- Freeradius-Users - lists.freeradius.org

3.2.0: dynamic_home_servers ?
by Stefan Winter 01 Jun '22

01 Jun '22

Hi, I'm giving dynamic_home_servers a try. I didn't get very far though: - started with the default shipped config - enabled sites-enabled/control-socket - enabled dynamic=true and the default directory - added one single entry in the directory, with filename "testrealm.lu": home_server testrealm.lu { # ipv6addr = "2001:db8::6" ipaddr = "192.168.20.5" proto = udp secret = "radsec" } - started FreeRADIUS, looked at the following error: including configuration file /home/stefan/RESTENA/freeradius-build/etc/raddb/home_servers/testrealm.lu home_server testrealm.lu { ipaddr = 192.168.20.5 port = 0 proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } Failed reading home_server from /home/stefan/RESTENA/freeradius-build/etc/raddb/home_servers/testrealm.lu - Dynamic home_server 'testrealm.lu' cannot have 'server' or 'auth+acct' So the configuration is parsed correctly, but then... I didn't specify "auth+acct" (and if I do, same error); nor do I know what is meant with "server" (and switching between ipaddr and ipv6addr didn't change anything)? Adding a port = 1812 doesn't change anything either. When I read in the docs that these should be "normal" home_server definitions, I wonder... they are seemingly not quite that normal? Greetings, Stefan Winter -- This email may contain information for limited distribution only, please treat accordingly. Fondation Restena, Stefan WINTER Chief Technology Officer 2, avenue de l'Université L-4365 Esch-sur-Alzette

2 12

Anonymous outer identity
by Jaume Obrador Vaquer 01 Jun '22

01 Jun '22

Hi, we’ve set up freeradius 3.0 in order to authenticate users through an LDAP server, also users are assigned different VLAN depending on gidNumber ldap attribute. We have 2 enabled sites ‘default’ and ‘inner-tunnel’ Those are the relevant parts of our setup: sites-enabled/default post-auth { if (LDAP-Group == 10000 ) { update reply { Service-Type = Framed-User Tunnel-Type = 13 Tunnel-Medium-Type = 6 Tunnel-Private-Group-ID = 20 } } if (LDAP-Group == 10001 ) { update reply { Service-Type = Framed-User Tunnel-Type = 13 Tunnel-Medium-Type = 6 Tunnel-Private-Group-ID = 40 } } [….] } mods-enabled/ldap user { […] filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(|(businessCategory=1)(businessCategory=2)))" […] } I’ve ignored most parts of the configuration because they are mostly default configuration. This have been working for several years with no relevant issues, but now we’ve noticed an issue that would like to correct: Windows clients sends ‘anonymous’ as anonymous identity when connecting to wifi after wake up, so outer identity is set to ‘anonymous’ and post-auth section of ‘default’ site gets the outer identity instead of the real one, so the LDAP search is based on ‘anonymous’, user is not found so no LDAP-Group, so no correct VLAN is assigned to that client. This also happens if someone enters “anonymous” as anonymous identity when connecting. Here’s a Access-Request part of a log ending with Access-Accept, but with wrong assigned VLAN. (29) Received Access-Request Id 43 from 192.168.0.19:38666 to 192.168.10.100:1812 length 306 (29) User-Name = "anonymous" (29) NAS-IP-Address = 192.168.0.19 (29) NAS-Identifier = "fa92bf24addf" (29) Called-Station-Id = "FA-92-BF-24-AD-DF:LLEDONER" (29) NAS-Port-Type = Wireless-802.11 (29) Service-Type = Framed-User (29) Calling-Station-Id = "D0-C5-D3-5A-3E-A9" (29) Connect-Info = "CONNECT 0Mbps 802.11b" (29) Acct-Session-Id = "AFE698CF77042B3D" (29) Acct-Multi-Session-Id = "7A7B1A2476F7F9DE" (29) WLAN-Pairwise-Cipher = 1027076 (29) WLAN-Group-Cipher = 1027076 (29) WLAN-AKM-Suite = 1027073 (29) Framed-MTU = 1400 (29) EAP-Message = 0x021e004b158000000041170303003c00000000000000010eb9490a83ceab9db4773eec8b6ebf9a98789e9d07b5f4c3a2653bd425ea8133893eedba6b2e0e5050f6987735a41ba601545c91 (29) State = 0x8492598d818c4c92471f232c19036cae (29) Message-Authenticator = 0x4c9003e6cc19547d42d86a1df23d1a76 (29) session-state: No cached attributes (29) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (29) authorize { (29) policy filter_username { (29) if (&User-Name) { (29) if (&User-Name) -> TRUE (29) if (&User-Name) { (29) if (&User-Name =~ / /) { (29) if (&User-Name =~ / /) -> FALSE (29) if (&User-Name =~ /@[^@]*@/ ) { (29) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (29) if (&User-Name =~ /\.\./ ) { (29) if (&User-Name =~ /\.\./ ) -> FALSE (29) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (29) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (29) if (&User-Name =~ /\.$/) { (29) if (&User-Name =~ /\.$/) -> FALSE (29) if (&User-Name =~ /(a)\./) { (29) if (&User-Name =~ /(a)\./) -> FALSE (29) } # if (&User-Name) = notfound (29) } # policy filter_username = notfound (29) [preprocess] = ok (29) [chap] = noop (29) [mschap] = noop (29) [digest] = noop (29) suffix: Checking for suffix after "@" (29) suffix: No '@' in User-Name = "anonymous", looking up realm NULL (29) suffix: No such realm "NULL" (29) [suffix] = noop (29) eap: Peer sent EAP Response (code 2) ID 30 length 75 (29) eap: Continuing tunnel setup (29) [eap] = ok (29) } # authorize = ok (29) Found Auth-Type = eap (29) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (29) authenticate { (29) eap: Expiring EAP session with state 0x8492598d818c4c92 (29) eap: Finished EAP session with state 0x8492598d818c4c92 (29) eap: Previous EAP request found for state 0x8492598d818c4c92, released from the list (29) eap: Peer sent packet with method EAP TTLS (21) (29) eap: Calling submodule eap_ttls to process data (29) eap_ttls: Authenticate (29) eap_ttls: Continuing EAP-TLS (29) eap_ttls: Peer indicated complete TLS record size will be 65 bytes (29) eap_ttls: Got complete TLS record (65 bytes) (29) eap_ttls: [eaptls verify] = length included (29) eap_ttls: [eaptls process] = ok (29) eap_ttls: Session established. Proceeding to decode tunneled attributes (29) eap_ttls: Got tunneled request (29) eap_ttls: User-Name = "mroig" (29) eap_ttls: User-Password = “******” (29) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (29) eap_ttls: Sending tunneled request (29) Virtual server inner-tunnel received request (29) User-Name = "mroig" (29) User-Password = “******” (29) FreeRADIUS-Proxied-To = 127.0.0.1 (29) NAS-IP-Address = 192.168.0.19 (29) NAS-Identifier = "fa92bf24addf" (29) Called-Station-Id = "FA-92-BF-24-AD-DF:LLEDONER" (29) NAS-Port-Type = Wireless-802.11 (29) Service-Type = Framed-User (29) Calling-Station-Id = "D0-C5-D3-5A-3E-A9" (29) Connect-Info = "CONNECT 0Mbps 802.11b" (29) Acct-Session-Id = "AFE698CF77042B3D" (29) Acct-Multi-Session-Id = "7A7B1A2476F7F9DE" (29) WLAN-Pairwise-Cipher = 1027076 (29) WLAN-Group-Cipher = 1027076 (29) WLAN-AKM-Suite = 1027073 (29) Framed-MTU = 1400 (29) Event-Timestamp = "May 26 2022 09:44:29 CEST" (29) server inner-tunnel { (29) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (29) authorize { (29) policy filter_username { (29) if (&User-Name) { (29) if (&User-Name) -> TRUE (29) if (&User-Name) { (29) if (&User-Name =~ / /) { (29) if (&User-Name =~ / /) -> FALSE (29) if (&User-Name =~ /@[^@]*@/ ) { (29) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (29) if (&User-Name =~ /\.\./ ) { (29) if (&User-Name =~ /\.\./ ) -> FALSE (29) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (29) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (29) if (&User-Name =~ /\.$/) { (29) if (&User-Name =~ /\.$/) -> FALSE (29) if (&User-Name =~ /(a)\./) { (29) if (&User-Name =~ /(a)\./) -> FALSE (29) } # if (&User-Name) = notfound (29) } # policy filter_username = notfound (29) [chap] = noop (29) [mschap] = noop (29) suffix: Checking for suffix after "@" (29) suffix: No '@' in User-Name = "mroig", looking up realm NULL (29) suffix: No such realm "NULL" (29) [suffix] = noop (29) update control { (29) &Proxy-To-Realm := LOCAL (29) } # update control = noop (29) eap: No EAP-Message, not doing EAP (29) [eap] = noop (29) [files] = noop rlm_ldap (ldap): Reserved connection (2) (29) ldap: EXPAND (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(|(businessCategory=1)(businessCategory=2))) (29) ldap: --> (&(uid=mroig)(|(businessCategory=1)(businessCategory=2))) (29) ldap: Performing search in "ou=Gent,ou=lledoner,dc=nigul,dc=coop" with filter "(&(uid=mroig)(|(businessCategory=1)(businessCategory=2)))", scope "sub" (29) ldap: Waiting for search result... (29) ldap: User object found at DN "uid=mroig,ou=Gent,ou=lledoner,dc=nigul,dc=coop" (29) ldap: Processing user attributes (29) ldap: control:NT-Password := 0x4431443741394445383432423837443141333545433343363734323637323033 rlm_ldap (ldap): Released connection (2) Need 4 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (29) [ldap] = updated (29) if (noop && User-Password) { (29) if (noop && User-Password) -> FALSE (29) [expiration] = noop (29) [logintime] = noop (29) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes (29) [pap] = updated (29) } # authorize = updated (29) Found Auth-Type = PAP (29) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (29) Auth-Type PAP { (29) pap: Login attempt with password (29) pap: Comparing with "known-good" NT-Password (29) pap: User authenticated successfully (29) [pap] = ok (29) } # Auth-Type PAP = ok (29) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (29) post-auth { (29) if (0) { (29) if (0) -> FALSE (29) } # post-auth = noop (29) } # server inner-tunnel (29) Virtual server sending reply (29) eap_ttls: Got tunneled Access-Accept (29) eap: Sending EAP Success (code 3) ID 30 length 4 (29) eap: Freeing handler (29) [eap] = ok (29) } # authenticate = ok (29) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (29) post-auth { (29) if (LDAP-Group == 10000 ) { (29) Searching for user in group "10000" rlm_ldap (ldap): Reserved connection (3) (29) EXPAND (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(|(businessCategory=1)(businessCategory=2))) (29) --> (&(uid=anonymous)(|(businessCategory=1)(businessCategory=2))) (29) Performing search in "ou=Gent,ou=lledoner,dc=nigul,dc=coop" with filter "(&(uid=anonymous)(|(businessCategory=1)(businessCategory=2)))", scope "sub" (29) Waiting for search result... (29) Search returned no results rlm_ldap (ldap): Released connection (3) (29) if (LDAP-Group == 10000 ) -> FALSE (29) if (LDAP-Group == 10001 ) { (29) Searching for user in group "10001" rlm_ldap (ldap): Reserved connection (4) (29) EXPAND (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(|(businessCategory=1)(businessCategory=2))) (29) --> (&(uid=anonymous)(|(businessCategory=1)(businessCategory=2))) (29) Performing search in "ou=Gent,ou=lledoner,dc=nigul,dc=coop" with filter "(&(uid=anonymous)(|(businessCategory=1)(businessCategory=2)))", scope "sub" (29) Waiting for search result... (29) Search returned no results rlm_ldap (ldap): Released connection (4) (29) if (LDAP-Group == 10001 ) -> FALSE (29) if (LDAP-Group == 10032 ) { (29) Searching for user in group "10032" rlm_ldap (ldap): Reserved connection (0) (29) EXPAND (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(|(businessCategory=1)(businessCategory=2))) (29) --> (&(uid=anonymous)(|(businessCategory=1)(businessCategory=2))) (29) Performing search in "ou=Gent,ou=lledoner,dc=nigul,dc=coop" with filter "(&(uid=anonymous)(|(businessCategory=1)(businessCategory=2)))", scope "sub" (29) Waiting for search result... (29) Search returned no results rlm_ldap (ldap): Released connection (0) (29) if (LDAP-Group == 10032 ) -> FALSE (29) update { (29) No attributes updated (29) } # update = noop (29) [exec] = noop (29) policy remove_reply_message_if_eap { (29) if (&reply:EAP-Message && &reply:Reply-Message) { (29) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (29) else { (29) [noop] = noop (29) } # else = noop (29) } # policy remove_reply_message_if_eap = noop (29) } # post-auth = noop (29) Sent Access-Accept Id 43 from 192.168.10.100:1812 to 192.168.0.19:38666 length 0 (29) MS-MPPE-Recv-Key = 0x9d69d88a6eec283428461d5b448a1895c01d1f9fabd804b184bc0e435328efad (29) MS-MPPE-Send-Key = 0x097545e078f9a72d69f885fa90ee1b65e7d0016fcf04a8f87281cf9242240f42 (29) EAP-Message = 0x031e0004 (29) Message-Authenticator = 0x00000000000000000000000000000000 (29) User-Name = "anonymous" (29) Finished request With a little research I’ve found several places that discusses this matter, but none one them offers a solution for us. What we tried is: In sites-enabled/inner-tunnel we set if (0) to if (1) here: # Instead of "use_tunneled_reply", change this "if (0)" to an # "if (1)". # if (1) { # # These attributes are for the inner-tunnel only, # and MUST NOT be copied to the outer reply. # update reply { User-Name !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY } # # Copy the inner reply attributes to the outer # session-state list. The post-auth policy will take # care of copying the outer session-state list to the # outer reply. # update { &outer.session-state: += &reply: } } This didn’t solve the issue. Also tried to add in same section post-auth: udate reply { User-Name := &request:User-Name } Neither solved the issue. So, as you see, we need a little help to make freeradius use the real identity every time it does the LDAP search to get the correct gidNumber, so we can assign the correct VLAN to the client. Thanks a lot. -- *Informació sobre protecció de dades: El responsable del tractament de les dades personals del destinatari és el remitent de la present comunicació. Aquestes dades són tractades per a la satisfacció del nostre interès legítim per a la gestió de contactes i el manteniment de comunicacions recíproques per qüestions derivades de la nostra activitat. Aquestes dades seran conservades mentre siguin útils per a la finalitat indicada, i, en tot cas, durant els terminis legals i per al temps necessari per atendre a possibles responsabilitats nascudes del tractament. Els interessats tenen dret a sol·licitar l'accés a les seves dades personals, la seva rectificació, supressió o portabilitat, la limitació del seu tractament, a oposar-se al tractament, així com a presentar una reclamació davant una autoritat de control.* _Aquest missatge i els seus documents adjunts són confidencials. Si vostè no és el destinatari, per favor posi-ho en coneixement del remitent i elimini aquesta comunicació i els documents adjunts del seu sistema, sense reproduir ni comunicar els seus continguts. La transmissió de correu electrònic no garanteix que sigui segur o lliure d'error, per la qual cosa, declinem qualsevol responsabilitat sobre aquest tema._

2 2

Re: FreeRADIUS and Active Directory: Access-Reject (RHEL/CentOS 8)
by White, Daniel E. (GSFC-770.0)[AEGIS] 01 Jun '22

01 Jun '22

BUMP ! Does anyone have FreeRADIUS on RHEL/CentOS 8 working with LDAP/Active Directory as its back end ? On 5/25/22, 13:12, "Freeradius-Users on behalf of White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users" <freeradius-users-bounces+daniel.e.white=nasa.gov(a)lists.freeradius.org on behalf of freeradius-users(a)lists.freeradius.org> wrote: Here are the important parts: RHEL 8.5 Trying to talk to Active Directory with LDAP My Microsoft SME says AD will never hand back a password. How do I get RADIUS to hand the password to AD ? (0) Received Access-Request Id 70 from 127.0.0.1:53801 to 127.0.0.1:1812 length 74 (0) User-Name = "demo" (0) User-Password = <<User Password>> (0) NAS-IP-Address = <<local host IP>> (0) NAS-Port = 0 (0) Message-Authenticator = 0x590d9fc4e81ec118e32a67ad6fea50ca (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "demo", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (sAMAccountName=demo) (0) ldap: Performing search in "OU=USERS,DC=dc1,DC=dc2,DC=dc3,DC=dc4" with filter "(sAMAccountName=demo)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "CN=Demo,OU=USERGROUP,OU=USERS,DC=dc1,DC=dc2,DC=dc3,DC=dc4" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://AD-DC-1:389 ldap://AD-DC-2:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> demo (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 70 from 127.0.0.1:1812 to 127.0.0.1:53801 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 70 with timestamp +7 Ready to process requests

2 1

setting auth type
by Luke Smith 31 May '22

31 May '22

I'm trying to get several of my systems to work with radius and I'm noticing they are trying to authenticate via pap and I have no option to change it. However, in looking at the below debug output from radius it looks like radius is denying it before it is even getting to pa. I'd honestly like to setup an "allow all" as long as the AD user/pass combo works but I can't find anything about setting this up. (0) Received Access-Request Id 1 from 192.168.8.110:46728 to 192.168.55.107:1812 length 51 (0) User-Name = "testuid" (0) User-Password = "****" (0) Service-Type = Login-User (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "testuid", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> testuid (0) sql: SQL-User-Name set to 'testuid' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuid' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuid' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'testuid' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'testuid' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.48-MariaDB, protocol version 10 (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> testuid (0) sql: SQL-User-Name set to 'testuid' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuid', '****', 'Access-Reject', '2022-05-31 15:40:07.510994') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuid', '****', 'Access-Reject', '2022-05-31 15:40:07.510994') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> testuid (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 1 from 192.168.55.107:1812 to 192.168.8.110:46728 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 1 with timestamp +2 Ready to process requests Confidentiality Notice: The information herein transmitted or attached is intended only for the person or entity to which this e-mail is addressed and may contain confidential and/or legally privileged material. Any review, retransmission, dissemination, other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this in error, please contact the sender immediately and delete the material from any and all computers, servers, and e-mail programs. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.

2 1

Memory Issue on 3.0.25??
by Mucci Andrea 31 May '22

31 May '22

Hi all, we use FreeRADIUS Version 3.0.25, for host x86_64-redhat-linux-gnu. We use Oracle 19 and the client "ORACLE_HOME=/usr/include/oracle/19.12/client64". In the last period we have this kind of issue: Mon May 30 18:06:00 2022 : Error: Received conflicting packet from client eIUMRad port 51000 - ID: 153 due to unfinished request in module cache-clid. Giving up on old request. Mon May 30 18:06:00 2022 : Error: Received conflicting packet from client eIUMRad port 51000 - ID: 155 due to unfinished request in module cache-clid. Giving up on old request. Mon May 30 18:06:01 2022 : Error: Received conflicting packet from client eIUMRad port 51000 - ID: 156 due to unfinished request in module cache-clid. Giving up on old request. Mon May 30 18:06:01 2022 : WARNING: (19200636) WARNING: Module rlm_cache became unblocked Mon May 30 18:06:01 2022 : Error: 1 requests have been waiting in the processing queue for 6 seconds. Check that all databases are running properly! Mon May 30 18:06:01 2022 : WARNING: (19200613) WARNING: Module rlm_cache became unblocked Mon May 30 18:06:01 2022 : WARNING: (19200612) WARNING: Module rlm_cache became unblocked Mon May 30 18:06:01 2022 : WARNING: (19200615) WARNING: Module rlm_cache became unblocked Mon May 30 18:06:01 2022 : WARNING: (19200638) WARNING: Module rlm_cache became unblocked This is the status process: â— radiusd.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled; vendor preset: disabled) Active: active (running) since Fri 2022-05-20 08:39:21 CEST; 1 weeks 4 days ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 17344 ExecStartPre=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS) Main PID: 17348 (radiusd) Status: "Processing requests" Memory: 2.4G (limit: 2.5G) CGroup: /system.slice/radiusd.service â””â”€17348 /usr/sbin/radiusd -f PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 17348 radiusd 20 0 9814724 2.536g 13656 S 33.3 5.4 838:57.37 radiusd The process use a large amount of memory. With the version 3.0.18 we have never encountered this kind of issue. BR Andrea

2 1

update-disconnect and originate-coa
by Antonios Kalkakos 31 May '22

31 May '22

Hello all, I am trying to figure out how to disconnect a user using the originate-coa and update disconnect{} using FreeRADIUS 3.0.21 on Debian 11. Sorry if it seems a bit stupid, but I am really confused and frustrated... Let's say that a user configured in user's file "testuser Cleartext-Password := "password", Login-Time := "Wk1000-1400"" should be disconnected after the permitted Login-Time has passed. I enabled and changed the contents of the originate-coa according to it's documentation, using the correct NAS IP address, secret etc and added the coa_server = coa under the appropriate NAS section in clients.conf. According to my understanding FreeRADIUS should have generated coa messages to the NAS but it didn't do anything. Is this the correct way to forcibly disconnect the user using originate-coa? Sorry again if the following question may be a bit stupid, but what is the recommended place in the virtual server (except pre- or post-proxy) to put update coa{} or update disconnect{}? Using radclient (cat packet.txt | radclient -x <nas ip address>:3799 disconnect "secret"") with the Acct-Session-Id obtained from freeradius -X output and the NAS coa secret, the user was disconnected normally. Thank you very much in advance, Antonios Kalkakos

3 3

EAP-TLS and EAP-Identity
by David Weidenkopf 27 May '22

27 May '22

Hello, I am trying to understand EAP-TLS configuration. RFC3748 seems to indicate that the identity response can be empty. This makes sense for EAP-TLS, since it is using certificates, so maybe the identity is not useful in that case. I am aware of RFC5080 and it seems to discuss the conflicting requirements around this. However, from looking at what I could find on this list about EAP-TLS configuration, is that the supplicant (wpa_supplicant in this case) is broken if it does not provide an identity. We control the supplicant and are only trying to integrate with customers using 8021X with WPA. We don't control their configuration. We have one that insists the identity should be able to be blank. My interest here is we use freeradius for testing our system. Is there a configuration for EAP-TLS that supports a blank or empty Identity? I appreciate any wisdom anyone can share regarding this. Regards David

2 2

Configuration file /etc/freeradius/radiusd.conf is globally writable
by Elias Pereira 26 May '22

26 May '22

Hi, I have set up an infrastructure with a freeradius container in docker, but the error below occurs whenever the container goes up. Configuration file /etc/freeradius/radiusd.conf is globally writable. Refusing to start due to insecure configuration. I have locally a folder with files from a freeradius server that I use in a VM. These files, via Dockerfile I copy to the container and then change the permission of the folder to: chown -R freerad. /etc/freeradius I'm not sure if the owner would be just freerad or it would have to be root:freerad, or if I have to change the permissions too. Any ideas? -- Elias Pereira

2 3

FreeRADIUS and Active Directory: Access-Reject
by White, Daniel E. (GSFC-770.0)[AEGIS] 25 May '22

25 May '22

I am attaching the entire output captured from “radiusd -X” Here is the important parts: RHEL 8.5 Trying to talk to Active Directory with LDAP My Microsoft SME says AD will never hand back a password. How do I get RADIUS to hand the password to AD ? (0) Received Access-Request Id 70 from 127.0.0.1:53801 to 127.0.0.1:1812 length 74 (0) User-Name = "demo" (0) User-Password = <<User Password>> (0) NAS-IP-Address = <<local host IP>> (0) NAS-Port = 0 (0) Message-Authenticator = 0x590d9fc4e81ec118e32a67ad6fea50ca (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "demo", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (sAMAccountName=demo) (0) ldap: Performing search in "OU=USERS,DC=dc1,DC=dc2,DC=dc3,DC=dc4" with filter "(sAMAccountName=demo)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "CN=Demo,OU=USERGROUP,OU=USERS,DC=dc1,DC=dc2,DC=dc3,DC=dc4" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://AD-DC-1:389 ldap://AD-DC-2:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> demo (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 70 from 127.0.0.1:1812 to 127.0.0.1:53801 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 70 with timestamp +7 Ready to process requests

2 1

free radius health check
by Mark Lybarger 20 May '22

20 May '22

hi, i'm looking to have a health check for my freeradius servers. they're doing udp on 1812/1813, but my aws nlb only handles health check via tcp (http). is there a way to expose an http port in addition to the udp ports for freeradius? or any clever ways to handle this? thanks!

3 5