- Freeradius-Users - lists.freeradius.org

eapol_test
by Bill Schoolfield 29 Jan '25

29 Jan '25

I'm following https://networkradius.com/articles/2021/10/25/command-line-EAP-testing.html (well sort of)..... I installed the debian 12 package for wpa_suppliment but I don't see any files for eapol_test. I also looked at the tar file contents at https://w1.fi/releases/ and I don't see any mention there. Anybody know how to build or download eapol_test?

3 3

Attributes Limits in Radius for SQL Queries
by Ahmed Chohan 29 Jan '25

29 Jan '25

Hi, I would like to know if there is a way to increase attribute size in radius as I'm getting an error when adding vendor attributes under mysq/queries.conf with message: "... is too long. Errors reading or parsing /etc/raddb/radiusd.conf" Currently under queries.conf, there are 146 vendor-specific attributes I've added for accounting purposes but if I go over 146 vendor-specific attributes, getting the message as shared above. Furthermore, I even increased the max_attribute parameter from 200 to 0 (no limit) for testing purposes, but I still got this error. Please let me know how I can overcome this issue. -- Regards, Ahmed Munir Chohan

2 1

thorization not working if proxying to anoither radius
by Peter Hudec 29 Jan '25

29 Jan '25

Hello, I would like to ask you to help me solve my issue. Forst, the freeradius is aliite bit older - Alma 9, freeradius-3.0.21-43.el9_5.x86_64 The packages froem the https://networkradius.com/packages/ do not wolr on Alma 9 ;( tehre is SSL ISSUE. My problemis as follows. I have users, with realms, there based on the relam I need to send request to another radius for 2FA. My radius should do the first FA, means the password authorization, the realm radius should do the 2fa In my case Cisco Duo for onretype of realm and some 3rd party radius for another realm. Based on the documentation, the PAPIf one is found, and no Auth-Type or Proxy-To-Realm attribute is set, the module will set Auth-Type := pap. So if I run the suffix module, to get the realm and pass the request to another radius, the PAP is omitted. I gva tried various solution as setting the Proxy-To-Realm after PAP in authorize section or set Auth-Type ;= PAP manually but neither solution is working, the PAP is not working and I have just the 2FA ;( Anyone got such a solution, wgere the freeradius is doing the fisrt facror and the 3rd party radius second ? regards Peter

3 4

Online RADIUS conference in March
by Alan DeKok 26 Jan '25

26 Jan '25

We're hosting an online RADIUS conference in March. Registration is free. The goal is general RADIUS education and raising awareness. https://radiusconference.org/ We are having talks for ISPs, Enterprises, and universities. We will be covering a wide range of topics. We have speakers from multiple companies, including myself, people from the WBA, and Eduroam. Please share the link to anyone who many be interested. Alan DeKok.

1 0

How to allow wrong passwords in Peap-Mschapv2?
by daoxuan shi 23 Jan '25

23 Jan '25

I'm trying to deploy freeadius 3.0.21, and having a problem. I need to support peap-machapv2 and peap-gtc authentication protocols. My boss is very old and often enters wrong passwords. I need to temporarily bypass password verification for him. Regardless of whether the password is correct or not, his computer will eventually complete peap-machapv2 authentication. I tried many methods, such as configuring his MAC address directly Auth-Type := Accept in authorize, but it didn't seem to work. thank you for your time -- Neil Shi

3 4

ntlm_auth and FR
by Gopal Raman 22 Jan '25

22 Jan '25

I 'm running PEAP authentication with my Radius server running on Ubuntu 22.04 and the same box also runs Samba 4 and is configured as an AD Domain Controller (just for testing). I want to use NTLM to do the MS-Chapv2 challenge response. I followed the Freeradius documentation that shows how to use ntlm_auth to get the NT-KEY and it works as expected when I invoke it like so from the bash shell # ntlm_auth --allow-mschapv2 --request-nt-key --domain=CN.LAN --username=nileadmin --challenge=eaea1458abf1a0b7 --nt-response=8f9ab8760a15cd40f2686c5a4c7954922ed17fb9f4cad7b3 Using the the NT-KEY the Radius server is able to complete the PEAP handshake with the client But what I really want is for the Radius server to run on a separate Linux host (say RadSrv) and talk to an external DC (like a Microsoft server). I've made RadSrv a member of the AD domain. When I run the exact same ntlm_auth on the RadSrv host, it reports that the password is incorrect and does not produce the NT-KEY. My question is whether using Samba it's even possible to do what I'm attempting. In other words should a domain member (not the DC) be able to run ntlm_auth and achieve the same result ? I can share smb.conf and other details on the DC and member if needed. Thanks Gopal Raman

2 1

TLS DHE ciphers fail in FIPS mode with openssl 3.0
by murugesh pitchaiah 22 Jan '25

22 Jan '25

Hi, I have an openssl client (FIPS) which has TLS connection with freeradius. The following ciphers were working well in the TLS handshake. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 Things were working fine with openssl client 1.0.2. But when I upgrade the client to openssl 3.0 - see the TLS handshake failing on the clide side with "bad dh" error. I see some references as "Randomly generated safe primes are not allowed by FIPS,". Ref: https://docs.openssl.org/3.0/man7/EVP_PKEY-DH/#dh-and-dhx-additional-parame… I see with "make dh" freeradius with the help of openssl - generates random dh. I guess these randomly generated safe primes are not allowed in FIPS from openssl 3. Guess somehow if we skip this and use only standard dh in radius server side it should work. Any information is much appreciated. Note: Freeradius server is using : OpenSSL 1.1.1 Thanks, Murugesh

2 1

Recommendations for Ensuring Accounting Reliability
by Erdal Emlik 21 Jan '25

21 Jan '25

Hi FreeRADIUS Users, I am currently working with a RADIUS ecosystem that includes proxies and backend servers, where the proxies forward incoming Accounting-Request packets from NAS devices directly to the backend. In case of issues with the backend servers or their dependent SQL systems, I am exploring ways to prevent the loss of accounting records and ensure reliable processing. I have reviewed the proxy-robust-accounting <https://freeradius.org/> documentation and am considering a couple of approaches: 1. Using the detail module in FreeRADIUS to temporarily store accounting requests locally when the SQL module fails and retry processing them later. However, I am concerned about the potential impact on disk space, especially in high-traffic scenarios or during prolonged outages. 2. Forwarding accounting requests from the proxy to an external queue, such as Elasticsearch or Kafka, as an alternative to directly relying on the backend SQL servers during failure scenarios. I would like to hear your thoughts on the feasibility of these approaches, as well as any recommendations or best practices for safeguarding accounting records in a setup involving proxies and backends. Your guidance would be greatly appreciated.

3 4

Radius attributes not sent
by Mik J 20 Jan '25

20 Jan '25

Hello, I have created a user like this > select * from radcheck where id=3; +----+----------+--------------------+----+----------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------+ | 3 | tata | Cleartext-Password | := | passtata | +----+----------+--------------------+----+----------+ > select * from radreply where id=3; +----+----------+--------------+----+-------+ | id | username | attribute | op | value | +----+----------+--------------+----+-------+ | 3 | tata | Fall-Through | = | Yes | +----+----------+--------------+----+-------+ > select * from radusergroup; +----+----------+-----------+----------+ | id | username | groupname | priority | +----+----------+-----------+----------+ | 1 | tata | admin | 1 | +----+----------+-----------+----------+ > select * from radgroupreply; +----+-----------+-------------------------+----+----------+ | id | groupname | attribute | op | value | +----+-----------+-------------------------+----+----------+ | 1 | admin | Tunnel-Type | == | VLAN | | 2 | admin | Tunnel-Medium-Type | == | IEEE-802 | | 3 | admin | Tunnel-Private-Group-Id | == | 9 | +----+-----------+-------------------------+----+----------+ But when I make my radius test request the Access accept is sent but not the other attributes # radtest tata passtata 127.0.0.1 1812 testing123 Sent Access-Request Id 54 from 0.0.0.0:39af to 127.0.0.1:1812 length 74 User-Name = "tata" User-Password = "passtata" NAS-IP-Address = 10.127.2.210 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "passtata" Received Access-Accept Id 54 from 127.0.0.1:714 to 127.0.0.1:14767 length 20 In my debug logs my attributes are retrieved but not sent (2) Received Access-Request Id 54 from 127.0.0.1:14767 to 127.0.0.1:1812 length 74 (2) User-Name = "tata" (2) User-Password = "passtata" (2) NAS-IP-Address = 10.127.2.210 (2) NAS-Port = 1812 (2) Message-Authenticator = 0xbea8f8a6107528be29765e63e58d0a3d (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "tata", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: No EAP-Message, not doing EAP (2) [eap] = noop (2) [files] = noop (2) sql: EXPAND %{User-Name} (2) sql: --> tata (2) sql: SQL-User-Name set to 'tata' rlm_sql (sql): Reserved connection (5) (2) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (2) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tata' ORDER BY id (2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tata' ORDER BY id (2) sql: User found in radcheck table (2) sql: Conditional check items matched, merging assignment check items (2) sql: Cleartext-Password := "passtata" (2) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (2) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tata' ORDER BY id (2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tata' ORDER BY id (2) sql: User found in radreply table, merging reply items (2) sql: Fall-Through = Yes (2) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (2) sql: --> SELECT groupname FROM radusergroup WHERE username = 'tata' ORDER BY priority (2) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'tata' ORDER BY priority (2) sql: User found in the group table (2) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (2) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'admin' ORDER BY id (2) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'admin' ORDER BY id (2) sql: Group "admin": Conditional check items matched (2) sql: Group "admin": Merging assignment check items (2) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (2) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'admin' ORDER BY id (2) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'admin' ORDER BY id (2) sql: Group "admin": Merging reply items (2) sql: Tunnel-Type == VLAN (2) sql: Tunnel-Medium-Type == IEEE-802 (2) sql: Tunnel-Private-Group-Id == "9" rlm_sql (sql): Released connection (5) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 10.9.8-MariaDB, protocol version 10 rlm_sql (sql): Closing expired connection (6) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): Closing expired connection (0) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket (2) [sql] = ok (2) [expiration] = noop (2) [logintime] = noop (2) [pap] = updated (2) } # authorize = updated (2) Found Auth-Type = PAP (2) # Executing group from file /etc/raddb/sites-enabled/default (2) Auth-Type PAP { (2) pap: Login attempt with password (2) pap: Comparing with "known good" Cleartext-Password (2) pap: User authenticated successfully (2) [pap] = ok (2) } # Auth-Type PAP = ok (2) # Executing section post-auth from file /etc/raddb/sites-enabled/default (2) post-auth { (2) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (2) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (2) update { (2) No attributes updated for RHS &session-state: (2) } # update = noop (2) sql: EXPAND .query (2) sql: --> .query (2) sql: Using query template 'query' rlm_sql (sql): Reserved connection (5) (2) sql: EXPAND %{User-Name} (2) sql: --> tata (2) sql: SQL-User-Name set to 'tata' (2) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (2) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'tata', 'passtata', 'Access-Accept', '2025-01-18 01:21:24.187903' ) (2) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'tata', 'passtata', 'Access-Accept', '2025-01-18 01:21:24.187903' ) (2) sql: SQL query returned: success (2) sql: 1 record(s) updated rlm_sql (sql): Released connection (5) (2) [sql] = ok (2) [exec] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) if (EAP-Key-Name && &reply:EAP-Session-Id) { (2) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (2) } # post-auth = ok (2) Login OK: [tata] (from client localhost port 1812) (2) Sent Access-Accept Id 54 from 127.0.0.1:1812 to 127.0.0.1:14767 length 20 (2) Finished request Waking up in 4.9 seconds. (2) Cleaning up request packet ID 54 with timestamp +6200 due to cleanup_delay was reached Ready to process requests I don't have any filters in place # grep filt /etc/raddb/radiusd.conf What could be the problem ?

2 2

Some guidance please
by Mark - Myakka Technologies 20 Jan '25

20 Jan '25

We have been using FreeRadius for over 10 years to authenticate our PPPoE users. We are putting in a new system that will be using DHCP and would like to authentication and accounting on our DHCP clients. Being these clients may be using their own equipment, MAC address username will not be the best. We have setup our system to use Option 82 to pass the username and password to the DHCP server. I have confirmed that the DHCP is receiving the Option 82 correctly and passing it to FreeRadius as both Agent-Circuit-Id and ADSL-Agent-Circuit-Id. I'm currently trying to figure out the best way to take the information contained in Agent-Circuit-Id and parse that to replace both username and password on the authorize request. Should I try to do this be writing my own ULang script in Policy.d and putting that in the start of authorize {} section? Should I dig into doing it as a PERL script? Seems like FreeRadius is optimized for PERL and doesn't take a performance hit. Has this been done before and I'm just not using the correct keywords in google to find it? I have read in certain posts that modifying User-Name is not recommended. If that is the case what variable should be used and where in the config should it be changed? Thanks -- Thanks, Mark mailto:mark@mailmt.com Myakka Communications www.Myakka.com Serving Manatee and Sarasota Counties with High-Speed Internet for over 20 years

2 5