my freeradius with active directory. the command sudo freeradius -X return this : *(1) ldap: --> Authenticated at 2023-08-23 17:16:46rlm_ldap (ldap): Reserved connection (1)(1) ldap: EXPAND (sAMAccountName=%{Stripped-User-Name}%{user-name}})(1) ldap: --> (sAMAccountName=wifirst_test(a)prodges.local})(1) ldap: Performing search in "ou=Utilisateurs,dc=prodges,dc=local" with filter "(sAMAccountName=login_test@**domain* *.local})", scope "sub"(1) ldap: Waiting for search result...(1) ldap: Search returned no resultsrlm_ldap (ldap): Released connection (1)Need more connections to reach 10 sparesrlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots usedrlm_ldap (ldap): Connecting to ldaps://172.19.16.7:636 <http://172.19.16.7:636>* I have a FreeRADIUS Version 3.2.1 on Debian GNU/Linux 12 (bookworm) My conf /etc/freeradius/3.0/mods-enabled/ldap : *ldap { # Note that this needs to match the name(s) in the LDAP server # certificate, if you're using ldaps. See OpenLDAP documentation # for the behavioral semantics of specifying more than one host. # # Depending on the libldap in use, server may be an LDAP URI. # In the case of OpenLDAP this allows additional the following # additional schemes: # - ldaps:// (LDAP over SSL) # - ldapi:// (LDAP over Unix socket) # - ldapc:// (Connectionless LDAP) server = 'ldaps://172.19.16.7 <http://172.19.16.7>'# server = 'ldap.rrdns.example.org <http://ldap.rrdns.example.org>'# server = 'ldap.rrdns.example.org <http://ldap.rrdns.example.org>' # Port to connect on, defaults to 389, will be ignored for LDAP URIs. port = 636 # Administrator account for searching and possibly modifying. # If using SASL + KRB5 these should be commented out. identity = 'login_sync(a)domain.local' password = 'password123' # Unless overridden in another section, the dn from which all # searches will start from. base_dn = 'DC=**domain* *,DC=local'* * user { # Where to start searching in the tree for users base_dn = "ou=Utilisateurs,dc=**domain* *,dc=local" # Filter for user objects, should be specific enough # to identify a single user object. # # For Active Directory, you should use # "samaccountname=" instead of "uid=" # # filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" filter = "(sAMAccountName=%{Stripped-User-Name}%{user-name}})" # filter = "(UserPrincipalName=%{Stripped-User-Name}:%{user-name}})" # For Active Directory nested group, you should comment out the previous 'filter = ...' # and use the below. Where 'group' is the group you are querying for. # # NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP_MATCHING_RULE_IN_CHAIN. # This applies only to DN attributes. This is an extended match operator that walks # the chain of ancestry in objects all the way to the root until it finds a match. # This reveals group nesting. It is available only on domain controllers with # Windows Server 2003 SP2 or Windows Server 2008 (or above). # # See: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-dir… <https://social.technet.microsoft.com/wiki/contents/articles/5392.active-dir…> # # filter = "(&(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf:1.2.840.113556.1.4.1941:=ou=Utilisateurs,dc=* *domain* *,dc=local))" # SASL parameters to use for user binds # # When we're prompted by the SASL library, these control # the responses given. # # Any of the config items below may be an attribute ref # or and expansion, so different SASL mechs, proxy IDs # and realms may be used for different users.* Regards Etienne -- *Ce message et toutes les pièces jointes (ci-après le "message") sont établis à l’intention exclusive des destinataires désignés. Il contient des informations confidentielles et pouvant être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de détruire le message. Toute utilisation de ce message non conforme à sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse de l'émetteur*

1 0

Fwd: AUTO AND MANUAL DISCONNECT NOT WORK FREE RADIUS-DALO RADIUSS
by King Slaver 23 Aug '23

23 Aug '23

---------- Forwarded message --------- From: King Slaver <nandishchauhan.ssstd9(a)gmail.com> Date: Sat, 19 Aug, 2023, 2:01 pm Subject: AUTO AND MANUAL DISCONNECT NOT WORK FREE RADIUS-DALO RADIUSS To: <freeradius-users-owner(a)lists.freeradius.org> Greetings, I have my local CentOS 7 VM, WITH FREE Radius version 3.0.22, and daloradius 1.3 All the things are configured correctly with openvpn, All accounting is working. But when accessperiod reaches, it sends a coa disconnect request, which results in recv- coa And disconnect ACK but the user still connected, if it loggot manualy on next login it gets error of plan reached. However fot me it is also not working manual radius -x disconnect, it does same send and gets received, user still got connected. It's been too long I been doing rnd, help me for it. I am waiting for answer soon. As I hope.

3 2

Regarding LDAP Module
by Vinit Bhosle 23 Aug '23

23 Aug '23

Dear Support, I have installed Freeradius 3.2.2. but I am getting an error while using LDAP module. Following is the error /usr/local/etc/raddb/mods-enabled/ldap[8]: Failed to link to module 'rlm_ldap': /usr/local/lib/rlm_ldap.so: cannot open shared object file: No such file or directory I am using CentOS Linux release 8.4.2105. How to load rlm_ldap ? Regards Vinit

2 1