January 2024 - Freeradius-Users - lists.freeradius.org

redis-ippool and multiple pools
by Miguel Berniz 29 Jan '24

29 Jan '24

Hi, I am having issues understanding how to pass &control.IP-Pool.Name to the module as I need to use different pools for dynamic assignment and fixed assignment for both fixed ip addresses and fixed subnets. If I just use a string with pool name in the module it works, but that way I understand I am limited to use a single pool. Relevant config sections are as follows: -default site recv Access-Request { update control { &Password.cleartext := %redis(hget, radcheck:%{User-Name}, Cleartext-Password) &IP-Pool.name := %redis(hget, radcheck:%{User-Name}, IP-Pool) } -redis_ippool redis_ippool { # # pool_name:: Name of the pool from which leases are allocated. # pool_name = &control.IP-Pool.Name -Example of redis monitor 1706399030.648328 [0 127.0.0.1:50284] "hget" "radcheck:test3" "Cleartext-Password" 1706399030.648554 [0 127.0.0.1:50284] "hget" "radcheck:test3" "IP-Pool" -Radius log (8) Packet-Type = Access-Request (8) Running 'recv Access-Request' from file /usr/local/etc/raddb/sites-enabled/default (8) recv Access-Request { (8) update control { (8) | redis (8) | %{User-Name} (8) | --> test3 (8) REDIS command arguments (8) Reserved connection (0) (8) [1] >>> Sending command(s) to 127.0.0.1:6379 (8) Executing command: hget (8) With arguments (8) [1] radcheck:test3 (8) [2] Cleartext-Password (8) [1] <<< Returned: success (8) Released connection (0) (8) | %redis({hget}{radcheck:, test3}{Cleartext-Password}) (8) | --> test (8) | redis (8) | %{User-Name} (8) | --> test3 (8) REDIS command arguments (8) Reserved connection (0) (8) [1] >>> Sending command(s) to 127.0.0.1:6379 (8) Executing command: hget (8) With arguments (8) [1] radcheck:test3 (8) [2] IP-Pool (8) [1] <<< Returned: success (8) Released connection (0) (8) | %redis({hget}{radcheck:, test3}{IP-Pool}) (8) | --> Dyn_Internet (8) &Password.cleartext := "test" (8) &IP-Pool.name := "Dyn_Internet" (8) } # update control (noop) (8) policy filter_username { (8) if (&State) { (8) | &State (8) | %exists() (8) | --> false (8) ... (8) } (8) elsif (&User-Name) { (8) | &User-Name (8) | %exists() (8) | --> true (8) if (&User-Name =~ / /) { (8) | =~ (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) ... (8) } (8) if (&User-Name =~ /@[^@]*@/ ) { (8) | =~ (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) ... (8) } (8) if (&User-Name =~ /\.\./ ) { (8) | =~ (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) ... (8) } (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)[^.]+(\.[^.]+)+$/)<mailto:/@[%5e.]+(\.%5b%5e.%5d+)+$/)>) { (8) | && (8) | =~ (8) | %logical_and() (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) | %logical_and(...) (8) ... (8) } (8) if (&User-Name =~ /\.$/) { (8) | =~ (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) ... (8) } (8) if (&User-Name =~ /(a)\./<mailto:/@\./>) { (8) | =~ (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) ... (8) } (8) &session-state.Session-State-User-Name := test3 (8) } # elsif (&User-Name) (noop) (8) } # policy filter_username (noop) (8) chap (noop) (8) digest (noop) (8) pap - Setting &control.Auth-Type = pap (8) pap (updated) (8) } # recv Access-Request (updated) (8) Running 'authenticate pap' from file /usr/local/etc/raddb/sites-enabled/default (8) authenticate pap { (8) pap - Login attempt with password (8) pap - Using "known good" cleartext password Cleartext (8) pap - Comparing with "known-good" Cleartext (4) (8) pap - User authenticated successfully (8) pap (ok) (8) } # authenticate pap (ok) (8) Running 'send Access-Accept' from file /usr/local/etc/raddb/sites-enabled/default (8) send Access-Accept { (8) &reply += { (8) &Session-State-User-Name = test3 (8) } (8) ERROR: Failed to evaluate required module option pool_name = &control.IP-Pool.Name What I am missing? Thanks in advance. This message is intended only for the use of the individual to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure. If the reader of this message is not the intended recipient or an employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender and deleting the original document.

2 5

How to write log only once in Post-Auth-Type REJECT section of EAP module?
by 남혁준 29 Jan '24

29 Jan '24

hello. I'm using the EAP module. Additionally, the REST module is used in the inner-server. If you want to refuse authentication in this situation, the REST module responds with 401 and Module-Failure-Message. This Module-Failure-Message is then correctly delivered to the Post-Auth-Type REJECT section within "Inner-server". Because I had declared rest in this section, the post-auth API was being called correctly and writing logs. However, one additional requirement arose. Logs should also be written when the certificate is incorrect. I added rest to the Post-Auth-Type REJECT section in the default (with external EAP) file. When the certificate was incorrect, the Post-Auth-Type REJECT section of the external EAP was reached, and this was also logged correctly. However, the problem now arises in situations where "Internal EAP" is called. In "Internal EAP", the Post-Auth-Type REJECT REST module log occurs once and Post-Auth-Type REJECT REST module log occurs once in "External EAP". Now, the log has occurred a total of 2 times. “Internal EAP” is the message I sent, but “outer EAP” is the message generated by the EAP-PEAP module. message : "eap_peap: The users session was previously rejected: returning reject (again.)" Logs do not necessarily have to be written from "internal EAP". So I wanted to forward messages originating from the "inner EAP" to the "outer EAP" module and then use them in the Post-Auth-Type REJECT REST module. However, I could not find a way, and only the message generated by the EAP-PEAP module was always delivered as Module-Failure-Message. How do I accomplish what I want?

2 2

dynamic lookup of list entries
by James Potter 29 Jan '24

29 Jan '24

Hi all, Here is the situation I'm trying to get working with FreeRadius, but having tried a load of variations around this I'm still stuck. I have a list of sites with specific VLANs I'd like users to end up on: sites { 1 { vlan = 234 } 2 { vlan = 245 } } I then have some clients, each with a site assigned: client cli1 { ipaddr = 1.2.3.4 secret = asdfasdf site = 1 } I'd now like to assign the VLAN from sites, something like: post-auth { update reply { Tunnel-Private-Group-ID = ${sites[${client.site}].vlan} } } But I've not a found a way of looking up an entry in a map dynamically ${sites.1.vlan} works (gives 234) ${client.site} works (gives 1) But ${sites.${client.site}.vlan} (or variations) doesn't work for me Do you have a way of doing this? (Or a different approach? I've also tried embedding sites in clients by setting client{sites = ${sites.1} } - no banana either). I'm trying to avoid death by switch statement here, one org I work with has 120 sites Any help would be greatly appreciated Thanks, Jim Potter UK

3 5

Unifi AP with FreeRADIUS - INVALID AUTHENTICATOR
by Aneesh Raghavan 28 Jan '24

28 Jan '24

Hello, I am trying to set up FreeRADIUS with my unifi ap. The freeradius server is saying Access-Accept, but clients cannot connect and the ap is saying `No RADIUS RX handler found (type=0 code=2 id=21) [INVALID AUTHENTICATOR] - dropping packet`. A PSK wireless network on the same ap/network works fine. Here is my FreeRADIUS debug log output, which includes the config and the messages when it tries to connect: https://0x0.st/HDih.txt aneesh-mba is the client that I am testing with. Additionally, here is the debug log of the Unifi AP when it tries to connect: https://0x0.st/HDiC.txt Any help would be appreciated.

1 1

Freeradius service does not start
by Dumitru 26 Jan '24

26 Jan '24

Hello, I wanted to start Freeradius server for configuring access with client devices. After installing the Freeradius server the Freeradius service is active but sometimes after the new installation or after executing the systemctl status freeradius command the service is not active. The current output is: ● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; enabled; vendor preset: enabled) Active: activating (auto-restart) (Result: exit-code) since Tue 2024-01-23 07:54:55 CET; 2s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 24003 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=226/NAMESPACE) CPU: 15ms Before the new installation I uninstalled Freeradius with apt purge freeradius and apt autoremove. status=226/NAMESPACE - usually appears sometimes after new Freeradius server installation. Freeradius server sometimes starts after new installation, sometimes not. If the Freeradius service starts, after a while it stops and after running systemctl status freeradius on exit, the message : status=1/FAILURE instead of status=226/NAMESPACE compared to the output above. OS: "Raspbian GNU/Linux 11 (bullseye) Below I place the debug output : radiusd -X 2>&1 | tee debugfileFreeRADIUS Version 3.0.21Copyright (C) 1999-2019 The FreeRADIUS server project and contributorsThere is NO warranty; not even for MERCHANTABILITY or FITNESS FOR APARTICULAR PURPOSEYou may redistribute copies of FreeRADIUS under the terms of theGNU General Public LicenseFor more information about these matters, see the file named COPYRIGHTStarting - reading configuration files ...including dictionary file /usr/share/freeradius/dictionaryincluding dictionary file /usr/share/freeradius/dictionary.dhcpincluding dictionary file /usr/share/freeradius/dictionary.vqpincluding dictionary file /etc/freeradius/3.0/dictionaryincluding configuration file /etc/freeradius/3.0/radiusd.confincluding configuration file /etc/freeradius/3.0/proxy.confincluding configuration file /etc/freeradius/3.0/clients.confincluding files in directory /etc/freeradius/3.0/mods-enabled/including configuration file /etc/freeradius/3.0/mods-enabled/expirationincluding configuration file /etc/freeradius/3.0/mods-enabled/alwaysincluding configuration file /etc/freeradius/3.0/mods-enabled/detail.logincluding configuration file /etc/freeradius/3.0/mods-enabled/passwdincluding configuration file /etc/freeradius/3.0/mods-enabled/papincluding configuration file /etc/freeradius/3.0/mods-enabled/ntlm_authincluding configuration file /etc/freeradius/3.0/mods-enabled/echoincluding configuration file /etc/freeradius/3.0/mods-enabled/radutmpincluding configuration file /etc/freeradius/3.0/mods-enabled/digestincluding configuration file /etc/freeradius/3.0/mods-enabled/utf8including configuration file /etc/freeradius/3.0/mods-enabled/sradutmpincluding configuration file /etc/freeradius/3.0/mods-enabled/sohincluding configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clientsincluding configuration file /etc/freeradius/3.0/mods-enabled/cache_eapincluding configuration file /etc/freeradius/3.0/mods-enabled/attr_filterincluding configuration file /etc/freeradius/3.0/mods-enabled/eapincluding configuration file /etc/freeradius/3.0/mods-enabled/mschapincluding configuration file /etc/freeradius/3.0/mods-enabled/replicateincluding configuration file /etc/freeradius/3.0/mods-enabled/logintimeincluding configuration file /etc/freeradius/3.0/mods-enabled/realmincluding configuration file /etc/freeradius/3.0/mods-enabled/execincluding configuration file /etc/freeradius/3.0/mods-enabled/filesincluding configuration file /etc/freeradius/3.0/mods-enabled/unpackincluding configuration file /etc/freeradius/3.0/mods-enabled/linelogincluding configuration file /etc/freeradius/3.0/mods-enabled/unixincluding configuration file /etc/freeradius/3.0/mods-enabled/detailincluding configuration file /etc/freeradius/3.0/mods-enabled/chapincluding configuration file /etc/freeradius/3.0/mods-enabled/exprincluding configuration file /etc/freeradius/3.0/mods-enabled/preprocessincluding files in directory /etc/freeradius/3.0/policy.d/including configuration file /etc/freeradius/3.0/policy.d/abfab-trincluding configuration file /etc/freeradius/3.0/policy.d/cuiincluding configuration file /etc/freeradius/3.0/policy.d/operator-nameincluding configuration file /etc/freeradius/3.0/policy.d/filterincluding configuration file /etc/freeradius/3.0/policy.d/dhcpincluding configuration file /etc/freeradius/3.0/policy.d/accountingincluding configuration file /etc/freeradius/3.0/policy.d/debugincluding configuration file /etc/freeradius/3.0/policy.d/eapincluding configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-idsincluding configuration file /etc/freeradius/3.0/policy.d/controlincluding configuration file /etc/freeradius/3.0/policy.d/canonicalizationincluding configuration file /etc/freeradius/3.0/policy.d/rfc7542including files in directory /etc/freeradius/3.0/sites-enabled/including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnelincluding configuration file /etc/freeradius/3.0/sites-enabled/defaultmain { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius"}main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes }}radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { }radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 10.17.30.250 { ipv4addr = 10.17.30.250 require_message_authenticator = no secret = <<< secret >>> shortname = "rdses1013-2" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } }Debugger not attachedsystemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digestradiusd: #### Instantiating modules #### modules { # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" }Creating attribute Unix-Group # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } instantiate { } # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.logrlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwdrlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eaprlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" disable_tlsv1 = yes disable_tlsv1_1 = yes tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } }Please use tls_min_version and tls_max_version instead of disable_tlsv1Please use tls_min_version and tls_max_version instead of disable_tlsv1_2 # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no }tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no }tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschaprlm_mschap (mschap): using internal authentication # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/filesreading pairlist file /etc/freeradius/3.0/mods-config/files/authorizereading pairlist file /etc/freeradius/3.0/mods-config/files/accountingreading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocessreading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroupsreading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints } # modulesradiusd: #### Loading Virtual Servers ####server { # from file /etc/freeradius/3.0/radiusd.conf} # serverserver inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...}Ignoring "sql" (see raddb/mods-available/README.rst)Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336} # server inner-tunnelserver default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...}} # server defaultradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnelListening on auth address * port 1812 bound to server defaultListening on acct address * port 1813 bound to server defaultListening on proxy address * port 39219Ready to process requests Best Regards.

2 4

Startup Fails with "No such file or directory" for sql queries.conf
by Timothy Weaver 25 Jan '24

25 Jan '24

Hi, I am attempting to use the FreeRADIUS Docker container, but when I try to include the mysql configuration the server fails to start with the following errors: .... including configuration file /etc/freeradius/mods-enabled/sql including configuration file /etc/freeradius/mods-config/sql/main/mysql/queries.conf} Unable to open file "/etc/freeradius/mods-config/sql/main/mysql/queries.conf}": No such file or directory Errors reading or parsing /etc/freeradius/radiusd.conf -------------------------- Here's what I've confirmed: 1. I am using a totally vanilla configuration from the Docker quick start instructions with no changes except to enable MySQL as the datastore. 2. The queries.conf file is present and permissions are correct. 3. Confirmed the database sql has been created with the schema under mods-config/sql/main/mysql/schema.sql 4. Confirmed the MySQL database is accessible with configuration parameters in the mod-available/sql file. Used mysql client to confirm with radius user and grants to all tables in the radius database. 5. In the mods-enabled/sql (linked to mods-available/sql)I have changed: * driver = "rlm_sql_null" to driver = "rlm_sql_mysql" * commented out the TLS section under mysql * confirmed the connection parameters for server, port, login, and password (see #4 above) * confirmed radius_db is set to the correct database name (I used "radius"). * uncommented read_clients = yes * ensured client_table = "nas" is uncommented * confirmed Dockerfile ------------- FROM freeradius/freeradius-server:latest COPY raddb/ /etc/freeradius/ Build ------- docker build -t freeradius -f Dockerfile . docker-compose.yml ---------------------------- version: "3" services: freeradius: image: freeradius:latest container_name: freeradius hostname: freeradius restart: always environment: - TZ="America/Los_Angeles" volumes: - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro

2 1

IPV6-Address accounting
by Hefin James [ahj] (Staff) 25 Jan '24

25 Jan '24

Hello, Quick question. We're currently using linelog to forward accounting information to our firewall for ip<->username matching, which has been working well for years. We've now got a test deployment of IPv6, and I need to do the same ipv6<->username matching. I've got it working, but only to 1 IPv6 address, when there could be many (as shown with the file based accounting log). Is there a way to run through the array of IPv6 addresses and getting a syslog line per IPv6 address? Thu Jan 25 09:41:48 2024 Framed-IP-Address = XXX.XXX.21.202 Framed-IPv6-Address = X:X:X:X:484d:9d72:e002:f00f Framed-IPv6-Address = X:X:X:X:b036:8ae5:2b04:1e52 Framed-IPv6-Address = fe80::30da:576d:c62d:2870 User-Name = "YYYY" Any pointers greatly appreciated. Thanks, Hefin

3 2

Is it possible to specify a message in the 403 response in Rest Module?
by 남혁준 25 Jan '24

25 Jan '24

First of all, I would like to inform you that the problem is not that I cannot be authenticated or that I cannot set it up. I mainly use the Rest module. So, I tried to use 401 and 403 separately as response types. In the case of a 401 response, it says "Use the body" and the message I responded to is parsed correctly. For 403 responses, the body is "not used." It says. Perhaps for that reason, no matter what response I send, it doesn't have much meaning. However, I confirmed that "Module-Failure-Message" in the 403 response contained the message "rest: Server returned:". It looks like it could be connected by conveying an additional message. If possible, I want the message to be delivered together and appended to the end, even if it responds with a 403 rejection. ex) rest: Server returned: Sorry, Server Reject" Is this possible behavior?

6 26

Mac-Auth or 802.1x
by Alpers, Andreas 24 Jan '24

24 Jan '24

Hello, My experience with Freeradius is still in the beginning. My requirements in the first step are not very high. I want to configure Freeradius so that users can be authenticated via 802.1x or via MAC-Auth. I followed these instructions exactly: https://wiki.freeradius.org/guide/mac-auth#mac-auth-or-802-1x Unfortunately, it does not work. I have created a username and password and also entered a Mac address in the file. But neither the user nor the Mac address work. I always get a reject, although it should work according to the instructions. I get the following answer when I run radtest: radtest andreas andreas123 127.0.0.1 1812 testing123 Sent Access-Request Id 123 from 0.0.0.0:51323 to 127.0.0.1:1812 length 77 User-Name = "andreas" User-Password = "andreas123" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "andreas123" Received Access-Reject Id 123 from 127.0.0.1:1812 to 127.0.0.1:51323 length 20 (0) -: Expected Access-Accept got Access-Reject Here are the individual files. I am very grateful for any help. /etc/freeradius/3.0/mods-available/files: files { moddir = ${modconfdir}/${.:instance} filename = ${moddir}/authorize acctusersfile = ${moddir}/accounting preproxy_usersfile = ${moddir}/pre-proxy } files authorized_macs { key = "%{Calling-Station-ID}" usersfile = ${confdir}/authorized_macs } # The instructions also say here # compat = no # but if I leave this in, I get an error message and the server no longer starts. Why does this happen? /etc/freeradius/3.0/authorized_macs 00-11-22-33-44-55 Reply-Message = "Device with MAC Address %{Calling-Station-Id} authorized for network access" /etc/freeradius/3.0/sites-available/default server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { preprocess # If cleaning up the Calling-Station-Id... rewrite_calling_station_id # If this is NOT 802.1x, assume mac-auth. We check this by testing # for the presence of the EAP-Message attribute in the request. if (!EAP-Message) { # Now check against the authorized_macs file authorized_macs if (!ok) { reject } else { # accept update control { Auth-Type := Accept } } } else { # Normal FreeRADIUS virtual server config goes here e.g. eap } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap digest eap } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } Thank you all for your help. Regards Andy

2 3

Freeradius configuration cannot be stored on a mapped Docker volume
by Timothy Weaver 23 Jan '24

23 Jan '24

When attempting to include a volume mapping to anything under either the /etc/raddb or /etc/freeradius container folders, the container crashes on startup. Despite the original ticket being closed as a Docker issue, the behavior does not occur with non Freeradius containers. For example, if the docker-compose.yml file includes: volumes: - ./freeradius:/etc/freeradius or volumes: - ./raddb:/etc/raddb This will not allow the container to start. Only a mapping to a specific file will work, but is sub-optimal because then you cannot persist anything in the mods-enabled folder. While the documentation explicitly handles this persistence with the `COPY raddb/ /etc/raddb/` line, it seems this is a workaround to supporting a very standard way of handling it in the docker-compose.yml.

4 5