- Freeradius-Users - lists.freeradius.org

rlm_rest in 3.0.17: cert validation of HTTPS server not working
by Stefan Winter 12 Feb '19

12 Feb '19

Hello, I'm using rlm_rest to validate second-factor tokens to a privacyIDEA server. This worked fine with a test env in HTTP, but now doesn't on HTTPS with cert validation enabled. I have this on the command-line: # openssl s_client -connect 2fa.restena.lu:443 -CAfile /usr/local/freeradius/config/raddb/mods-config/rest/trustroot.pem CONNECTED(00000003) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Assured ID Root CA verify return:1 depth=1 C = NL, ST = Noord-Holland, L = Amsterdam, O = TERENA, CN = TERENA SSL CA 3 verify return:1 depth=0 C = LU, L = Esch-sur-Alzette, O = Fondation RESTENA, CN = *.restena.lu verify return:1 --- Certificate chain 0 s:/C=LU/L=Esch-sur-Alzette/O=Fondation RESTENA/CN=*.restena.lu i:/C=NL/ST=Noord-Holland/L=Amsterdam/O=TERENA/CN=TERENA SSL CA 3 1 s:/C=NL/ST=Noord-Holland/L=Amsterdam/O=TERENA/CN=TERENA SSL CA 3 i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA --- [...] Verify return code: 0 (ok) I.e. the server sends the intermediate, and the matching root is in the trustroot.pem file. But when I transpose this into the rlm_rest config like this: rest { tls { ca_file = ${confdir}/mods-config/rest/trustroot.pem check_cert = "yes" # doesn't work regardless if check_cert_cn is yes or no [...] Then I get an error message during FreeRADIUS' cert validation phase: rlm_rest (rest): Reserved connection (0) (15) rest: Expanding URI components (15) rest: EXPAND https://2fa.restena.lu (15) rest: --> https://2fa.restena.lu (15) rest: EXPAND //validate/radiuscheck (15) rest: --> //validate/radiuscheck (15) rest: Sending HTTP POST to "https://2fa.restena.lu//validate/radiuscheck" (15) rest: EXPAND user=%{urlquote:%{User-Name}}&pass=%{urlquote:%{TOTP-Token}} (15) rest: --> user=swinter&pass=thetokenvalue (15) rest: ERROR: Request failed: 83 - Issuer check against peer certificate failed (15) rest: ERROR: Server returned no data rlm_rest (rest): Released connection (0) I don't really know what to make of "Issuer check against peer certificate failed". The root appears to be recognised, and the intermedaite chain is the expected one. So what would be failing here? For reference, the two CA certs are pasted at the end. They are the root and intermediate, concatenated. If I only place the root cert itself into the file -> same result. Greetings, Stefan Winter -----BEGIN CERTIFICATE----- MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+ wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4 VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/ AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe +o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIE+zCCA+OgAwIBAgIQCHC8xa8/25Wakctq7u/kZTANBgkqhkiG9w0BAQsFADBl MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv b3QgQ0EwHhcNMTQxMTE4MTIwMDAwWhcNMjQxMTE4MTIwMDAwWjBkMQswCQYDVQQG EwJOTDEWMBQGA1UECBMNTm9vcmQtSG9sbGFuZDESMBAGA1UEBxMJQW1zdGVyZGFt MQ8wDQYDVQQKEwZURVJFTkExGDAWBgNVBAMTD1RFUkVOQSBTU0wgQ0EgMzCCASIw DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMV2Dw/ZQyk7bG3RR63eEL8jwnio Snc18SNb4EweQefCMQC9iDdFdd25AhCAHo/tZCMERaegOTuBTc9jP8JJ/yKeiLDS lrlcinQfkioq8hLIt2hUtVhBgUBoBhpPhSn7tU08D08/QJYbzqjMXjX/ZJj1dd10 VAWgNhEEEiRVY++Udy538RV27tOkWUUhn6i+0SftCuirOMo/h9Ha8Y+5Cx9E5+Ct 85XCFk3shKM6ktTPxn3mvcsaQE+zVLHzj28NHuO+SaNW5Ae8jafOHbBbV1bRxBz8 mGXRzUYvkZS/RYVJ+G1ShxwCVgEnFqtyLvRx5GG1IKD6JmlqCvGrn223zyUCAwEA AaOCAaYwggGiMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMHkG CCsGAQUFBwEBBG0wazAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQu Y29tMEMGCCsGAQUFBzAChjdodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGln aUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqgOKA2hjRodHRw Oi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3Js MDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVk SURSb290Q0EuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxo dHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMB0GA1UdDgQWBBRn/YggFCeYxwnS JRm76VERY3VQYjAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzANBgkq hkiG9w0BAQsFAAOCAQEAqSg1esR71tonHqyYzyc2TxEydHTmQN0dzfJodzWvs4xd xgS/FfQjZ4u5b5cE60adws3J0aSugS7JurHogNAcyTnBVnZZbJx946nw09E02DxJ WYsamM6/xvLYMDX/6W9doK867mZTrqqMaci+mqege9iCSzMTyAfzd9fzZM2eY/lC J1OuEDOJcjcV8b73HjWizsMt8tey5gvHacDlH198aZt+ziYaM0TDuncFO7pdP0GJ +hY77gRuW6xWS++McPJKe1e9GW6LNgdUJi2GCZQfXzer8CM/jyxflp5HcahE3qm5 hS+1NGClXwmgmkMd1L8tRNaN2v11y18WoA5hwnA9Ng== -----END CERTIFICATE----- -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 3

Eduroam and setting identity privacy in Windows
by Jim Potter 12 Feb '19

12 Feb '19

Hi all, I've been tasked with addressing our FreeRadius servers for our eduroam setup here. What I would like to achieve is authentication to happen invisibly where possible - our laptops would perform machine authentication, users would log in and would re-authenticate to wireless invisibly (currently each user needs to set up the wireless connection on each device the use - this is really bad from a user experience point of view, especially for students using laptops from a bank). Has anyone else had any success doing anything like this? The big problem I have run in to is in fact not really FreeRadius at all, rather the domain bound windows clients sending their credentials in the wrong format. Computer authentication comes in the form *host/mypc.bathspa.ac.uk <http://mypc.bathspa.ac.uk>* and users in the format *DOMAIN\myusername, *not *myusername(a)bathspa.ac.uk <myusername(a)bathspa.ac.uk>* as required by eduroam. I've updated the policy files on FreeRadius to authenticate the above formats successfully, but if staff are to be able to use their devices on remote eduroam sites, they need either their username ( at least their anonymous ID/identity privacy name) to be sent in the format *someone(a)bathspa.ac.uk <someone(a)bathspa.ac.uk>* Has anyone found a way of doing this? thanks in advance, Jim Server Engineer Bath Spa University

4 7

what would cause sql to return reject response?
by Bipin Patel 11 Feb '19

11 Feb '19

i have the below in authorize sql { notfound = 1 reject = 2 } if (notfound) { update reply { Reply-Message := "Incorrect Username or Password" } reject } if (reject) { update reply { Reply-Message := "Your account is disabled, contact admin" } reject } expiration { userlock = 1 } if (userlock) { update reply { Reply-Message := "Your account has expired, contact admin" } reject } logintime pap but the reject response is never generated from the sql module, if the username doesnt match it generates the notfound and if password doesnt match the pap module rejects the request and sql responds ok but what i want is the sql module to generate the reject response. can anyone guide me under what circumstances does the sql module generate a reject response coz i tried setting Auth-Type attribute to reject but still sql doesnt generate reject

2 4

Problem with migrating from macOS Server to FreeRADIUS 3.0.17
by Stephan Jung 11 Feb '19

11 Feb '19

Hello, I am trying to migrate a Server from maOS Server Version 5.6.1 (17S2109) to FreeRADIUS 3.0.17 and I have to configure OpenDirectory integration. I am following Apple’s macOS Server— Service Migration Guide | March 2018 <https://developer.apple.com/support/macos-server/macOS-Server-Service-Migra…> and set up everything accordingly. The server runs currently macOS 10.13.6 and serves also Opendirectory, but the rlm_opendirectory.dylib is nowhere to be found! I installed FreeRADIUS through brew. A) on the step "Configure FreeRADIUS” of Apple’s migration guide 4) Run the following command:  ls /usr/local/lib/rlm_opendirectory.* You should see the following in the output: • rlm_opendirectory.a • rlm_opendirectory.dylib • rlm_opendirectory.la Since I installed FreeRADIUS through Brew I checked in ls /usr/local/Cellar/freeradius-server/3.0.17/lib/rlm_opendirectory.* too, but nothing is found in both locations! B) on the last step "Set up users” when testing the configuration I get: /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/opendirectory[20]: Failed to link to module 'rlm_opendirectory': dlopen(/usr/local/Cellar/freeradius-server/3.0.17/lib/rlm_opendirectory.dylib, 6): image not found This is the complete output: I wrote on stackoverfow <https://stackoverflow.com/questions/54617087/freeradius-problems-with-open-…>, serverfault <https://serverfault.com/questions/953195/suddenly-radius-authentication-is-…> as well as Apple discussion forum <https://discussions.apple.com/thread/250152034>. Does someone now how to configure this? Where these library files come from? How to force macOS to write them? Thank you very much in advance!!! Stephan

3 7

Interpretation of Linked Unlinked and MA lines in the radsniff output
by Fekete Tamás 11 Feb '19

11 Feb '19

Hello! I would like to ask help with understanding the radsniff output as there are some lines I can not interpret. When I have run radsniff -W 1, I got the following output: ... Access-Request counters: Total : 66.000/s Linked : 64.000/s Unlinked : 0.000/s Access-Request latency: High : 1000.607ms Low : 0.260ms Average : 17.473ms MA : 23.723ms Access-Request retransmits & loss: RT (0) : 56.000/s ... I don't understand what is the difference between an Access-Request which is linked or unlinked. Can you explain this? And another question is: do you know what is the MA in the Access-Request latency? - Tamas Fekete

2 2

Problem with migrating from macOS Server to FreeRADIUS 3.0.17
by Stephan Jung 10 Feb '19

10 Feb '19

Unfortunately the log was stripped from my last mail. This is the complete output I get, when checking my FreeRADIUS installation: $ sudo /usr/local/Cellar/freeradius-server/3.0.17/bin/radiusd -XC FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/Cellar/freeradius-server/3.0.17/share/freeradius/dictionary including dictionary file /usr/local/Cellar/freeradius-server/3.0.17/share/freeradius/dictionary.dhcp including dictionary file /usr/local/Cellar/freeradius-server/3.0.17/share/freeradius/dictionary.vqp including dictionary file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/dictionary including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/radiusd.conf including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/proxy.conf including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/clients.conf including files in directory /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/ including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/eap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/echo including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/digest including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/date including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/pap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/expr including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/linelog including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/unix including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/exec including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/files including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/replicate including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/chap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/unpack including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/logintime including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/expiration including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/soh including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/mschap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/passwd including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/realm including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/opendirectory including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/sql including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/sql/main/sqlite/queries.conf including files in directory /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/ including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/accounting including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/eap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/canonicalization including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/dhcp including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/cui including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/filter including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/operator-name including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/control including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/debug including files in directory /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/sites-enabled/ including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/sites-enabled/default including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local/Cellar/freeradius-server/3.0.17" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local/Cellar/freeradius-server/3.0.17" localstatedir = "/usr/local/var" sbindir = "/usr/local/Cellar/freeradius-server/3.0.17/bin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/Cellar/freeradius-server/3.0.17/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/Cellar/freeradius-server/3.0.17/bin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = opendirectory radiusd: #### Instantiating modules #### modules { # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_eap # Loading module "eap" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/utf8 # Loaded module rlm_always # Loading module "reject" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/digest # Loaded module rlm_date # Loading module "date" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_expr # Loading module "expr" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loading module "detail" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "ntlm_auth" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "exec" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_files # Loading module "files" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/files files { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/replicate # Loaded module rlm_chap # Loading module "chap" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/chap # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/unpack # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/expiration # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no use_open_directory = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/opendirectory[20]: Failed to link to module 'rlm_opendirectory': dlopen(/usr/local/Cellar/freeradius-server/3.0.17/lib/rlm_opendirectory.dylib, 6): image not found [certificates]$ Thank you all in advance, Stephan

1 0

Framed-Pool
by One Zero Art 09 Feb '19

09 Feb '19

Hi, I am new in freeradius so need some help to understand Framed-Pool attribute reply. I am using a Mysql database. For AAA. I want my user to get an IP pool. Now where I will add this attribute in "radreply" or in "radgroupreply". I have a few groups like 1M, 2M etc. Thank you

2 2

About FreeRADIUS configuration file
by 水上ナツ 08 Feb '19

08 Feb '19

I first touched FreeRADIUS. I have a question about the setting file. · What is the role of sites-enabled/default? When will it be used? · There are many files in mods-enabled, but can I delete unnecessary files? Is there no problem even if it does not delete? I am waiting for reply. Thank you.

2 3

Trouble Getting Mac-Auth to Work
by Seth Turner 07 Feb '19

07 Feb '19

I'm new to FreeRadius, but have managed to get LDAP authentication working properly. Now I am trying to add in mac-auth as well for certain devices, but all devices are being rejected when they connect to the SSID regardless if the MAC is in the file. Based on what I am seeing, the calling-station-Id is being rewritten to the proper format, which matches what I have in the mac file, but RADIUS still rejects the connection. Can somebody help direct me as to what the issue may be? *NOTE: The end goal is actually to block certain MAC's from connecting to an SSID, which is why the file is called blocked_macs instead of authorized_mac like the documentation. I'm just trying to follow the guide for mac_auth atm before I try using it to restrict by MAC.* This is what I have under the Authorize section of default.conf. * preprocess* * # If cleaning up the Calling-Station-Id...* * rewrite_calling_station_id* * # Now check against the blocked_macs file* * blocked_macs* * if (!ok) {* * # No match was found, so reject* * reject* * }* * else {* * # The MAC address was found, so update Auth-Type* * # to accept this auth.* * update control {* * Auth-Type := Accept* * }* * }* This is what I get while running radiusd -X. Hopefully that is the proper logging needed for troubleshooting. *(0) [preprocess] = ok* *(0) policy rewrite_calling_station_id {* *(0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {* *(0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE* *(0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {* *(0) update request {* *(0) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}* *(0) --> 60-D8-19-D4-F0-83* *(0) &Calling-Station-Id := 60-D8-19-D4-F0-83* *(0) } # update request = noop* *(0) [updated] = updated* *(0) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated* *(0) ... skipping else: Preceding "if" was taken* *(0) } # policy rewrite_calling_station_id = updated* *(0) blocked_macs: EXPAND %{Calling-Station-ID}* *(0) blocked_macs: --> 60-D8-19-D4-F0-83* *(0) [blocked_macs] = noop* *(0) if (!ok) {* *(0) if (!ok) -> TRUE* *(0) if (!ok) {* *(0) [reject] = reject* *(0) } # if (!ok) = reject* *(0) } # authorize = reject* *(0) Using Post-Auth-Type Reject* -- *Seth Turner*Gasconade County R-2 School District Network Manager OHS Hunting and Fishing Club Sponsor Phone (573)-437-2172

2 2

Proxy-tester nagios check for Freeradius
by Fekete Tamás 06 Feb '19

06 Feb '19

Hello! I would like to make a proxy-tester Nagios check for Freeradius and would like to ask some help for debugging as I experience some problem with using eapol_test. The design is that a user wants to authenticate at realm "A" with credentials stored at realm "B". The infrastructure already set up for proxying based on the realm names and the Access-Requests are do forwarded. I tried this proxy scenario with radtest. And with radtest it works. However, I have some questions regarding this developer work. Maybe you can help me. The first is: is it true, that radtest doesn't encrypt it's messages so proxy requests will contain the password in a recoverable manner? - Tamas Fekete

2 2