- Freeradius-Users - lists.freeradius.org

Re: FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 09 May '22

09 May '22

Thanks, Alan The users are connecting to network devices (Cisco, Juniper switches and routers) The network devices connect to RADIUS to verify the user's credentials which redide in AD. From your response, it sounds like the existing configuration will work without the need to add winbind. Is this accurate ? On 5/9/22, 07:52, "Freeradius-Users on behalf of Alan DeKok" <freeradius-users-bounces+daniel.e.white=nasa.gov(a)lists.freeradius.org on behalf of aland(a)deployingradius.com> wrote: On May 9, 2022, at 7:31 AM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > RHEL 8 server > Joined to AD domain using sssd for credentials > > The file /etc/nsswitch.conf contains: > > passwd: sss files systemd > group: sss files systemd > netgroup: sss files > automount: sss files > services: sss files > > shadow: files sss > hosts: files dns myhostname > > aliases: files > ethers: files > gshadow: files > networks: files dns > protocols: files > publickey: files > rpc: files > > This guide > https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.free… > says to append "winbind" to passwd, shadow, group, protocols, services, netgroup, automount > > Is this going to break things ? If you want users to come directly from AD, then you can add winbind. If instead you use sssd for users, and it connects to AD, then just list "sss". Alan DeKok.

1 0

PEAP-MSCHAPv2 and anonymous outer identity - can't understand passing inner username to outer tunnel
by Samuel Walker-Kierluk 05 May '22

05 May '22

Hi all, I’ve got FreeRADIUS handling our “eduroam” needs at my university. Users from outside our realms are proxied to the national eduroam proxies, and users matching our realms are handled locally: -Authentication: PEAP-MSCHAPv2 authentication (using ntlm_auth) against our Active Directory domain controllers -Post-Auth in outer server file: for users of our own realm and on our own campus’s network, I use a few “if” statements (one based on a username pattern, another based on an LDAP-Group lookup of Stripped-User-Name) to send the VLAN ID to the access point. This works wonderfully when using the same inner and outer identity, but after I set up anonymous outer identities on my clients, the VLAN ID assignment in the post-auth section doesn’t work properly, as it uses the outer identity “anonymous” instead of the username from the inner tunnel. I’ve spent about a day and a half working on this, going through old mailing list posts and the documentation, inserting and removing sections, with no progress being made. It’s clear that I’ve missed some piece of information or misunderstood a critical concept, regarding how to pass the inner identity (hopefully both User-Name and Stripped-User-Name) to the outer post-auth section. (I don’t need the actual Access-Accept message to contain the inner identity, I just need to be able to use it for the VLAN assignment.) I thought that the “copy_request_to_tunnel” and “use_tunneled_reply” would update at least the User-Name attribute (though not the Stripped-User-Name attribute of the outer tunnel), but even my first “if” statement in my outer-tunnel post-auth section, which uses the User-Name attribute, always receives “anonymous” as the User-Name attribute. I also tried making a dictionary Attribute for local use (ID between 3000 and 4000, type string), along the lines of “Username-to-use-for-VLAN-assignment”, and having it be set in the inner-tunnel server and accessible to the outer-tunnel server, but I think I’ve misunderstood how this works. Given the trouble I’m having, I think I’ve missed something that should have been obvious (with more sleep? or more coffee?) and would really appreciate any pointers that might come to mind! I’ve included below: —outer-tunnel configuration —inner-tunnel configuration —eap module configuration Does anyone have any advice on what I might have missed, or where to look? Happy to provide a debug. Apologies for anything incomprehensible in the configs… they are put together from a number of different tutorials from GEANT and other online resources, and I am relatively new to RADIUS. Best, Samuel server eduroam { listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } authorize { if ("%{client:shortname}" !~ /rad[1-2]\.eduroam\.fr/) { update request { Operator-Name := "1MYDOMAIN.FR" } } auth_log suffix if (Realm == "NULL") { update request { &Module-Failure-Message += 'Rejected: Realm is NULL' } reject } eap } authenticate { # Uniquement le module eap eap } preacct { suffix } accounting { } post-auth { if ("%{client:shortname}" == "campus-wifi") { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-ID := 6 # Unless a user-group check below indicates a different VLAN, user will get VLAN 6, the guest VLAN. } if (Realm == "MYDOMAIN.FR") || (Realm == "SECONDARYDOMAIN.FR") { if (&User-Name =~ /[aA][1234567890][1234567890]*/) { # for User-Name starting with a[1-9].... update reply { Tunnel-Private-Group-ID := 17 # Set to student VLAN. } } elsif (LDAP-Group == "CN=Employees,OU=Groups,DC=mydomain,DC=local") { # For staff and faculty... update reply { Tunnel-Private-Group-ID := 15 # Set to staff VLAN } } else { update reply { Tunnel-Private-Group-ID := 6 # For all users not covered above, set to guest VLAN } } } } reply_log Post-Auth-Type REJECT { reply_log } } pre-proxy { pre_proxy_log if("%{Packet-Type}" != "Accounting-Request") { attr_filter.pre-proxy } } post-proxy { post_proxy_log attr_filter.post-proxy } } server eduroam-inner-tunnel { authorize { auth_log files # for the eduroam test account eap mschap pap } authenticate { Auth-Type ntlm_auth { ntlm_auth } Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } post-auth { reply_log Post-Auth-Type REJECT { reply_log update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } } eap { # General EAP information default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} tls-config tls-common { private_key_file = ${certdir}/myCert.key certificate_file = ${certdir}/myCert.cer ca_file = ${cadir}/myCertCA.cer dh_file = ${certdir}/dh random_file = /dev/urandom ca_path = ${cadir} cipher_list = "DEFAULT@SECLEVEL=1" ecdh_curve = "prime256v1" tls_min_version = "1.0" tls_max_version = "1.2" cache { enable = yes name = example-cache-name # NAME OF CACHE persist_dir = ${logdir}/tlscache } verify { } ocsp { enable = no } } # Declare the EAP methods being used. ttls { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } mschapv2 { } }

3 2

freeradius_server_release_3_0_25 was changed
by Andrei Katsuk 04 May '22

04 May '22

I used https://github.com/FreeRADIUS/freeradius-server/archive/release_3_0_25.zip link to download and build freeradius-server. But after some time the archive was changed and there were no any comments about it. Attached you can find the diff (seems it related to rlm_couchbase module). Please comment this, should I use the newest archive or previous one? and why this changes disappeared ? Andrei

3 2

Re: Freeradius-Users Digest, Vol 205, Issue 1
by thyde rndstudio.com 01 May '22

01 May '22

Alan - thank you; that was the same path I was (kind of) working down (although I didn't show the explicit example), and it was giving me the unable to load module errors. From your example it dawned on me since I had used hyphens in the file and module names, perhaps the interpreter was being confused, so I used the "eap2" example to start more simply, but still get the same error: /etc/freeradius/3.0/mods-enabled/eap2[2]: Failed to link to module 'rlm_eap2': /usr/lib/freeradius/rlm_eap2.so: cannot open shared object file: No such file or directory (TL/DR: it's not the hyphens, it was contradictory information on how to replicate module sections from the documentation and past list info; additionally, avoid the use of the word "replicate" when searching documentation - that's a whole different beast. I will admit to the fact that putting "copy module" into the wiki for FR does return a single result and that information is relevant, but only AFTER you already know the solution; it's for OTP specifically, not generic.) I did get this going with the nudge given by Alan, but for those watching: It took a little more digging to get details, these helped me get more insight: https://lists.freeradius.org/pipermail/freeradius-users/2017-April/087371.h… and https://fossies.org/linux/freeradius-server/raddb/mods-available/README.rst If you find some search results that illustrate to copy the eap "module" and rename sections of it - don't copy the FILE as those instructions infer! Copy the eap SECTION inside of mods-available/eap while still INSIDE of eap file, with renaming. such as in mods-available/eap: eap { ... } eap SSID-A { ...} And as the posts above indicate, in your sites-enabled/default (or whatever your actual server is) be sure to place a reference in the authenticate section as well as your actual call (Remember I'm doing EAP-TLS, so): if(Eap-Message) { # EAP-TLS with certificate, no u/p, no mac filter if (Aruba-Essid-Name == "mySSID-A") { SSID-A } ...etc... and further on: authenticate { ... Auth-Type eap { eap { ...} } Auth-Type SSID-A { SSID-A { ...} } ... } Noting also that the hyphens in file and module names do not currently upset the interpreter. Many thanks, Ted. ________________________________ From: Freeradius-Users <freeradius-users-bounces+thyde=rndstudio.com(a)lists.freeradius.org> on behalf of freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> Sent: Sunday, May 1, 2022 8:00 AM To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Subject: Freeradius-Users Digest, Vol 205, Issue 1 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. EAP-TLS separate client cert per ssid FR v3.0.17 (thyde rndstudio.com) 2. Re: EAP-TLS separate client cert per ssid FR v3.0.17 (Alan Buxey) ---------------------------------------------------------------------- Message: 1 Date: Sat, 30 Apr 2022 14:02:36 +0000 From: thyde rndstudio.com <thyde(a)rndstudio.com> To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: EAP-TLS separate client cert per ssid FR v3.0.17 Message-ID: <SJ0PR19MB442956C3357B75B8EDD1D809B9FF9(a)SJ0PR19MB4429.namprd19.prod.outlook.com> Content-Type: text/plain; charset="utf-8" Good morning, I've been using FR for a number of years, with some "approved" and some "less than approved" configuration edits, but mostly with straightforward single CA, single client cert, EAP-TLS configuration, which has been outstanding. I have other configs where I add in EAP-TTLS or do mac auth, however what I would like to try next is EAP-TLS with multiple SSIDs, where there is a single separate cert per SSID. Please note that the certs will have different issue dates, and may change per freeradius instance, so chaining client certs into a single file and trying to attack some cert property is not the preferred path, unless it is the ONLY path. It would make cert management difficult to say the least. I have reviewed documentation to the best of my ability, however a lot of the searching (including on netrad) turned up solutions that were for prior versions of FR, with results for FR2 being most popular. I also see a number of posts/responses that ask if it can be done, where the response is "yes lot of people do it" - but there is no actual instruction on how to do so. There are also snippets of earlier versions of FR3 prior the "tls-common" update, which attempting those breaks my current version, as one would expect. (As noted in subject, my FR version is 3.0.17) So far, I have tried to replicate the eap module (mods-enabled/eap -> renaming both file and module) with no success as FR complains about my copied eap modules not being compiled (cannot fine {name}.so) - which I fully understand where that is coming from as a dev myself I'm not really interested in re-writing the eap module source just to accommodate this particular forced practice, of which I'm sure Alan would agree (just getting that taken care of early in the conversation). Is there an example doc that could illustrate how to "properly" instruct the eap module to test only ClientCertA against SSID-A and only ClientCertB against ClientCertB? A test of ClientCertB attempting to associate on SSID-A must? fail. I would like to retain the ability to also pre-test mac auth on some SSIDs before eap as I currently do in my default site (ie in sites-enabled/default) Currently I test against SSID and mac in my site/server: (inside authorize) if(Eap-Message) { # EAP-TLS with certificate, no u/p, no mac filter. if (Aruba-Essid-Name == "ALANSFREEWIFI") { eap } # EAP-TLS with certificate, no u/p, WITH mac filter. elsif (Aruba-Essid-Name == "ALANSPROTECTEDNETWORK") { if (Calling-Station-Id == "aabbccddeeff") { eap } } etc... and the eap module is currently stock aside from the certificate details; however in the above version, the same cert is on all clients - and that's not my optimal deployment choice. Moving forward, should this test happen in the virt-server (ie in sites-enabled/default), or does the (mods-enabled/eap) get extended to test against the ssid and mac? Kindest regards, Ted. ------------------------------ Message: 2 Date: Sun, 1 May 2022 09:03:35 +0100 From: Alan Buxey <alan.buxey(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: EAP-TLS separate client cert per ssid FR v3.0.17 Message-ID: <CAOVYXj_wfJzffbXooqK_C4yG1ym5s_dqMPVP8tkuEKZ_B26-9g(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hi, The easiest way is to just use inland, change whichever ssid you want to to call eg 'eap2' instead 'eap' and copy current eap module configuration file to a new eap2 configuration file and edit it so that it's known as eap2 . Then edit eap2 to provide/use new CA/cert/whatever alan On Sat, 30 Apr 2022, 15:02 thyde rndstudio.com, <thyde(a)rndstudio.com> wrote: > Good morning, > I've been using FR for a number of years, with some "approved" and some > "less than approved" configuration edits, but mostly with straightforward > single CA, single client cert, EAP-TLS configuration, which has been > outstanding. I have other configs where I add in EAP-TTLS or do mac auth, > however what I would like to try next is EAP-TLS with multiple SSIDs, where > there is a single separate cert per SSID. > > Please note that the certs will have different issue dates, and may change > per freeradius instance, so chaining client certs into a single file and > trying to attack some cert property is not the preferred path, unless it is > the ONLY path. It would make cert management difficult to say the least. > > I have reviewed documentation to the best of my ability, however a lot of > the searching (including on netrad) turned up solutions that were for prior > versions of FR, with results for FR2 being most popular. I also see a > number of posts/responses that ask if it can be done, where the response is > "yes lot of people do it" - but there is no actual instruction on how to > do so. There are also snippets of earlier versions of FR3 prior the > "tls-common" update, which attempting those breaks my current version, as > one would expect. (As noted in subject, my FR version is 3.0.17) > > So far, I have tried to replicate the eap module (mods-enabled/eap -> > renaming both file and module) with no success as FR complains about my > copied eap modules not being compiled (cannot fine {name}.so) - which I > fully understand where that is coming from as a dev myself I'm not really > interested in re-writing the eap module source just to accommodate this > particular forced practice, of which I'm sure Alan would agree (just > getting that taken care of early in the conversation). > > Is there an example doc that could illustrate how to "properly" instruct > the eap module to test only ClientCertA against SSID-A and only ClientCertB > against ClientCertB? A test of ClientCertB attempting to associate on > SSID-A must? fail. > > I would like to retain the ability to also pre-test mac auth on some SSIDs > before eap as I currently do in my default site (ie in > sites-enabled/default) Currently I test against SSID and mac in my > site/server: (inside authorize) > > if(Eap-Message) { > > # EAP-TLS with certificate, no u/p, no mac filter. > if (Aruba-Essid-Name == "ALANSFREEWIFI") { > eap > } > # EAP-TLS with certificate, no u/p, WITH mac filter. > elsif (Aruba-Essid-Name == "ALANSPROTECTEDNETWORK") { > if (Calling-Station-Id == "aabbccddeeff") { > eap > } > > } > etc... > > and the eap module is currently stock aside from the certificate details; > however in the above version, the same cert is on all clients - and that's > not my optimal deployment choice. > > Moving forward, should this test happen in the virt-server (ie in > sites-enabled/default), or does the (mods-enabled/eap) get extended to test > against the ssid and mac? > > Kindest regards, > Ted. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 205, Issue 1 ************************************************

2 1

EAP-TLS separate client cert per ssid FR v3.0.17
by thyde rndstudio.com 01 May '22

01 May '22

Good morning, I've been using FR for a number of years, with some "approved" and some "less than approved" configuration edits, but mostly with straightforward single CA, single client cert, EAP-TLS configuration, which has been outstanding. I have other configs where I add in EAP-TTLS or do mac auth, however what I would like to try next is EAP-TLS with multiple SSIDs, where there is a single separate cert per SSID. Please note that the certs will have different issue dates, and may change per freeradius instance, so chaining client certs into a single file and trying to attack some cert property is not the preferred path, unless it is the ONLY path. It would make cert management difficult to say the least. I have reviewed documentation to the best of my ability, however a lot of the searching (including on netrad) turned up solutions that were for prior versions of FR, with results for FR2 being most popular. I also see a number of posts/responses that ask if it can be done, where the response is "yes lot of people do it" - but there is no actual instruction on how to do so. There are also snippets of earlier versions of FR3 prior the "tls-common" update, which attempting those breaks my current version, as one would expect. (As noted in subject, my FR version is 3.0.17) So far, I have tried to replicate the eap module (mods-enabled/eap -> renaming both file and module) with no success as FR complains about my copied eap modules not being compiled (cannot fine {name}.so) - which I fully understand where that is coming from as a dev myself I'm not really interested in re-writing the eap module source just to accommodate this particular forced practice, of which I'm sure Alan would agree (just getting that taken care of early in the conversation). Is there an example doc that could illustrate how to "properly" instruct the eap module to test only ClientCertA against SSID-A and only ClientCertB against ClientCertB? A test of ClientCertB attempting to associate on SSID-A must fail. I would like to retain the ability to also pre-test mac auth on some SSIDs before eap as I currently do in my default site (ie in sites-enabled/default) Currently I test against SSID and mac in my site/server: (inside authorize) if(Eap-Message) { # EAP-TLS with certificate, no u/p, no mac filter. if (Aruba-Essid-Name == "ALANSFREEWIFI") { eap } # EAP-TLS with certificate, no u/p, WITH mac filter. elsif (Aruba-Essid-Name == "ALANSPROTECTEDNETWORK") { if (Calling-Station-Id == "aabbccddeeff") { eap } } etc... and the eap module is currently stock aside from the certificate details; however in the above version, the same cert is on all clients - and that's not my optimal deployment choice. Moving forward, should this test happen in the virt-server (ie in sites-enabled/default), or does the (mods-enabled/eap) get extended to test against the ssid and mac? Kindest regards, Ted.

3 2

warning and ignore radius log messages
by Can Paçacı 29 Apr '22

29 Apr '22

Hi Too many the following logs started to come from our radius servers (version 3.0.20). db is external and PostgreSql-12. What does this mean? Is it database problem or anything else? What can we do? There is no auth. and acct. problem on the FR server observed. WARNING: Module rlm_sql became unblocked Ignoring duplicate packet from client 34Acibh01 port 1812 - ID: 129 due to unfinished request in component session module sql Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

3 3

SQL module and credentials configured in the clear
by Brendan Kearney 29 Apr '22

29 Apr '22

for a myraid of purposes, i have my radius servers connect to MariaDB, and have configured mods-available/sql with the requisite user/pass credential set. i am wondering if the case can be made to add/include the option to use the keytab created and used for LDAP connectivity. having a user/pass combo in clear text on the filesystem is no-no in many organizations. per the mariadb docs, i setup gssapi and created my user and used gssapi for authentication /https://mariadb.com/kb/en/authentication-plugin-gssapi// create the user that matches what is configured in the keytab in mariadb: /create user 'radius\/server2.bpk2.com' identified via gssapi;/ note the hard quoting and escaping of the forward slash. this was the only combination that resulted in the user being successfully created for me. i authenticated with the keytab, and pulled a TGT: / [root@server1 raddb]# kinit -kt radius.keytab -p radius/server1.bpk2.com// // [root@server1 raddb]# klist// // Ticket cache: FILE:/tmp/krb5cc_0// // Default principal: radius/server1.bpk2.com(a)BPK2.COM// // // Valid starting Expires Service principal// // 04/28/2022 19:47:51 04/29/2022 19:47:51 krbtgt/BPK2.COM(a)BPK2.COM// // renew until 05/05/2022 19:47:51/ then i connected to the database using the identity: / [root@server1 raddb]# mysql -h database -u radius/server1.bpk2.com radius// // Reading table information for completion of table and column names// // You can turn off this feature to get a quicker startup with -A// // // Welcome to the MariaDB monitor. Commands end with ; or \g.// // Your MariaDB connection id is 125319// // Server version: 10.4.19-MariaDB MariaDB Server// // // Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.// // // Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.// // // MariaDB [radius]> show tables;// // +------------------------+// // | Tables_in_radius |// // +------------------------+// // .../ / MariaDB [radius]> status// // --------------// // mysql Ver 15.1 Distrib 10.4.19-MariaDB, for Linux (x86_64) using EditLine wrapper// // // Connection id: 125319// // Current database: radius// // Current user: radius/server1.bpk2.com(a)server1.bpk2.com/ it is entirely possible to use the keytab and connect to a properly configured mariadb instance with a keytab. can the functionality to authenticate to databases like mariadb with the keytab be added? thank you, brendan

2 1

Building Freeradius 3.2.0
by Bassem Mettichi 28 Apr '22

28 Apr '22

Hello, iam trying to build Freeradius 3.2.0 from source when i run make i get these warnings: CC src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c: In function ‘mod_process’: src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c:832:8: warning: implicit declaration of function ‘EC_POINT_get_affine_coordinates’; did you mean ‘EC_POINT_get_affine_coordinates_GFp’? [-Wimplicit-function-declaration] 832 | if (!EC_POINT_get_affine_coordinates(session->group, session->my_element, x, y, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | EC_POINT_get_affine_coordinates_GFp CC src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c: In function ‘do_equation’: src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c:144:2: warning: implicit declaration of function ‘EC_GROUP_get_curve’; did you mean ‘EC_GROUP_get_degree’? [-Wimplicit-function-declaration] 144 | EC_GROUP_get_curve(group, p, a, b, bnctx); | ^~~~~~~~~~~~~~~~~~ | EC_GROUP_get_degree In file included from src/modules/rlm_eap/eap.h:29, from src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.h:38, from src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c:37: src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c: In function ‘compute_password_element’: src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c:259:17: warning: implicit declaration of function ‘EVP_MD_CTX_new’; did you mean ‘EVP_MD_CTX_init’? [-Wimplicit-function-declaration] 259 | MEM(hmac_ctx = EVP_MD_CTX_new()); | ^~~~~~~~~~~~~~ src/freeradius-devel/radiusd.h:396:22: note: in definition of macro ‘MEM’ 396 | #define MEM(x) if (!(x)) { ERROR("%s[%u] OUT OF MEMORY", __FILE__, __LINE__); _fr_exit_now(__FILE__, __LINE__, 1); } | ^ src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c:259:15: warning: assignment to ‘EVP_MD_CTX *’ {aka ‘struct env_md_ctx_st *’} from ‘int’ makes pointer from integer without a cast [-Wint-conversion] 259 | MEM(hmac_ctx = EVP_MD_CTX_new()); | ^ src/freeradius-devel/radiusd.h:396:22: note: in definition of macro ‘MEM’ 396 | #define MEM(x) if (!(x)) { ERROR("%s[%u] OUT OF MEMORY", __FILE__, __LINE__); _fr_exit_now(__FILE__, __LINE__, 1); } | ^ src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c:390:4: warning: implicit declaration of function ‘EVP_MD_CTX_reset’; did you mean ‘EVP_MD_CTX_creat’? [-Wimplicit-function-declaration] 390 | EVP_MD_CTX_reset(hmac_ctx); | ^~~~~~~~~~~~~~~~ | EVP_MD_CTX_create src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c:481:4: warning: implicit declaration of function ‘EC_POINT_set_affine_coordinates’; did you mean ‘EC_POINT_set_affine_coordinates_GFp’? [-Wimplicit-function-declaration] 481 | !EC_POINT_set_affine_coordinates(session->group, session->pwe, x_candidate, y, session->bnctx)) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | EC_POINT_set_affine_coordinates_GFp src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c:510:2: warning: implicit declaration of function ‘EVP_MD_CTX_free’; did you mean ‘EVP_MD_CTX_create’? [-Wimplicit-function-declaration] 510 | EVP_MD_CTX_free(hmac_ctx); | ^~~~~~~~~~~~~~~ | EVP_MD_CTX_create src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c: In function ‘process_peer_commit’: src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c:666:7: warning: implicit declaration of function ‘EC_POINT_get_affine_coordinates’; did you mean ‘EC_POINT_get_affine_coordinates_GFp’? [-Wimplicit-function-declaration] 666 | if (!EC_POINT_get_affine_coordinates(session->group, K, session->k, NULL, bn_ctx)) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | EC_POINT_get_affine_coordinates_GFp How to solve this issue ? Thanks Bassem

4 6

reconnect to mysql on DB write errors
by Cypher A 26 Apr '22

26 Apr '22

Is there a way / config option for freeRadius to reconnect to sql server on DB operation errors (eg. db write errors). background: the sql cluster we use is behind a DNS based Load balancer. Every 2 weeks, half of the cluster are taken out of DNS for service by automated tasks. The DNS update happens a few seconds after the servers are taken out (and all DBs marked read-only) and during these few seconds, radius can still connect to the down'd sql servers but all writes will fail. Eventually, the read-only mysql will stop and radius will reconnect to the valid sql servers. The one option I see "connect_failure_retry_delay" seems to only matter for establishing sql connection. In this case, sql connection itself is fine, just to a read-only DB. Any suggestions are welcome. tia.

3 8

Granting varied levels of NAS permission based on LDAP group membership
by Braden McGrath 24 Apr '22

24 Apr '22

FR users & maintainers, I have a functional FreeRADIUS installation (3.0.20 - I know it's slightly old, it's from the Ubuntu repo - on Ubuntu 20.04LTS), being used for management access and authorization on varied network equipment at an ISP (not everything supports TACACS so we're using RADIUS). When I first setup this system, Alan and other members of this group gave me a bunch of help and I threw together a policy.d file (called "group_authz") that is querying for LDAP group membership, and then altering the replies back to the various NASes with specific attributes to grant read-only or read-write permissions on the devices. I was originally told by my boss that a universal read-only and read-write group would be sufficient, so it was pretty easy to check for membership in one of those two groups and then just send back specific attributes depending on %{client:nas_type}. Of course, now the goalposts have shifted. I've been told that we need "tiered" access. Some users (tier 2 NOC team) should get R/W to most of the network, but should *not* have any access at all to some of the more sensitive gear (core/datacenter network stuff). Others (tier 1 NOC team) should get only R/O to the same chunk of network, but not the sensitive stuff. We still need a "full R/W" (tier3/architects) and "full R/O" (probably won't get used much, but just in case) as well. I'm now trying to figure out the "best" / most elegant way to handle this new requirement. I'm thinking that it would be helpful to use group nesting to make things more simple on the LDAP side, but I don't know if LDAP-Group[*] will catch nested membership (user is a member of group X, which is a member of group Y - does LDAP-Group show group Y)? I'll also need to define the "sensitive" gear somehow (either via NAS name or IP address as defined in clients.conf) and return a reject for those cases... Below is the entirety of my "group_authz" file from policy.d/ so you know what I'm doing now. I am far from a developer, so I'm open to any and all ideas to improve this (in case I've done something stupid), as well as meet my new "tiered" requirements. Thanks all! Braden McGrath braden(a)big-geek.net group_authz { if (&LDAP-Group[*] == "cn=network-fulladmin,${modules.ldap.group.base_dn}") { switch "%{client:nas_type}" { case mikrotik { # For Mikrotik routers update reply { &Mikrotik-Group := "full" } return } case dell_os10 { # For Dell OS10 switches update reply { &Cisco-AVPair += 'shell:roles="sysadmin"' } return } case juniper { # For Juniper / JunOS devices update reply { &Juniper-Local-User-Name := "SUPER" } return } case cisco { update reply { &Cisco-AVPair += "shell:priv-lvl=15" # &Service-Type := "Administrative-User" } return } case awplus { # AlliedWare Plus - Allied Telesis switches (and others) # https://www.alliedtelesis.com/sites/default/files/documents/configuration-g… # NOTE: AWPlus treats any Service-Type other than "Administrative-User" or "NAS-Prompt-User" as ACCESS-REJECT update reply { &Service-Type := "Administrative-User" } return } case { # default case - shouldn't ever match! update reply { &Reply-Message := "Could not find NAS_Type - check clients.conf?" } reject } } # debug_reply return } elsif (&LDAP-Group[*] == "cn=network-readonly,${modules.ldap.group.base_dn}") { switch "%{client:nas_type}" { case mikrotik { # Obviously, this group gets read access... update reply { &Mikrotik-Group := "read" } return } case dell_os10 { # On the Dells, this allows normal "op" actions but can't read/dump config update reply { &Cisco-AVPair += 'shell:roles="netoperator"' } return } case juniper { # true read-only for now, can use "OPR" if we want to allow clearing counters / etc update reply { &Juniper-Local-User-Name := "RO" } return } case cisco { update reply { # priv-lvl=1 is basic RO / not-enabled on Cisco, not "7" like Allied Telesis &Cisco-AVPair += "shell:priv-lvl=1" #&Service-Type := "NAS-Prompt-User" } return } case awplus { # this should be readonly/show commands for Allied Telesis # Definitely need both of these for priv7 level, drop the AVPair for just priv1 update reply { &Cisco-AVPair += "shell:priv-lvl=7" &Service-Type := "NAS-Prompt-User" } return } case { # default case, shouldn't ever match update reply { &Reply-Message := "Could not find NAS_Type - check clients.conf?" } reject } } return } else { update reply { &Reply-Message := "User not authorized - check directory/LDAP group membership" } reject } }

4 5