- Freeradius-Users - lists.freeradius.org

Version 3.2.7 has been released
by Matthew Newton 31 Jan '25

31 Jan '25

We have released FreeRADIUS version 3.2.7 today. Some highlights in this release: - Easier configuration of TEAP - Configurable behaviour for "return" in policies and groups - see "unlang" in radiusd.conf - A new "python_path_mode" in rlm_python3 to configure how the python_path option is used. - Updates for RADIUS/TLS and more configuration options. Note that python2 and rlm_couchbase have been removed from the Alpine Docker images as the base OS has been updated and no longer supports Python 2 or Couchbase 2. Full information is in doc/ChangeLog. Download from the normal places: https://freeradius.org/releases/ https://freeradius.org/ftp/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_7 Packages are available from InkBridge Networks for common Linux distributions as usual: https://packages.inkbridgenetworks.com/ and Docker images have been refreshed on Dockerhub: https://hub.docker.com/r/freeradius/freeradius-server -- Matthew

2 1

We have released version 3.2.7
by Alan DeKok 31 Jan '25

31 Jan '25

Release notes below. Note that we have updated TEAP, and are interoperable with Microsoft. However, there are open issues with the TEAP standard which are being worked through the IETF. As such, TEAP may or may not work outside of the "Microsoft - FreeRADIUS" ecosystem. I would suggest that people wait before doing wide-spread deployments for TEAP. Configuration changes • The dpsk module now supports dynamic expansion of the filename parameter. • radiusd.conf now contains an unlang section, which controls new behavior for the return statement. • New configuration parameters for TEAP which makes it much easier to configure. See the teap section of the eap module. • Change idle timeout for incoming radsec connections, to better match behavior of radsecproxy. • python2 and rlm_couchbase are no longer available in the alpine docker image. • utmp files are becoming obsolete due to 32-bit time. unix/radwtmp have been commented out in the default config and radlast is no longer installed if last is not present on the system. Feature improvements • Print MD5 hash of the configuration files in debug mode. This helps people track configuration changes. • Add support for IPv6 to "abinary" type. The fields are the same as for "ip", but use "ipv6", and IPv6 formatted addresses. • Update radclient to make it clear that Message-Authenticator is added to all Access-Request packets, even if the input file does not contain it. • Add support for Subject AltName URI. Closes #5450. • Add python_path_mode option to python3 module. • Relax checks on OpenSSL minor versions for OpenSSL 3.x. • Add API for deleting dynamic home servers. • Set SO_KEEPALIVE on outbound sockets, so firewalls are less likly to close TCP connections. • Allow querying of statistics when home_server has src_ipaddr set. See FreeRADIUS-Stats-Server-Src-IP-Address. Fixes #5483 • Update dictionary "man" page. Fixes #4346. • Change jlibtool to use --show-config, to avoid conflicts with clang --config. Fixes #5442. • RADIUS/TLS clients now support a tls subsection. For connections from this client, this section is used in preference to the "listen" TLS settings. This allows a server to easily present different identities to different clients. • RADIUS/TLS has been updated for TLS-PSK and TLS 1.3. Tested with radsecproxy. Bug fixes • For EAP-TLS, send TLS start without a length field. Some clients refuse to do EAP-TLS when this field exists. • Avoid blocking TLS sockets on corner cases during session setup. • Update home server stats. • Correct error message about untrusted certs. Fixes #5466. • Use PyEval_RestoreThread to swap to main thread. Fixes #5111 • Don't run Python detach function on config check. • Fix a number of issues with TLS connections and check_client_connections = yes. • Be more careful about managing the incoming queue when databases block the server. The server will still be unable to make progress, but it should crash less. Whether or not this is a good thing is unknown. • Better handler single-character expansions. Fixes #2216. • Correct calculation of EAP length in pre-proxy. Fixes #5486. • Don't segfault when using detail listeners. Fixes #5485 • Add build check for Couchbase v2, rlm_couchbase won't build on v3.

1 0

Unable to use freeradius 3.0.26 with openssl 3.0
by Amit P 31 Jan '25

31 Jan '25

Hi, I am using Freeradius version 3.0.26 for a basic authentication, My system is upgraded from Openssl 1.0.2 to 3.0.4 version and after this the authentication is failing because server is rejecting the incoming request with following message. Dropping packet without response because of error: Received packet from 10.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) This must be happening, because MD5 is deprecated in openssl3.0 which is used by Freeradius for calculating Message-Authenticator attribute. I could see in release notes of 3.0.26, openssl 3.0 and tls1.3 support is added. i need help with the below line from release notes. *Add configure-time FIPS workaround to use internal MD4/MD5 implementations when disabled in OpenSSL.* I believe this workaround is the solution to my problem, can you please help me in what exactly needs to be done for this workaround. Thanks & Regards, Amit

4 7

Message-Authenticator in Access-Challenge and Access-Accept
by FreeRAD 30 Jan '25

30 Jan '25

In Access-Requests I can see that the Message-Authenticator is set to a randomly generated string which I would expect. However in the Access-Challenge and Access-Accept packets it is just set to all 0s (e.g. 0x0000...). What could the reason be for a random string not being generated for the replies from the server to the NAS? I added the below in response to the BlastRADIUS vulnerability notification on the FreeRADIUS but I was under the impression that FreeRADIUS should still be generating it's own string based off of HMAC and shared secret etc. * if (!EAP-Message) { update reply { Message-Authenticator := 0x00 } }*

2 2

eapol_test
by Bill Schoolfield 29 Jan '25

29 Jan '25

I'm following https://networkradius.com/articles/2021/10/25/command-line-EAP-testing.html (well sort of)..... I installed the debian 12 package for wpa_suppliment but I don't see any files for eapol_test. I also looked at the tar file contents at https://w1.fi/releases/ and I don't see any mention there. Anybody know how to build or download eapol_test?

3 3

Attributes Limits in Radius for SQL Queries
by Ahmed Chohan 29 Jan '25

29 Jan '25

Hi, I would like to know if there is a way to increase attribute size in radius as I'm getting an error when adding vendor attributes under mysq/queries.conf with message: "... is too long. Errors reading or parsing /etc/raddb/radiusd.conf" Currently under queries.conf, there are 146 vendor-specific attributes I've added for accounting purposes but if I go over 146 vendor-specific attributes, getting the message as shared above. Furthermore, I even increased the max_attribute parameter from 200 to 0 (no limit) for testing purposes, but I still got this error. Please let me know how I can overcome this issue. -- Regards, Ahmed Munir Chohan

2 1

thorization not working if proxying to anoither radius
by Peter Hudec 29 Jan '25

29 Jan '25

Hello, I would like to ask you to help me solve my issue. Forst, the freeradius is aliite bit older - Alma 9, freeradius-3.0.21-43.el9_5.x86_64 The packages froem the https://networkradius.com/packages/ do not wolr on Alma 9 ;( tehre is SSL ISSUE. My problemis as follows. I have users, with realms, there based on the relam I need to send request to another radius for 2FA. My radius should do the first FA, means the password authorization, the realm radius should do the 2fa In my case Cisco Duo for onretype of realm and some 3rd party radius for another realm. Based on the documentation, the PAPIf one is found, and no Auth-Type or Proxy-To-Realm attribute is set, the module will set Auth-Type := pap. So if I run the suffix module, to get the realm and pass the request to another radius, the PAP is omitted. I gva tried various solution as setting the Proxy-To-Realm after PAP in authorize section or set Auth-Type ;= PAP manually but neither solution is working, the PAP is not working and I have just the 2FA ;( Anyone got such a solution, wgere the freeradius is doing the fisrt facror and the 3rd party radius second ? regards Peter

3 4

Online RADIUS conference in March
by Alan DeKok 26 Jan '25

26 Jan '25

We're hosting an online RADIUS conference in March. Registration is free. The goal is general RADIUS education and raising awareness. https://radiusconference.org/ We are having talks for ISPs, Enterprises, and universities. We will be covering a wide range of topics. We have speakers from multiple companies, including myself, people from the WBA, and Eduroam. Please share the link to anyone who many be interested. Alan DeKok.

1 0

How to allow wrong passwords in Peap-Mschapv2?
by daoxuan shi 23 Jan '25

23 Jan '25

I'm trying to deploy freeadius 3.0.21, and having a problem. I need to support peap-machapv2 and peap-gtc authentication protocols. My boss is very old and often enters wrong passwords. I need to temporarily bypass password verification for him. Regardless of whether the password is correct or not, his computer will eventually complete peap-machapv2 authentication. I tried many methods, such as configuring his MAC address directly Auth-Type := Accept in authorize, but it didn't seem to work. thank you for your time -- Neil Shi

3 4

ntlm_auth and FR
by Gopal Raman 22 Jan '25

22 Jan '25

I 'm running PEAP authentication with my Radius server running on Ubuntu 22.04 and the same box also runs Samba 4 and is configured as an AD Domain Controller (just for testing). I want to use NTLM to do the MS-Chapv2 challenge response. I followed the Freeradius documentation that shows how to use ntlm_auth to get the NT-KEY and it works as expected when I invoke it like so from the bash shell # ntlm_auth --allow-mschapv2 --request-nt-key --domain=CN.LAN --username=nileadmin --challenge=eaea1458abf1a0b7 --nt-response=8f9ab8760a15cd40f2686c5a4c7954922ed17fb9f4cad7b3 Using the the NT-KEY the Radius server is able to complete the PEAP handshake with the client But what I really want is for the Radius server to run on a separate Linux host (say RadSrv) and talk to an external DC (like a Microsoft server). I've made RadSrv a member of the AD domain. When I run the exact same ntlm_auth on the RadSrv host, it reports that the password is incorrect and does not produce the NT-KEY. My question is whether using Samba it's even possible to do what I'm attempting. In other words should a domain member (not the DC) be able to run ntlm_auth and achieve the same result ? I can share smb.conf and other details on the DC and member if needed. Thanks Gopal Raman

2 1