- Freeradius-Users - lists.freeradius.org

Authenticate with machine account and without ntlm_auth
by Rodrigo Antunes 19 Nov '24

19 Nov '24

Hi, I'd like to authenticate a PC using it's machine account and the mschap module, without calling ntlm_auth, is this possible? I noticed that the machine send its user as "host/machinename" but I don't know how to obtain and check its password. Maybe I should check the nt-hashes in users file? Thanks

6 18

Can't run freeradius after reboot
by Francis Augusto Medeiros-Logeay 19 Nov '24

19 Nov '24

Hi, I think there were some updates on our RHEL 9 machine where I test frreeradius, and now radiusd refuses to run: radiusd -X Error : tls - libssl version mismatch. built: 30000070 linked: 30200020 I upgraded to 3.2.6, and it didn’t seem to fix. Any clues on how to fix this? Best, Francis

2 2

How to get FR user check items override group check items
by Abraham Jacob 18 Nov '24

18 Nov '24

I have been using FreeRADIUS 1.1 (yeah very old) on an old Debian server over the years without any issues. Thank you for wonderful software! Now, as part of the server upgrade, I tried installing version 3.2.1 in Debian 12 and I was able to configure it except for one issue. In v1.1 user attributes get priority over group items. I am using the same SQL tables from v1.1. There I am setting Session-Timeout to 3600 in the radgroupcheck table. For some select users I set Session-Timeout differently, say 7200. In v1.1, I am seeing Session-Timeout = 7200 for Access-Accept while in v3.2.1 it is 3600. I checked the server in debug mode and found following <snip> .... (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Session-Timeout := 7200 (0) sql: Crypt-Password := "$1$bd1rxwue$ab3wiY34Cjfk5QM13/vNy0" .... (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{S QL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'VPN -60-Min' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'VPN-60-Min' ORDER BY id (0) sql: Group "VPN-60-Min": Conditional check items matched (0) sql: Group "VPN-60-Min": Merging assignment check items (0) sql: Session-Timeout := 3600 .... (0) dailycounter: Allowing user, &control:Session-Timeout value (3600) is greater than counter value (0) (0) dailycounter: Setting &reply:Session-Timeout value to 3600 .... Sent Access-Accept Id 55 from 192.168.3.180:1812 to 192.168.3.180:39999 length 32 (0) Idle-Timeout = 600 (0) Session-Timeout = 3600 (0) Finished request </snip> So I think this is the expected behaviour in the new version. Following are the sql contents. Table radgroupreply: +----+------------+--------------+----+-------+ | id | groupname | attribute | op | value | +----+------------+--------------+----+-------+ | 9 | VPN-60-Min | Idle-Timeout | := | 600 | +----+------------+--------------+----+-------+ Table radgroupcheck: +----+------------+-----------------+----+-------+ | id | groupname | attribute | op | value | +----+------------+-----------------+----+-------+ | 2 | VPN-60-Min | Session-Timeout | := | 3600 | +----+------------+-----------------+----+-------+ Table: radcheck: +----+----------+-----------------+----+------------------------------------+ | id | username | attribute | op | value | +----+----------+-----------------+----+------------------------------------+ | 18 | vpn-user | Session-Timeout | := | 7200 | | 19 | vpn-user | Crypt-Password | := | $1$bd1rxwue$ab3wiY34Cjfk5QM13/vNy0 | +----+----------+-----------------+----+------------------------------------+ Now my question: Is there any configuration options available to get the old v1.1 behaviour? This way I don't have to set Session-Timeout for all my users, just a select few who need to be different from default. Thanks Abraham

3 9

Using the rest module
by Francis Augusto Medeiros-Logeay 17 Nov '24

17 Nov '24

Hi, I’m fairly new to Freeradius, and today I took the time to read the documentation and to search what’s a best practice to implement some polling-based (blocking) authentication with FreeRADIUS towards a rest api server. I tried with Python first, but since I’m having trouble with concurrency, so I’m exploring other alternatives. The rest module seems like a fit, but I didn’t find much about other possibilities rather than interpreting the response code and having a json as a response that match existing attributes. In my case, I need simply to evaluate a value of a nested json key that doesn’t really match any existing attributes. Is there a way to do it? For example: { ‘detail’ : { ‘ result’ : { ‘value’ :’true’}}} I need to authenticate that user based on the value of ‘value’. Is the rest module a good tool for this? I saw that there is a json module that might be used with the rest, but it doesn’t seem to be available for the version I am using (3.0.21 on RHEL 9). I have three api calls, to three different url’s, so I figured out how to create multiple instances of the rest module, which is great. It’s just the response logic that I’m failing to understand. Could anyone point me to the right direction? Best, Francis

2 2

Using the authenticate function on rlm_python
by Francis Augusto Medeiros-Logeay 16 Nov '24

16 Nov '24

Hi there, I am trying to write a python script to be used by the python module of Freeradius. My main goal is to send an Access-Challenge to the user so that he would reply to that challenge. On perl, usually this «Response-Packet-Type» is configured on RAD_CHECK. But how do we send this in Python? I tried this: def authenticate(p): print("*** authenticate ***") print("") radiusd.radlog(radiusd.L_INFO, "*** log call in authenticate ***") print("") print(p) print(radiusd.config) print("") reply = ( ('Reply-Message', 'Hello from rlm_python'), ('State', 'test'), ('Response-Packet-Type', 'Access-Challenge') ) # config = ( ('Response-Packet-Type' , 'Acccess-Challenge'), ) config = ( ('Cleartext-Password' , '123'), ) return (radiusd.RLM_MODULE_HANDLED, reply,None) But without any success. Any clues of what to do here? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 11

Re: Add TLS version to logs with linelog in FreeRADIUS 3.2.4
by Dominic Stalder 15 Nov '24

15 Nov '24

Hi guys * another try, after failing to reach the mailing list for this topic with my email address * Coming back to this topic of TLS logging in FreeRADIUS 3.2.4, are there any news on this topic? I recently updated to FreeRADIUS 3.2.6, but TLS version is still missing. In the debug output (freeradius -X) I was missing the follwing attributes since 2.3.4: (10) update { (10) &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 1014 ... (10) &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'ECDHE-RSA-AES256-GCM-SHA384' (10) &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.2' Thanks and regards Dominic

2 1

Reject certificate in use
by Rodrigo Prieto 13 Nov '24

13 Nov '24

Hello, I need to configure that if a client's certificate is in use, it cannot be used by another. I was looking at some examples on the web but it didn't work for me. If you can guide me, I appreciate it. Thank you.

3 9

logging auth failures with inner identity
by James Potter 12 Nov '24

12 Nov '24

Hi list, I'm working on setting up FreeRad logging and I'm stuck on how to capture the EAP inner identity when an authentication fails. * I can capture auth requests coming in (in authorize section of outer site) * I can capture auth successes and failures (in outer site:post-auth) * I can capture successful auths in the EAP:TLS inner site But - when an EAP-TLS auth fails (eg on cert expired, not trusted, revoked) then it appears that the inner site is not called at all. I've put relevant log lines in TLS-inner:post-auth (and authenticate and authorize) but it appears that none of these are called. Any idea how I can access the inner username (in the case of TLS I'm after the SAN UPN of the client certificate) in a failed auth attempt? Thanks, Jim Potter Jisc Config snippets FWIW: server home { authorize { log_auth_req eap } post-auth { log_auth_accept Post-Auth-Type REJECT { log_auth_reject } } } eap { tls { virtual_server = eap-inner } } server eap-inner { authorize { log_inner } authenticate { log_inner } post-auth { log_inner Post-Auth-Type REJECT { log_inner } } }

2 1

FreeRADIUS 4: DHCP v4: ERROR: Expansion "network" needs to be resolved before it is used
by Dima Ermakov 11 Nov '24

11 Nov '24

Hi, I am trying to test FreeRADIUS 4 on RockyLinux 9.4 built from commit c01f1dbb733966ac51f7d2bacb6343fc04450024 I know that this software is not supposed to be used in production (and I don't do it, it is testing only for now). I tried to configure a simple DHCPv4 service which uses the "files" module to assign per-network properties. The processing fails with expansion of "key" in files: """ files files_dhcp_network { # # moddir:: Search for files in a subdirectory of mods-config which # matches this instance of the files module. # moddir = ${modconfdir}/files_dhcp # # key:: The default key attribute to use for matches. # # The content of this attribute is used to match the `name` of the entry. # key = 'network' # # filename:: The old `users` style file is now located here. # filename = ${moddir}/dhcp_config } """ with error: files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used. Here is a part of my ${moddir}/dhcp_config (inspired by https://www.freeradius.org/documentation/freeradius-server/3.2.7/howto/prot… ): """ network IP-Pool.Name := "local" Domain-Name := "example.org", Subnet-Mask := 255.255.255.0, Router-Address := 172.16.1.1, Domain-Name-Server := 192.168.20.2, Fall-Through := yes network Network-Subnet < 172.25.1.0/24 IP-Pool.Name := "pool-172.25.1.0/24", Subnet-Mask := 255.255.255.0, Broadcast-Address := 172.25.1.255 """ Could you, please, if possible point me to what should be corrected? Here is the debug output of a test request: [root@w-v-dmierm-freeradius-test-0 mods-enabled]# radiusd -v Info : radiusd - FreeRADIUS version 4.0.65535 (git #), for host x86_64-redhat-linux-gnu, built on Sep 25 2013 at 00:00:00 Info : Copyright 1999-2024 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT [root@w-v-dmierm-freeradius-test-0 mods-enabled]# radiusd -X Info : Copyright 1999-2024 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf Including files in directory "/etc/raddb/template.d/" including configuration file /etc/raddb/template.d/default including configuration file /etc/raddb/clients.conf Including files in directory "/etc/raddb/global.d/" including configuration file /etc/raddb/global.d/ldap including configuration file /etc/raddb/global.d/python Including files in directory "/etc/raddb/mods-enabled/" including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/files_dhcp Including files in directory "/etc/raddb/policy.d/" including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalisation including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/time including configuration file /etc/raddb/policy.d/vendor /etc/raddb/policy.d/vendor[8]: Using deprecated syntax. Please use new the new 'foreach' syntax. Including files in directory "/etc/raddb/sites-enabled/" including configuration file /etc/raddb/sites-enabled/dhcp Loaded module process_dhcpv4 Parsing initial logging configuration. main { prefix = /usr log { destination = file syslog_facility = daemon local_state_dir = "/usr/var" logdir = "/usr/var/log" file = /var/log/radius/radius.log suppress_secrets = no } } Parsing security rules to bootstrap UID / GID / chroot / etc. main { log { } security { allow_core_dumps = no allow_vulnerable_openssl = no openssl_fips_mode = no } name = radiusd local_state_dir = "/usr/var" run_dir = /var/run/radiusd } Parsing main configuration main { server dhcp { namespace = dhcpv4 Loaded module proto_dhcpv4 listen { type = Discover type = Request type = Inform type = Release type = Decline transport = udp Loaded module proto_dhcpv4_udp udp { ipaddr = 0.0.0.0 interface = ens224 port = 67 client_port = 68 broadcast = yes networks { } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 priority { Discover = normal Request = normal Decline = normal Release = normal Inform = normal Lease-Query = low Bulk-Lease-Query = low } } } } log { colourise = yes } security { } sbin_dir = "/usr/sbin" logdir = /var/log/radius radacctdir = /var/log/radius/radacct reverse_lookups = no hostname_lookups = yes max_request_time = 30 pidfile = /var/run/radiusd/radiusd.pid debug_level = 0 max_requests = 16384 resources { } thread pool { num_networks = 1 Dynamically determined thread.workers = 2 num_workers = 2 openssl_async_pool_init = 64 openssl_async_pool_max = 1024 } migrate { rewrite_update = false forbid_update = false } } Switching to configured log settings log debug { destination = null timestamp = yes colourise = no } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 secret = <<< secret >>> require_message_authenticator = auto limit_proxy_state = auto proto = * limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> require_message_authenticator = no limit_proxy_state = auto limit { max_connections = 16 lifetime = 0 idle_timeout = 30s } } Debugger not attached Configuration version: A2E989E4-D5C6-4963-A1D1-083575FFAC4D systemd watchdog is disabled pre-suid-down capabilities: =ep trigger { ... } subsection not found, triggers will be disabled #### Instantiating libraries #### #### Bootstrapping process modules #### #### Bootstrapping protocol modules #### #### Instantiating libraries #### #### Bootstrapping static modules #### modules { static { Loaded module rlm_always always reject { rcode = reject } always fail { rcode = fail } always ok { rcode = ok } always handled { rcode = handled } always invalid { rcode = invalid } always disallow { rcode = disallow } always notfound { rcode = notfound } always noop { rcode = noop } always updated { rcode = updated } Loaded module rlm_files files files_dhcp_network { filename = /etc/raddb/mods-config/files_dhcp/dhcp_config } files files_dhcp_host { filename = /etc/raddb/mods-config/files_dhcp/dhcp_config } } # static #### Bootstrapping rlm modules #### Bootstrapping rlm_always "disallow" Bootstrapping rlm_always "fail" Bootstrapping rlm_always "handled" Bootstrapping rlm_always "invalid" Bootstrapping rlm_always "noop" Bootstrapping rlm_always "notfound" Bootstrapping rlm_always "ok" Bootstrapping rlm_always "reject" Bootstrapping rlm_always "updated" Including dictionary file "/etc/raddb/dictionary" #### Instantiating listeners #### Compiling policies in server dhcp { ... } Compiling policies in - recv Discover {...} Reading file /etc/raddb/mods-config/files_dhcp/dhcp_config Reading file /etc/raddb/mods-config/files_dhcp/dhcp_config Compiling policies in - recv Request {...} Compiling policies in - recv Decline {...} Compiling policies in - recv Release {...} Compiling policies in - recv Inform {...} Compiling policies in - recv Lease-Query {...} /etc/raddb/sites-enabled/dhcp[307]: Skipping remaining instructions due to 'return' /etc/raddb/sites-enabled/dhcp[319]: Skipping remaining instructions due to 'return' dhcpv4 { ... } section is unused #### Instantiating process modules #### #### Instantiating protocol modules #### Instantiating proto_dhcpv4 "dhcp.dhcpv4" Instantiating proto_dhcpv4_udp "dhcp.dhcpv4.udp" #### Instantiating rlm modules #### Instantiating rlm_always "disallow" Instantiating rlm_always "fail" Instantiating rlm_always "handled" Instantiating rlm_always "invalid" Instantiating rlm_always "noop" Instantiating rlm_always "notfound" Instantiating rlm_always "ok" Instantiating rlm_always "reject" Instantiating rlm_always "updated" Scheduler created in single-threaded mode #### Opening listener interfaces #### Listening on dhcpv4_udp server * port 67 on interface ens224 bound to virtual server dhcp post-suid-down capabilities: =ep Ready to process requests proto_dhcpv4_udp - Received Discover XID f252956f length 300 dhcpv4_udp server * port 67 on interface ens224 Worker - Resetting cleanup timer to +30 (0) dhcp { (0) Received Discover XID f252956f from 0.0.0.0:68 to 255.255.255.255:67 via ens224 (0) Opcode = Client-Message (0) Hardware-Type = Ethernet (0) Hardware-Address-Length = 6 (0) Hop-Count = 0 (0) Transaction-Id = 4065498479 (0) Number-of-Seconds = 0 (0) Flags = 0 (0) Client-IP-Address = 0.0.0.0 (0) Your-IP-Address = 0.0.0.0 (0) Server-IP-Address = 0.0.0.0 (0) Gateway-IP-Address = 0.0.0.0 (0) Client-Hardware-Address = 02:01:aa:bb:cc:dd (0) Message-Type = Discover (0) Client-Identifier = 0x616263313233 (0) Network-Subnet = 0.0.0.0/32 (0) Net { (0) Src { (0) IP = 0.0.0.0 (0) Port = 68 (0) } (0) Dst { (0) IP = 255.255.255.255 (0) Port = 67 (0) } (0) Timestamp = "2024-11-08T10:16:53Z" (0) } (0) Packet-Type = Discover (0) Running 'recv Discover' from file /etc/raddb/sites-enabled/dhcp (0) recv Discover { (0) files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used (0) files_dhcp_network (fail) (0) } # recv Discover (fail) (0) Not sending reply to client (0) dhcp (fail) (0) } # dhcp (fail) (0) Done request (0) Finished request proto_dhcpv4_udp - cleaning up request in 5.000000s ^CSignalled to terminate Exiting normally Thank you in advance, // Dmitrii.

2 7

Mailing List test
by dominic.stalder＠unibe.ch 11 Nov '24

11 Nov '24

Sorry guys, but I just wanted to check why my emails / questions don’t get to the list anymore; am I blocked or have been thrown off the list?

4 9