- Freeradius-Users - lists.freeradius.org

update-disconnect and originate-coa
by Antonios Kalkakos 31 May '22

31 May '22

Hello all, I am trying to figure out how to disconnect a user using the originate-coa and update disconnect{} using FreeRADIUS 3.0.21 on Debian 11. Sorry if it seems a bit stupid, but I am really confused and frustrated... Let's say that a user configured in user's file "testuser Cleartext-Password := "password", Login-Time := "Wk1000-1400"" should be disconnected after the permitted Login-Time has passed. I enabled and changed the contents of the originate-coa according to it's documentation, using the correct NAS IP address, secret etc and added the coa_server = coa under the appropriate NAS section in clients.conf. According to my understanding FreeRADIUS should have generated coa messages to the NAS but it didn't do anything. Is this the correct way to forcibly disconnect the user using originate-coa? Sorry again if the following question may be a bit stupid, but what is the recommended place in the virtual server (except pre- or post-proxy) to put update coa{} or update disconnect{}? Using radclient (cat packet.txt | radclient -x <nas ip address>:3799 disconnect "secret"") with the Acct-Session-Id obtained from freeradius -X output and the NAS coa secret, the user was disconnected normally. Thank you very much in advance, Antonios Kalkakos

3 3

EAP-TLS and EAP-Identity
by David Weidenkopf 27 May '22

27 May '22

Hello, I am trying to understand EAP-TLS configuration. RFC3748 seems to indicate that the identity response can be empty. This makes sense for EAP-TLS, since it is using certificates, so maybe the identity is not useful in that case. I am aware of RFC5080 and it seems to discuss the conflicting requirements around this. However, from looking at what I could find on this list about EAP-TLS configuration, is that the supplicant (wpa_supplicant in this case) is broken if it does not provide an identity. We control the supplicant and are only trying to integrate with customers using 8021X with WPA. We don't control their configuration. We have one that insists the identity should be able to be blank. My interest here is we use freeradius for testing our system. Is there a configuration for EAP-TLS that supports a blank or empty Identity? I appreciate any wisdom anyone can share regarding this. Regards David

2 2

Configuration file /etc/freeradius/radiusd.conf is globally writable
by Elias Pereira 26 May '22

26 May '22

Hi, I have set up an infrastructure with a freeradius container in docker, but the error below occurs whenever the container goes up. Configuration file /etc/freeradius/radiusd.conf is globally writable. Refusing to start due to insecure configuration. I have locally a folder with files from a freeradius server that I use in a VM. These files, via Dockerfile I copy to the container and then change the permission of the folder to: chown -R freerad. /etc/freeradius I'm not sure if the owner would be just freerad or it would have to be root:freerad, or if I have to change the permissions too. Any ideas? -- Elias Pereira

2 3

FreeRADIUS and Active Directory: Access-Reject
by White, Daniel E. (GSFC-770.0)[AEGIS] 25 May '22

25 May '22

I am attaching the entire output captured from “radiusd -X” Here is the important parts: RHEL 8.5 Trying to talk to Active Directory with LDAP My Microsoft SME says AD will never hand back a password. How do I get RADIUS to hand the password to AD ? (0) Received Access-Request Id 70 from 127.0.0.1:53801 to 127.0.0.1:1812 length 74 (0) User-Name = "demo" (0) User-Password = <<User Password>> (0) NAS-IP-Address = <<local host IP>> (0) NAS-Port = 0 (0) Message-Authenticator = 0x590d9fc4e81ec118e32a67ad6fea50ca (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "demo", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (sAMAccountName=demo) (0) ldap: Performing search in "OU=USERS,DC=dc1,DC=dc2,DC=dc3,DC=dc4" with filter "(sAMAccountName=demo)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "CN=Demo,OU=USERGROUP,OU=USERS,DC=dc1,DC=dc2,DC=dc3,DC=dc4" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://AD-DC-1:389 ldap://AD-DC-2:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> demo (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 70 from 127.0.0.1:1812 to 127.0.0.1:53801 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 70 with timestamp +7 Ready to process requests

2 1

free radius health check
by Mark Lybarger 20 May '22

20 May '22

hi, i'm looking to have a health check for my freeradius servers. they're doing udp on 1812/1813, but my aws nlb only handles health check via tcp (http). is there a way to expose an http port in addition to the udp ports for freeradius? or any clever ways to handle this? thanks!

3 5

FreeRadius server 3.0.21 user name case insensitivity
by Luveh Keraph 18 May '22

18 May '22

Out of the box, when fed a user name and password for authentication, the FreeRadius server 3.0.21 processes the user name in a case-sensitive way. I would like to configure my server so that it processes user names case-insensitively. So far what I have done is to add the following line to my /etc/raddb/mods-enabled/files file, within the file { } block: key = "%{%{Stripped-User-Name}:-%{tolower:%{User-Name}}}" This converts the user names received to all-lowercase. With this, things work as expected as long as I make sure to define my RADIUS users in my server's users file with all lowercase characters. Is it, however, possible to configure the FreeRadius server so that it compares input user names against those in the server's default users database in a case-insensitive way, so that names in this database - just a plaintext file, really - can be entered in mixed case?

3 2

rlm_ldap no longer support of krb5 cache config in FreeRaDIUS 3
by Peter Lee 17 May '22

17 May '22

In FreeRADIUS 2, the rlm_ldap module has assapi_krb5 included to allow users to enable/init krb5 with ccache from ldap configuration. However this feature has been removed from rlm_ldap in 3.0.x. What is the alternative way from FreeRADIUS 3 to enable/init multiple kerberos caches? Thank you.

2 1

log message when logintime returns userlock?
by Josef Vybíhal 17 May '22

17 May '22

HI list, I just set up the 'logintime' module. It works great - no problem there. I wanted to add one last thing - log when the user tries to login outside of allowed timeframe. It seemed easy to do: If the 'logintime' module returns 'userlock', I will just call the linelog module. post-auth { ... logintime if (userlock) { log_locked_by_logintime } ... } But this does not do what I expected. After logintime returns 'userlock', nothing else following in post-auth section is called. Snippet from debug: (9) } # policy assign_vlan = noop (9) logintime: Checking Login-Time (9) [logintime] = userlock (9) } # if (1) = userlock (9) } # post-auth = userlock (9) Using Post-Auth-Type Reject Technically it's inside of the if (1) {} condition, I have tried to move it outside of it, but the behavior was the same. Is this expected? Is there some trick how I can call the linelog in case of userlock? Due to the length of it, I have put full debug log here: https://up.jvi.cz/log_logintime.log Josef

2 2

Reporting on active users using radwho
by Djerk Geurts 16 May '22

16 May '22

Over the last week, I’ve spent some time getting radsniff telemetry into Grafana via Collectd and Telegraf. Sadly radsniff direct to Telegraf doesn’t work, but that’s another story. Wanting to graph online users I then scripted a rough little bit of bash to take the output of `radwho -r -n` and output the number of active users in influx format to Telegraf. However I’ve noticed that at midnight the reported online users drop to 0 to then slowly ramp up again. This may well be normal behaviour for what I should expect from rad who output, but it’s not what I’d like to see in my graph, it’s worrying to see the number of active xDSL subscribers drop to 0. I’d rather avoid having to state such a caveat. Is there a better way to track active users using the data available from FreeRADIUS server, its tools or directly from the (MySQL) database? — Thanks, Djerk Geurts

3 5

Case insensitive username
by Simon Dankau 13 May '22

13 May '22

Hello, we use FreeRadius at a school with about 3000 users and divide them into different groups. Since support requests often come from teachers who cannot enter their login data with correct capitalization, we want to use FreeRadius "case insensitive". At school we basically have 3 different groups. username student : 1234567 (a student's unique ID) username teacher: ABCD username employee: t.surname Some of our teachers try to login with "Abcd" or "abcd". That does not work, because FreeRadius is case sensitive. So far I've been browsing the forums and trying a few possible solutions. This includes the solutions from the following thread: https://lists.freeradius.org/pipermail/freeradius-users/2020-February/09751… 1. Changes in the server configuration authorize { update request { Stripped-User-Name := "%{tolower:%{User-Name}}" } ... everything else ... } 2. Changes in the "files" module key = "%{%{Stripped-User-Name}:-%{tolower:%{User-Name}}}" I can only test the login over the command line on our testserver, because i do not want to disrupt our currently working FreeRadius server including the wifi. All tests performed follow the scheme below. root@bkr-app:~# radtest TEST password 10.11.100.31:1812 10 test123 Sent Access-Request Id 245 from 0.0.0.0:33130 to 10.11.100.31:1812 length 74 User-Name = "TEST" User-Password = "start12K" NAS-IP-Address = 10.11.100.31 NAS-Port = 10 Message-Authenticator = 0x00 Cleartext-Password = "start12K" Received Access-Accept Id 245 from 10.11.100.31:1812 to 0.0.0.0:0 length 55 Reply-Message = "DEBUG: Lehrer VPN" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "37" root@bkr-app:~# radtest test start12K 10.11.100.31:1812 10 test123 Sent Access-Request Id 73 from 0.0.0.0:45170 to 10.11.100.31:1812 length 74 User-Name = "test" User-Password = "start12K" NAS-IP-Address = 10.11.100.31 NAS-Port = 10 Message-Authenticator = 0x00 Cleartext-Password = "start12K" Received Access-Reject Id 73 from 10.11.100.31:1812 to 0.0.0.0:0 length 46 Reply-Message = "DEBUG: Not found, reject" (0) -: Expected Access-Accept got Access-Reject root@bkr-app:~# Is there a way to use FreeRadius case insensitive so that we can reduce the support requests? Greetings from Germany, Simon

2 5