- Freeradius-Users - lists.freeradius.org

How to configure FreeRADIUS authentication with Active Directory
by Network RADIUS 10 Jan '22

10 Jan '22

** How to configure FreeRADIUS authentication with Active Directory --------------------------------------------- Active Directory is widely used in the Enterprise and University systems. However, because of proprietary design decisions within Active Directory, getting it to work with FreeRADIUS requires a few extra steps. When FreeRADIUS uses Active Directory as a user database, certain limitations apply. Active Directory won’t give FreeRADIUS the “known good” password for FreeRADIUS to use. Instead, FreeRADIUS has to take the user authentication data (PAP, MS-CHAP, etc.) and hand them to Active Directory. It will check the information, and return success / fail to FreeRADIUS. For MS-CHAP authentication, the way to connect FreeRADIUS to Active Directory is through Samba, and the ntlm_auth helper program. This article walks through the steps for configuring Samba to act as an intermediary between FreeRADIUS and Active Directory. Read the full article… https://networkradius.com/articles/2021/09/29/configure-authentication-with… <https://networkradius.com/articles/2021/09/29/configure-authentication-with…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

sql authorization but using LDAP for authentication?
by Coy Hile 08 Jan '22

08 Jan '22

Hi all, I’m trying to centralize a few things in my POC setup on my network so that I don’t have separate RADIUS password for access to terminal servers or network devices). I see the following: ===== (0) Received Access-Request Id 204 from 192.168.42.18:33452 to 172.17.64.47:1812 length 90 (0) User-Name = "hile" (0) User-Password = “REDACTED" (0) NAS-IP-Address = 192.168.42.18 (0) NAS-Identifier = "basement-anc1" (0) NAS-Port = 32427 (0) NAS-Port-Type = Virtual (0) Calling-Station-Id = "10.100.9.64" (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) policy filter_password { (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) EXPAND %{string:User-Password} (0) --> REDACTED (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> TRUE (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) update request { (0) EXPAND %{string:User-Password} (0) —> REDACTED &Tmp-String-0 := dkG0,t7Ly (0) EXPAND %{string:Tmp-String-0} (0) --> REDACTED (0) &User-Password := dkG0,t7Ly (0) &Tmp-String-0 !* ANY (0) } # update request = noop (0) } # if (&User-Password && (&User-Password != "%{string:User-Password}")) = noop (0) } # policy filter_password = noop (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/192.168.42.18/auth-detail-20220107 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.42.18/auth-detail-20220107 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Jan 7 20:45:37 2022 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "hile", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=hile) (0) ldap: Performing search in "dc=coyhile,dc=com" with filter "(uid=hile)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=hile,ou=people,dc=coyhile,dc=com" (0) ldap: Processing user attributes (0) ldap: control:Password-With-Header += '{crypt}$6$ut$GUTveD8XX1rMcJSpadioxYp7YUtSdTMauWDcNuzQu3mqVn20k8x3Wo2Kb6K9V8BeliKYCC9THwEEbnH5yc2vH.' rlm_ldap (ldap): Released connection (0) Need more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap.coyhile.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Closing expired connection (4) - Hit idle_timeout limit rlm_ldap (ldap): Closing expired connection (3) - Hit idle_timeout limit rlm_ldap (ldap): Closing expired connection (2) - Hit idle_timeout limit rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing expired connection (1) - Hit idle_timeout limit (0) [ldap] = updated (0) sql: EXPAND %{User-Name} (0) sql: --> hile (0) sql: SQL-User-Name set to 'hile' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'hile' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'hile' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: WARNING: User not found in radcheck table. (0) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='hile' ORDER BY priority (0) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='hile' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' port=5432 user='radius' password='radpass' application_name='FreeRADIUS 3.0.25 - radiusd (sql)' Connected to database 'radius' on 'postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' server version 120001, protocol version 3, backend PID 113082 rlm_sql (sql): Closing expired connection (5) - Hit idle_timeout limit rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (4) - Hit idle_timeout limit rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (3) - Hit idle_timeout limit rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (2) - Hit idle_timeout limit rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): Closing expired connection (0) - Hit idle_timeout limit rlm_sql_postgresql: Socket destructor called, closing socket (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: Converted: &control:Password-With-Header -> &control:Crypt-Password (0) pap: Removing &control:Password-With-Header (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known-good" Crypt-password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/192.168.42.18/reply-detail-20220107 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.42.18/reply-detail-20220107 (0) reply_log: EXPAND %t (0) reply_log: --> Fri Jan 7 20:45:37 2022 (0) [reply_log] = ok (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND %{User-Name} (0) sql: --> hile (0) sql: SQL-User-Name set to 'hile' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('hile', 'dkG0=3D2Ct7Ly', 'Access-Accept', '2022-01-07 20:45:37.860687' ) (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('hile', 'dkG0=3D2Ct7Ly', 'Access-Accept', '2022-01-07 20:45:37.860687' ) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (1) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = ok (0) Sent Access-Accept Id 204 from 172.17.64.47:1812 to 192.168.42.18:33452 length 20 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 204 with timestamp +69 Ready to process requests ======= My question is that since there’s a username set from the LDAP module, but NOT one found in the SQL module, the sql module never checks the `radreply` table. Contrast that with a setup where I have a password set in the SQL module itself, one sees: ====== Ready to process requests (0) Received Access-Request Id 91 from 192.168.42.18:1530 to 172.17.64.47:1812 length 90 (0) User-Name = "hile" (0) User-Password = "dkG0,t7Ly\000\000\000\000\000\001a" (0) NAS-IP-Address = 192.168.42.18 (0) NAS-Identifier = "basement-anc1" (0) NAS-Port = 505 (0) NAS-Port-Type = Virtual (0) Calling-Station-Id = "10.100.9.64" (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) policy filter_password { (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) EXPAND %{string:User-Password} (0) --> dkG0,t7Ly (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> TRUE (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) update request { (0) EXPAND %{string:User-Password} (0) --> dkG0,t7Ly (0) &Tmp-String-0 := dkG0,t7Ly (0) EXPAND %{string:Tmp-String-0} (0) --> dkG0,t7Ly (0) &User-Password := dkG0,t7Ly (0) &Tmp-String-0 !* ANY (0) } # update request = noop (0) } # if (&User-Password && (&User-Password != "%{string:User-Password}")) = noop (0) } # policy filter_password = noop (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/192.168.42.18/auth-detail-20220107 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.42.18/auth-detail-20220107 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Jan 7 20:59:11 2022 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "hile", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> hile (0) sql: SQL-User-Name set to 'hile' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'hile' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'hile' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "dkG0,t7Ly" (0) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'hile' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'hile' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 3 , fields = 5 (0) sql: User found in radreply table, merging reply items (0) sql: Arista-AVPair := "shell:priv-lvl=15" (0) sql: Arista-AVPair := "shell:roles=network-admin" (0) sql: Filter-Id := ":group_name=admin;" (0) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='hile' ORDER BY priority (0) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='hile' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' port=5432 user='radius' password='radpass' application_name='FreeRADIUS 3.0.25 - radiusd (sql)' Connected to database 'radius' on 'postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' server version 120001, protocol version 3, backend PID 113633 (0) [sql] = ok rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=hile) (0) ldap: Performing search in "dc=coyhile,dc=com" with filter "(uid=hile)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=hile,ou=people,dc=coyhile,dc=com" (0) ldap: Processing user attributes (0) ldap: control:Password-With-Header += '{crypt}$6$ut$GUTveD8XX1rMcJSpadioxYp7YUtSdTMauWDcNuzQu3mqVn20k8x3Wo2Kb6K9V8BeliKYCC9THwEEbnH5yc2vH.' rlm_ldap (ldap): Released connection (0) Need more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap.coyhile.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = updated (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: Config already contains a "known good" password (&control:Cleartext-Password). Ignoring &control:Password-With-Header (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/192.168.42.18/reply-detail-20220107 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.42.18/reply-detail-20220107 (0) reply_log: EXPAND %t (0) reply_log: --> Fri Jan 7 20:59:11 2022 (0) [reply_log] = ok (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> hile (0) sql: SQL-User-Name set to 'hile' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('hile', 'dkG0=3D2Ct7Ly', 'Access-Accept', '2022-01-07 20:59:11.751612' ) (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('hile', 'dkG0=3D2Ct7Ly', 'Access-Accept', '2022-01-07 20:59:11.751612' ) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' port=5432 user='radius' password='radpass' application_name='FreeRADIUS 3.0.25 - radiusd (sql)' Connected to database 'radius' on 'postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' server version 120001, protocol version 3, backend PID 113634 (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = ok (0) Sent Access-Accept Id 91 from 172.17.64.47:1812 to 192.168.42.18:1530 length 98 (0) Arista-AVPair = "shell:priv-lvl=15" (0) Arista-AVPair = "shell:roles=network-admin" (0) Filter-Id = ":group_name=admin;" (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 91 with timestamp +51 ======= Is there some configuration that I need to tweak to make the server check `radreply` table even there’s no user returned from the rad check table? -- Coy Hile coy.hile(a)coyhile.com

2 2

attr.filter.reject should not remove FreeRADIUS-Response-Delay Attributes
by Daniel Finger 07 Jan '22

07 Jan '22

Hi! I experimented a bit with the FreeRADIUS-Response-Delay attributes, but it did not work at first. If I add those back to the attr_filter/access_reject configuration, everythings works as I expected it. Is it possible to change the default https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-conf… configuration or is there a deeper meaning behind the removal? -- Greetings Daniel Finger

2 1

Fwd: Tagged Vlan pass with Cisco Switch in Freeradius
by Demo Demo 07 Jan '22

07 Jan '22

Hej Experts, I require an avail to understand how we can give tagged Vlan or more than one Vlan in Freeradius with Cisco 3000 series switch. I am able to push the one VLAN at a time for a utilizer but it will be great if i can pass the two vlan of a Utilizer at same time. Thanks for your fortification. BR// Asha

1 0

FR 3.0 doesn't return Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-Id in Access-Accept
by Alex Zetaeffesse 07 Jan '22

07 Jan '22

Hi, I configured a user as follows in /etc/freeradius/3.0/users # PEAP Cisco cisco(a)realm.local Cleartext-password := realm123 Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id = "VLAN103" I see FR sends such attributes in the second Access-Challenge but not in the Access-Accept. Therefore our 9800 puts the client in the default VLAN. Most probably it's a FR misconfiguration but I wouldn't know why and where in the config to fix it. I have attached the debugs from freeradius -X and the captures. Hope somebody can point me in the right direction. Alex

2 3

Easy way to see what is missing from configuration?
by Coy Hile 05 Jan '22

05 Jan '22

Hi all, I had saved older (still 3.x versions, but unknown how far downrev) versions of a configuration from a working server, and I’m reinstalling a newer version on Ubuntu 20.04. I *thought* I had configured everything appropriately, but apparently not in the least. I get, e.g. radiusd -XC [….] Ignoring "sql" (see raddb/mods-available/README.rst) […] Is there some easy way to see what is missing or otherwise objected to in mods-available/sql? -- Coy Hile coy.hile(a)coyhile.com

2 2

tls/ssl
by mohamed almeshal 04 Jan '22

04 Jan '22

happy new year for all savers ... i have issue with tls ... what i want to achieve is not to order sign request from devices and let the server accept all requests until it have vaild cert . i try some tricks but no luck . i think i have to disable require client cert but with no luck . thanks savers

2 1

Radius requests from unknow hosts
by Marko Bozinovski 04 Jan '22

04 Jan '22

Hello, First time doing this, so I am not sure if i am doing it correctly. I have configured RADIUS server and setup few juniper devices. Configuration is ok, my clients can authenticate using radius etc. I am worried about one thing. When i configure one EX switch, it keeps sending some strange request, something like this (0) User-Name = "root" (0) User-Password = "\010\n\r\177IN" (0) NAS-Identifier = "EX1" (0) Calling-Station-Id = "165.22.195.82" (0) NAS-IPv6-Address = 2600:894c0:c0:30::6 Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { NAS-IPv6-Address is the address of that EX, and NAS-Identifier is ok, but username root is strange, and calling-station-id. >From my perspective it looks like it is sending requests from that EX with username root. Sometimes it use other usernames. I have read that can be related to brute force attack's. Thank you and sorry for noob and confusing question. Marko

2 1

Self Service Kiosk / Workflow to trust untrusted devices to add them to personal VLAN dynamically
by Stefan Mueller 04 Jan '22

04 Jan '22

Hello FreeRADIUS user, I hope that someone out there is able to give me some piece of advice to my unusual idea. There are two WiFis in our multi-apartment building: 1. WPA2 EAP Auth - for trusted user (such as residents) using FreeRADIUS for authentication and dynamic VLAN assignment 2. WPA2 PSK (for guests, IoT without EAP support etc.) Currently, the admin has to assign printer, TV-Boxes etc. manually to the respective VLAN of a resident. The standard use case to make this necessary is to allow the respective resident to control the device by smartphone. Is it somehow possible to allow each resident to open an GUI and select untrusted devices (devices connected to the WPA2 PSK) and just click on a button to make them trusted, so their VLAN assignment will be change, means FreeRADIUS changes the following Mikrotik-Wireless-VLANID := 10, Mikrotik-Wireless-VLANID-Type := 0, due to this *workflow *triggered by an trusted user via the GUI? Thank you and a restful start into 2022 Stefan

2 4

How to use Virtual Servers
by Network RADIUS 04 Jan '22

04 Jan '22

** How to use FreeRADIUS virtual servers --------------------------------------------- Virtual servers provide a powerful way to define unique policies for different traffic sources. When policy rules for each traffic source are defined in their own separate configuration file, it’s a lot simpler to define them, understand them, and debug them. Virtual servers are unique to FreeRADIUS. Other RADIUS servers typically have one global policy, with sub-policies defined in a series of nested if/else statements. Unfortunately, the logic expressed in the if/else statements quickly becomes difficult to understand and maintain for all but the simplest scenarios. As the needs of the network infrastructure evolves over time, the logic statements grow in complexity and become error prone and difficult to debug. Changes to one piece may result in unexpected side effects. Read the full article… https://networkradius.com/articles/2021/09/25/virtual-servers.html <https://networkradius.com/articles/2021/09/25/virtual-servers.html> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/contact/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0