- Freeradius-Users - lists.freeradius.org

Multi-tenancy support
by Cecil Wei 20 Jun '22

20 Jun '22

Hi all, I have been working on a project that we need to support more than 10000 tenants. I tried to create multiple virtual servers and each listen to different ports and I found that I can only create up to 300 virtual servers due to the limitation of FD_SETSIZE. In this case I will need to have more than 300 servers running which doesn't seem to make much sense. I also consider the option of creating multiple client sections to specify the source IP addresses and the corresponding virtual server. However, I don't seem to find a way to identify tenants if the incoming traffic is from the same proxy server. I am running out of options and hoping that you may share your experience or suggestions. thank you very much Cecil

6 17

Enabling EAP-TTLS-PAP for wired usage
by Florent Vercourt 15 Jun '22

15 Jun '22

Hello everyone, I’m currently setting up a freeradius, and i would need some information on how to setup EAP-TTLS-PAP for a wired usage. Users will be identified via an LDAP database on the accounting will by via MySQL. I already understood how works EAP-TTLS and how to set it as the default_eap_type, but it is mainly for the PAP part, do i have to configure it myself in /etc/raddb/mods-enabled/eap in the ttls section, if so, what do i have to activate ? , or is it default-activated without having to configure it, otherwise where do i have to configure it ? Also, do i necessarily need to have 2 servers enabled in the module /etc/raddb/sites-enabled/, or can i have just one configured ? Could i communicate in PAP with my MySQL database, or do i have to authorize another protcol of communication ? Thank you all for your help, Florent VERCOURT

2 1

Question on dynamic home_server
by Yushu Shi (yusshi) 15 Jun '22

15 Jun '22

Hi there, Need some help with using freeradius as a proxy to two radius server pools. The requirement is like below: * There are two server pools, identified with host names: primary.radius.myorg.com and secondary.radius.myorg.com. * DNS request to the two host names returns the IP addresses of several servers in the pool in a round robin fashion, i.e, “host primary.radius.myorg.com” command returns 3 IP addresses. * IP address of each server may get changed. Need to honor DNS TTL timer. * All auth requests should be directed to the hosts in the primary pool round robin, and only fail over to the secondary if all hosts behind the primary are unresponsive. Is there any way to accomplish these requirements without restarting the process? How should I create the home_server pools in proxy.conf to do this? Thanks, Yushu

3 5

Replacement certificate
by 网络时代 14 Jun '22

14 Jun '22

Hello, System version: Centos linux release 7.9.2009 Radius version: Freeradius-server-3.0.21 source code compilation and installation Routing: MikroTik v 6.48.6 I want to replace the certificate generated by Freeradius with the certificate made by "MikroTik". Let me introduce the process of replacing the certificate, enter the certificate directory, use "$ rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt*", delete the old certificate, Use SFTP to upload the certificate file produced by MikroTik and convert it into a certificate file with the corresponding name and format. The uploaded certificate category is shown in the screenshot below, and the final debugging output will report an error. Where am I doing wrong? Best regards } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 51441 Listening on proxy address :: port 40927 Ready to process requests Ready to process requests Signalled to terminate Exiting normally [root@myradius e_zhangiso]# cd /usr/local/etc/raddb/certs/ [root@myradius certs]# ls 01.pem     ca.der      index.txt           Makefile      server.cnf  server.pem 02.pem     ca.key      index.txt.attr      passwords.mk  server.crt  xpextensions bootstrap  ca.pem      index.txt.attr.old  README        server.csr ca.cnf     client.cnf  index.txt.old       serial        server.key ca.crl     dh          inner-server.cnf    serial.old    server.p12 [root@myradius certs]# rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* [root@myradius certs]# ls bootstrap  ca.crl      dh                Makefile      README      xpextensions ca.cnf     client.cnf  inner-server.cnf  passwords.mk  server.cnf [root@myradius certs]# ls bootstrap  ca.crt  client.cnf        Makefile      server.cnf  server.p12 ca.cnf     ca.key  dh                passwords.mk  server.crt  server.pem ca.crl     ca.pem  inner-server.cnf  README        server.key  xpextensions [root@myradius certs]# radiusd -X FreeRADIUS Version 3.0.21 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main {  security {   allow_core_dumps = no  } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes  log {   stripped_names = no   auth = no   auth_badpass = no   auth_goodpass = no   colourise = yes   msg_denied = "You are already logged in - access denied"  }  resources {  }  security {   max_attributes = 200   reject_delay = 1.000000   status_server = yes   allow_vulnerable_openssl = "no"  } } radiusd: #### Loading Realms and Home Servers ####  proxy server {   retry_delay = 5   retry_count = 3   default_fallback = no   dead_time = 120   wake_all_if_all_dead = no  }  home_server localhost {   ipaddr = 127.0.0.1   port = 1812   type = "auth"   secret = <<< secret >>>   response_window = 20.000000   response_timeouts = 1   max_outstanding = 65536   zombie_period = 40   status_check = "status-server"   ping_interval = 30   check_interval = 30   check_timeout = 4   num_answers_to_alive = 3   revive_interval = 120   limit {   max_connections = 16   max_requests = 0   lifetime = 0   idle_timeout = 0   }   coa {   irt = 2   mrt = 16   mrc = 5   mrd = 30   }  }  home_server_pool my_auth_failover { type = fail-over home_server = localhost  }  realm example.com { auth_pool = my_auth_failover  }  realm LOCAL {  } radiusd: #### Loading Clients ####  client localhost {   ipaddr = 127.0.0.1   require_message_authenticator = no   secret = <<< secret >>>   nas_type = "other"   proto = "*"   limit {   max_connections = 16   lifetime = 0   idle_timeout = 30   }  }  client localhost_ipv6 {   ipv6addr = ::1   require_message_authenticator = no   secret = <<< secret >>>   limit {   max_connections = 16   lifetime = 0   idle_timeout = 30   }  }  client socket_client {   ipaddr = 172.18.30.1   require_message_authenticator = no   secret = <<< secret >>>   limit {   max_connections = 16   lifetime = 0   idle_timeout = 30   }  } Debugger not attached  # Creating Auth-Type = mschap  # Creating Auth-Type = digest  # Creating Auth-Type = eap  # Creating Auth-Type = PAP  # Creating Auth-Type = CHAP  # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules ####  modules {   # Loaded module rlm_always   # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always   always reject {   rcode = "reject"   simulcount = 0   mpp = no   }   # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always   always fail {   rcode = "fail"   simulcount = 0   mpp = no   }   # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always   always ok {   rcode = "ok"   simulcount = 0   mpp = no   }   # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always   always handled {   rcode = "handled"   simulcount = 0   mpp = no   }   # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always   always invalid {   rcode = "invalid"   simulcount = 0   mpp = no   }   # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always   always userlock {   rcode = "userlock"   simulcount = 0   mpp = no   }   # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always   always notfound {   rcode = "notfound"   simulcount = 0   mpp = no   }   # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always   always noop {   rcode = "noop"   simulcount = 0   mpp = no   }   # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always   always updated {   rcode = "updated"   simulcount = 0   mpp = no   }   # Loaded module rlm_attr_filter   # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter   attr_filter attr_filter.post-proxy {   filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"   key = "%{Realm}"   relaxed = no   }   # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter   attr_filter attr_filter.pre-proxy {   filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"   key = "%{Realm}"   relaxed = no   }   # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter   attr_filter attr_filter.access_reject {   filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"   key = "%{User-Name}"   relaxed = no   }   # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter   attr_filter attr_filter.access_challenge {   filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"   key = "%{User-Name}"   relaxed = no   }   # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter   attr_filter attr_filter.accounting_response {   filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"   key = "%{User-Name}"   relaxed = no   }   # Loaded module rlm_cache   # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap   cache cache_eap {   driver = "rlm_cache_rbtree"   key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"   ttl = 15   max_entries = 0   epoch = 0   add_stats = no   }   # Loaded module rlm_chap   # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap   # Loaded module rlm_date   # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date   date {   format = "%b %e %Y %H:%M:%S %Z"   utc = no   }   # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date   date wispr2date {   format = "%Y-%m-%dT%H:%M:%S"   utc = no   }   # Loaded module rlm_detail   # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail   detail {   filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"   header = "%t"   permissions = 384   locking = no   escape_filenames = no   log_packet_header = no   }   # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log   detail auth_log {   filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"   header = "%t"   permissions = 384   locking = no   escape_filenames = no   log_packet_header = no   }   # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log   detail reply_log {   filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"   header = "%t"   permissions = 384   locking = no   escape_filenames = no   log_packet_header = no   }   # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log   detail pre_proxy_log {   filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"   header = "%t"   permissions = 384   locking = no   escape_filenames = no   log_packet_header = no   }   # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log   detail post_proxy_log {   filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"   header = "%t"   permissions = 384   locking = no   escape_filenames = no   log_packet_header = no   }   # Loaded module rlm_digest   # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest   # Loaded module rlm_dynamic_clients   # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients   # Loaded module rlm_eap   # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap   eap {   default_eap_type = "md5"   timer_expire = 60   ignore_unknown_eap_types = no   cisco_accounting_username_bug = no   max_sessions = 16384   }   # Loaded module rlm_exec   # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo   exec echo {   wait = yes   program = "/bin/echo %{User-Name}"   input_pairs = "request"   output_pairs = "reply"   shell_escape = yes   }   # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec   exec {   wait = no   input_pairs = "request"   shell_escape = yes   timeout = 10   }   # Loaded module rlm_expiration   # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration   # Loaded module rlm_expr   # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr   expr {   safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"   }   # Loaded module rlm_files   # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files   files {   filename = "/usr/local/etc/raddb/mods-config/files/authorize"   acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting"   preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy"   }   # Loaded module rlm_linelog   # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog   linelog {   filename = "/usr/local/var/log/radius/linelog"   escape_filenames = no   syslog_severity = "info"   permissions = 384   format = "This is a log message for %{User-Name}"   reference = "messages.%{%{reply:Packet-Type}:-default}"   }   # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog   linelog log_accounting {   filename = "/usr/local/var/log/radius/linelog-accounting"   escape_filenames = no   syslog_severity = "info"   permissions = 384   format = ""   reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"   }   # Loaded module rlm_logintime   # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime   logintime {   minimum_timeout = 60   }   # Loaded module rlm_mschap   # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap   mschap {   use_mppe = yes   require_encryption = no   require_strong = no   with_ntdomain_hack = yes    passchange {    }   allow_retry = yes   winbind_retry_with_normalised_username = no   }   # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth   exec ntlm_auth {   wait = yes   program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"   shell_escape = yes   }   # Loaded module rlm_pap   # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap   pap {   normalise = yes   }   # Loaded module rlm_passwd   # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd   passwd etc_passwd {   filename = "/etc/passwd"   format = "*User-Name:Crypt-Password:"   delimiter = ":"   ignore_nislike = no   ignore_empty = yes   allow_multiple_keys = no   hash_size = 100   }   # Loaded module rlm_preprocess   # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess   preprocess {   huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"   hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"   with_ascend_hack = no   ascend_channels_per_line = 23   with_ntdomain_hack = no   with_specialix_jetstream_hack = no   with_cisco_vsa_hack = no   with_alvarion_vsa_hack = no   }   # Loaded module rlm_radutmp   # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp   radutmp {   filename = "/usr/local/var/log/radius/radutmp"   username = "%{User-Name}"   case_sensitive = yes   check_with_nas = yes   permissions = 384   caller_id = yes   }   # Loaded module rlm_realm   # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm   realm IPASS {   format = "prefix"   delimiter = "/"   ignore_default = no   ignore_null = no   }   # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm   realm suffix {   format = "suffix"   delimiter = "@"   ignore_default = no   ignore_null = no   }   # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm   realm bangpath {   format = "prefix"   delimiter = "!"   ignore_default = no   ignore_null = no   }   # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm   realm realmpercent {   format = "suffix"   delimiter = "%"   ignore_default = no   ignore_null = no   }   # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm   realm ntdomain {   format = "prefix"   delimiter = "\\"   ignore_default = no   ignore_null = no   }   # Loaded module rlm_replicate   # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate   # Loaded module rlm_soh   # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh   soh {   dhcp = yes   }   # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp   radutmp sradutmp {   filename = "/usr/local/var/log/radius/sradutmp"   username = "%{User-Name}"   case_sensitive = yes   check_with_nas = yes   permissions = 420   caller_id = no   }   # Loaded module rlm_unix   # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix   unix {   radwtmp = "/usr/local/var/log/radius/radwtmp"   } Creating attribute Unix-Group   # Loaded module rlm_unpack   # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack   # Loaded module rlm_utf8   # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8   instantiate {   }   # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always   # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always   # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always   # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always   # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always   # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always   # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always   # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always   # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always   # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy   # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy   # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject   # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge   # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response   # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked   # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail   # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output   # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log   # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log   # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log   # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap    # Linked to sub-module rlm_eap_md5    # Linked to sub-module rlm_eap_leap    # Linked to sub-module rlm_eap_gtc    gtc {     challenge = "Password: "     auth_type = "PAP"    }    # Linked to sub-module rlm_eap_tls    tls {     tls = "tls-common"    }    tls-config tls-common {     verify_depth = 0     ca_path = "/usr/local/etc/raddb/certs"     pem_file_type = yes     private_key_file = "/usr/local/etc/raddb/certs/server.pem"     certificate_file = "/usr/local/etc/raddb/certs/server.pem"     ca_file = "/usr/local/etc/raddb/certs/ca.pem"     private_key_password = <<< secret >>>     dh_file = "/usr/local/etc/raddb/certs/dh"     fragment_size = 1024     include_length = yes     auto_chain = yes     check_crl = no     check_all_crl = no     cipher_list = "DEFAULT"     cipher_server_preference = no     ecdh_curve = "prime256v1"     disable_tlsv1 = yes     disable_tlsv1_1 = yes     tls_max_version = "1.2"     tls_min_version = "1.2"     cache {     enable = no     lifetime = 24     max_entries = 255     }     verify {     skip_if_ocsp_ok = no     }     ocsp {     enable = no     override_cert_url = yes     url = "http://127.0.0.1/ocsp/"     use_nonce = yes     timeout = 0     softfail = no     }    } tls: Failed reading private key file "/usr/local/etc/raddb/certs/server.pem" tls: error:0906D06C:PEM routines:PEM_read_bio:no start line tls: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to initialise rlm_eap_tls /usr/local/etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" [root@myradius certs]# 

2 1

Proxy response_window issue
by JS SV 14 Jun '22

14 Jun '22

Hi, I'm having a behavior that I don't fully understand when using proxy timers. I am using radclient to do the tests and I find that if radclient sends, for example, 3 retransmissions (timeout) the timers do not add up. I have the following configuration for home_server: response_window = 20 zombie_period = 40 check_interval = 30 num_answers_to_alive = 3 fail no response no response ------>|-------------------------------->|---------------------------------->|-------------------- req. response_window zombie_period (dead) 20s 40s The part that doesn't work for me is the response_window, if only one request is sent with radclient it goes well, the problem comes if more are sent, I add the debug: (0) Mon Jun 13 13:02:59 2022: Debug: Received Access-Request Id 205 from 127.0.0.1:60690 to 127.0.0.1:1812 length 236 (0) Mon Jun 13 13:02:59 2022: Debug: User-Name = "000a0b0c0d0f" ... (0) Mon Jun 13 13:02:59 2022: Debug: NAS-IP-Address = 10.10.36.50 (0) Mon Jun 13 13:02:59 2022: Debug: # Executing section authorize from file /etc/raddb/sites-enabled/default (0) Mon Jun 13 13:02:59 2022: Debug: authorize { ... (0) Mon Jun 13 13:02:59 2022: Debug: } # authorize = updated (0) Mon Jun 13 13:02:59 2022: Debug: Starting proxy to home server 10.10.39.211 port 1812 (0) Mon Jun 13 13:02:59 2022: Debug: server default { (0) Mon Jun 13 13:02:59 2022: Debug: } (0) Mon Jun 13 13:02:59 2022: Debug: Sent Access-Request Id 145 from 0.0.0.0:42987 to 10.10.39.211:1812 length 237 (0) Mon Jun 13 13:02:59 2022: Debug: User-Name = "000a0b0c0d0f" ... (0) Mon Jun 13 13:02:59 2022: Debug: Proxy-State = 0x323035 (0) Mon Jun 13 13:02:59 2022: Debug: Expecting proxy response no later than 19.673084 seconds from now (0) Mon Jun 13 13:03:04 2022: Debug: Sending duplicate proxied request to home server 10.10.39.211 port 1812 - ID: 145 (0) Mon Jun 13 13:03:04 2022: Debug: Sent Access-Request Id 145 from 0.0.0.0:42987 to 10.10.39.211:1812 length 237 (0) Mon Jun 13 13:03:04 2022: Debug: User-Name = "000a0b0c0d0f" ... (0) Mon Jun 13 13:03:04 2022: Debug: Event-Timestamp = "Jun 13 2022 13:02:59 CEST" (0) Mon Jun 13 13:03:04 2022: Debug: Proxy-State = 0x323035 (0) Mon Jun 13 13:03:09 2022: Debug: Sending duplicate proxied request to home server 10.10.39.211 port 1812 - ID: 145 (0) Mon Jun 13 13:03:09 2022: Debug: Sent Access-Request Id 145 from 0.0.0.0:42987 to 10.10.39.211:1812 length 237 (0) Mon Jun 13 13:03:09 2022: Debug: User-Name = "000a0b0c0d0f" ... (0) Mon Jun 13 13:03:09 2022: Debug: Event-Timestamp = "Jun 13 2022 13:02:59 CEST" (0) Mon Jun 13 13:03:09 2022: Debug: Proxy-State = 0x323035 (0) Mon Jun 13 13:03:19 2022: Debug: Expecting proxy response no later than 9.993284 seconds from now (0) Mon Jun 13 13:03:29 2022: Debug: No proxy response, giving up on request and marking it done (0) Mon Jun 13 13:03:29 2022: ERROR: Failing proxied request for user "000a0b0c0d0f", due to lack of any response from home server 10.10.39.211 port 1812 (0) Mon Jun 13 13:03:29 2022: Debug: Clearing existing &reply: attributes (0) Mon Jun 13 13:03:29 2022: Debug: Found Post-Proxy-Type Fail-Authentication (0) Mon Jun 13 13:03:29 2022: Debug: server default { (0) Mon Jun 13 13:03:29 2022: Debug: # Executing group from file /etc/raddb/sites-enabled/default (0) Mon Jun 13 13:03:29 2022: Debug: Post-Proxy-Type Fail-Authentication { (0) Mon Jun 13 13:03:29 2022: Debug: policy accept { (0) Mon Jun 13 13:03:29 2022: Debug: update control { (0) Mon Jun 13 13:03:29 2022: Debug: } # update control = noop (0) Mon Jun 13 13:03:29 2022: Debug: [handled] = handled (0) Mon Jun 13 13:03:29 2022: Debug: } # policy accept = handled (0) Mon Jun 13 13:03:29 2022: Debug: } # Post-Proxy-Type Fail-Authentication = handled (0) Mon Jun 13 13:03:29 2022: Debug: } (0) Mon Jun 13 13:03:29 2022: Debug: # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) Mon Jun 13 13:03:29 2022: Debug: Sent Access-Accept Id 205 from 127.0.0.1:1812 to 127.0.0.1:60690 length 0 (0) Mon Jun 13 13:03:29 2022: Debug: Finished request (0) Mon Jun 13 13:03:34 2022: Debug: Cleaning up request packet ID 205 with timestamp +7 I can see in the first request that the timer starts at 20s (13:02:59) but when I receive the third request, the timer has 10s left (13:03:19) when it should have finished, right? What are these extra 10s due to? Thanks!

2 5

Certificate import
by 网络时代 14 Jun '22

14 Jun '22

Hello, System version: Centos linux release 7.9.2009 Radius version: Freeradius-server-3.0.21 source code compilation and installation Routing: MikroTik v 6.48.6 As shown in the image below, the certificate with the red box is created by Freeradius and imported into MikroTik, with the "MikroTik" flag, created for the router itself. As can be seen from the comparison in the figure, the certificate created by Freeradius and imported into MikroTik is relative to the certificate created by the router itself, and there are no relevant parameters in the red box. 1. Is it normal that there is no "Key Usage" in the ca certificate? If not, how to modify ca.cnf? 2. Is it normal that the CA item in the status of the server certificate is empty? In addition, how to modify server.cnf and add the DNS parameter in "Subject Alt. Name"? Best regards

1 0

User name case insensitivity - revisited
by Luveh Keraph 13 Jun '22

13 Jun '22

I thought I had grasped what is involved in making FreeRADIUS 3.0.* to process user names in a case-insensitive way, but I am not so sure now. Here is what I have done: First, I added the following line in my /etc/raddb/mods-enabled/files: key = "%{%{Stripped-User-Name}:-%{tolower:%{User-Name}}}" I launched my FreeRADIUS server after ths. I have the following entry in my /etc/raddb/users file: ijk_user1 User-Password != "IJKpassword1" ijk_user1 Cleartext-Password := "IJKpassword1" With this, when I try to ssh as IJK_User1 (notice the mixed case) into a system that turns over authentication to my FreeRADIUS server, I get the following debugging information at this server: Sat Jun 11 11:02:25 2022 : Debug: (0) files: EXPAND %{%{Stripped-User-Name}:-%{tolower:%{User-Name}}} Sat Jun 11 11:02:25 2022 : Debug: (0) files: --> ijk_user1 Sat Jun 11 11:02:25 2022 : Debug: (0) files: users: Matched entry ijk_user1 at line 447 Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) Sat Jun 11 11:02:25 2022 : Debug: (0) [files] = ok Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) Sat Jun 11 11:02:25 2022 : Debug: (0) [expiration] = noop Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) Sat Jun 11 11:02:25 2022 : Debug: (0) [logintime] = noop Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) Sat Jun 11 11:02:25 2022 : Debug: (0) [pap] = updated Sat Jun 11 11:02:25 2022 : Debug: (0) } # authorize = updated Sat Jun 11 11:02:25 2022 : Debug: (0) Found Auth-Type = PAP Sat Jun 11 11:02:25 2022 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Sat Jun 11 11:02:25 2022 : Debug: (0) Auth-Type PAP { Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authenticate]: calling pap (rlm_pap) Sat Jun 11 11:02:25 2022 : Debug: (0) pap: Login attempt with password "IJKpassword1" (12) Sat Jun 11 11:02:25 2022 : Debug: (0) pap: Comparing with "known good" Cleartext-Password "IJKpassword1" (12) Sat Jun 11 11:02:25 2022 : Debug: (0) pap: User authenticated successfully Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[authenticate]: returned from pap (rlm_pap) Sat Jun 11 11:02:25 2022 : Debug: (0) [pap] = ok Sat Jun 11 11:02:25 2022 : Debug: (0) } # Auth-Type PAP = ok Sat Jun 11 11:02:25 2022 : Debug: (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default Sat Jun 11 11:02:25 2022 : Debug: (0) post-auth { Sat Jun 11 11:02:25 2022 : Debug: (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { Sat Jun 11 11:02:25 2022 : Debug: (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE Sat Jun 11 11:02:25 2022 : Debug: (0) update { Sat Jun 11 11:02:25 2022 : Debug: (0) No attributes updated for RHS &session-state: Sat Jun 11 11:02:25 2022 : Debug: (0) } # update = noop Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec) Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec) Sat Jun 11 11:02:25 2022 : Debug: (0) [exec] = noop Sat Jun 11 11:02:25 2022 : Debug: (0) policy remove_reply_message_if_eap { Sat Jun 11 11:02:25 2022 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) { Sat Jun 11 11:02:25 2022 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Sat Jun 11 11:02:25 2022 : Debug: (0) else { Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[post-auth]: calling noop (rlm_always) Sat Jun 11 11:02:25 2022 : Debug: (0) modsingle[post-auth]: returned from noop (rlm_always) Sat Jun 11 11:02:25 2022 : Debug: (0) [noop] = noop Sat Jun 11 11:02:25 2022 : Debug: (0) } # else = noop Sat Jun 11 11:02:25 2022 : Debug: (0) } # policy remove_reply_message_if_eap = noop Sat Jun 11 11:02:25 2022 : Debug: (0) } # post-auth = noop Sat Jun 11 11:02:25 2022 : Debug: (0) Sent Access-Accept Id 64 from 192.168.0.55. 23:1812 to 192.168.0.66:60600 length 0 Which is fine: the user name gets converted from IJK_User1 to ijk_user1 and the authentication with password IJKpassword1 succeeds, as expected. I then changed the relevant entry in my /etc/raddb/users file as follows: IJK_User1 User-Password != "IJKpassword1" IJK_User1 Cleartext-Password := "IJKpassword1" After restarting the FreeRADIUS server I attempted the same log in as before. This is what I got in my traces: Sat Jun 11 11:48:54 2022 : Debug: (0) files: EXPAND %{%{Stripped-User-Name}:-%{tolower:%{User-Name}}} Sat Jun 11 11:48:54 2022 : Debug: (0) files: --> ijk_user1 Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) Sat Jun 11 11:48:54 2022 : Debug: (0) [files] = noop Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) Sat Jun 11 11:48:54 2022 : Debug: (0) [expiration] = noop Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) Sat Jun 11 11:48:54 2022 : Debug: (0) [logintime] = noop Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) Sat Jun 11 11:48:54 2022 : WARNING: (0) pap: No "known good" password found for the user. Not setting Auth-Type Sat Jun 11 11:48:54 2022 : WARNING: (0) pap: Authentication will fail unless a "known good" password is available Sat Jun 11 11:48:54 2022 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) Sat Jun 11 11:48:54 2022 : Debug: (0) [pap] = noop Sat Jun 11 11:48:54 2022 : Debug: (0) } # authorize = ok Sat Jun 11 11:48:54 2022 : ERROR: (0) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject Sat Jun 11 11:48:54 2022 : Debug: (0) Failed to authenticate the user Sat Jun 11 11:48:54 2022 : Debug: (0) Using Post-Auth-Type Reject If I understand things correctly, the key = ... line that I added to the files file does indeed recast the incoming user name to lowercase. However, the FreeRADIUS server still compares incoming user names against those in the users file in a case sensitive way. This is fine, but not quite what I was looking for. Is it possible to get FreeRADIUS to compare user names (and user names alone - not passwords) in a real case-insensitive way against those in the /etc/raddb/users file?

4 6

MySQL Stored Procedure
by Aurélio de Souza Ribeiro Neto 11 Jun '22

11 Jun '22

Hello All, I'm using Freeradius 3.0.25-2 on Linux Ubunt and MySQL 5.7 and Mikrotik NAS Sometimes, if I have a energy fault on equipment, I have to many simultaneous authentication packets from same user. When it happens, the same user can use 2 ou more IPs from my Pool simultaneous. Is there a way to write a MySQL Stored Procedure to clean this faults? Someone can help-me with this? Thanks Aurélio

2 1

Releasing 3.0.26 and 3.2.0 soon
by Alan DeKok 11 Jun '22

11 Jun '22

We're going to release 3.0.26 and 3.2.0 in the near future. After months of work, they're finally ready for release. The delays were due to two issues. One was the release of OpenSSL3. It behaves differently than previous versions of OpenSSL, and it took a while to track down exactly what was going on. Thanks to Alex Clouter for patches. The second delay was due to Windows 11 inter-operability. We've been working closely with the Windows team to ensure that their software works with ours, and vice-versa. The use of TLS 1.3 complicates things, as TLS 1.3 is substantially different from earlier versions of TLS. Thanks again to Alex Clouter for testing and patches. We will be releasing 3.2.0 as the "new feature" branch of the v3 series. 3.2 will be 100% configuration compatible with 3.0, but will have new features which are not available in the main 3.0 release. We will be continuing to maintain 3.0 for the forseeable future. However, it will be "feature frozen". The only patches going into 3.0 will be bug fixes. This helps to ensure stability and low cost of maintenance. Matthew Newton is the v3 release manager, and can comment more if needed. Alan DeKok.

5 7

Python module for FreeRADIUS
by Klara Mall 09 Jun '22

09 Jun '22

Hi, does anybody know why there is no Debian package for the FreeRADIUS Python module in the networkradius.com Debian repository[0]? We use the Debian packages from networkradius.com and not from Debian itself to have the recent version running. But now we need the Python module and wonder why there's no Debian package there. Moreover the package in Debian itself depends on the version (= not >=) of the freeradius package, so it can't be installed with the newer recent freeradius package version. Does anybody has any hints on this? Best regards Klara [0] https://networkradius.com/packages/ -- Karlsruher Institut für Technologie (KIT) Steinbuch Centre for Computing (SCC) Klara Mall Abteilungsleiter Netze und Telekommunikation (NET) Zirkel 2, Geb. 20.21, R. 001.1 76131 Karlsruhe Telefon: +49 721 608-48946 E-Mail: klara.mall(a)kit.edu Web: http://www.scc.kit.edu Sitz der Körperschaft: Kaiserstraße 12, 76131 Karlsruhe KIT – Die Forschungsuniversität in der Helmholtz-Gemeinschaft

2 3