April 2025 - Freeradius-Users - lists.freeradius.org

Cisco Console Port Help
by Timothy M Butterworth 22 Apr '25

22 Apr '25

Hello, I have the following configuration and I am having an issue. Logging into a VTY line through SSH takes me immediately to enable privileged mode login. Logging into Console takes me to a non-privileged mode login and I have to enter the Enable Secret Password. How do I get the console to take me immediately to enable privileged mode login? ### Free RADIUS Configuration sudo vim /etc/freeradius/3.0/clients.conf client 10.0.0.0/8 { secret = REMOVED nastype = cisco shortname = Butter.net } ### FreeRADIUS User Config sudo vim /etc/freeradius/3.0/users tmb Cleartext-Password := "REMOVED" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15" # FreeRADIUS group config DEFAULT Group == "cisco-rw" Service-Type = NAS-Prompt-User, Cisco-AVPair == 'shell:priv-lvl=15', User-Name = tmb Thanks Tim -- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/ ⠈⠳⣄⠀⠀

4 3

TLS Client Certificate Attributes with proxy
by jhbulk75 22 Apr '25

22 Apr '25

We use the rest module to call our backend server during post-auth for additional processing. When the request is locally terminated EAP-TLS, the request attribute list contains all of the TLS certificate attributes. We have a feature request that requires access to one of these TLS client cert attributes in post-auth (TLS-Client-Cert-Subject-Alt-Name-Uri). When the request is proxied this information is not available in post-auth. Does this mean it's not possible to see this data in a proxy configuration? Or does FreeRADIUS just not provide it because the eap module was not called. In other words, in lieu of FR not providing this for us, could EAP-Message be parsed to manually extract this data? Or is the information simply not there? We're trying to determine if this is still a viable option in a proxy environment. Thanks for any insights.

2 1

query on hostapd
by SIMON BABY 22 Apr '25

22 Apr '25

Hello Team, Do we have to enable anything in the bridge interface in Linux for processing EAPOL packets ? Currently the bridge in my setup cannot detect EAPOL packets. However the DSA lan ports are able to detect. The bridge interface contains the lan ports. Regards Simon

3 8

Bash automation for FreeRADIUS
by Travis Bean 21 Apr '25

21 Apr '25

Hello, I developed a Bash script to automate the installation and configuration of open-source software (i.e., launchpad.net/linuxha) I want to make sure the syntax of this script is perfect so I can use it as a teaching tool to educate people about Linux. I need to know if there is anything misconfigured with my FreeRADIUS syntax. If you find a bug in LinuxHA, please submit a bug report to bugs.launchpad.net/linuxha/+filebug. Kind regards, Travis Bean

1 0

Requesting guidance to understand all moving parts for RadSec + EAP-TLS
by Yoann Gini 20 Apr '25

20 Apr '25

Hello, As said on the other thread, I’m trying to use RadSec to provide EAP-TLS authentication for remote site. I’m mainly a NPS user during last years, it’s been a while since I haven’t used Freeradius. I’m a little bit lost in the set of configuration to do here, especially since some parts seems redundant between RadSec and EAP-TLS. Especially, I will have different intermediate certificates authority to authenticate access points on one side and wireless client on the other. Also, the configuration for EAP-TLS will need to be PKI based only (authenticate and authorize if certificate based authentication works and if the certificate is not revoked). No per-user authorization expected, and the FreeRadius server is expected to not know the list of valid users, solely relying on PKI for that. So if someone can lead me to a clean article about the use of RadSec + EAP-TLS in FreeRadius, or if someone can take the time to explain it to me, I’m really interested. Thanks a lot

4 8

Converting MAC address formats
by Mike Diggins 19 Apr '25

19 Apr '25

I'm using MAC address authentication against a FreeRADIUS Version 3.0.20 (RHEL8) server. My WLAN controller sends the MAC in the format 2c-7b-a0-2f-bb-f1 but FR seems to convert it to 2c7ba02fbbf1. My SQL database has the MACs in the 2c-7b-a0-2f-bb-f1 format. I added this to sites-enabled/default in the authorize section. I've tried many formats but can't seem to get it right. Can it be fixed or am I crazy and should just update the database with the expected format? # Check if User-Name is a MAC address in the correct format if ("%{User-Name}" =~ /^([0-9A-Fa-f:-]{12,17})$/) { update request { # Convert to lowercase (optional) Tmp-String-0 := "%{tolower:%{User-Name}}" # Remove non-alphanumeric characters (colons, dashes) using expr Tmp-String-1 := "%{expr:%{Tmp-String-0}:s/[-:]//g}" # Assign cleaned MAC address to User-Name User-Name := "%{Tmp-String-1}" } } The debug output is: (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "2c7ba02fbbf1", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) if ("%{User-Name}" =~ /^([0-9A-Fa-f:-]{12,17})$/) { (0) EXPAND %{User-Name} (0) --> 2c7ba02fbbf1 (0) if ("%{User-Name}" =~ /^([0-9A-Fa-f:-]{12,17})$/) -> TRUE (0) if ("%{User-Name}" =~ /^([0-9A-Fa-f:-]{12,17})$/) { (0) update request { (0) EXPAND %{tolower:%{User-Name}} (0) --> 2c7ba02fbbf1 (0) Tmp-String-0 := 2c7ba02fbbf1 (0) Expected operator at "c7ba02fbbf1:s/[-:]//g" (0) EXPAND %{expr:%{Tmp-String-0}:s/[-:]//g} (0) --> (0) Tmp-String-1 := (0) EXPAND %{Tmp-String-1} (0) --> (0) User-Name := (0) } # update request = noop (0) } # if ("%{User-Name}" =~ /^([0-9A-Fa-f:-]{12,17})$/) = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} -Mike

2 1

Advanced usage of Radsec and PKI integration?
by Yoann Gini 18 Apr '25

18 Apr '25

Hello, I’m looking at the following Radsec documentation for FreeRadius and I’m lacking some details, maybe someone here can share some guidance? https://www.freeradius.org/documentation/freeradius-server/3.2.8/howto/prot… My goal here is to simplify the use of FreeRadius by solely relying on Certificate Based Authentication for the client, and so, finding a way to configure FreeRadius to accept all client, regardless of their IP, if they can authenticate with a certificate coming from a specific PKI and that is currently not revoked in the PKI’s CRL. My goal here is to easily provide Cloud Radius for remote network who might by on non static IP address or behind CG-NAT. Best regards Yoann

2 1

General question about RadSec implementation on FR 3.2.x
by dominic.stalder＠unibe.ch 17 Apr '25

17 Apr '25

Hi guys I know, there is a documentation page about RadSec: https://www.freeradius.org/documentation/freeradius-server/3.2.8/howto/prot… But I have some general questions about the RadSec implementation on FR 3.2.x, which I think are not answered in the above documentation page: 1. When I want to proxy RADIUS requests to other RADIUS servers over RadSec (TLS/2083): a) do I have to configure the home servers in /etc/freeradius/sites-enabled/tls as well, only in the tls file or only in the proxy.conf? --> I did a test with configuring them only in /etc/freeradius/proxy.conf and the requests were proxied over TLS/2083 to the configured RADIUS proxy servers: home_server xyz-TLS { type = auth+acct ipaddr = 1.2.3.4 proto = tcp port = 2083 secret = radsec tls { private_key_file = ${certdir}/radsec.key certificate_file = ${certdir}/radsec.pem ca_file = ${cadir}/radsec-ca.pem fragment_size = 8192 } response_window = 20 zombie_period = 40 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } b) what about a mixed deployment, where some of the RADIUS proxy / home servers are accessed over RADIUS (UDP/1812) and some others are access over RadSec (TCP/2083)? 2. When I want to answer RADIUS requests from other RADIUS proxy servers over RadSec (TCP/2083): a) do I have to configure the clients in /etc/freeradius/sites-enabled/tls as well or only in the tls file? If only in the tls file, I can remove them from the clients.conf file, correct? b) same as 1.a), what about a mixed deployment; some RADIUS clients are RADIUS (UDP/1812), some are RadSec (TCP/2083)? Thanks and regards Dominic _________________________________ Universität Bern Abteilung Informatikdienste Dominic Stalder Network Engineer Hochschulstrasse 6 CH-3012 Bern Tel. +41 (0)31 684 38 18 dominic.stalder(a)unibe.ch<mailto:dominic.stalder@unibe.ch> www.id.unibe.ch _________________________________

2 4

multiple-login checking
by Can Paçacı 16 Apr '25

16 Apr '25

Hi, Which method is better performance to limit for concurrent logins per user, Simultaneous-Use checking or checkrad? Since simultaneus-use check performs "select count(*) .." for each session in query.conf, it causes performance loss in db. Which method is suitable for the least performance loss? Also, the NAS we use (Huawei-BNG) is not included in the NAS types list on the checkrad man-page. The Freeradius version is 3.0.20. Regards -- Can Paçacı

2 1

TOTP authentication with the TOTP module
by IT DEB 16 Apr '25

16 Apr '25

I am trying a simple TOTP authentication with the TOTP module. The idea is that the user only has to enter the OTP via Radius and is authenticated. Freeradius starts but the authentication does not work. See below config and output. Thanks itdeb ############################################################################ #clients.conf File client pc1 { ipaddr = 192.168.65.161 secret = testing12345 } #users File bw TOTP-Secret := "JBSWY3DPEHPK3PXP" #default File Auth-Type CHAP { totp } #totp File totp { time_step = 30 otp_length = 6 lookback_steps = 1 lookback_interval = 30 } ############################################################################ ############################################################################ Ready to process requests (0) Received Access-Request Id 23 from 192.168.65.161:60716 to 192.168.65.160:1812 length 72 (0) NAS-Identifier = "vncserver" (0) User-Name = "bw" (0) CHAP-Password = 0x00549ccaa7d52c08fd1655bce475bdd1d9 (0) Message-Authenticator = 0x30156802c7f5b5504b3d1fdd42943c0b (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) chap: &control:Auth-Type := CHAP (0) [chap] = ok (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "bw", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry bw at line 1 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop Not doing PAP as Auth-Type is already set. (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = CHAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type CHAP { (0) [totp] = noop (0) } # Auth-Type CHAP = noop (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> bw (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 23 from 192.168.65.160:1812 to 192.168.65.161:60716 length 20 Waking up in 3.9 seconds. (0) Sending duplicate reply to client pc1 port 60716 - ID: 23 Waking up in 8.9 seconds. (0) Cleaning up request packet ID 23 with timestamp +34 due to cleanup_delay was reached Ready to process requests ############################################################################

2 11