- Freeradius-Users - lists.freeradius.org

Does Pam_Radius support Acct-Interim-Interval?
by Mark Antony 04 Aug '20

04 Aug '20

Hello, I have a question about Pam_Radius plugin and Freeradius. Does it only support authentication? I'm asking because while authentication seem to work, Acct-Interim-Interval seem to be completely ignored. post-auth { update reply { Acct-Interim-Interval = 10 } } For testing purposes I have set it to 10 seconds and I was expecting it to fire update-requests every 10 seconds, but this isn't happening. Thanks, Mark

2 1

eapol_test ipv6
by Dave Macias 03 Aug '20

03 Aug '20

Hello, After much googling i was able to use eapol_test with ipv6. Distro provided eapol_test tool does not support ipv6 so had to build from source. Looking at this old post, https://www.spinics.net/lists/hostap/msg06118.html i needed to add the "CONFIG_IPV6=y" to the eapol_test/config_linux file to be able to support radius server's ipv6 address. *Possible to add it to source code?* *I'm willing to PR it.* Just some extra info: Output from distro eapol_test: $ eapol_test -c eapol_test.txt -s <mysecret> -a ::1 -N <whatever> Reading configuration file 'eapol_test.txt' ... Invalid IP address '::1' eapol_test: eapol_test.c:1036: wpa_init_conf: Assertion `0' failed. Aborted Output from source build with CONFIG_IPV6=y: $ ./eapol_test_source -c eapol_test.txt -s <mysecret> -a ::1 -N <whatever> Reading configuration file 'eapol_test.txt' Line: 1 - start of a new network block ... EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit ENGINE: engine deinit MPPE keys OK: 1 mismatch: 0 SUCCESS Thank you for the support! -Dave

1 0

Freeradius and smsotp
by Milovan Kotlica 30 Jul '20

30 Jul '20

Hi, I have installed Freeradius 2.1.12 on Centos 6 and I use Thomas Glanzmann SMSOTP. Now I want to migrate that on Centos 8. I installed Freeradius 3.0.17 and same SMSOTP. When I login on vpn I first type username/password and after that smsotp pin. On new instalation I have issue with smsotp. My first login is OK and smsotp module creates and send smsotp pin. But after I type smsotp pin on vpn radius reject. smsotpd.pl scripts return wornings: Subroutine _call redefined at (eval 155) line 30. Subroutine SendSMSExtService::want_som redefined at (eval 155) line 73. Subroutine AUTOLOAD redefined at (eval 155) line 90. Subroutine SendSMSExtService::SendSMSExt redefined at (eval 155) line 88. Server session encountered read error 104: Connection reset by peer Server session encountered read error 104: Connection reset by peer p.s. In attach is last part of Freeradius debug. Thanks

2 4

Virtual Servers & nas_table Server Column Problem
by Ali Arslan 29 Jul '20

29 Jul '20

Hello, I use freeradius 3.0.20 on ubuntu server 20.04 virtual machines with mssql backend accessed by freetds. I had 3 virtual machines just for freeradius, so i wanted to run them all on a single machine to make better use of resources and decided to make use of Virtual Server capability of freeradius. i kept the defualt site as the server of main ISP and added 2 more virtual servers, namely WISPServer and HotspotServer (for hotels and cafes) whose listen sections are as follows: server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } ... } server WISPServer { listen { type = auth ipaddr = * port = 2812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 2813 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 2812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 2813 type = acct limit { } } ... } server HotspotServer { listen { type = auth ipaddr = * port = 3812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 3813 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 3812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 3813 type = acct limit { } } ... } And sql module definitions are all similar except database names. sql { # default server # sql WISPSQL{ for WISPServer # sql HotspotSQL{ for HotspotServer dialect = "mssql" driver = "rlm_sql_freetds" server = "SQLServer" port = 1433 login = "sa" password = "<<servet>>" radius_db = "ISP" # radius_db = "WISP" for WISPServer # radius_db = "Hotspot" for HotspotServer acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radcheck" delete_stale_sessions = yes pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } read_clients = yes client_table = "nas" group_attribute = "SQL-Group" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } Here i use radcheck GroupName custom column to define groups, a user can only have a singe group and it is a calculated field. nas_table has a Server column to define virtual server name: nas_query = " SELECT Id, IPAddress, ShortName, 'other', Secret, ISNULL(Server, '') FROM ${nas_table}" The attached debug file shows that the client added to WISPServer clients list: rlm_sql (WISPSQL): Adding client 192.168.1.1 (ofis) to WISPServer clients list rlm_sql (192.168.1.1): Client "ofis" (WISPSQL) added But when the client ( 92.168.1.1 ) sends an accountig request i get error: Ignoring request to acct address * port 2813 bound to server WISPServer from unknown client 192.168.1.1 port 41272 proto udp To make it work i needed to do one two things, remove Server column from nas query or make it NULL (actually empty string, NULL does not work either), in this case it adds clients to global client list saying rlm_sql ( WISPSQL): Adding client 192.168.1.1 (ofis) to global clients list For security reasons i wan to define client for a Virtual Server, how can i make it work? An example debug oupt is attached. Thaks.

2 2

Lease Query is not working in latest master branch
by Chinnapaiyan, Nagamani 29 Jul '20

29 Jul '20

Hi, Lease Query is not working in latest master(#feb57bfef488dbb8a850b47b6a72eb1db0285fbe), Other messages are working fine. And same LQ was working fine previously. Debug output: Info : FreeRADIUS Version 4.0.0 Info : Copyright 1999-2020 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/raddb/dictionary" ... ... proto_dhcpv4_udp - Received DHCP-Request XID 13df720c length 332 dhcpv4_udp server 127.0.0.1 port 6767 on interface lo (11) Running request (11) Received DHCP-Request XID 13df720c from 127.0.0.1:6768 to 127.0.0.1:6767 via lo (11) DHCP-Opcode = Client-Message (11) DHCP-Hardware-Type = Ethernet (11) DHCP-Hardware-Address-Length = 6 (11) DHCP-Hop-Count = 0 (11) DHCP-Transaction-Id = 333410828 (11) DHCP-Number-of-Seconds = 0 (11) DHCP-Flags = 0 (11) DHCP-Client-IP-Address = 0.0.0.0 (11) DHCP-Your-IP-Address = 0.0.0.0 (11) DHCP-Server-IP-Address = 0.0.0.0 (11) DHCP-Gateway-IP-Address = 0.0.0.0 (11) DHCP-Client-Hardware-Address = 04:11:22:33:44:55 (11) DHCP-Message-Type = DHCP-Request (11) DHCP-Client-Identifier = 0x041122334455 (11) DHCP-Parameter-Request-List = DHCP-Subnet-Mask (11) DHCP-Parameter-Request-List = DHCP-Router-Address (11) DHCP-Parameter-Request-List = DHCP-Domain-Name-Server (11) DHCP-Vendor-Class-Identifier = 0x766961736174312e30 (11) DHCP-Subscriber-Id = "041122334455(a)aut.res.viasat.com" (11) DHCP-Relay-Remote-Id = 0x04a0bc112233 (11) DHCP-Relay-Circuit-Id = 0x00a0bc223344 (11) DHCP-Requested-IP-Address = 169.254.1.191 (11) DHCP-DHCP-Server-Identifier = 10.43.18.31 (11) Running 'recv DHCP-Request' from file /etc/raddb/sites-enabled/dhcp (11) recv DHCP-Request { ... ... TIMER - proto_dhcpv4_udp - cleanup delay proto_dhcpv4_udp - Received DHCP-Lease-Query XID 103fd54a length 321 dhcpv4_udp server 127.0.0.1 port 6767 on interface lo Failed tracking packet from client default - discarding it Regards, Nagamani Chinnapaiyan

2 3

tls: Failed changing permissions with networkradius.com packages
by Arnaud LAURIOU 29 Jul '20

29 Jul '20

Hi, We are replacing our default ubuntu (18.04) FR packages with those provided by networkradius.com (3.0.21). We use TLS (radsec), we kept the same tls virtual-server and with networkradius packages we have an error during the startup process : freeradius[19720]: tls: Failed changing permissions on /var/tmp/radsec: No such file or directory This directory exists, it is owned by freeradius user and it is empty : $ ls -al /var/tmp/radsec total 8 drwx------ 2 freerad freerad 4096 juil. 28 15:41 . drwxrwxrwt 7 root root 4096 juil. 28 17:15 .. In debug mode (freeradius -fxx -l stdout) : freeradius start fine, no error. listen { type = "auth" virtual_server = "default" ipaddr = 194.57.7.17 port = 2083 proto = "tcp" .. verify { skip_if_ocsp_ok = no tmpdir = "/var/tmp/radsec" client = "/usr/bin/openssl verify -CApath /etc/freeradius/certs -CAfile /etc/freeradius/certs/eduPKICA.crt %{TLS-Client-Cert-Filename}" } Any idea ? Regards, Arnaud Lauriou -- Direction des Services Applicatifs RENATER - Rennes https://www.renater.fr/

2 2

MAC address Randomization
by Eric Aguilar 28 Jul '20

28 Jul '20

Hello! I wanted to exchange some ideas on the impact we will all have on the MAC address randomization being implemented as an enabled by default feature on iOS14 Apple Devices (https://support.apple.com/en-us/HT211227) Some authentication procedures on our networks are based on the MAC address so I think the impact is going to be huge and certainly, analytics and accounting will be impacted as well. ¿What are your thoughts on this? ¿What are some workarounds we should implement? ¿are there any?

3 2

EAP-PWD Authentication with Username and MAC
by psuet 27 Jul '20

27 Jul '20

Hi, I want to authenticate users with EAP-PWD with ./mods-config/files/authorize and check the used Calling-Station-ID in the process. A example for an entry in the authorize file: > username Calling-Station-Id == "A1-B2-C3-D4-E5-F6" Cleartext-Password > := "password" Authentication works fine for PEAP, but it looks like Calling-Station-ID is not available when the file is checked against when using EAP-PWD. Is there a method to make Calling-Station-Id available to the files mod when using EAP-PWD? (Freeradius 3.0.21) Thanks for any answer! Paul

4 5

help on REST HTTP-headers
by Mark Grayson (mgrayson) 24 Jul '20

24 Jul '20

Hi All Very new to freeRADIUS and trying to set up a post-auth rest POST to a 3rd party system that is expecting an API-key. So I set up rest config as post-auth { uri = "{$..connect_uri}/post" method = 'post' body = 'json' REST-HTTP-Header = "x-api-key: 94332cabcdef57456582e5af2bfa123456789" data = '{"end-user":"radius-test"}' tls = ${..tls} } But the debug I see from the POST server is Headers ------- Forwarded: for="<IP@>";proto=https X-Cloud-Trace-Context: 0edff73713fcbb7dd9741ac6e8ca6436/18102608228808296760 X-Forwarded-For: <IP@>, 169.254.1.1 Content-Length: 26 Content-Type: application/json X-Forwarded-Proto: https X-Freeradius-Section: post-auth X-Freeradius-Server: default Accept: */* User-Agent: FreeRADIUS 3.0.22 Body ---- {"end-user":"radius-test"} Any idea what I'm doing wrong when trying to configure the x-api-key header? Cheers, Mark

3 4

Expansion of acct-unique-session-id query
by FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) 23 Jul '20

23 Jul '20

Hi all, Me again ☺ I’m having an issue with the creation of the Acct-Unique-Session-Id control attribute in v4. In v3, the policy did something like the following : (545) else { (545) update request { (545) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (545) --> 0a28ca134cc4f141e97cacdf91f7551f (545) Acct-Unique-Session-Id := "0a28ca134cc4f141e97cacdf91f7551f" If I do something like : echo -n "00c0b7869f20,001E00000002,192.168.105.142,IT-2530-2,,5" | md5sum I get the same md5 hash, good: 0a28ca134cc4f141e97cacdf91f7551f - In v4, (I’ve altered the attributes used in the calculation to match the v3 calculation, to try and demonstrate the issue). The output should in theory be the same? I get: (0) else { (0) update request { (0) EXPAND %{User-Name} (0) --> 00c0b7869f20 (0) EXPAND %{Acct-Session-ID} (0) --> 001E00000002 (0) EXPAND %{NAS-IP-Address} (0) --> 192.168.105.142 (0) EXPAND %{NAS-Identifier} (0) --> IT-2530-2 (0) EXPAND %{NAS-Port-ID} (0) --> , (0) EXPAND %{NAS-Port} (0) --> 5 (0) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (0) (%{md5:00c0b7869f20,001E00000002,192.168.105.142,IT-2530-2,,5}) (0) --> 0xa5850401f8c9f7ffdd43a04100ca8190 (0) &Acct-Unique-Session-Id := "\245\205\004\001\370\311\367\377\335C\240A\000ʁ\220" Everything expands ok, and it says it’s doing an md5 on the correct resulting “string”, but the output looks pretty odd. Should the md5 come out in hex format? I guess it’s maybe that part at fault, instead of the hex->string conversion? Thanks Andy ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

2 3