February 2025 - Freeradius-Users - lists.freeradius.org

Python module for Accounting
by Erdal Emlik 13 Feb '25

13 Feb '25

Hi List, I’m trying to send accounting logs to Kafka using the FreeRADIUS Python module (example.py). I’ve implemented a callback and exception handling, but when I manually stop the Kafka service, I can’t catch any errors—neither in the callback nor in the exception block. def delivery_report(err,msg): if err is not None: logstash_logger.add_info_log(f"Failed Message, Key : {msg.key()} Value : {msg.value()} Err : {err}") def accounting(p): try: record = create_record(p) logstash_logger.add_info_log("accounting started 1") if len(record.User_Name) == 0: raise Exception("User-Name can not be found in request!") key_for_record = create_key_for_record(record) logstash_logger.add_info_log("accounting started 2") kafka_producer.produce(kafka_topic, key=key_for_record, value=json.dumps(record.__dict__),callback=delivery_report) kafka_producer.poll(0) logstash_logger.add_info_log("accounting started 3") except KafkaException as e: logstash_logger.add_info_log(f"accounting started 4 {err}") logstash_logger.add_info_log("accounting started 5") return radiusd.RLM_MODULE_OK I can see logs 1-2-3-5, but my goal is to detect when a message fails to send and store it for later retries. However, I’m not sure if I’m on the right path. If needed, I can provide more details, debug output, and code snippets. Looking forward to your guidance. Best regards,

2 3

MikroTik VPN + HotSpot
by Adnan RIHAN 12 Feb '25

12 Feb '25

New to Radius in general, I’m currently using it to connect our users on L2TP on MikroTik (RouterOS 7.16.2), with Freeradius (3.0.21) using Samba AD (4.17.12-Debian) as the backend. It works great, users and computers are members of the AD, so it’s using mschapv2 and ntlm_auth. Now, I would like to setup a hotspot on mikrotik to authenticate the users to the same Samba AD, the thing is, Mikrotik only supports CHAP and PAP. As far as I understand, Samba AD only supports mschapv2 so it seems I’m stuck with PAP as the common mechanism. Am I right ? If so, as I’m still using the default site, is there a guide to use ntlm_auth with PAP as a fallback mechanism if mschap and eventually chap (keeping it just in case I can use it for something else later) fail? Or do you guys have a better idea for my needs please? -- Cordialement, Adnan RIHAN GPG: D433-5C63 (https://keybase.io/max13/key.asc) ⇒ Si vous n’utilisez pas GPG/PGP mais voulez m’envoyer un e-mail chiffré: https://encrypt.to/0xD4335C63.

2 6

Crafting a CHAP auth request
by Alan Batie 11 Feb '25

11 Feb '25

I'm trying to use radclient to test chap authentication, however it looks like the chap-password attribute is getting encrypted or something and not passed as specified. How should one do this? I'm trying to get a test working with freeradius 1.1.7 that I can use to validate a freeradius 3.2.5 installation... https://freeradius-users.freeradius.narkive.com/OdBT8CjP/ms-chap-authentica… tshark -V for a real, accepted, request: Radius Protocol Code: Access-Request (1) Packet identifier: 0x7c (124) Length: 175 Authenticator: D9FC93F9B090BAD032E0F15793F31AE6 Attribute Value Pairs AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=6 t=Framed-Protocol(7): PPP(1) Framed-Protocol: PPP (1) AVP: l=6 t=NAS-Port(5): 15832385 NAS-Port: 15832385 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=7 t=User-Name(1): CPEV2 User-Name: CPEV2 AVP: l=19 t=Calling-Station-Id(31): <macaddr> Calling-Station-Id: <macaddr> AVP: l=10 t=Called-Station-Id(30): service1 Called-Station-Id: service1 AVP: l=15 t=NAS-Port-Id(87): bridge2-10.11 NAS-Port-Id: bridge2-10.11 AVP: l=10 t=Acct-Session-Id(44): 81e19440 Acct-Session-Id: 81e19440 AVP: l=18 t=CHAP-Challenge(60): 16C474F4671ABE2E03E2F199B170E22A CHAP-Challenge: 16C474F4671ABE2E03E2F199B170E22A AVP: l=19 t=CHAP-Password(3): 015223EA79AAE8B427798EC0FA5EC35FA9 CHAP-Password: 015223EA79AAE8B427798EC0FA5EC35FA9 AVP: l=9 t=NAS-Identifier(32): knox-gw NAS-Identifier: knox-gw AVP: l=6 t=NAS-IP-Address(4): 207.55.2.20 NAS-IP-Address: 207.55.2.20 (207.55.2.20) AVP: l=18 t=Message-Authenticator(80): 4605A791CA930685357F73A2B89D6197 Message-Authenticator: 4605A791CA930685357F73A2B89D6197 From that, I craft up this input to radclient: Service-Type = Framed-User Framed-Protocol = PPP NAS-Port-Type = Ethernet NAS-Port = 15832385 User-Name = CPEv2 Calling-Station-Id = <macaddr> Called-Station-Id = service1 NAS-Port-Id = bridge2-10.11 Acct-Session-Id = 81e19440 CHAP-Challenge = 0x16C474F4671ABE2E03E2F199B170E22A CHAP-Password = 0x015223EA79AAE8B427798EC0FA5EC35FA9 NAS-Identifier = knox-gw NAS-IP-Address = 207.55.2.20 Message-Authenticator = 0x4605A791CA930685357F73A2B89D6197 However, what gets sent is: Radius Protocol Code: Access-Request (1) Packet identifier: 0xfd (253) Length: 175 Authenticator: 68FC978374D1E2D4B190667E651488E5 Attribute Value Pairs AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=6 t=Framed-Protocol(7): PPP(1) Framed-Protocol: PPP (1) AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=6 t=NAS-Port(5): 15832385 NAS-Port: 15832385 AVP: l=7 t=User-Name(1): CPEv2 User-Name: CPEv2 AVP: l=19 t=Calling-Station-Id(31): <macaddr> Calling-Station-Id: <macaddr> AVP: l=10 t=Called-Station-Id(30): service1 Called-Station-Id: service1 AVP: l=15 t=NAS-Port-Id(87): bridge2-10.11 NAS-Port-Id: bridge2-10.11 AVP: l=10 t=Acct-Session-Id(44): 81e19440 Acct-Session-Id: 81e19440 AVP: l=18 t=CHAP-Challenge(60): 16C474F4671ABE2E03E2F199B170E22A CHAP-Challenge: 16C474F4671ABE2E03E2F199B170E22A AVP: l=19 t=CHAP-Password(3): FDB41FBAC26B503DBA63E94B8C667E928A CHAP-Password: FDB41FBAC26B503DBA63E94B8C667E928A AVP: l=9 t=NAS-Identifier(32): knox-gw NAS-Identifier: knox-gw AVP: l=6 t=NAS-IP-Address(4): 207.55.2.20 NAS-IP-Address: 207.55.2.20 (207.55.2.20) AVP: l=18 t=Message-Authenticator(80): D07850811C046CAD43B07082152D0050 Message-Authenticator: D07850811C046CAD43B07082152D0050

2 2

Help in understanding variable expansion
by Luca Cavana 11 Feb '25

11 Feb '25

Hello, this environment is used to perform (also) EAP-TLS, which is working fine. The supplicants in this environment are a mixture of Linux and Windows that all send the User-Name attribute in the form used by Windows, which is: host/UPPERCASE_HOSTNAME.lowercase.fqdn. To be able to match the certificate's Subject to the User-Name attribute I am using the following piece of unlang (in post-auth) which matches the full fqdn and compares it with the certificate subject with a case insensitive regular expression. cavanasystems_verify_tls_client_common_name { if (&User-Name =~ /^host\/([A-Z0-9]{13}.corp\.cavanasystems\.com)/) { update request { &Sanitized-Host-Name := "%{1}" } } if ((&User-Name !~ /^@/) && &TLS-Client-Cert-Common-Name && (&TLS-Client-Cert-Common-Name !~ /%{&Sanitized-Host-Name}/i)) { reject } } This works but I have to instruct the Linux supplicants to send their User-Name as Windows does, which I do not like. If I change my regular expression match using variable substitution while defaulting another variable, like this: /%{%{&Sanitized-Host-Name}:-%{&User-Name}}/i ... which I expect to firstly match the Sanitized-Host-Name (which will exist only if a Windows supplicant is trying to authenticate) and if that does not exist, match with the User-Name (which is sent "good" by a Linux client). The problem is that this is what actually happens: the following debug is from a Linux client mimicking the Windows behavior. (8) if ((&User-Name !~ /^@/) && &TLS-Client-Cert-Common-Name && (&TLS-Client-Cert-Common-Name !~ /%{%{&Sanitized-Host-Name}:-%{&User-Name}}/i)) { (8) EXPAND %{%{&Sanitized-Host-Name}:-%{&User-Name}} (8) --> ITMIL01CD0002\\.corp\\.cavanasystems\\.com (8) if ((&User-Name !~ /^@/) && &TLS-Client-Cert-Common-Name && (&TLS-Client-Cert-Common-Name !~ /%{%{&Sanitized-Host-Name}:-%{&User-Name}}/i)) -> TRUE (8) if ((&User-Name !~ /^@/) && &TLS-Client-Cert-Common-Name && (&TLS-Client-Cert-Common-Name !~ /%{%{&Sanitized-Host-Name}:-%{&User-Name}}/i)) { (8) [reject] = reject (8) } # if ((&User-Name !~ /^@/) && &TLS-Client-Cert-Common-Name && (&TLS-Client-Cert-Common-Name !~ /%{%{&Sanitized-Host-Name}:-%{&User-Name}}/i)) = reject (8) } # policy cavanasystems_verify_tls_client_common_name = reject I've enabled some debug and this is the state the AVPs are in: (8) Attributes matching "request:" (8) &request:User-Name = host/ITMIL01CD0002.corp.cavanasystems.com (8) &request:Sanitized-Host-Name := ITMIL01CD0002.corp.cavanasystems.com I don't understand why it looks like the server is escaping the dots "\\." while doing the EXPAND operation. Thank you very much, Luca Cavana

2 3

FreeRADIUS Not Storing Cache Data in Redis
by Luca Borruto 11 Feb '25

11 Feb '25

Hi everyone, We are currently facing an issue with FreeRADIUS where no cache entries are being created in Redis. We’ve tested the Redis connection, authentication, and database selection, but when we run KEYS * in Redis, it returns an empty array. When running FreeRADIUS in debug mode (radiusd -X), we do not see any Redis-related errors, yet the expected data is not found in Redis. I configured redis, cache, cache_tls and cache_eap modules for testing purpose, and it's still a bit confusing on which one to enable for production (we use only EAP-TLS with Radsec): *mods-enabled/redis:* redis { server = raddb-redis-master.radius.svc.cluster.local port = 6379 password = root } *mods-enabled/cache:* cache cache_redis { driver = "rlm_cache_redis" key = "%{control:State}" ttl = 43200 redis { server = raddb-redis-master.radius.svc.cluster.local port = 6379 password = root } update { &reply: += &reply: &control:State := &request:State } } *mods-enabled/cache_tls:* cache cache_tls_session { driver = rlm_cache_redis key = &Session-Id ttl = 43200 redis { server = raddb-redis-master.radius.svc.cluster.local port = 6379 password = root } update { &reply:TLS-Session-Data := &session-state:TLS-Session-Data } } *mods-enabled/cache_eap:* cache cache_eap { driver = rlm_cache_redis key = "%{control:State}" ttl = 43200 redis { server = raddb-redis-master.radius.svc.cluster.local port = 6379 password = root } update reply { &reply += &reply &control:State := &request:State } } Is there anything wrong with our configuration that could be preventing data from being stored in Redis? Any help would be greatly appreciated. Please let me know if any additional logs or details would be helpful. Best regards, Luca,

2 2

Configuring FreeRADIUS Behind Azure Load Balancer - Health Probe Issue
by Luca Borruto 10 Feb '25

10 Feb '25

Hello everyone, I am currently running FreeRADIUS v3.2.6 on K8S behind an Azure Load Balancer, serving RadSec (TLS on TCP 2083) for wifi EAP authentication. The load balancer is configured with a TCP health probe on port 2083 to verify the service’s availability (that's the way Azure LB works), the issue is that FreeRADIUS does not seem to accept these health probe requests. In the logs, I see messages like: Ignoring request to auth+acct proto tcp address * port 2083 (TLS) bound to server default from unknown client 10.0.2.4 port 3286 proto tcp The health probe originates from internal ALB IPs (e.g., 10.0.2.4, 10.0.2.33). FreeRADIUS rejects them as unknown clients and as a result, the load balancer marks the service as unhealthy and so, the traffic is not achieved to the freeradius pods. I am looking for guidance on the recommended way to configure FreeRADIUS to work behind an Azure Load Balancer: What is the best practice for handling this scenario? Any official recommendations or insights from the community would be greatly appreciated. Best regards, Luca Borruto IT System Administrator

3 6

mschap
by Alan Batie 08 Feb '25

08 Feb '25

I'm migrating an outdated system from centos 5/freeradius 1.1.7 to ubuntu 24/freeradius 3.2.5; it authenticates ppp connections via mschap by mac address with an sql procedure call. It doesn't look like there's anything to configure in mschap, the old system has all the mschap stuff commented out by default and so does the new system, but mschap is failing and it looks like it's not even getting to the sql part. It really just needs to ignore the mschap since the only part of it getting used is one of a few static usernames. I can send the full debug output privately if need be... It does work if you're using pap instead of chap, so the sql part works... (0) Received Access-Request Id 176 from 10.65.23.69:47717 to 10.67.10.137:1812 length 294 (0) Message-Authenticator = 0xcc69da5fbbc2a69a88a5e18907ebcc29 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) NAS-Port-Type = Ethernet (0) User-Name = "CPEv2" (0) Calling-Station-Id = "64:D1:54:7A:B1:F4" (0) Calling-Station-Id = "tarana-service" (0) NAS-Port-Id = "vlan2000-tarana" (0) Acct-Session-Id = "81f01557" (0) MS-CHAP-Challenge = 0x3131366139653232316662366161376332313437343231373735346236613135 (0) MS-CHAP2-Response = 0x30313030363236663563643935326431373930373966376465333139303966356465323230303030303030303030303030303030326261653431646 530306330366137666137376464356132313063313662623037613235363063623563333838373264 (0) NAS-Identifier = "admin03" (0) NAS-IP-Address = 207.55.16.41 (0) NAS-Port = 15762707 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/peak (0) authorize { (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/10.65.23.69/auth-detail-20250206 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.23.69/auth-detail-20250206 (0) auth_log: EXPAND %t (0) auth_log: --> Thu Feb 6 15:44:52 2025 (0) [auth_log] = ok (0) [chap] = noop (0) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = fail (0) } # authorize = fail (0) Invalid user: [CPEv2] (from client admin01 port 15762707 cli 64:D1:54:7A:B1:F4) (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/peak (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: WARNING: No such configuration item .query (0) [sql] = noop (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> CPEv2

2 5