- Freeradius-Users - lists.freeradius.org

Modifying incoming packets with unlang
by David le Roux 28 Mar '22

28 Mar '22

Hello, I am migrating from an old raddb instance and one of the changes is that freeradius no longer uses the attr_rewrite module and instead relies on unlang. We use this module to change the packet requests and I have scoured the documentation but have made no headway in translating the following two commands, especially in how to deal with packets. Could I get some pointers by any unlang experts, I'm really scratching my head and this is all new to me. Thanks ============================= attr_rewrite copyusertocertcn { attribute = Cert-CN new_attribute = yes searchfor = "" searchin = packet replacewith = "%{User-Name}" } attr_rewrite removehostportion { attribute = Cert-CN searchin = packet searchfor = "(host/)(.*)" replacewith = "%{2}" ignore_case = no new_attribute = no } ============================= Kind regards, David le Roux ________________________________ Miller Homes Limited Registered in Scotland - SC255429 2 Lochside View, Edinburgh Park, Edinburgh, EH12 9DH Disclaimer: The Information in this e-mail is confidential and for use by the addressee(s) only. It may also be privileged. If you are not the intended recipient please notify us immediately on +44 (0) 870 336 5000 and delete the message from your computer: you may not copy or forward it, or use or disclose its contents to any other person. We do not accept any liability or responsibility for: (1) changes made to this email after it was sent, or (2) viruses transmitted through this email or any attachment. Miller Homes Limited <https://www.millerhomes.co.uk>

2 2

Get EAP version and TLS method via radius attributes
by Ibaakee Ledum 25 Mar '22

25 Mar '22

Hello, I'm a newbie to freeradius so forgive my lack of knowledge. I use the rlm_python module during radius authentication / authorization and would like to know if during EAP authentication, attributes related to EAP can be fetched from the rlm_python module to determine the EAP method used and TLS version if possible. E.g we have functions like *authorize, authenticate, post_auth *which are called during a radius request for rlm_python and they all accept a vps argument containing a tuple of request attributes, e.t.c. Is it possible to fetch EAP method and TLS version from this vps argument ? Thanks

2 1

Problem with "Fragmented IP protocol"
by Luca Bertoncello 24 Mar '22

24 Mar '22

Hi again, As I wrote yesterday, we have an Access Point in one office, connected via OpenVPN to the main office. Freeradius runs on the main office. When trying to authenticate with EAP-TLS it does not works (APs in main office have no problem). With Wireshark I see the error: 13 0.480756 10.6.21.9 10.0.21.10 IPv4 1516 Fragmented IP protocol (proto=UDP 17, off=0, ID=a62d) The packet was fragmented, but seems to reach the server with Freeradius. Can someone help me to solve the problem? Thanks a lot Luca Bertoncello

1 0

Setting Framed-MTU Attribute
by Luca Bertoncello 24 Mar '22

24 Mar '22

Hi list! We have a Freeradius 3.0.17 from Debian Repositories to serve the WLAN-Enterprise authentication. It work(ed) wonderful. Now we have a second office, connected via OpenVPN. In this office, too, there are devices that need to connect to the WLAN. We use Unifi to manage our WLANs. The problem: if the device uses WPA2-Enteprise with password authentication it works via VPN, too. If the device uses a certificate, the authentication process does not work. With tcpdump I see: 7 0.326167 10.6.21.10 10.0.21.10 IPv4 1514 Fragmented IP protocol (proto=UDP 17, off=0, ID=ced8) I already searched in net and I think, I have to set the Framed-MTU attribute to a lesser value. Current it is 1400 (if I see other packets in the communication). Problem: I cannot find a way to set it... I already tried to add the attribute in mods-config/attr_filter/access_challenge and in the inner tunnel. Even is the attribute 1400... Can someone help me? Thanks Luca Bertoncello

4 13

Freeradius (packetfence) - Error binding to port for 127.0.0.1 port 18121
by P.Thirunavukkarasu 24 Mar '22

24 Mar '22

Hi all, The following is the debug output and the error I noticed in the freeradius *freeradius -X* radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } Failed binding to auth address * port 1812 bound to server default: Address already in use /etc/freeradius/sites-enabled/default[59]: Error binding to port for 0.0.0.0 port 1812 */usr/sbin/freeradius -d /usr/local/pf/raddb -n auth -fxx -l stdout* auth: #### Opening IP addresses and Ports #### listen { type = "status" virtual_server = "status" ipaddr = 127.0.0.1 port = 18121 Failed binding to status address 127.0.0.1 port 18121 bound to server status: Address already in use /usr/local/pf/raddb/auth.conf[7]: Error binding to port for 127.0.0.1 port 18121 Regards, Thirunavukkarasu

5 6

Integration GO language into Freeradius
by Peter Balsianok 22 Mar '22

22 Mar '22

Hi, Is there any plan to integrate GO language into the Freeradius server? Similar to rlm_perl or rlm_python. Thank you very much for the answer. Peter Balsianok

8 15

multiple freeradius instances with sqlippool, is it safe?
by Matteo Sgalaberni 22 Mar '22

22 Mar '22

Hello, I'm would like to have multiple freeradius instances (processes on different servers) all pointing to the same postgres database. (My goal is to have a freeradius service redundant, I have a postgresql cluster with patroni/haproxy and each radius server point to all of them via a dsn multiple host connection definition and obviously it's connected to the master) I would like to use the sqlipool module. Is it safe use it in this scenario or does exists some side effects (I have some ideas of what could be wrong but I would like a your opinion...)? Do you have suggestions to what to pay attention to in this scenario? Thanks M.

4 6

Compile 3.0.25
by Nicolas Breuer 21 Mar '22

21 Mar '22

Hello the Community, I hope you are doing well. Can you help me to find what library is missing / corrupt to compile FR 3.0.0.25 LINK build/lib/rlm_otp.la CC src/modules/rlm_pap/rlm_pap.c LINK build/lib/rlm_pap.la CC src/modules/rlm_passwd/rlm_passwd.c LINK build/lib/rlm_passwd.la CC src/modules/rlm_perl/rlm_perl.c src/modules/rlm_perl/rlm_perl.c: In function âmod_bootstrapâ: src/modules/rlm_perl/rlm_perl.c:503: error: âPERL_API_VERSION_STRINGâ undeclared (first use in this function) src/modules/rlm_perl/rlm_perl.c:503: error: (Each undeclared identifier is reported only once src/modules/rlm_perl/rlm_perl.c:503: error: for each function it appears in.) make: *** [build/objs/src/modules/rlm_perl/rlm_perl.lo] Error 1 I have configured with : ./configure --enable-reproducible-builds

2 2

Return Username to the Mikrotik
by Muhammed Buvaydani 17 Mar '22

17 Mar '22

hello, I have enabled the mac authentication in my system, so when the user is connected to the wifi Mikrotik will send a mac address as a username, I am checking if the username is a mac address I am getting the username that belongs to that mac and do the rest of the authentication against the username(not the MAc) so if the user has rights access to the internet I am sending accept but Mikrotik saved the username as a mac address, I tried to reply with the attribute: User-Name="user" but it seems not working are there any attributes or something that I can do that Thanks in Advance

4 4

Monitoring FreeRadius with Icinga2
by Jonathan Davis 17 Mar '22

17 Mar '22

This is a brief question for those who use Icinga2 to monitor their FreeRadius servers. Do you use the built in radius check command, the remote (on the radius server) nagios check command, a bash/python script that executes 'radtest' remotely against the radius server (secret needs to be added as a variable to icinga), or something else? If you use a bash/python script, there are a few of them out there, what is the lists preference? Thank you, Jonathan

3 2