- Freeradius-Users - lists.freeradius.org

Password Change Prompt on NAS
by Feagles, Arthur B III CTR (USA) 24 Jan '21

24 Jan '21

Thanks to Alan’s guide “Configuring Authentication with Active Directory", users are successfully authenticating their network device logons (Cisco/Juniper) via AD. • What: I would like password expiration prompts be made available on the network devices • Why: To use the burden of changing expired passwords • what you expect the server to do: pass the error code 648 ERROR_PASSWD_EXPIRED to the NAS, and by some magic I don't understand prompt the user to change their password • what the server does instead (i.e. debug output): debug below; NAS does not prompt for password change, but instead repeats password: prompt. Thanks -Art- 1 FreeRADIUS Version 3.0.13 2 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors 3 There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A 4 PARTICULAR PURPOSE 5 You may redistribute copies of FreeRADIUS under the terms of the 6 GNU General Public License 7 For more information about these matters, see the file named COPYRIGHT 8 Starting - reading configuration files ... 9 including dictionary file /usr/share/freeradius/dictionary 10 including dictionary file /usr/share/freeradius/dictionary.dhcp 11 including dictionary file /usr/share/freeradius/dictionary.vqp 12 including dictionary file /etc/raddb/dictionary 13 including configuration file /etc/raddb/radiusd.conf 14 including configuration file /etc/raddb/proxy.conf 15 including configuration file /etc/raddb/clients.conf 16 including files in directory /etc/raddb/mods-enabled/ 17 including configuration file /etc/raddb/mods-enabled/always 18 including configuration file /etc/raddb/mods-enabled/attr_filter 19 including configuration file /etc/raddb/mods-enabled/cache_eap 20 including configuration file /etc/raddb/mods-enabled/chap 21 including configuration file /etc/raddb/mods-enabled/date 22 including configuration file /etc/raddb/mods-enabled/detail 23 including configuration file /etc/raddb/mods-enabled/detail.log 24 including configuration file /etc/raddb/mods-enabled/dhcp 25 including configuration file /etc/raddb/mods-enabled/digest 26 including configuration file /etc/raddb/mods-enabled/dynamic_clients 27 including configuration file /etc/raddb/mods-enabled/eap 28 including configuration file /etc/raddb/mods-enabled/echo 29 including configuration file /etc/raddb/mods-enabled/exec 30 including configuration file /etc/raddb/mods-enabled/expiration 31 including configuration file /etc/raddb/mods-enabled/expr 32 including configuration file /etc/raddb/mods-enabled/files 33 including configuration file /etc/raddb/mods-enabled/linelog 34 including configuration file /etc/raddb/mods-enabled/logintime 35 including configuration file /etc/raddb/mods-enabled/mschap 36 including configuration file /etc/raddb/mods-enabled/ntlm_auth 37 including configuration file /etc/raddb/mods-enabled/pap 38 including configuration file /etc/raddb/mods-enabled/passwd 39 including configuration file /etc/raddb/mods-enabled/preprocess 40 including configuration file /etc/raddb/mods-enabled/radutmp 41 including configuration file /etc/raddb/mods-enabled/realm 42 including configuration file /etc/raddb/mods-enabled/replicate 43 including configuration file /etc/raddb/mods-enabled/soh 44 including configuration file /etc/raddb/mods-enabled/sradutmp 45 including configuration file /etc/raddb/mods-enabled/unix 46 including configuration file /etc/raddb/mods-enabled/unpack 47 including configuration file /etc/raddb/mods-enabled/utf8 48 including files in directory /etc/raddb/policy.d/ 49 including configuration file /etc/raddb/policy.d/accounting 50 including configuration file /etc/raddb/policy.d/canonicalization 51 including configuration file /etc/raddb/policy.d/control 52 including configuration file /etc/raddb/policy.d/cui 53 including configuration file /etc/raddb/policy.d/debug 54 including configuration file /etc/raddb/policy.d/dhcp 55 including configuration file /etc/raddb/policy.d/eap 56 including configuration file /etc/raddb/policy.d/filter 57 including configuration file /etc/raddb/policy.d/operator-name 58 including files in directory /etc/raddb/sites-enabled/ 59 including configuration file /etc/raddb/sites-enabled/inner-tunnel 60 including configuration file /etc/raddb/sites-enabled/default 61 main { 62 security { 63 user = "radiusd" 64 group = "radiusd" 65 allow_core_dumps = no 66 } 67 name = "radiusd" 68 prefix = "/usr" 69 localstatedir = "/var" 70 logdir = "/var/log/radius" 71 run_dir = "/var/run/radiusd" 72 } 73 main { 74 name = "radiusd" 75 prefix = "/usr" 76 localstatedir = "/var" 77 sbindir = "/usr/sbin" 78 logdir = "/var/log/radius" 79 run_dir = "/var/run/radiusd" 80 libdir = "/usr/lib64/freeradius" 81 radacctdir = "/var/log/radius/radacct" 82 hostname_lookups = no 83 max_request_time = 30 84 cleanup_delay = 5 85 max_requests = 16384 86 pidfile = "/var/run/radiusd/radiusd.pid" 87 checkrad = "/usr/sbin/checkrad" 88 debug_level = 0 89 proxy_requests = yes 90 log { 91 stripped_names = no 92 auth = yes 93 auth_badpass = no 94 auth_goodpass = no 95 colourise = yes 96 msg_denied = "You are already logged in - access denied" 97 } 98 resources { 99 } 100 security { 101 max_attributes = 200 102 reject_delay = 1.000000 103 status_server = yes 104 } 105 } 106 radiusd: #### Loading Realms and Home Servers #### 107 proxy server { 108 retry_delay = 5 109 retry_count = 3 110 default_fallback = no 111 dead_time = 120 112 wake_all_if_all_dead = no 113 } 114 home_server localhost { 115 ipaddr = 127.0.0.1 116 port = 1812 117 type = "auth" 118 secret = <<< secret >>> 119 response_window = 20.000000 120 response_timeouts = 1 121 max_outstanding = 65536 122 zombie_period = 40 123 status_check = "status-server" 124 ping_interval = 30 125 check_interval = 30 126 check_timeout = 4 127 num_answers_to_alive = 3 128 revive_interval = 120 129 limit { 130 max_connections = 16 131 max_requests = 0 132 lifetime = 0 133 idle_timeout = 0 134 } 135 coa { 136 irt = 2 137 mrt = 16 138 mrc = 5 139 mrd = 30 140 } 141 } 142 home_server_pool my_auth_failover { 143 type = fail-over 144 home_server = localhost 145 } 146 realm example.com { 147 auth_pool = my_auth_failover 148 } 149 realm LOCAL { 150 } 151 radiusd: #### Loading Clients #### 152 client localhost { 153 ipaddr = 127.0.0.1 154 require_message_authenticator = no 155 secret = <<< secret >>> 156 nas_type = "other" 157 proto = "*" 158 limit { 159 max_connections = 16 160 lifetime = 0 161 idle_timeout = 30 162 } 163 } 164 client localhost_ipv6 { 165 ipv6addr = ::1 166 require_message_authenticator = no 167 secret = <<< secret >>> 168 limit { 169 max_connections = 16 170 lifetime = 0 171 idle_timeout = 30 Clients removed 1603 } 1604 Debugger not attached 1605 # Creating Auth-Type = mschap 1606 # Creating Auth-Type = eap 1607 # Creating Auth-Type = PAP 1608 # Creating Auth-Type = CHAP 1609 # Creating Auth-Type = MS-CHAP 1610 # Creating Auth-Type = ntlm_auth 1611 # Creating Auth-Type = digest 1612 radiusd: #### Instantiating modules #### 1613 modules { 1614 # Loaded module rlm_always 1615 # Loading module "reject" from file /etc/raddb/mods-enabled/always 1616 always reject { 1617 rcode = "reject" 1618 simulcount = 0 1619 mpp = no 1620 } 1621 # Loading module "fail" from file /etc/raddb/mods-enabled/always 1622 always fail { 1623 rcode = "fail" 1624 simulcount = 0 1625 mpp = no 1626 } 1627 # Loading module "ok" from file /etc/raddb/mods-enabled/always 1628 always ok { 1629 rcode = "ok" 1630 simulcount = 0 1631 mpp = no 1632 } 1633 # Loading module "handled" from file /etc/raddb/mods-enabled/always 1634 always handled { 1635 rcode = "handled" 1636 simulcount = 0 1637 mpp = no 1638 } 1639 # Loading module "invalid" from file /etc/raddb/mods-enabled/always 1640 always invalid { 1641 rcode = "invalid" 1642 simulcount = 0 1643 mpp = no 1644 } 1645 # Loading module "userlock" from file /etc/raddb/mods-enabled/always 1646 always userlock { 1647 rcode = "userlock" 1648 simulcount = 0 1649 mpp = no 1650 } 1651 # Loading module "notfound" from file /etc/raddb/mods-enabled/always 1652 always notfound { 1653 rcode = "notfound" 1654 simulcount = 0 1655 mpp = no 1656 } 1657 # Loading module "noop" from file /etc/raddb/mods-enabled/always 1658 always noop { 1659 rcode = "noop" 1660 simulcount = 0 1661 mpp = no 1662 } 1663 # Loading module "updated" from file /etc/raddb/mods-enabled/always 1664 always updated { 1665 rcode = "updated" 1666 simulcount = 0 1667 mpp = no 1668 } 1669 # Loaded module rlm_attr_filter 1670 # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter 1671 attr_filter attr_filter.post-proxy { 1672 filename = "/etc/raddb/mods-config/attr_filter/post-proxy" 1673 key = "%{Realm}" 1674 relaxed = no 1675 } 1676 # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter 1677 attr_filter attr_filter.pre-proxy { 1678 filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" 1679 key = "%{Realm}" 1680 relaxed = no 1681 } 1682 # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter 1683 attr_filter attr_filter.access_reject { 1684 filename = "/etc/raddb/mods-config/attr_filter/access_reject" 1685 key = "%{User-Name}" 1686 relaxed = no 1687 } 1688 # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter 1689 attr_filter attr_filter.access_challenge { 1690 filename = "/etc/raddb/mods-config/attr_filter/access_challenge" 1691 key = "%{User-Name}" 1692 relaxed = no 1693 } 1694 # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter 1695 attr_filter attr_filter.accounting_response { 1696 filename = "/etc/raddb/mods-config/attr_filter/accounting_response" 1697 key = "%{User-Name}" 1698 relaxed = no 1699 } 1700 # Loaded module rlm_cache 1701 # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap 1702 cache cache_eap { 1703 driver = "rlm_cache_rbtree" 1704 key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" 1705 ttl = 15 1706 max_entries = 0 1707 epoch = 0 1708 add_stats = no 1709 } 1710 # Loaded module rlm_chap 1711 # Loading module "chap" from file /etc/raddb/mods-enabled/chap 1712 # Loaded module rlm_date 1713 # Loading module "date" from file /etc/raddb/mods-enabled/date 1714 date { 1715 format = "%b %e %Y %H:%M:%S %Z" 1716 } 1717 # Loaded module rlm_detail 1718 # Loading module "detail" from file /etc/raddb/mods-enabled/detail 1719 detail { 1720 filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addre ss}}/detail-%Y%m%d" 1721 header = "%t" 1722 permissions = 384 1723 locking = no 1724 escape_filenames = no 1725 log_packet_header = no 1726 } 1727 # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log 1728 detail auth_log { 1729 filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addre ss}}/auth-detail-%Y%m%d" 1730 header = "%t" 1731 permissions = 384 1732 locking = no 1733 escape_filenames = no 1734 log_packet_header = no 1735 } 1736 # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log 1737 detail reply_log { 1738 filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addre ss}}/reply-detail-%Y%m%d" 1739 header = "%t" 1740 permissions = 384 1741 locking = no 1742 escape_filenames = no 1743 log_packet_header = no 1744 } 1745 # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log 1746 detail pre_proxy_log { 1747 filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addre ss}}/pre-proxy-detail-%Y%m%d" 1748 header = "%t" 1749 permissions = 384 1750 locking = no 1751 escape_filenames = no 1752 log_packet_header = no 1753 } 1754 # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log 1755 detail post_proxy_log { 1756 filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addre ss}}/post-proxy-detail-%Y%m%d" 1757 header = "%t" 1758 permissions = 384 1759 locking = no 1760 escape_filenames = no 1761 log_packet_header = no 1762 } 1763 # Loaded module rlm_dhcp 1764 # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp 1765 # Loaded module rlm_digest 1766 # Loading module "digest" from file /etc/raddb/mods-enabled/digest 1767 # Loaded module rlm_dynamic_clients 1768 # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients 1769 # Loaded module rlm_eap 1770 # Loading module "eap" from file /etc/raddb/mods-enabled/eap 1771 eap { 1772 default_eap_type = "md5" 1773 timer_expire = 60 1774 ignore_unknown_eap_types = no 1775 cisco_accounting_username_bug = no 1776 max_sessions = 16384 1777 } 1778 # Loaded module rlm_exec 1779 # Loading module "echo" from file /etc/raddb/mods-enabled/echo 1780 exec echo { 1781 wait = yes 1782 program = "/bin/echo %{User-Name}" 1783 input_pairs = "request" 1784 output_pairs = "reply" 1785 shell_escape = yes 1786 } 1787 # Loading module "exec" from file /etc/raddb/mods-enabled/exec 1788 exec { 1789 wait = no 1790 input_pairs = "request" 1791 shell_escape = yes 1792 timeout = 10 1793 } 1794 # Loaded module rlm_expiration 1795 # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration 1796 # Loaded module rlm_expr 1797 # Loading module "expr" from file /etc/raddb/mods-enabled/expr 1798 expr { 1799 safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" 1800 } 1801 # Loaded module rlm_files 1802 # Loading module "files" from file /etc/raddb/mods-enabled/files 1803 files { 1804 filename = "/etc/raddb/mods-config/files/authorize" 1805 acctusersfile = "/etc/raddb/mods-config/files/accounting" 1806 preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" 1807 } 1808 # Loaded module rlm_linelog 1809 # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog 1810 linelog { 1811 filename = "/var/log/radius/linelog" 1812 escape_filenames = no 1813 syslog_severity = "info" 1814 permissions = 384 1815 format = "This is a log message for %{User-Name}" 1816 reference = "messages.%{%{reply:Packet-Type}:-default}" 1817 } 1818 # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog 1819 linelog log_accounting { 1820 filename = "/var/log/radius/linelog-accounting" 1821 escape_filenames = no 1822 syslog_severity = "info" 1823 permissions = 384 1824 format = "" 1825 reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" 1826 } 1827 # Loaded module rlm_logintime 1828 # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime 1829 logintime { 1830 minimum_timeout = 60 1831 } 1832 # Loaded module rlm_mschap 1833 # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap 1834 mschap { 1835 use_mppe = yes 1836 require_encryption = no 1837 require_strong = no 1838 with_ntdomain_hack = yes 1839 ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-DOMAIN.REMOVED} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" 1840 passchange { 1841 ntlm_auth = "/usr/bin/ntlm_auth --helper-protocol=ntlm-change-password-1" 1842 ntlm_auth_username = "username: %{mschap:User-Name}" 1843 ntlm_auth_domain = "nt-domain: %{%{mschap:NT-Domain}:-DOMAIN.REMOVED}" 1844 } 1845 allow_retry = yes 1846 winbind_retry_with_normalised_username = no 1847 } 1848 # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth 1849 exec ntlm_auth { 1850 wait = yes 1851 program = "/usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN.REMOVED --username=%{mschap:User-Name} --password=%{User-Password}" 1852 shell_escape = yes 1853 } 1854 # Loaded module rlm_pap 1855 # Loading module "pap" from file /etc/raddb/mods-enabled/pap 1856 pap { 1857 normalise = yes 1858 } 1859 # Loaded module rlm_passwd 1860 # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd 1861 passwd etc_passwd { 1862 filename = "/etc/passwd" 1863 format = "*User-Name:Crypt-Password:" 1864 delimiter = ":" 1865 ignore_nislike = no 1866 ignore_empty = yes 1867 allow_multiple_keys = no 1868 hash_size = 100 1869 } 1870 # Loaded module rlm_preprocess 1871 # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess 1872 preprocess { 1873 huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" 1874 hints = "/etc/raddb/mods-config/preprocess/hints" 1875 with_ascend_hack = no 1876 ascend_channels_per_line = 23 1877 with_ntdomain_hack = no 1878 with_specialix_jetstream_hack = no 1879 with_cisco_vsa_hack = no 1880 with_alvarion_vsa_hack = no 1881 } 1882 # Loaded module rlm_radutmp 1883 # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp 1884 radutmp { 1885 filename = "/var/log/radius/radutmp" 1886 username = "%{User-Name}" 1887 case_sensitive = yes 1888 check_with_nas = yes 1889 permissions = 384 1890 caller_id = yes 1891 } 1892 # Loaded module rlm_realm 1893 # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm 1894 realm IPASS { 1895 format = "prefix" 1896 delimiter = "/" 1897 ignore_default = no 1898 ignore_null = no 1899 } 1900 # Loading module "suffix" from file /etc/raddb/mods-enabled/realm 1901 realm suffix { 1902 format = "suffix" 1903 delimiter = "@" 1904 ignore_default = no 1905 ignore_null = no 1906 } 1907 # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm 1908 realm realmpercent { 1909 format = "suffix" 1910 delimiter = "%" 1911 ignore_default = no 1912 ignore_null = no 1913 } 1914 # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm 1915 realm ntdomain { 1916 format = "prefix" 1917 delimiter = "\\" 1918 ignore_default = no 1919 ignore_null = no 1920 } 1921 # Loaded module rlm_replicate 1922 # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate 1923 # Loaded module rlm_soh 1924 # Loading module "soh" from file /etc/raddb/mods-enabled/soh 1925 soh { 1926 dhcp = yes 1927 } 1928 # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp 1929 radutmp sradutmp { 1930 filename = "/var/log/radius/sradutmp" 1931 username = "%{User-Name}" 1932 case_sensitive = yes 1933 check_with_nas = yes 1934 permissions = 420 1935 caller_id = no 1936 } 1937 # Loaded module rlm_unix 1938 # Loading module "unix" from file /etc/raddb/mods-enabled/unix 1939 unix { 1940 radwtmp = "/var/log/radius/radwtmp" 1941 } 1942 Creating attribute Unix-Group 1943 # Loaded module rlm_unpack 1944 # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack 1945 # Loaded module rlm_utf8 1946 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 1947 instantiate { 1948 } 1949 # Instantiating module "reject" from file /etc/raddb/mods-enabled/always 1950 # Instantiating module "fail" from file /etc/raddb/mods-enabled/always 1951 # Instantiating module "ok" from file /etc/raddb/mods-enabled/always 1952 # Instantiating module "handled" from file /etc/raddb/mods-enabled/always 1953 # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always 1954 # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always 1955 # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always 1956 # Instantiating module "noop" from file /etc/raddb/mods-enabled/always 1957 # Instantiating module "updated" from file /etc/raddb/mods-enabled/always 1958 # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter 1959 reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy 1960 # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter 1961 reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy 1962 # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter 1963 reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject 1964 [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". 1965 [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". 1966 # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter 1967 reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge 1968 # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter 1969 reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response 1970 # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap 1971 rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked 1972 # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail 1973 # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log 1974 rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output 1975 # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log 1976 # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log 1977 # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log 1978 # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap 1979 # Linked to sub-module rlm_eap_md5 1980 # Linked to sub-module rlm_eap_leap 1981 # Linked to sub-module rlm_eap_gtc 1982 gtc { 1983 challenge = "Password: " 1984 auth_type = "PAP" 1985 } 1986 # Linked to sub-module rlm_eap_tls 1987 tls { 1988 tls = "tls-common" 1989 } 1990 tls-config tls-common { 1991 verify_depth = 0 1992 ca_path = "/etc/raddb/certs" 1993 pem_file_type = yes 1994 private_key_file = "/etc/raddb/certs/server.pem" 1995 certificate_file = "/etc/raddb/certs/server.pem" 1996 ca_file = "/etc/raddb/certs/ca.pem" 1997 private_key_password = <<< secret >>> 1998 dh_file = "/etc/raddb/certs/dh" 1999 fragment_size = 1024 2000 include_length = yes 2001 auto_chain = yes 2002 check_crl = no 2003 check_all_crl = no 2004 cipher_list = "DEFAULT" 2005 cipher_server_preference = no 2006 ecdh_curve = "prime256v1" 2007 cache { 2008 enable = no 2009 lifetime = 24 2010 max_entries = 255 2011 } 2012 verify { 2013 skip_if_ocsp_ok = no 2014 } 2015 ocsp { 2016 enable = no 2017 override_cert_url = yes 2018 url = "http://127.0.0.1/ocsp/" 2019 use_nonce = yes 2020 timeout = 0 2021 softfail = no 2022 } 2023 } 2024 # Linked to sub-module rlm_eap_ttls 2025 ttls { 2026 tls = "tls-common" 2027 default_eap_type = "md5" 2028 copy_request_to_tunnel = no 2029 use_tunneled_reply = no 2030 virtual_server = "inner-tunnel" 2031 include_length = yes 2032 require_client_cert = no 2033 } 2034 tls: Using cached TLS configuration from previous invocation 2035 # Linked to sub-module rlm_eap_peap 2036 peap { 2037 tls = "tls-common" 2038 default_eap_type = "mschapv2" 2039 copy_request_to_tunnel = no 2040 use_tunneled_reply = no 2041 proxy_tunneled_request_as_eap = yes 2042 virtual_server = "inner-tunnel" 2043 soh = no 2044 require_client_cert = no 2045 } 2046 tls: Using cached TLS configuration from previous invocation 2047 # Linked to sub-module rlm_eap_mschapv2 2048 mschapv2 { 2049 with_ntdomain_hack = no 2050 send_error = no 2051 } 2052 # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration 2053 # Instantiating module "files" from file /etc/raddb/mods-enabled/files 2054 reading pairlist file /etc/raddb/mods-config/files/authorize 2055 reading pairlist file /etc/raddb/mods-config/files/accounting 2056 reading pairlist file /etc/raddb/mods-config/files/pre-proxy 2057 # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog 2058 # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog 2059 # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime 2060 # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap 2061 rlm_mschap (mschap): authenticating by calling 'ntlm_auth' 2062 # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap 2063 # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd 2064 rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no 2065 # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess 2066 reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups 2067 reading pairlist file /etc/raddb/mods-config/preprocess/hints 2068 # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm 2069 # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm 2070 # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm 2071 # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm 2072 } # modules 2073 radiusd: #### Loading Virtual Servers #### 2074 server { # from file /etc/raddb/radiusd.conf 2075 } # server 2076 server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel 2077 # Loading authenticate {...} 2078 # Loading authorize {...} 2079 Ignoring "sql" (see raddb/mods-available/README.rst) 2080 Ignoring "ldap" (see raddb/mods-available/README.rst) 2081 # Loading session {...} 2082 # Loading post-proxy {...} 2083 # Loading post-auth {...} 2084 # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:330 2085 } # server inner-tunnel 2086 server default { # from file /etc/raddb/sites-enabled/default 2087 # Loading authenticate {...} 2088 # Loading authorize {...} 2089 # Loading preacct {...} 2090 # Loading accounting {...} 2091 # Loading post-proxy {...} 2092 # Loading post-auth {...} 2093 } # server default 2094 radiusd: #### Opening IP addresses and Ports #### 2095 listen { 2096 type = "auth" 2097 ipaddr = 127.0.0.1 2098 port = 18120 2099 } 2100 listen { 2101 type = "auth" 2102 ipaddr = * 2103 port = 0 2104 limit { 2105 max_connections = 16 2106 lifetime = 0 2107 idle_timeout = 30 2108 } 2109 } 2110 listen { 2111 type = "acct" 2112 ipaddr = * 2113 port = 0 2114 limit { 2115 max_connections = 16 2116 lifetime = 0 2117 idle_timeout = 30 2118 } 2119 } 2120 listen { 2121 type = "auth" 2122 ipv6addr = :: 2123 port = 0 2124 limit { 2125 max_connections = 16 2126 lifetime = 0 2127 idle_timeout = 30 2128 } 2129 } 2130 listen { 2131 type = "acct" 2132 ipv6addr = :: 2133 port = 0 2134 limit { 2135 max_connections = 16 2136 lifetime = 0 2137 idle_timeout = 30 2138 } 2139 } 2140 Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel 2141 Listening on auth address * port 1812 bound to server default 2142 Listening on acct address * port 1813 bound to server default 2143 Listening on auth address :: port 1812 bound to server default 2144 Listening on acct address :: port 1813 bound to server default 2145 Listening on proxy address * port 49658 2146 Listening on proxy address :: port 33500 2147 Ready to process requests 2148 (0) Received Access-Request Id 90 from IP-REMOVED:61997 to IP-REMOVED:1812 length 90 2149 (0) User-Name = "USERNAME-REMOVED" 2150 (0) User-Password = "PASSWORD-REMOVED" 2151 (0) NAS-Identifier = "JUNIPER-DEVICE-NAME-REMOVED" 2152 (0) Calling-Station-Id = "IP-REMOVED" 2153 (0) NAS-IP-Address = IP-REMOVED 2154 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default 2155 (0) authorize { 2156 (0) policy filter_username { 2157 (0) if (&User-Name) { 2158 (0) if (&User-Name) -> TRUE 2159 (0) if (&User-Name) { 2160 (0) if (&User-Name =~ / /) { 2161 (0) if (&User-Name =~ / /) -> FALSE 2162 (0) if (&User-Name =~ /@[^@]*@/ ) { 2163 (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE 2164 (0) if (&User-Name =~ /\.\./ ) { 2165 (0) if (&User-Name =~ /\.\./ ) -> FALSE 2166 (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { 2167 (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE 2168 (0) if (&User-Name =~ /\.$/) { 2169 (0) if (&User-Name =~ /\.$/) -> FALSE 2170 (0) if (&User-Name =~ /(a)\./) { 2171 (0) if (&User-Name =~ /(a)\./) -> FALSE 2172 (0) } # if (&User-Name) = notfound 2173 (0) } # policy filter_username = notfound 2174 (0) [preprocess] = ok 2175 (0) [chap] = noop 2176 (0) [mschap] = noop 2177 (0) [digest] = noop 2178 (0) suffix: Checking for suffix after "@" 2179 (0) suffix: No '@' in User-Name = "USERNAME-REMOVED", looking up realm NULL 2180 (0) suffix: No such realm "NULL" 2181 (0) [suffix] = noop 2182 (0) eap: No EAP-Message, not doing EAP 2183 (0) [eap] = noop 2184 (0) files: users: Matched entry USERNAME-REMOVED at line 96 2185 (0) [files] = ok 2186 (0) [expiration] = noop 2187 (0) [logintime] = noop 2188 (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type 2189 (0) pap: WARNING: Authentication will fail unless a "known good" password is available 2190 (0) [pap] = noop 2191 (0) } # authorize = ok 2192 (0) Found Auth-Type = ntlm_auth 2193 (0) # Executing group from file /etc/raddb/sites-enabled/default 2194 (0) authenticate { 2195 (0) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN.REMOVED --username=%{mschap:User-Name} --password=%{User-Password}: 2196 (0) ntlm_auth: EXPAND --username=%{mschap:User-Name} 2197 (0) ntlm_auth: --> --username=USERNAME-REMOVED 2198 (0) ntlm_auth: EXPAND --password=%{User-Password} 2199 (0) ntlm_auth: --> --password=PASSWORD-REMOVED 2200 (0) ntlm_auth: ERROR: Program returned code (1) and output 'NT_STATUS_PASSWORD_MUST_CHANGE: The user password must be changed before logging on the first time. (0xc0000224)' 2201 (0) [ntlm_auth] = reject 2202 (0) } # authenticate = reject 2203 (0) Failed to authenticate the user 2204 (0) Login incorrect (ntlm_auth: Program returned code (1) and output 'NT_STATUS_PASSWORD_MUST_CHANGE: The user password must be changed before logging on the first time. (0xc0000224)'): [USERNAME-REMOVED] (from client IP-REMOVED port 0 cli IP-REMOVED) 2205 (0) Using Post-Auth-Type Reject 2206 (0) # Executing group from file /etc/raddb/sites-enabled/default 2207 (0) Post-Auth-Type REJECT { 2208 (0) attr_filter.access_reject: EXPAND %{User-Name} 2209 (0) attr_filter.access_reject: --> USERNAME-REMOVED 2210 (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 2211 (0) [attr_filter.access_reject] = updated 2212 (0) [eap] = noop 2213 (0) policy remove_reply_message_if_eap { 2214 (0) if (&reply:EAP-Message && &reply:Reply-Message) { 2215 (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE 2216 (0) else { 2217 (0) [noop] = noop 2218 (0) } # else = noop 2219 (0) } # policy remove_reply_message_if_eap = noop 2220 (0) } # Post-Auth-Type REJECT = updated 2221 (0) Delaying response for 1.000000 seconds 2222 Waking up in 0.9 seconds. 2223 (0) (0) Discarding duplicate request from client IP-REMOVED port 61997 - ID: 90 due to delayed response 2224 Waking up in 0.2 seconds. 2225 (0) Sending delayed response 2226 (0) Sent Access-Reject Id 90 from IP-REMOVED:1812 to IP-REMOVED:61997 length 20 2227 Waking up in 3.9 seconds. 2228 (0) Cleaning up request packet ID 90 with timestamp +10 2229 Ready to process requests

2 1

FW: FreeRadius - Integrate FreeRadius with Google Authenticator
by YewFong.Chua＠fujitsu.com 20 Jan '21

20 Jan '21

Hi Members of FreeRadius, I would like to check whether, does FreeRadius has a proper guide or step for us to integrate FreeRadius with Google Authenticator? Also, we have a few concern mentioned below and not sure whether FreeRadius is able to highlight our concern: 1) Can FreeRadius installed on the latest Ubuntu server 20.04? 2) How can we integrate FreeRadius with Google Authenticator? Is there any guide or proper step we can follow? 3) Understand that CyberArk which is a Privileged Access Management solution can work with FreeRadius by configuring the Radius Configuration on CyberArk to talk to FreeRadius. May I know whether any additional configuration (Other than creating Radius Client on FreeRadius) that is required to be done on FreeRadius side in order for FreeRadius with Google Authenticator to works? 4) Also, whether is there any proper step for the following tasks: a. Patch for FreeRadius application. b. Patch for Ubuntu server that is installed with FreeRadius c. Step to harden the Ubuntu server d. Assume that Google Authenticator can upgrade, just as it is and it will not affect the FreeRadius? Regards, Yew Fong Off-in-Lieu Planning: Nil Annual Leave Planning: 22nd, 28th & 29th Jan 2021 15th to 19th Feb 2021 National Reservist Leave Nil Fujitsu Asia Pte Ltd Nexus @One-North 1 Fusionopolis Link, #04-01 Singapore 138542 DID: +65 6512 7525 Mobile: +65 9794 6548 E-mail: yewfong.chua(a)fujitsu.com<mailto:yewfong.chua@fujitsu.com> Web: http://sg.fujitsu.com<http://sg.fujitsu.com/> | LinkedIn: www.linkedin.com/company/fujitsu-asia<http://www.linkedin.com/company/fujitsu-asia>

3 4

Lists other than request in rlm_rest
by Nathan Ward 16 Jan '21

16 Jan '21

Hi all, I’d like to get control and reply attributes in to rlm_rest requests - we use control attributes for results of various bits of logic which we then translate in to reply attributes in post-auth if relevant - and it’d be useful to get those control attributes in to rest. Reply attributes in there would be useful as well, so we can “log" to a rest endpoint and include the request and reply (and control!) - a slightly different use case but same “tool”. >From what I can see, there doesn’t seem to be a way to have rlm_rest send attributes in the body (in JSON, let’s say) other than request attributes - the code I can see (rest_encode_json etc.) seems to be always looking at the request (request_t->packet->vps). Is there a clever way I haven’t thought of to get control and reply attributes in to rest requests? -- Nathan Ward

3 6

reply_log not happening on failures
by Dan M 14 Jan '21

14 Jan '21

Is there a known issue with rejected requests not generating a reply log entry. For a successful request the reply log is always written. Is it an order thing maybe in some section?

4 6

Cache user access on eap-ttls with ldap as authenticate system
by André 14 Jan '21

14 Jan '21

Hello, I'm using EAP-TTLS + LDAP with okta, all is working fine. But I would like to use the cache system of freeradius in case the internet goes down, if no internet access to contact the ldap server is it possible to use a cache? (21) Received Access-Request Id 117 from 192.168.31.239:32773 to 192.168.31.183:1812 length 294 (21) User-Name = "leon.wolf(a)domain.local" (21) Chargeable-User-Identity = 0x00 (21) Location-Capable = Civic-Location (21) Calling-Station-Id = "90-78-41-4f-dd-73" (21) Called-Station-Id = "00-b7-71-86-b8-80:testrd" (21) NAS-Port = 1 (21) Cisco-AVPair = "audit-session-id=c0a81fef0001f1c46000318e" (21) Acct-Session-Id = "60003186/90:78:41:4f:dd:73/237979" (21) NAS-IP-Address = 192.168.31.239 (21) NAS-Identifier = "WLC1" (21) Airespace-Wlan-Id = 3 (21) Service-Type = Framed-User (21) Framed-MTU = 1300 (21) NAS-Port-Type = Wireless-802.11 (21) Tunnel-Type:0 = VLAN (21) Tunnel-Medium-Type:0 = IEEE-802 (21) Tunnel-Private-Group-Id:0 = "96" (21) EAP-Message = 0x020500061500 (21) State = 0xcab4fefcc8b1eb3813f65861255465ba (21) Message-Authenticator = 0x29f8146d52be66b41004b4ed9a6d1296 (21) session-state: No cached attributes (21) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (21) authorize { (21) policy filter_username { (21) if (&User-Name) { (21) if (&User-Name) -> TRUE (21) if (&User-Name) { (21) if (&User-Name =~ / /) { (21) if (&User-Name =~ / /) -> FALSE (21) if (&User-Name =~ /@[^@]*@/ ) { (21) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (21) if (&User-Name =~ /\.\./ ) { (21) if (&User-Name =~ /\.\./ ) -> FALSE (21) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (21) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (21) if (&User-Name =~ /\.$/) { (21) if (&User-Name =~ /\.$/) -> FALSE (21) if (&User-Name =~ /(a)\./) { (21) if (&User-Name =~ /(a)\./) -> FALSE (21) } # if (&User-Name) = notfound (21) } # policy filter_username = notfound (21) [preprocess] = ok (21) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (21) auth_log: --> /var/log/freeradius/radacct/ 192.168.31.239/auth-detail-20210114 (21) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.31.239/auth-detail-20210114 (21) auth_log: EXPAND %t (21) auth_log: --> Thu Jan 14 12:58:17 2021 (21) [auth_log] = ok (21) eap: Peer sent EAP Response (code 2) ID 5 length 6 (21) eap: Continuing tunnel setup (21) [eap] = ok (21) } # authorize = ok (21) Found Auth-Type = eap (21) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (21) Auth-Type eap { (21) eap: Expiring EAP session with state 0xcab4fefcc8b1eb38 (21) eap: Finished EAP session with state 0xcab4fefcc8b1eb38 (21) eap: Previous EAP request found for state 0xcab4fefcc8b1eb38, released from the list (21) eap: Peer sent packet with method EAP TTLS (21) (21) eap: Calling submodule eap_ttls to process data (21) eap_ttls: Authenticate (21) eap_ttls: Continuing EAP-TLS (21) eap_ttls: Peer ACKed our handshake fragment (21) eap_ttls: [eaptls verify] = request (21) eap_ttls: [eaptls process] = handled (21) eap: Sending EAP Request (code 1) ID 6 length 957 (21) eap: EAP session adding &reply:State = 0xcab4fefcc9b2eb38 (21) [eap] = handled (21) if (handled && (Response-Packet-Type == Access-Challenge)) { (21) EXPAND Response-Packet-Type (21) --> Access-Challenge (21) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (21) if (handled && (Response-Packet-Type == Access-Challenge)) { (21) attr_filter.access_challenge: EXPAND %{User-Name} (21) attr_filter.access_challenge: --> leon.wolf(a)domain.local (21) attr_filter.access_challenge: Matched entry DEFAULT at line 12 (21) [attr_filter.access_challenge.post-auth] = updated (21) [handled] = handled (21) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (21) } # Auth-Type eap = handled (21) Using Post-Auth-Type Challenge (21) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (21) Post-Auth-Type Challenge { (21) policy remove_reply_message_if_eap { (21) if (&reply:EAP-Message && &reply:Reply-Message) { (21) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (21) else { (21) [noop] = noop (21) } # else = noop (21) } # policy remove_reply_message_if_eap = noop (21) attr_filter.access_challenge: EXPAND %{User-Name} (21) attr_filter.access_challenge: --> leon.wolf(a)domain.local (21) attr_filter.access_challenge: Matched entry DEFAULT at line 12 (21) [attr_filter.access_challenge.post-auth] = updated (21) } # Post-Auth-Type Challenge = updated (21) Sent Access-Challenge Id 117 from 192.168.31.183:1812 to 192.168.31.239:32773 length 0 (21) EAP-Message = 0x010603bd158000000b9f03020186304b06082b06010505070101043f303d303b06082b06010505073002862f687474703a2f2f617070732e6964656e74727573742e636f6d2f726f6f74732f647374726f6f74636178332e703763301f0603551d23041830168014c4a7b1a47b2c71fadbe14b9075ffc4156085891030540603551d20044d304b3008060667810c010201303f060b2b0601040182df130101013030302e06082b060105050702011622687474703a2f2f6370732e726f6f742d78312e6c657473656e63727970742e6f7267303c0603551d1f043530333031a02fa02d862b687474703a2f2f63726c2e6964656e74727573742e636f6d2f445354524f4f544341583343524c2e63726c301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100d94ce0c9f584883731dbbb13e2b3fc8b6b62126c58 (21) Message-Authenticator = 0x00000000000000000000000000000000 (21) State = 0xcab4fefcc9b2eb3813f65861255465ba (21) Finished request Waking up in 4.9 seconds. (22) Received Access-Request Id 118 from 192.168.31.239:32773 to 192.168.31.183:1812 length 424 (22) User-Name = "leon.wolf(a)domain.local" (22) Chargeable-User-Identity = 0x00 (22) Location-Capable = Civic-Location (22) Calling-Station-Id = "90-78-41-4f-dd-73" (22) Called-Station-Id = "00-b7-71-86-b8-80:testrd" (22) NAS-Port = 1 (22) Cisco-AVPair = "audit-session-id=c0a81fef0001f1c46000318e" (22) Acct-Session-Id = "60003186/90:78:41:4f:dd:73/237979" (22) NAS-IP-Address = 192.168.31.239 (22) NAS-Identifier = "WLC1" (22) Airespace-Wlan-Id = 3 (22) Service-Type = Framed-User (22) Framed-MTU = 1300 (22) NAS-Port-Type = Wireless-802.11 (22) Tunnel-Type:0 = VLAN (22) Tunnel-Medium-Type:0 = IEEE-802 (22) Tunnel-Private-Group-Id:0 = "96" (22) EAP-Message = 0x0206008815800000007e160303004610000042410436fe757ae06837679e32e33eef46449bfb57126ab725fbc270219624e528203360ee7521080563eb18d57ed754f7079e1bf3c4423f5975e1d2aedd7597251c87140303000101160303002800000000000000009b5217d1d18538b885d7f88ff00291a7d352e5b47e9b660c263b64b9f36067dd (22) State = 0xcab4fefcc9b2eb3813f65861255465ba (22) Message-Authenticator = 0x6e609bd8d4caf0c99454c818de75af99 (22) session-state: No cached attributes (22) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (22) authorize { (22) policy filter_username { (22) if (&User-Name) { (22) if (&User-Name) -> TRUE (22) if (&User-Name) { (22) if (&User-Name =~ / /) { (22) if (&User-Name =~ / /) -> FALSE (22) if (&User-Name =~ /@[^@]*@/ ) { (22) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (22) if (&User-Name =~ /\.\./ ) { (22) if (&User-Name =~ /\.\./ ) -> FALSE (22) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (22) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (22) if (&User-Name =~ /\.$/) { (22) if (&User-Name =~ /\.$/) -> FALSE (22) if (&User-Name =~ /(a)\./) { (22) if (&User-Name =~ /(a)\./) -> FALSE (22) } # if (&User-Name) = notfound (22) } # policy filter_username = notfound (22) [preprocess] = ok (22) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (22) auth_log: --> /var/log/freeradius/radacct/ 192.168.31.239/auth-detail-20210114 (22) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.31.239/auth-detail-20210114 (22) auth_log: EXPAND %t (22) auth_log: --> Thu Jan 14 12:58:17 2021 (22) [auth_log] = ok (22) eap: Peer sent EAP Response (code 2) ID 6 length 136 (22) eap: Continuing tunnel setup (22) [eap] = ok (22) } # authorize = ok (22) Found Auth-Type = eap (22) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (22) Auth-Type eap { (22) eap: Expiring EAP session with state 0xcab4fefcc9b2eb38 (22) eap: Finished EAP session with state 0xcab4fefcc9b2eb38 (22) eap: Previous EAP request found for state 0xcab4fefcc9b2eb38, released from the list (22) eap: Peer sent packet with method EAP TTLS (21) (22) eap: Calling submodule eap_ttls to process data (22) eap_ttls: Authenticate (22) eap_ttls: Continuing EAP-TLS (22) eap_ttls: Peer indicated complete TLS record size will be 126 bytes (22) eap_ttls: Got complete TLS record (126 bytes) (22) eap_ttls: [eaptls verify] = length included (22) eap_ttls: TLS_accept: SSLv3/TLS write server done (22) eap_ttls: <<< recv TLS 1.2 [length 0046] (22) eap_ttls: TLS_accept: SSLv3/TLS read client key exchange (22) eap_ttls: TLS_accept: SSLv3/TLS read change cipher spec (22) eap_ttls: <<< recv TLS 1.2 [length 0010] (22) eap_ttls: TLS_accept: SSLv3/TLS read finished (22) eap_ttls: >>> send TLS 1.2 [length 0001] (22) eap_ttls: TLS_accept: SSLv3/TLS write change cipher spec (22) eap_ttls: >>> send TLS 1.2 [length 0010] (22) eap_ttls: TLS_accept: SSLv3/TLS write finished (22) eap_ttls: Serialising session 36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f, and storing in cache (22) eap_ttls: WARNING: Wrote session 36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f to /var/log/freeradius/tlscache/36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f.asn1 (139 bytes) (22) eap_ttls: (other): SSL negotiation finished successfully (22) eap_ttls: TLS - Connection Established (22) eap_ttls: Attr-156.7 = 0x45434448452d5253412d4145533235362d47434d2d534841333834 (22) eap_ttls: Attr-155.7 = 0x544c5320312e32 (22) eap_ttls: TLS - got 51 bytes of data (22) eap_ttls: [eaptls process] = handled (22) eap: Sending EAP Request (code 1) ID 7 length 61 (22) eap: EAP session adding &reply:State = 0xcab4fefcceb3eb38 (22) [eap] = handled (22) if (handled && (Response-Packet-Type == Access-Challenge)) { (22) EXPAND Response-Packet-Type (22) --> Access-Challenge (22) if (handled && (Response-Packet-Type == Access-Challenge)) -> TRUE (22) if (handled && (Response-Packet-Type == Access-Challenge)) { (22) attr_filter.access_challenge: EXPAND %{User-Name} (22) attr_filter.access_challenge: --> leon.wolf(a)domain.local (22) attr_filter.access_challenge: Matched entry DEFAULT at line 12 (22) [attr_filter.access_challenge.post-auth] = updated (22) [handled] = handled (22) } # if (handled && (Response-Packet-Type == Access-Challenge)) = handled (22) } # Auth-Type eap = handled (22) Using Post-Auth-Type Challenge (22) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (22) Post-Auth-Type Challenge { (22) policy remove_reply_message_if_eap { (22) if (&reply:EAP-Message && &reply:Reply-Message) { (22) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (22) else { (22) [noop] = noop (22) } # else = noop (22) } # policy remove_reply_message_if_eap = noop (22) attr_filter.access_challenge: EXPAND %{User-Name} (22) attr_filter.access_challenge: --> leon.wolf(a)domain.local (22) attr_filter.access_challenge: Matched entry DEFAULT at line 12 (22) [attr_filter.access_challenge.post-auth] = updated (22) } # Post-Auth-Type Challenge = updated (22) session-state: Saving cached attributes (22) TLS-Cache-Filename = "/var/log/freeradius/tlscache/36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f.asn1" (22) Attr-156.7 = 0x45434448452d5253412d4145533235362d47434d2d534841333834 (22) Attr-155.7 = 0x544c5320312e32 (22) Sent Access-Challenge Id 118 from 192.168.31.183:1812 to 192.168.31.239:32773 length 0 (22) EAP-Message = 0x0107003d158000000033140303000101160303002836d8a1ff6b2afaae621fc261218f4483f1c4545f86a9b8fe41deae7225f2324e15c977fd19b170a0 (22) Message-Authenticator = 0x00000000000000000000000000000000 (22) State = 0xcab4fefcceb3eb3813f65861255465ba (22) Finished request Waking up in 4.9 seconds. (23) Received Access-Request Id 119 from 192.168.31.239:32773 to 192.168.31.183:1812 length 387 (23) User-Name = "leon.wolf(a)domain.local" (23) Chargeable-User-Identity = 0x00 (23) Location-Capable = Civic-Location (23) Calling-Station-Id = "90-78-41-4f-dd-73" (23) Called-Station-Id = "00-b7-71-86-b8-80:testrd" (23) NAS-Port = 1 (23) Cisco-AVPair = "audit-session-id=c0a81fef0001f1c46000318e" (23) Acct-Session-Id = "60003186/90:78:41:4f:dd:73/237979" (23) NAS-IP-Address = 192.168.31.239 (23) NAS-Identifier = "WLC1" (23) Airespace-Wlan-Id = 3 (23) Service-Type = Framed-User (23) Framed-MTU = 1300 (23) NAS-Port-Type = Wireless-802.11 (23) Tunnel-Type:0 = VLAN (23) Tunnel-Medium-Type:0 = IEEE-802 (23) Tunnel-Private-Group-Id:0 = "96" (23) EAP-Message = 0x0207006315800000005917030300540000000000000001e70b56177cd34eacf86e9bd90e8fe557e020b9f6d814adddf9bde349e67f3e9a1dda72f8fd14224098f24cae3410220287d1814b3984a577db30a8289bd48a898a69c25b4667f3cc93b0ab0b (23) State = 0xcab4fefcceb3eb3813f65861255465ba (23) Message-Authenticator = 0x19e54adcb4aeb90d8bcb07f5984056ec (23) Restoring &session-state (23) &session-state:TLS-Cache-Filename = "/var/log/freeradius/tlscache/36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f.asn1" (23) &session-state:Attr-156.7 = 0x45434448452d5253412d4145533235362d47434d2d534841333834 (23) &session-state:Attr-155.7 = 0x544c5320312e32 (23) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (23) authorize { (23) policy filter_username { (23) if (&User-Name) { (23) if (&User-Name) -> TRUE (23) if (&User-Name) { (23) if (&User-Name =~ / /) { (23) if (&User-Name =~ / /) -> FALSE (23) if (&User-Name =~ /@[^@]*@/ ) { (23) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (23) if (&User-Name =~ /\.\./ ) { (23) if (&User-Name =~ /\.\./ ) -> FALSE (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (23) if (&User-Name =~ /\.$/) { (23) if (&User-Name =~ /\.$/) -> FALSE (23) if (&User-Name =~ /(a)\./) { (23) if (&User-Name =~ /(a)\./) -> FALSE (23) } # if (&User-Name) = notfound (23) } # policy filter_username = notfound (23) [preprocess] = ok (23) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (23) auth_log: --> /var/log/freeradius/radacct/ 192.168.31.239/auth-detail-20210114 (23) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.31.239/auth-detail-20210114 (23) auth_log: EXPAND %t (23) auth_log: --> Thu Jan 14 12:58:17 2021 (23) [auth_log] = ok (23) eap: Peer sent EAP Response (code 2) ID 7 length 99 (23) eap: Continuing tunnel setup (23) [eap] = ok (23) } # authorize = ok (23) Found Auth-Type = eap (23) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (23) Auth-Type eap { (23) eap: Expiring EAP session with state 0xcab4fefcceb3eb38 (23) eap: Finished EAP session with state 0xcab4fefcceb3eb38 (23) eap: Previous EAP request found for state 0xcab4fefcceb3eb38, released from the list (23) eap: Peer sent packet with method EAP TTLS (21) (23) eap: Calling submodule eap_ttls to process data (23) eap_ttls: Authenticate (23) eap_ttls: Continuing EAP-TLS (23) eap_ttls: Peer indicated complete TLS record size will be 89 bytes (23) eap_ttls: Got complete TLS record (89 bytes) (23) eap_ttls: [eaptls verify] = length included (23) eap_ttls: [eaptls process] = ok (23) eap_ttls: Session established. Proceeding to decode tunneled attributes (23) eap_ttls: Got tunneled request (23) eap_ttls: User-Name = "leon.wolf(a)domain.local" (23) eap_ttls: User-Password = "scN3VXa4XZvm7N4!" (23) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (23) eap_ttls: Sending tunneled request (23) Virtual server default received request (23) User-Name = "leon.wolf(a)domain.local" (23) User-Password = "scN3VXa4XZvm7N4!" (23) FreeRADIUS-Proxied-To = 127.0.0.1 (23) Chargeable-User-Identity = 0x00 (23) Location-Capable = Civic-Location (23) Calling-Station-Id = "90-78-41-4f-dd-73" (23) Called-Station-Id = "00-b7-71-86-b8-80:testrd" (23) NAS-Port = 1 (23) Cisco-AVPair = "audit-session-id=c0a81fef0001f1c46000318e" (23) Acct-Session-Id = "60003186/90:78:41:4f:dd:73/237979" (23) NAS-IP-Address = 192.168.31.239 (23) NAS-Identifier = "WLC1" (23) Airespace-Wlan-Id = 3 (23) Service-Type = Framed-User (23) Framed-MTU = 1300 (23) NAS-Port-Type = Wireless-802.11 (23) Tunnel-Type:0 = VLAN (23) Tunnel-Medium-Type:0 = IEEE-802 (23) Tunnel-Private-Group-Id:0 = "96" (23) Event-Timestamp = "Jan 14 2021 12:58:17 WET" (23) WARNING: Outer and inner identities are the same. User privacy is compromised. (23) server default { (23) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (23) authorize { (23) policy filter_username { (23) if (&User-Name) { (23) if (&User-Name) -> TRUE (23) if (&User-Name) { (23) if (&User-Name =~ / /) { (23) if (&User-Name =~ / /) -> FALSE (23) if (&User-Name =~ /@[^@]*@/ ) { (23) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (23) if (&User-Name =~ /\.\./ ) { (23) if (&User-Name =~ /\.\./ ) -> FALSE (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (23) if (&User-Name =~ /\.$/) { (23) if (&User-Name =~ /\.$/) -> FALSE (23) if (&User-Name =~ /(a)\./) { (23) if (&User-Name =~ /(a)\./) -> FALSE (23) } # if (&User-Name) = notfound (23) } # policy filter_username = notfound (23) [preprocess] = ok (23) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (23) auth_log: --> /var/log/freeradius/radacct/ 192.168.31.239/auth-detail-20210114 (23) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.31.239/auth-detail-20210114 (23) auth_log: EXPAND %t (23) auth_log: --> Thu Jan 14 12:58:17 2021 (23) [auth_log] = ok (23) eap: No EAP-Message, not doing EAP (23) [eap] = noop (23) [expiration] = noop (23) [logintime] = noop (23) update control { (23) Cache-Status-Only = yes (23) } # update control = noop (23) cache: EXPAND %{User-Name} (23) cache: --> leon.wolf(a)domain.local (23) cache: Found entry for "leon.wolf(a)domain.local" (23) [cache] = ok (23) if (notfound) { (23) if (notfound) -> FALSE (23) if (User-Password) { (23) if (User-Password) -> TRUE (23) if (User-Password) { (23) update control { (23) Auth-Type := LDAP (23) } # update control = noop (23) } # if (User-Password) = noop (23) cache: EXPAND %{User-Name} (23) cache: --> leon.wolf(a)domain.local (23) cache: Found entry for "leon.wolf(a)domain.local" (23) cache: Merging cache entry into request (23) cache: &reply:Reply-Message += "Cache last updated at Thu Jan 14 11:57:02 2021" (23) cache: &reply:Class := 0x4b703872434c46586d6c6c6953624238735a644a42746459576945614b2e4e65 (23) [cache] = ok (23) } # authorize = ok (23) Found Auth-Type = LDAP (23) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (23) Auth-Type LDAP { rlm_ldap (ldap): Closing connection (9): Hit idle_timeout, was idle for 162 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (10): Hit idle_timeout, was idle for 160 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (11), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://jumia.ldap.idp.com:389 rlm_ldap (ldap): Could not start TLS: Can't contact LDAP server rlm_ldap (ldap): Opening connection failed (11) (23) [ldap] = fail (23) } # Auth-Type LDAP = fail (23) Failed to authenticate the user (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (23) Post-Auth-Type REJECT { (23) attr_filter.access_reject: EXPAND %{User-Name} (23) attr_filter.access_reject: --> leon.wolf(a)domain.local (23) attr_filter.access_reject: Matched entry DEFAULT at line 11 (23) [attr_filter.access_reject] = updated (23) [eap] = noop (23) policy remove_reply_message_if_eap { (23) if (&reply:EAP-Message && &reply:Reply-Message) { (23) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (23) else { (23) [noop] = noop (23) } # else = noop (23) } # policy remove_reply_message_if_eap = noop (23) } # Post-Auth-Type REJECT = updated (23) } # server default (23) Virtual server sending reply (23) Reply-Message = "Cache last updated at Thu Jan 14 11:57:02 2021" (23) eap_ttls: Got tunneled Access-Reject tls: Removing session 36e87b2e23855a94095eeb8a40b2fe08eedc7eeb03d6a3aa50f95511fb46838f from the cache (23) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (23) eap: Sending EAP Failure (code 4) ID 7 length 4 (23) eap: Failed in EAP select (23) [eap] = invalid (23) } # Auth-Type eap = invalid (23) Failed to authenticate the user (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (23) Post-Auth-Type REJECT { (23) attr_filter.access_reject: EXPAND %{User-Name} (23) attr_filter.access_reject: --> leon.wolf(a)domain.local (23) attr_filter.access_reject: Matched entry DEFAULT at line 11 (23) [attr_filter.access_reject] = updated (23) [eap] = noop (23) policy remove_reply_message_if_eap { (23) if (&reply:EAP-Message && &reply:Reply-Message) { (23) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (23) else { (23) [noop] = noop (23) } # else = noop (23) } # policy remove_reply_message_if_eap = noop (23) } # Post-Auth-Type REJECT = updated (23) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (23) Sending delayed response (23) Sent Access-Reject Id 119 from 192.168.31.183:1812 to 192.168.31.239:32773 length 44 (23) EAP-Message = 0x04070004 (23) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (18) Cleaning up request packet ID 114 with timestamp +3690 (19) Cleaning up request packet ID 115 with timestamp +3690 (20) Cleaning up request packet ID 116 with timestamp +3690 (21) Cleaning up request packet ID 117 with timestamp +3690 (22) Cleaning up request packet ID 118 with timestamp +3690 (23) Cleaning up request packet ID 119 with timestamp +3690 Ready to process requests ***** Config for sites-enabled/default ****** server default { listen { type = auth ipaddr = 192.168.31.183 port = 0 limit { # # Limit the number of simultaneous TCP connections to the socket # # The default is 16. # Setting this to 0 means "no limit" max_connections = 16 # The per-socket "max_requests" option does not exist. # # The lifetime, in seconds, of a TCP connection. After # this lifetime, the connection will be closed. # # Setting this to 0 means "forever". lifetime = 0 # # The idle timeout, in seconds, of a TCP connection. # If no packets have been received over the connection for # this time, the connection will be closed. # # Setting this to 0 means "no timeout". # # We STRONGLY RECOMMEND that you set an idle timeout. # idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { # Only for "proto = tcp". These are ignored for "udp" sockets. # } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { filter_username preprocess auth_log eap { ok = return updated = return } expiration logintime update control { Cache-Status-Only = 'yes' } cache if (notfound) { ldap } if (User-Password) { # <- when using cache this it's here with True update control { Auth-Type := ldap } } cache } authenticate { Auth-Type PAP { #pap ldap # eap-ttls comes here for authentication } Auth-Type LDAP { ldap } Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter } } } preacct { preprocess acct_unique suffix } accounting { detail -sql attr_filter.accounting_response } session { } post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY } } update { &reply: += &session-state: } remove_reply_message_if_eap Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject # Insert EAP-Failure message if the request was # rejected by policy instead of because of an # authentication failure eap # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap } Post-Auth-Type Challenge { remove_reply_message_if_eap attr_filter.access_challenge.post-auth } } pre-proxy { } post-proxy { eap } } ****** eap config **** eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} md5 { } leap { } gtc { auth_type = PAP } tls-config tls-common { private_key_file = /etc/freeradius/3.0/certs/rsa/fullchain2.key certificate_file = /etc/freeradius/3.0/certs/rsa/fullchain2.pem ca_file = /etc/ssl/certs/ca-certificates.crt ca_file = /etc/freeradius/3.0/certs/rsa/rootDSTX3.pem dh_file = ${certdir}/dh ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no tls_min_version = "1.2" ecdh_curve = "prime256v1" cache { enable = yes name = "EAP module" persist_dir = "${logdir}/tlscache" } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } ttls { tls = tls-common default_eap_type = gtc copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "default" } virtual_server = default }

2 12

free radius behind a load balancer?
by Coy Hile 14 Jan '21

14 Jan '21

Hi all, Has anyone tried putting the FreeRADIUS server behind a load balancer? I see dynamic-clients does queries based on the Packet-Src-IP-Address, but can one reasonably do similar based on NAS-IP-Address (assuming that the client sends that attribute? -- Coy Hile coy.hile(a)coyhile.com

4 9

Referencing a module by a ${}-Variable
by freeradius-mlist-users＠m20.kunterbunt.de 14 Jan '21

14 Jan '21

Hello all, I am trying to set up a freeradius server with several mysql databases for different sets of accounts. The distinguation of the request should happen via the 'nas' table, which points to the different virtual servers. So, in the directory "sites-enabled" I have a file defining several virtual servers: server wlan { instance_name = "wlan" $INCLUDE "../sites-available/instances_include" } and within in the "instances_include" I want to refer to a separate instance of the SQL module: authorize { filter_username filter_password preprocess sql_instance_${.instance_name} auth_log } These modules are all defined in "mods-enabled": sql sql_instance_wlan { radius_db = "raddb_wlan" $INCLUDE "../mods-available/sql_instances_include" } The problem here is, that the line "sql_instance_${.instance_name}" is not accepted during server startup: including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/instances including configuration file /etc/freeradius/3.0/sites-enabled/../sites-available/instances_include /etc/freeradius/3.0/sites-enabled/../sites-available/instances_include[10]: Parse error after ".instance_name": unexpected token "}" Errors reading or parsing /etc/freeradius/3.0/radiusd.conf First I tried to use ${.name2}, which I hoped to refer to the section name "wlan". When this didn't worked, I defined a separate variable "instance_name". I checked the files, that they have standard UNIX line termination and no additional ctrl characters. FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... Is there any possibility to refer to a module by a ${} variable? Thanks for your attention and hopefully your help! Kind regards, Michael Sievert

2 1

Problem with EAP Identity
by Michael Schwartzkopff 13 Jan '21

13 Jan '21

Hi, I stumbled upon a strange behaviour of my switches. I want to configure 802.1x. In the first packet the Switch sends: Debug: (7) Received Access-Request Id 81 from x.x.x.46:36296 to x.x.x.154:1812 length 152 Debug: (7) User-Name = "3464A9D11215" The debug goes on: Debug: (7) eap: Peer sent packet with method EAP Identity (1) Debug: (7) eap: EAP session adding &reply:State = 0x45e56b9d45e46617 Debug: (7) modsingle[authenticate]: returned from eap (rlm_eap) Debug: (7) [eap] = handled The next request from the switch is: Debug: (8) Received Access-Request Id 82 from x.x.x.46:36296 to x.x.x.154:1812 length 167 Debug: (8) User-Name = "host/test(a)xxx.xx" (...) Debug: (8) State = 0x45e56b9d45e46617718e28efb749ef6f and then the RADIUS server complains: Debug: (8) eap: Previous EAP request found for state 0x45e56b9d45e46617, released from the list Debug: (8) eap: Identity does not match User-Name. Authentication failed Debug: (8) eap: Failed in handler Can anyone explain what happens here? Does the switch change the User-Name within the RADIUS / EAP session? Is this a bug of the switch? Or does something other happen here? Thanks for any hints. Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

3 5

Wrong date of freeradius 3 recording in MySql
by Nikolai Petrov 12 Jan '21

12 Jan '21

Hello, I installed FreeRADIUS 3, Daloradius, and MySQL Debian 9. After some struggle I drove everything I had on another machine with a similar installation but with freeradius 2. I noticed a problem with accounting (wrote in db). The time is correct, but the date is 2 days ago. The problem is from freeradius. When I write from PHP in MySql my date is ok, but from accounting, it comes with a date of -2 days. *Do you any idea of where to hide the problem?* Best Regards, Nikolai Petrov

2 5

EAP-PEAP: unknown ca error
by Nick Iatsenko 08 Jan '21

08 Jan '21

Hello everyone, I successfully configured FreeRADIUS 3.0.21 on my new Opnsense firewall. Connected devices via Wi-Fi: - iOS : OK - MacOS : OK - Android : KO I found another person (Daniel Lopez) having similar issue with EAP-TLS back in 2017 but he was provided link to the resource with instructions for different clients (OS) but not Android. Root CA is used to issue Server cert (no intermediate cert is used - it's a home setup ;) ). I installed Root CA cert on my Pixel3 > Settings > Security > Encryption & Credentials > Install a certificate > CA Certificate > followed the dialog New Root CA cert is visible under Settings > Security > Encryption & Credentials > Trusted credentials > User My concern: I don't see my new Root CA cert under CA certificate section in the Wi-Fi profile and have to choose "Use system certificates" Below is the debug result. I hope it helps to confirm my hypothesis (presented Server cert is not Trusted by Android phone). Feel free to forward me to the other Android related resource if this is not the right place to ask for help with my issue. (261) Received Access-Request Id 62 from 192.168.31.2:53892 to 192.168.31.1:1812 length 183 (261) Service-Type = Framed-User (261) Framed-MTU = 1400 (261) User-Name = "Nick_Pixel3" (261) State = 0x7616a93d7e1fb07496c66d6bce81643b (261) NAS-Port-Id = "guest_WLAN" (261) NAS-Port-Type = Wireless-802.11 (261) Calling-Station-Id = "96-4D-45-A8-84-E0" (261) Called-Station-Id = "CC-2D-E0-A9-52-2A:XATA_guest" (261) EAP-Message = 0x0209001119800000000715030300020230 (261) Message-Authenticator = 0x145801a756ad058b3a78d10e7f6343f1 (261) NAS-Identifier = "MikroTik" (261) NAS-IP-Address = 192.168.31.2 (261) session-state: No cached attributes (261) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (261) authorize { (261) policy filter_username { (261) if (&User-Name) { (261) if (&User-Name) -> TRUE (261) if (&User-Name) { (261) if (&User-Name =~ / /) { (261) if (&User-Name =~ / /) -> FALSE (261) if (&User-Name =~ /@[^@]*@/ ) { (261) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (261) if (&User-Name =~ /\.\./ ) { (261) if (&User-Name =~ /\.\./ ) -> FALSE (261) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (261) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (261) if (&User-Name =~ /\.$/) { (261) if (&User-Name =~ /\.$/) -> FALSE (261) if (&User-Name =~ /(a)\./) { (261) if (&User-Name =~ /(a)\./) -> FALSE (261) } # if (&User-Name) = notfound (261) } # policy filter_username = notfound (261) [preprocess] = ok (261) [chap] = noop (261) [mschap] = noop (261) [digest] = noop (261) suffix: Checking for suffix after "@" (261) suffix: No '@' in User-Name = "Nick_Pixel3", looking up realm NULL (261) suffix: No such realm "NULL" (261) [suffix] = noop (261) eap: Peer sent EAP Response (code 2) ID 9 length 17 (261) eap: Continuing tunnel setup (261) [eap] = ok (261) } # authorize = ok (261) Found Auth-Type = eap (261) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (261) authenticate { (261) eap: Expiring EAP session with state 0x7616a93d7e1fb074 (261) eap: Finished EAP session with state 0x7616a93d7e1fb074 (261) eap: Previous EAP request found for state 0x7616a93d7e1fb074, released from the list (261) eap: Peer sent packet with method EAP PEAP (25) (261) eap: Calling submodule eap_peap to process data (261) eap_peap: Continuing EAP-TLS (261) eap_peap: Peer indicated complete TLS record size will be 7 bytes (261) eap_peap: Got complete TLS record (7 bytes) (261) eap_peap: [eaptls verify] = length included (261) eap_peap: <<< recv TLS 1.2 [length 0002] (261) eap_peap: ERROR: TLS Alert read:fatal:unknown CA (261) eap_peap: TLS_accept: Need to read more data: error (261) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (261) eap_peap: TLS - In Handshake Phase (261) eap_peap: TLS - Application data. (261) eap_peap: ERROR: TLS failed during operation (261) eap_peap: ERROR: [eaptls process] = fail (261) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (261) eap: Sending EAP Failure (code 4) ID 9 length 4 (261) eap: Failed in EAP select (261) [eap] = invalid (261) } # authenticate = invalid (261) Failed to authenticate the user (261) Using Post-Auth-Type Reject (261) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (261) Post-Auth-Type REJECT { (261) attr_filter.access_reject: EXPAND %{User-Name} (261) attr_filter.access_reject: --> Nick_Pixel3 (261) attr_filter.access_reject: Matched entry DEFAULT at line 11 (261) [attr_filter.access_reject] = updated (261) [eap] = noop (261) policy remove_reply_message_if_eap { (261) if (&reply:EAP-Message && &reply:Reply-Message) { (261) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (261) else { (261) [noop] = noop (261) } # else = noop (261) } # policy remove_reply_message_if_eap = noop (261) } # Post-Auth-Type REJECT = updated

2 1