- Freeradius-Users - lists.freeradius.org

Packet-Src-IP-Address Unknown attribute
by Onur GURSOY 12 Nov '20

12 Nov '20

Hello All, Thanks for your all of answer in advance. I have some trouble about perl module. freeradius rlm_perl module requires libperl5.26 in ubuntu 18.04 but in 20.04 there is per which is version 5.30 so freeradius didn't start. when i install activeperl which has include libperl.so,5.26 I got error like this: /opt/sinecins/bin/freeradius/etc/raddb/mods-enabled/detail[34]: Failed > parsing expanded string: > /opt/sinecins/bin/freeradius/etc/raddb/mods-enabled/detail[34]: > ...reeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/det... > /opt/sinecins/bin/freeradius/etc/raddb/mods-enabled/detail[34]: But i remove perl module from mods-enable, freeradius begins. I couldn't understand clearly where is the relationship and error Many thanks, With My Best Regards, -- Onur GÜRSOY R&D Engineer in Embedded Systems Master Student at Gebze Institute Of Technology Department Of Electronic Engineering GSM : 0(545) 764 7653 e-mail: onurgursoygyte(a)gmail.com

2 1

linelog permission issue
by lingctam 12 Nov '20

12 Nov '20

Dear all, My client authentications keep failing due to linelog permissions issues: Thu Nov 12 19:22:15 2020 : Auth: (58) Login OK: [xxxxxxxxxxxxxx(a)anon.com] (from client xxxxxxxxxx port 0 via TLS tunnel) Thu Nov 12 19:22:15 2020 : Error: rlm_linelog: Failed to open /radius/log/linelog-20201112: Permission denied Thu Nov 12 19:22:15 2020 : Error: rlm_linelog: Failed to open /radius/log/linelog-20201112: Permission denied Thu Nov 12 19:22:15 2020 : Auth: (59) Rejected in post-auth: [xxxxxxxxxxx(a)anon.com] (from client xxxxxxxxxxxx port 13 cli 0ec84fa38cad) There are no issues writing into authentication, accounting, and reply logs. I have set 660 permissions for the linelog module as well. Could someone please help? Or offer a way to bypass this? Authentications are fine once linelog has been commented out in the virtual server configs... but having the linelog would help immensely in monitoring the authentications coming in the hundreds per minute. Thanks in advance.

3 2

radius tls for dynamic-authorization
by murugesh pitchaiah 12 Nov '20

12 Nov '20

Hi I am working on using freeradius as radsec server (radius tls). Able to see auth and acct works good. Is it feasible to do it for dynamic-authorization as well ? In the 'sites-available/tls' file not able to add ' coa' to type along with 'auth+acct'. Also I see the 'coa' file in sites-available; but not sure if feasible to configure it for TLS with listening in port 2083. Please share comments.Thanks. Thanks. murugesh

2 2

802.1x supplicant address with freeradius backend
by X Xiao 11 Nov '20

11 Nov '20

I'm using EAP/802.1x (hostapd) along with freeradius to authenticate wireless users which worked well, is there a way for me to know which IP address is used by each logged-in user? Thanks,

3 2

RADIUS TOTP Setup
by Nemanja Simpraga 11 Nov '20

11 Nov '20

Greetings, I am working on a TOTP authentication method setup with FreeRADIUS. For starters, I'd just like to generate a static user which uses TOTP (Time-based One-Time Passwords) to authenticate against the server. My company uses BitWarden which has an integrated Authenticator feature which can generate TOTP tokens which you can use for passing MFA challenges and logging in. Is it possible to have a user defined in RADIUS which is bound to a BitWarden token generator in some way? We do the same thing for accounts in our directory. The codes MSFT generates for their intended MSFT Auth mobile app I put into the BitWarden token generator to bind those accounts to the generator. After that I can use the codes from BitWarden to pass the MFA challenge and sign in. I've read about multiOTP and LinOTP but I can't seem to understand how they fit into this picture. Am I going in the right direction with this? Is this BitWarden setup possible? I am still quite new to FreeRADIUS, so bear with me. Thank you! Best regards, [cid:image001.png@01D6A951.934B5080] [cid:image002.png@01D6A951.934B5080]<https://www.facebook.com/iOLAPInc/> [cid:image003.png@01D6A951.934B5080] <https://twitter.com/iolapinc> [cid:image004.png@01D6A951.934B5080] <https://www.linkedin.com/company/iolap/> [cid:image005.png@01D6A951.934B5080] <https://iolap.com/> NEMANJA ŠIMPRAGA System Network Administrator [cid:image006.png@01D6A951.934B5080] nsimpraga(a)iolap.com<mailto:nsimpraga@iolap.com> +385 95 922 71 70

2 3

WiMAX / LTE EPS-AKA Key Generation
by Benjamin Thompson 08 Nov '20

08 Nov '20

Hi I am writing to ask whether anyone has any advice or scripts etc. to generate the Authentication Vector (AUTN, RAND, XRES, and KASME) for LTE authentication. The documentation I have found is: About the keys: https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.… -> 3GPP TS 33.401 V16.3.0 (2020-7) Page 24 About the RADIUS attributes: http://wimaxforum.org/Document/Download/WMF-T33-001-R022v05_Network-Stage3-… -> Page 1309 I am looking to implement this but it would be great if someone has already done it and can help me on my way. Ben Thompson

4 13

Want to use Radius with Azure ADDS
by Zett 08 Nov '20

08 Nov '20

Hello guys, I have Azure ADDS and secureLDAP. I setup freeRadius and connected to LDAP, it works so far with radtest in a normal way. I used this for setup <https://www.nasirhafeez.com/freeradius-with-ldaps-on-azure-ad-domain-servic…>. It is PAP method with LDAP bind as user. But actually it must be mschap, which is only working with ntlm_auth, isn’t it? When I use: radtest -t mschap salihzett password localhost 0 testing123 It doesn’t work. (184) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (184) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) (184) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (184) mschap: Client is using MS-CHAPv1 with NT-Password (184) mschap: ERROR: FAILED: No NT-Password. Cannot perform authentication (184) mschap: ERROR: MS-CHAP2-Response is incorrect I found this hint <http://lists.freeradius.org/pipermail/freeradius-users/2011-November/057120…>, but I don’t know how I need to do this for Azure ADDS. To create an user who has permissions to read the cleartext password. Maybe there is also other ways since 2011. Actually the way is not important, the goal is important :) So If anyone has a hint for me for using Radius with Azure ADDS, I am very thanksful. Thanks S.

2 1

Mac Address based Auth
by Ritah Mulinde 05 Nov '20

05 Nov '20

Hello All Kindly send me a documented guide on how to configure Mac Address based authentication on FreeRadius. Much appreciated. BR Ritah

3 3

Poet Auth Reject not working after reject using exec Module
by Muhammed Buvaydani 02 Nov '20

02 Nov '20

I have FreeRADIUS Version 3.0.21 and I am trying to authenticate users using External Php script , the script is working fine , my problem it is not insert in radpostauth table after getting reject from the script , this is the debug mode when I get reject user (0) Received Access-Request Id 71 from 127.0.0.1:47913 to 127.0.0.1:1812 length 100 (0) User-Name = "Aboserifaban" (0) User-Password = "123456" (0) Calling-Station-Id = "4e:f9:5e:77:0c:9a" (0) NAS-Port = 102 (0) NAS-IP-Address = 103.200.57.138 (0) Framed-Protocol = PPP (0) Framed-IP-Address = 192.168.0.1 (0) NAS-Identifier = "nas" (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "Aboserifaban", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry DEFAULT at line 48 (0) files: EXPAND /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "%{User-Name}" "%{User-Password}" "%{Calling-Station-Id}" "%{NAS-Port-Id}" "%{NAS-IP-Address}" "%{Framed-Protocol}" "%{Framed-IP-Address}" (0) files: --> /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "Aboserifaban" "123456" "4e:f9:5e:77:0c:9a" "" "103.200.57.138" "PPP" "192.168.0.1" (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> Aboserifaban (0) sql: SQL-User-Name set to 'Aboserifaban' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Aboserifaban' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Aboserifaban' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "123456" (0) sql: Simultaneous-Use := 1 (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'Aboserifaban' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'Aboserifaban' ORDER BY id rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'cloudradius' on Localhost via UNIX socket, server version 5.5.65-MariaDB, protocol version 10 (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'Aboserifaban' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'Aboserifaban' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (0) (0) [sql] = ok (0) if (User-Name =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { (0) if (User-Name =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> FALSE (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section session from file /usr/local/etc/raddb/sites-enabled/default (0) session { (0) sql: EXPAND %{User-Name} (0) sql: --> Aboserifaban (0) sql: SQL-User-Name set to 'Aboserifaban' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL (0) sql: --> SELECT COUNT(*) FROM radacct WHERE username = 'Aboserifaban' AND acctstoptime IS NULL (0) sql: Executing select query: SELECT COUNT(*) FROM radacct WHERE username = 'Aboserifaban' AND acctstoptime IS NULL rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) } # session = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) exec: Executing: /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "Aboserifaban" "123456" "4e:f9:5e:77:0c:9a" "" "103.200.57.138" "PPP" "192.168.0.1": (0) exec: ERROR: Program returned code (1) and output 'Reply-Message := "Your Account has been expired."' (0) [exec] = reject (0) } # post-auth = reject (0) Delaying response for 1.000000 seconds Waking up in 0.1 seconds. Waking up in 0.7 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 71 from 127.0.0.1:1812 to 127.0.0.1:47913 length 52 (0) Reply-Message := "Your Account has been expired." Waking up in 3.9 seconds. (0) Cleaning up request packet ID 71 with timestamp +3 Ready to process requests as you see above it rejected the user but it seems the SQL module not running , this is my configuration in POST-Auth section in default file post-auth { exec sql Post-Auth-Type REJECT { update reply { Reply-Message = "Rejected: invalid username or password..!" } # log failed authentications in SQL, too. exec sql } } when I stop exec in Post-auth section and it is working fine and it insert the result in radpostauth table Please help me to fix this issue Thanks in Advance Best Regards

3 3

Post Auth Reject not working after reject using exec Module
by Muhammed Buvaydani 31 Oct '20

31 Oct '20

I have FreeRADIUS Version 3.0.21 and I am trying to authenticate users using External Php script , the script is working fine , my problem it is not insert in radpostauth table after getting reject from the script , this is the debug mode when I get reject user 0) Received Access-Request Id 71 from 127.0.0.1:47913 to 127.0.0.1:1812 length 100 (0) User-Name = "Aboserifaban" (0) User-Password = "123456" (0) Calling-Station-Id = "4e:f9:5e:77:0c:9a" (0) NAS-Port = 102 (0) NAS-IP-Address = 103.200.57.138 (0) Framed-Protocol = PPP (0) Framed-IP-Address = 192.168.0.1 (0) NAS-Identifier = "nas" (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "Aboserifaban", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry DEFAULT at line 48 (0) files: EXPAND /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "%{User-Name}" "%{User-Password}" "%{Calling-Station-Id}" "%{NAS-Port-Id}" "%{NAS-IP-Address}" "%{Framed-Protocol}" "%{Framed-IP-Address}" (0) files: --> /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "Aboserifaban" "123456" "4e:f9:5e:77:0c:9a" "" "103.200.57.138" "PPP" "192.168.0.1" (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> Aboserifaban (0) sql: SQL-User-Name set to 'Aboserifaban' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Aboserifaban' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Aboserifaban' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "123456" (0) sql: Simultaneous-Use := 1 (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'Aboserifaban' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'Aboserifaban' ORDER BY id rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'cloudradius' on Localhost via UNIX socket, server version 5.5.65-MariaDB, protocol version 10 (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'Aboserifaban' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'Aboserifaban' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (0) (0) [sql] = ok (0) if (User-Name =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { (0) if (User-Name =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> FALSE (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section session from file /usr/local/etc/raddb/sites-enabled/default (0) session { (0) sql: EXPAND %{User-Name} (0) sql: --> Aboserifaban (0) sql: SQL-User-Name set to 'Aboserifaban' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL (0) sql: --> SELECT COUNT(*) FROM radacct WHERE username = 'Aboserifaban' AND acctstoptime IS NULL (0) sql: Executing select query: SELECT COUNT(*) FROM radacct WHERE username = 'Aboserifaban' AND acctstoptime IS NULL rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) } # session = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) exec: Executing: /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "Aboserifaban" "123456" "4e:f9:5e:77:0c:9a" "" "103.200.57.138" "PPP" "192.168.0.1": (0) exec: ERROR: Program returned code (1) and output 'Reply-Message := "Your Account has been expired."' (0) [exec] = reject (0) } # post-auth = reject (0) Delaying response for 1.000000 seconds Waking up in 0.1 seconds. Waking up in 0.7 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 71 from 127.0.0.1:1812 to 127.0.0.1:47913 length 52 (0) Reply-Message := "Your Account has been expired." Waking up in 3.9 seconds. (0) Cleaning up request packet ID 71 with timestamp +3 Ready to process requests as you see above it rejected the user but it seems the SQL module not running , this is my configuration in POST-Auth section in default file post-auth { exec sql Post-Auth-Type REJECT { update reply { Reply-Message = "Rejected: invalid username or password..!" } # log failed authentications in SQL, too. exec sql } } when I stop exec in Post-auth section and it is working fine and it insert the result in radpostauth table Please help me to fix this issue Thanks in Advance Best Regards

1 0