- Freeradius-Users - lists.freeradius.org

eapol_test on Windows ;-)
by Stefan Paetow 09 Mar '21

09 Mar '21

Hi everyone, So... question... we’re trying to resolve something tricky with one of our members who is a Windows person. Given that I know eapol_test, I thought I’d give it a try to build it with mingw64, not fun. Does *anyone* on the list happen to have managed to build it on Windows, and if you have, could I possibly beg you for a copy? ☺ Alternatively, and I’m looking at the Gods o’ RADIUS here, do you know of something else that speaks EAP that works on Windows, but doesn’t require the poor man to download the better part of a gigabyte of ‘stuff’ to run some EAP tests? I know we’re all Linux and macOS wonks here, but... help? ☺ With Kind Regards Stefan Paetow Federated Roaming Technical Specialist t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet In line with government advice, at Jisc we’re now working from home and our offices are currently closed. Read our statement on coronavirus<https://www.jisc.ac.uk/about/corporate/coronavirus-statement>. jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

3 4

Migrate working freeradius config to another server
by Kyle Keilson 05 Mar '21

05 Mar '21

Has anyone had success copying thier existing FreeRadius config from one working server to another? I'm trying to migrate a server and copied the /etc/raddb directory (ensuring symlinks are intact), but I am getting errors particularly with modules: /etc/raddb/sites-enabled/default[341]: Failed to find "auth_log" as a module or policy. /etc/raddb/sites-enabled/default[341]: Please verify that the configuration exists in /etc/raddb/mods-enabled/auth_log. /etc/raddb/sites-enabled/default[265]: Errors parsing authorize section. On the working server, this module does not exist in this directory. I am confused why it is prompting as an error on this server. Kyle Keilson Institutional Technology Ringling College of Art and Design 2700 N Tamiami Trail Sarasota, FL 34234 Office: 941.359.7633 Web: www.ringling.edu<http://www.ringling.edu/>

2 1

How to bind-map 802.1X identity to DHCP-provided IP address ?
by Olivier 05 Mar '21

05 Mar '21

Hello, For logging purpose in MSCHAPv2 WiFi environment, I would like to enforce or log a 802.1X ID-to-IP address map. 1. What are the available options to implement this ? I'm daily using ISC DHCP or Dnsmasq for implementing DHCP services but I wouldn't hesitate to use something (Freeradius, ISC Kea, whatever, ..) if that helped. 2. I've read that DHCP Option 82 suboptions could be used with DHCP Relay to inject in DHCP requests some additional data but I fail to see how 802.1X could be part of this injected data. Is it worth digging this path ? Best regards

2 1

Access-Reject
by Hassan, Hazem (Nokia - EG/Cairo) 04 Mar '21

04 Mar '21

Hi , I have IPoE setup , it stuck on authentication with the following error: Given the user file as show below: User file: 98:86:5d:90:c2:84 Cleartext-Password := "LetMeIn" Alc-Subsc-Prof-Str = "three_services_1G", Alc-SLA-Prof-Str = "Internet_1G", Alc-Subsc-ID-Str = "98:86:5d:90:c2:84", Framed-IP-Address = 100.0.0.3, Framed-IP-Netmask = 255.255.255.0, Framed-Route = "192.168.1.0/24 0.0.0.0", Alc-Default-Router = 100.0.0.2, Alc-Primary-Dns = 188.172.144.120, Alc-Secondary-Dns = 141.0.144.64, Delegated-IPv6-Prefix = 2a02:8802::/64, Alc-Ipv6-Address = 2a02:8800::3/128 Error in the debug (5) Received Access-Request Id 193 from 10.113.139.50:64445 to 80.194.79.79:1812 length 149 (5) User-Name = "98:86:5d:90:bd:b4" (5) User-Password = "LetMeIn" (5) NAS-IP-Address = 10.113.139.50 (5) NAS-Port-Type = Ethernet (5) NAS-Port-Id = "lag-2:11" (5) NAS-Identifier = "BNG-SR1" (5) Alc-Client-Hardware-Addr = "98:86:5d:90:bd:b4" (5) Acct-Session-Id = "785EB00001369B60414DD7" (5) Alc-SAP-Session-Index = 1 (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "98:86:5d:90:bd:b4", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: No EAP-Message, not doing EAP (5) [eap] = noop (5) [files] = noop (5) [expiration] = noop (5) [logintime] = noop (5) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (5) pap: WARNING: Authentication will fail unless a "known good" password is available (5) [pap] = noop (5) } # authorize = ok (5) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> 98:86:5d:90:bd:b4 (5) attr_filter.access_reject: Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) [eap] = noop (5) policy remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) { (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else { (5) [noop] = noop (5) } # else = noop (5) } # policy remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Cleaning up request packet ID 191 with timestamp +10 (5) Sending delayed response (5) Sent Access-Reject Id 193 from 80.194.79.79:1812 to 10.113.139.50:64445 length 20 Waking up in 1.3 seconds. Any idea? Thanks, Hazem

3 3

lpad on regular expression matches does not work
by Tomasz Chiliński 04 Mar '21

04 Mar '21

Hello all, I try to improve Calling-Station-Id MAC address canonicalization a little bit, so that is should left pad MAC octets with zeroes. I modified default settings as is: mac-addr-regexp = '([0-9a-f]{1,2})[:\-\.]([0-9a-f]{1,2})[:\-\.]([0-9a-f]{1,2})[:\-\.]([0-9a-f]{1,2})[:\-\.]([0-9a-f]{1,2})[:\-\.]([0-9a-f]{1,2})' This regular expression matches example MAC address properly: [0] => 18:d0:71:f3:70:8 [1] => 18 [2] => d0 [3] => 71 [4] => f3 [5] => 70 [6] => 8 Then I want to make the whole thing this way: rewrite_calling_station_id { if (&Calling-Station-Id && (&Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i)) { update request { &Calling-Station-Id := "%{toupper:%{lpad:%{1} 2 0}:%{lpad:%{2} 2 0}:%{lpad:%{3} 2 0}:%{lpad:%{4} 2 0}:%{lpad:%{5} 2 0}:%{lpad:%{6} 2 0}}" } updated } else { noop } } And here's surprise - lpad expression function handles only attribute parameters (ex. {lpad:&User-Name 100 0}), but not regexp matches. What am I doing wrong? -- Bests, Tomasz Chiliński, Chilan opiekun projektu LMS - https://lms.org.pl kierownik projektu LMS Plus / LMS+ - https://lms-plus.org -- Pozdrawiam Tomasz Chiliński, Chilan opiekun projektu LMS - https://lms.org.pl kierownik projektu LMS Plus / LMS+ - https://lms-plus.org

3 5

Bug in new freeradius patch
by lingctam 04 Mar '21

04 Mar '21

Hi all, We have two freeradius servers running as a pair. After applying the new freeradius patch to both servers, the radiusd service would disappear one in one server and soon after, the service disappears in the second sever. There are no indication of the root cause from system logs. New version: freeradius-3.0.20-3.module_el8.3.0+476+0982bc20.x86_64 Old version: freeradius-3.0.17-7.module_el8.2.0+321+f9fd5d26.x86_64 After reverting one server to old freeradius version, the radiusd service runs without issue. Has anyone run into this issue? Thanks in advance.

2 1

Standard & Realm Authentication
by Richard J Palmer 02 Mar '21

02 Mar '21

Hello All We have been using FreeRadius for quite a long time to authenticate PPPoE and L2TP sessions and hotspots. So far everything works. However I'd like to add an extra function and wondered if you could provide a pointers, Generally Users send their username - we look in SQL and return Data from radreply / ip pools etc. We have no problem there. On our LNS / LAC Devices we also have a small number of sessions that we forward to other ISPs. With these we don't have the username - but forward based on realm On our LNS We have: --- <match name="EXAMPLE-FWD" graph="EXAMPLE-FWD" username="*myexample.co.uk @example.ws" payload-table="0" relay-pick="true" relay-ip="1.2.3.4 1.2.3.5" relay-secret="test123" relay-hostname="test-hostname"/> --- As an alternative the LNS can get this data from Radius - and given the growing number of LNS devices - rather than keeping the sync up to date on multiple devices it makes sence to run this as part of the radius. NOTE this is not a radius proxy - where we pass on the radius request if it's a matching realm - BUT a radius reply to the LNS telling it to forward the connection on to the customers LNS. What I am trying to achieve in FreeRadius is 1) If there's an exact username (as now) continue as now 2) IF there's not a match either run a second SQL which will find the realm - and return accept. And then pass back the necessary attributes back to allow the session to forward. Pretty happy to do most of the work here but some pointers would be perfect. I could I suppose do this by replacing the SQL query with a stored procedure - but open to any better ideas? Thanks in advance Richard

3 6

sqlippool, same username, give different pool IP addresses
by Alberio Mirko 26 Feb '21

26 Feb '21

hello there, I am using a freeradius instance for assigning PPPoE public ip addresses to our customers. Also I created a different ip pool for service purpose, we have a service PPPoE single username for the management of the routers and it is always the same, the goal is that when the router is connected to our network it gets a private management IP so we can access and configure it. The management IP should be took from the aforemented pool, dynamically, and freed when the router is configured. So for example pool is: 172.16.0.1 172.16.0.2 172.16.0.3 172.16.0.4 routerA authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 routerB authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.2 ... etc. Could this can be done using freeradius and its modules? At the moment using sqlippool I can only get the same user to get always the same ip, example: routerA authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 routerB authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 ... etc. can somebody help me? Thanks-a-lot! I attach the debugfile as intended. -- Mirko Alberio mirko.alberio(a)telemar.it

2 1

Freeradius3.x with Openldap Authorization
by Srijan 26 Feb '21

26 Feb '21

Hello, greetings.. I got some queries related to openldap authentication and authorization, followed ldap_howto.rst. Able to Authenticate via ldap but for authorization not working according to userwise's profiles.. how can i obtain user's profile. if i put default profile then it works and reply same to all users, Here's my ldap config: ldap { server = 'localhost' identity = 'cn=adm,dc=xyx,dc=com.' base_dn = 'ou=radius,dc=xyz,dc=com' update { control:Password-With-Header += 'userPassword' control:Expiration := 'radiusExpiration' control:Calling-Station-Id := 'radiusCallingStationId' control:NAS-Identifier := 'radiusNASIdentifier' control:Simultaneous-Use := 'radiusSimultaneousUse' reply:Reply-Message := 'radiusReplyMessage' control:NT-Password := 'ntPassword' reply:Idle-Timeout := 'radiusIdleTimeout' reply:Session-Timeout := 'radiusSessionTimeout' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" sasl { } } profile { filter = '(objectclass=radiusprofile)' default = 'uid=planx,ou=profiles,ou=radius,dc=xyz,dc=com' attribute = 'radiusProfileDn' } Result with Default profile config: Sent Access-Request Id 188 from 0.0.0.0:60201 to 127.0.0.1:1812 length 77 User-Name = "user1" User-Password = "user123" NAS-IP-Address = 10.21.8.10 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "user123" Received Access-Accept Id 188 from 127.0.0.1:1812 to 127.0.0.1:60201 length 104 Idle-Timeout = 600 Session-Timeout = 86400 Acct-Interim-Interval = 10800 ERX-Egress-Policy-Name = "20MD" ERX-Ingress-Policy-Name = "20MU" MS-Primary-DNS-Server = 1.1.1.1 MS-Secondary-DNS-Server = 9.9.9.9 Framed-Pool = "staff-pool" Openldap: # planx, profiles, radius, xyz.com dn: uid=planx,ou=profiles,ou=radius,dc=xyz,dc=com cn: planx radiusIdleTimeout: 600 radiusSessionTimeout: 86400 radiusServiceType: Framed-User radiusFramedProtocol: PPP uid: planx objectClass: radiusObjectProfile objectClass: radiusprofile radiusReplyAttribute: Acct-Interim-Interval := 10800 radiusReplyAttribute: ERX-Egress-Policy-Name := 10MD radiusReplyAttribute: ERX-Ingress-Policy-Name := 20MU radiusReplyAttribute: MS-Primary-DNS-Server := 1.1.1.1 radiusReplyAttribute: MS-Secondary-DNS-Server := 9.9.9.9 radiusReplyAttribute: Framed-Pool := staff-pool # plany, profiles, radius, xyz.com dn: uid=plany,ou=profiles,ou=radius,dc=xyz,dc=com cn: plany objectClass: radiusObjectProfile objectClass: radiusprofile objectClass: top radiusFramedProtocol: PPP radiusIdleTimeout: 600 radiusServiceType: Framed-User radiusSessionTimeout: 86400 uid: plany radiusReplyAttribute: Acct-Interim-Interval := 10800 radiusReplyAttribute: ERX-Egress-Policy-Name := 10MD radiusReplyAttribute: ERX-Ingress-Policy-Name := 10MU radiusReplyAttribute: MS-Primary-DNS-Server := 1.1.1.1 radiusReplyAttribute: MS-Secondary-DNS-Server := 9.9.9.9 radiusReplyAttribute: Framed-Pool := default-pool # users, radius, xyz.com dn: ou=users,ou=radius,dc=xyz,dc=com objectClass: organizationalUnit objectClass: top ou: users dn: uid=user1,ou=users,ou=radius,dc=xyz,dc=com radiusGroupName: planx uid: user1 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: radiusprofile *is " radiusGroupName:" obsolete in Freeradius3 ?* dn: uid=user2,ou=users,ou=radius,dc=xyz,dc=com radiusGroupName: plany uid: user2 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: radiusprofile ----- How can I obtain a user's profile, please suggest.. Regards, Srijan

2 1

Change Of Authorization
by Hassan, Hazem (Nokia - EG/Cairo) 26 Feb '21

26 Feb '21

Hi , Is it possible to do COA via FreeRadius ? If yes how? Thanks, Hazem

3 2