- Freeradius-Users - lists.freeradius.org

FreeRADIUS+EAP in Alpine based docker container
by victorsugo 20 Sep '20

20 Sep '20

I'd like to run FreeRADIUS in a docker container, but I can't start it with the default config. (I am not sure if this is the right place for my question or should I go to an alpine forum/list.) What I do: $ docker run -it alpine # apk add freeradius-eap make openssl # cd /etc/raddb/certs # ./bootstrap # radiusd -X What I wait: it starts radius server. What I get instead of it: an error message. # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap /etc/raddb/mods-enabled/eap[14]: Failed to find 'Auth-Type EAP' section. Cannot authenticate users. /etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" But... If I edit /etc/raddb/sites-enabled/default and change authenticate { ... -eap ... } to authenticate { ... eap ... } then it starts with no error. I've tried to compare the logs with "diff -y --suppress-common-lines wrong.log good.log" and in the left column I get only that error message. Have you got any idea, what happens, what is the problem with the conditional loading of eap module? Regards, Victor Sugo

2 1

Freeradius, Kerberos and Openldap GSSAPI-SASL service principal issue
by Dario García Díaz-Miguel 18 Sep '20

18 Sep '20

Hi there, I'm writing to this mailing list looking for some help in order to configure Freeradius on a Kerberos and OpenLDAP GSSAPI-SASL infrastructure. We have everything working flawlessly. Freeradius service and server is working fine with krb5 and ldap modules enabled. The problem is when we need to start the freeradius service. The service only starts if you manually issue a ticket for the service kerberos principal or the host principal. This is such a strange behavior I can't understand. Krb5 module: krb5 { keytab = /etc/radius.keytab service_principal = radius/ex.ample.com pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 lifetime = 0 idle_timeout = 0 } } The keytab /etc/radius.keytab contains the keys for the service principal radius/ex.ample.com. The service should be able to access to the keytab to asks automatically for a ticket for radius/ex.ample.com. But it doesn't. Instead, the service fails until we issue for a new ticket: kinit -k -t /etc/radius.keytab radius/ex.ample.com The ownership of this keytab is radiusd:radiusd and it has reading permissions 440. But I've also tried with 777 with no luck The reason because it does not understand is that ldap has anon bind disallowed and the freeradius service tries an anonymous bind. I know that according to the rules I should have posted the full output debug log but I'm afraid that since it's a totally isolated environment, I can't extract the whole log. Error: rlm_ldap (ldap): Bind with (anonymous) to ldap://ex.ample.com:389 failed: Local error Error: rlm_ldap (ldap): Opening connection failed (0) Error: rlm_ldap (ldap): Error: /etc/raddb/mods-enabled/ldap [8]: Instantiation failed for module "ldap" This is how the ldap module SASL section looks: sasl { mech = 'GSSAPI' realm ='EX.AMPLE.COM' } The most weird behavior is that If we issue a host ticket (kinit -k) it starts and bind correctly using the host/ex.ample.com service principal. No matter that the service principal configured on krb5 module is radius/ex.ample.com Any ideas about how to proceed and the reasons why this happens? We are running the 3.0.15-2.11.2 freeradius version on SuSE12 SP3. Thank you so much. Kind Regards. Dario Garcia Díaz-Miguel GGCS-SES Unit GGCS SKMF Infrastructure Division GMV C\ de Isaac Newton, 11 28760, Tres Cantos, Madrid España +34 918 07 21 00 +34 918 07 21 99 www.gmv.com P Please consider the environment before printing this e-mail.

3 3

I want to limit the number of users online to 1 at the same time. Is it OK to operate the database only?
by 纽约城门口的小木匠 ■ 17 Sep '20

17 Sep '20

I want to limit the number of users online to 1 at the same time. Is it OK to operate the database only?

2 1

Accounting Start - Proxy
by Byron Jeffery 15 Sep '20

15 Sep '20

Hi I am looking into a possible scenario where we need to pass the accounting start record to two devices simultaneously, but because we have multiple sites, I will need to look at the source NAS and then forward/proxy to the two correct accounting servers based on that site. Currently our NAS can only send the accounting start to one device at a time. In my research, I know that there is the option of setting up a freeradius accounting proxy with some home servers, but I am struggling to understand if this will accomplish what we are looking to do as above. Will I need to reference these home servers in the Accounting section in the sites-enabled>default config file? Hope I made sense, sorry. - Kind Regards - Byron Jeffery - Assisting ICT Manager -- The content of this message is provided without responsibility in law for their accuracy or otherwise, and without assumption of a duty of care by Christian Education Ministries. Whilst every attempt has been made to ensure that material contained in this email is free from computer viruses or other defects, the attached files are provided, and may only be used, on the basis that the user assumes all responsibility for use of the material transmitted. This email is intended only for the use of the individual or entity names above and may contain information that is confidential and privileged. If you are not the intended recipient, please note that any dissemination, distribution or copying of this email is strictly prohibited. If you have received this email in error, please notify us immediately by return email and destroy the original message.

2 1

Wiki RadSec outdated
by Henning Hollermann 14 Sep '20

14 Sep '20

Hi, I think freeRADIUS supports RadSec by now, correct? https://wiki.freeradius.org/glossary/RadSec Best, Henning

2 3

External trigger for CoA
by Vadim Cargatser (vcargats) 14 Sep '20

14 Sep '20

Hi, We'd like to trigger a CoA based on an external event. Is this possible? There was a mail thread back in 2010 I was just wondering if something has been changed so far: http://freeradius.1045715.n5.nabble.com/Freeradius-COA-trigger-td3204376.ht… I know the basic approach is to use radclient for that scenario. Unfortunately, radclient does not support TLS/RADSEC which is critical for us. In case this is not currently possible, can we just implement that? Say to allow getting external events for example from RabbitMQ? Thanks, Vadim

2 2

Post-Auth-Type reject not insert in radpostauth table
by Muhammed Buvaydani 13 Sep '20

13 Sep '20

hi there,I have freeradius version3 which has an external authentication script in the users file this is the users file content DEFAULT Auth-Type := accept Exec-Program-Wait="/usr/bin/php /var/www/html/cloudradius/captiveportal/auth.php \"%{User-Name}\" \"%{User-Password}\" \"%{Calling-Station-Id}\" \"%{NAS-Port}\" \"%{NAS-IP-Address}\" and this is the post auth section in default file under sites-enables post-auth { reply_log exec sql Post-Auth-Type reject { sql attr_filter.access_reject } } and this is the output which is returned from my external script in reject status Reply-Message="User not found" the problem is when I get rejected user it is not insert in radpost auth rable but it insert without any problem when I get accepted user this is the debug when I get rejected user (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) reply_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /usr/local/var/log/radius/radacct/127.0.0.1/reply-detail-20200913 (0) reply_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/reply-detail-20200913 (0) reply_log: EXPAND %t (0) reply_log: --> Sun Sep 13 23:40:40 2020 (0) [reply_log] = ok (0) exec: Executing: /usr/bin/php /var/www/html/cloudradius/captiveportal/auth.php "28:C6:8E:3F:6E:dB1" "1234" "28:C6:8E:3F:6E:BB" "102" "103.81.214.233" "PPP" "192.168.0.1" "" "nas": (0) exec: ERROR: Program returned code (1) and output 'Reply-Message="User not found"' (0) [exec] = reject (0) } # post-auth = reject (0) EXPAND User : %{User-Name}, MAC : %{Calling-Station-Id}, Nas : %{NAS-IP-Address}, Nas Port : %{NAS-Port-Id}, Ip : %{Framed-IP-Address} (0) --> User : 28:C6:8E:3F:6E:dB1, MAC : 28:C6:8E:3F:6E:BB, Nas : 103.81.214.233, Nas Port : , Ip : 192.168.0.1 (0) Rejected in post-auth: [28:C6:8E:3F:6E:dB1/1234] (from client localhost port 102 cli 28:C6:8E:3F:6E:BB) User : 28:C6:8E:3F:6E:dB1, MAC : 28:C6:8E:3F:6E:BB, Nas : 103.81.214.233, Nas Port : , Ip : 192.168.0.1 (0) EXPAND User : %{User-Name}, MAC : %{Calling-Station-Id}, Nas : %{NAS-IP-Address}, Nas Port : %{NAS-Port-Id}, Ip : %{Framed-IP-Address} (0) --> User : 28:C6:8E:3F:6E:dB1, MAC : 28:C6:8E:3F:6E:BB, Nas : 103.81.214.233, Nas Port : , Ip : 192.168.0.1 (0) Login incorrect (exec: Program returned code (1) and output 'Reply-Message="User not found"'): [28:C6:8E:3F:6E:dB1/1234] (from client localhost port 102 cli 28:C6:8E:3F:6E:BB) User : 28:C6:8E:3F:6E:dB1, MAC : 28:C6:8E:3F:6E:BB, Nas : 103.81.214.233, Nas Port : , Ip : 192.168.0.1 (0) Delaying response for 1.000000 seconds Waking up in 0.2 seconds.

2 1

[Auto Reply] stop
by 4794094048＠vtext.com 13 Sep '20

13 Sep '20

[Auto Reply] stop

1 0

[Auto-Reply] I'm driving right now - I'll get bac...
by 4794094048＠vtext.com 13 Sep '20

13 Sep '20

[Auto-Reply] I'm driving right now - I'll get back to you later.

1 0

Add VSA in pre-proxy stage
by Arnaud LAURIOU 11 Sep '20

11 Sep '20

Hello, I'm trying to add a VSA in an Access-Request before proxing it to an authentification RADIUS server. I use this attribute definition : BEGIN-VENDOR FreeRADIUS format=Extended-Vendor-Specific-1 ATTRIBUTE FreeRADIUS-Eduroam-Prevent-Loop 1 integer END-VENDOR FreeRADIUS I add this VSA in the pre-proxy stage, but I get : (0) # Executing section pre-proxy from file /etc/freeradius/sites-enabled/default (0) pre-proxy { ... (0) if (!FreeRADIUS-Eduroam-Prevent-Loop) { (0) if (!FreeRADIUS-Eduroam-Prevent-Loop) -> TRUE (0) if (!FreeRADIUS-Eduroam-Prevent-Loop) { (0) update request { (0) &FreeRADIUS-Eduroam-Prevent-Loop := 1 (0) } # update request = noop (0) } # if (!FreeRADIUS-Eduroam-Prevent-Loop) = noop (0) ... skipping else: Preceding "if" was taken Why is the return state of this update to 'noop' ? I shoud not get a 'ok' or 'updated' return state ? And this VSA does not seem to be added to the forwarded Access-Request : (0) Proxying request to home server 194.57.4.197 port 1812 timeout 14.000000 (0) Sent Access-Request Id 255 from 0.0.0.0:47596 to 194.57.4.197:1812 length 162 (0) User-Name = "anonymous(a)renater.fr" (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id := "02-00-00-00-00-01" (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Connect-Info = "eduroam.fr monitoring" (0) EAP-Message = 0x02c8001901616e6f6e796d6f75734072656e617465722e6672 (0) Message-Authenticator = 0x0705ffe079dfb7dc4cd3bdaad44477d4 (0) Event-Timestamp = "Sep 11 2020 15:14:17 CEST" (0) Proxy-State = 0x30 It seems that I missed something, but where ? Regards, Arnaud Lauriou

3 2