- Freeradius-Users - lists.freeradius.org

Certificate Details Outside TLS Tunnel
by FreeRAD 20 Oct '24

20 Oct '24

If I run a TCPDump from one of the clients that is sending Auth-Requests to my RADIUS server, I have noticed that in the Access-Challenge messages back from the server you can see certificate details that I have put in the various cnf files in etc/freeradius/3.0/certs. For example, I can see the 'organizationName' and 'emailAddress' from the server.cnf file amongst other details and strings of hashed data within the TCPDump output. I know that the tunnel won't have been established at this point so this in particular wouldn't be hiding those details, but is there a need for them to be exposed? And if not where would I look to configure my server to hide these details from external entities? I know RADSec is preferred but wasn't sure if this information was exposed on purpose.

2 2

BlastRADIUS
by Connor Herring 20 Oct '24

20 Oct '24

Hi All, Hopefully a quick one, I am on FreeRADIUS v3.2.1 so have implemented the recommended steps into my server to mitigate BlastRADIUS attacks (however unlikely) by adding the below into my default and inner-tunnel servers: authorize { if (!EAP-Message) { update reply { Message-Authenticator := 0x00 } } ... Since I am using EAPTTLS/PAP, surely I am not susceptible to BlastRADIUS since the PAP traffic is within a TLS tunnel? Or have I misunderstood? The RADIUS also only communicates locally so not over the internet. Furthermore after implementing the aforementioned change, nothing seems to have changed in the debug log. Should I see a difference between the debugs before implementing this change and after? Kind regards, Connor

4 7

EAP & MAC Auth accepting only MAC address
by FreeRAD 18 Oct '24

18 Oct '24

Hi, I'm doing some testing for my FreeRADIUS installation in which I am performing MAC Auth which, provided the MAC is correct, then performs EAP-TTLS/PAP auth. This works fine from a Windows client because it forces you to enter a username and password. I was performing some testing using the radclient command and noticed that the unlang code that the MAC auth guide <https://wiki.freeradius.org/guide/mac-auth#mac-auth-and-802-1x> gives you allows authentication as long as the MAC address is correct even if there is no username or password so EAP isn't enforced which doesn't seem right to me. I've reduced the code down to this which I *think* would force EAP auth even if the MAC is correct: *#If cleaning up the Calling-Station-Id... rewrite_calling_station_id # always check against the authorized_macs file first authorized_macs if (!ok) { # Reject if the MAC address was not permitted. reject } else { eap { ok = return updated = return } }* I've then used radeapclient to test which seems ok but is there a better way of achieving this? The radeapclient command I used is: *"User-Name = ,EAP-Code = ,EAP-Id = ,EAP-Type-Identity = ,Message-Authenticator = ,Cleartext-Password = ,Calling-Station-ID= " | radeapclient auth * Thanks

2 1

Framed IP and and Protocol in SQL written as Null
by Saied Ahadi 18 Oct '24

18 Oct '24

I am having some trouble moving from FR2 to FR3. I did a fresh install recently on FR3. Authentication part is working correctly. However I noticed that most of the time the Framed IP address and FramedProtocol are not written correctly into the mysql database. I am sure I have incorrectly setup something but since I don't understand how I can go ahead and trouble shoot this matter. Here are the logs use freeradius -X BlastRADIUS check: Received packet without Message-Authenticator. YOU MUST SET "require_message_authenticator = true", or YOU MUST SET "limit_proxy_state = true" for client pubip !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! The packet does not contain Message-Authenticator, which is a security issue UPGRADE THE CLIENT AS YOUR NETWORK IS VULNERABLE TO THE BLASTRADIUS ATTACK. Once the client is upgraded, set "require_message_authenticator = true" for client pubip !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (0) Received Access-Request Id 91 from 143.198.146.8:56216 to 67.205.156.27:1812 length 186 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) NAS-Port = 15728640 (0) NAS-Port-Type = Ethernet (0) User-Name = "saied" (0) Calling-Station-Id = "0C:DC:B7:B1:00:00" (0) NAS-Port-Id = "ether2" (0) Acct-Session-Id = "81b00000" (0) MS-CHAP-Challenge = 0x1e86ccb35ca835cd91f0010ed05ef9f8 (0) MS-CHAP2-Response = 0x0100b82b5ae17cd5f3d5c529bd97d16f686d0000000000000000d6856ebb6089ace13cb4d8e5dccdb75bc2ab423d994b19d8 (0) NAS-Identifier = "MikroTik" (0) NAS-IP-Address = 192.168.122.30 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "saied", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: sql_groupcmp (0) files: EXPAND %{User-Name} (0) files: --> saied (0) files: SQL-User-Name set to 'saied' rlm_sql (sql): Reserved connection (1) (0) files: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) files: --> SELECT groupname FROM radusergroup WHERE username = 'saied' ORDER BY priority (0) files: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'saied' ORDER BY priority rlm_sql (sql): Released connection (1) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.39-MariaDB-0ubuntu0.20.04.2, protocol version 10 rlm_sql (sql): Closing expired connection (5) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (4) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (3) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (2) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): Closing expired connection (0) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket (0) files: sql_groupcmp finished: User is NOT a member of group inactive-user (0) files: sql_groupcmp (0) files: EXPAND %{User-Name} (0) files: --> saied (0) files: SQL-User-Name set to 'saied' rlm_sql (sql): Reserved connection (1) (0) files: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) files: --> SELECT groupname FROM radusergroup WHERE username = 'saied' ORDER BY priority (0) files: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'saied' ORDER BY priority rlm_sql (sql): Released connection (1) (0) files: sql_groupcmp finished: User is NOT a member of group multilink-active-user (0) files: users: Matched entry DEFAULT at line 84 (0) files: users: Matched entry DEFAULT at line 186 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> saied (0) sql: SQL-User-Name set to 'saied' rlm_sql (sql): Reserved connection (6) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'saied' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'saied' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "saied" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'saied' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'saied' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'saied' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'saied' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (6) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) if (User-Name){ (0) if (User-Name) -> TRUE (0) if (User-Name) { (0) if ("%{sql:UPDATE radacct set AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale Session' WHERE UserName='%{User-Name}' and CallingStationId='%{Calling-Station-Id}' and AcctStopTime is NULL}"){ rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) rlm_sql (sql): Reserved connection (6) rlm_sql (sql): Released connection (6) (0) EXPAND %{User-Name} (0) --> saied (0) SQL-User-Name set to 'saied' rlm_sql (sql): Reserved connection (1) (0) Executing query: UPDATE radacct set AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale Session' WHERE UserName='saied' and CallingStationId='0C:DC:B7:B1:00:00' and AcctStopTime is NULL rlm_sql_mysql: Rows matched: 0 Changed: 0 Warnings: 0 (0) SQL query affected no rows rlm_sql (sql): Released connection (1) (0) EXPAND %{sql:UPDATE radacct set AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale Session' WHERE UserName='%{User-Name}' and CallingStationId='%{Calling-Station-Id}' and AcctStopTime is NULL} (0) --> (0) if ("%{sql:UPDATE radacct set AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale Session' WHERE UserName='%{User-Name}' and CallingStationId='%{Calling-Station-Id}' and AcctStopTime is NULL}") -> FALSE (0) } # if (User-Name) = ok (0) } # authorize = ok (0) Found Auth-Type = mschap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) mschap: Found Cleartext-Password, hashing to create NT-Password (0) mschap: Creating challenge hash with username: saied (0) mschap: Client is using MS-CHAPv2 (0) mschap: Adding MS-CHAPv2 MPPE keys (0) [mschap] = ok (0) } # authenticate = ok (0) # Executing section session from file /etc/freeradius/sites-enabled/default (0) session { (0) sql: EXPAND %{User-Name} (0) sql: --> saied (0) sql: SQL-User-Name set to 'saied' rlm_sql (sql): Reserved connection (6) (0) sql: EXPAND SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL (0) sql: --> SELECT COUNT(*) FROM radacct WHERE username = 'saied' AND acctstoptime IS NULL (0) sql: Executing select query: SELECT COUNT(*) FROM radacct WHERE username = 'saied' AND acctstoptime IS NULL rlm_sql (sql): Released connection (6) (0) [sql] = ok (0) } # session = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) policy sql_session_start.post-auth { (0) policy acct_unique { (0) update request { (0) &Tmp-String-9 := "ai:" (0) } # update request = noop (0) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (0) EXPAND %{hex:&Class} (0) --> (0) EXPAND ^%{hex:&Tmp-String-9} (0) --> ^61693a (0) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (0) else { (0) update request { (0) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (0) --> c8cfd558bded834454aa713d62999e75 (0) &Acct-Unique-Session-Id := c8cfd558bded834454aa713d62999e75 (0) } # update request = noop (0) } # else = noop (0) update request { (0) &Tmp-String-9 !* ANY (0) } # update request = noop (0) } # policy acct_unique = noop (0) sql: EXPAND %{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query} (0) sql: --> type.post-auth.query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND %{User-Name} (0) sql: --> saied (0) sql: SQL-User-Name set to 'saied' (0) sql: EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}', NULLIF('%{%{NAS-Port-ID}:-%{NAS-Port}}', ''), '%{NAS-Port-Type}', FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), NULL, NULL, 0, '', '%{Connect-Info}', NULL, 0, 0, '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', NULL, '', '', '', '', '' ) detail (/var/log/freeradius/radacct/detail_coa): Polling for detail file detail (/var/log/freeradius/radacct/detail_coa): Detail listener state unopened waiting 1.181563 sec (0) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES('81b00000', 'c8cfd558bded834454aa713d62999e75', 'saied', '', '192.168.122.30', NULLIF('ether2', ''), 'Ethernet', FROM_UNIXTIME(1729070924), NULL, NULL, 0, '', '', NULL, 0, 0, '', '0C:DC:B7:B1:00:00', '', 'Framed-User', NULL, '', '', '', '', '' ) (0) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES('81b00000', 'c8cfd558bded834454aa713d62999e75', 'saied', '', '192.168.122.30', NULLIF('ether2', ''), 'Ethernet', FROM_UNIXTIME(1729070924), NULL, NULL, 0, '', '', NULL, 0, 0, '', '0C:DC:B7:B1:00:00', '', 'Framed-User', NULL, '', '', '', '', '' ) (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (1) (0) [sql.accounting] = ok (0) } # policy sql_session_start.post-auth = ok (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (6) (0) sql: EXPAND %{User-Name} (0) sql: --> saied (0) sql: SQL-User-Name set to 'saied' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'saied', '', 'Access-Accept', '2024-10-16 09:28:44.887811' ) (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'saied', '', 'Access-Accept', '2024-10-16 09:28:44.887811' ) (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (6) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = ok (0) Sent Access-Accept Id 91 from 67.205.156.27:1812 to 143.198.146.8:56216 length 209 (0) Framed-Protocol = PPP (0) Framed-Compression = Van-Jacobson-TCP-IP (0) MS-CHAP2-Success = 0x01533d36324342373731454439304334353137333343393345453730334233374442323343463941304441 (0) MS-MPPE-Recv-Key = 0x86232b7b39c9e6b140d6daaf2bcc09ac (0) MS-MPPE-Send-Key = 0x93f5635e2e62404b6a8b28415c685ebc (0) MS-MPPE-Encryption-Policy = Encryption-Allowed (0) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (0) Finished request (1) Received Accounting-Request Id 92 from 143.198.146.8:53796 to 67.205.156.27:1813 length 134 (1) Service-Type = Framed-User (1) Framed-Protocol = PPP (1) NAS-Port = 15728640 (1) NAS-Port-Type = Ethernet (1) User-Name = "saied" (1) Calling-Station-Id = "0C:DC:B7:B1:00:00" (1) NAS-Port-Id = "ether2" (1) Acct-Session-Id = "81b00000" (1) Framed-IP-Address = 10.10.10.254 (1) Acct-Authentic = RADIUS (1) Event-Timestamp = "Oct 16 2024 09:28:44 UTC" (1) Acct-Status-Type = Start (1) NAS-Identifier = "MikroTik" (1) Acct-Delay-Time = 0 (1) NAS-IP-Address = 192.168.122.30 (1) # Executing section preacct from file /etc/freeradius/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) policy acct_unique { (1) update request { (1) &Tmp-String-9 := "ai:" (1) } # update request = noop (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (1) EXPAND %{hex:&Class} (1) --> (1) EXPAND ^%{hex:&Tmp-String-9} (1) --> ^61693a (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (1) else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> c8cfd558bded834454aa713d62999e75 (1) &Acct-Unique-Session-Id := c8cfd558bded834454aa713d62999e75 (1) } # update request = noop (1) } # else = noop (1) update request { (1) &Tmp-String-9 !* ANY (1) } # update request = noop (1) } # policy acct_unique = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "saied", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) } # preacct = ok (1) # Executing section accounting from file /etc/freeradius/sites-enabled/default (1) accounting { (1) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (1) detail: --> /var/log/freeradius/radacct/143.198.146.8/detail-20241016 (1) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/143.198.146.8/detail-20241016 (1) detail: EXPAND %t (1) detail: --> Wed Oct 16 09:28:44 2024 (1) [detail] = ok (1) [unix] = ok (1) sql: EXPAND %{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query} (1) sql: --> type.start.query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (1) (1) sql: EXPAND %{User-Name} (1) sql: --> saied (1) sql: SQL-User-Name set to 'saied' (1) sql: EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}', '%{Framed-Interface-Id}', '%{Delegated-IPv6-Prefix}' ) (1) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('81b00000', 'c8cfd558bded834454aa713d62999e75', 'saied', '', '192.168.122.30', 'ether2', 'Ethernet', FROM_UNIXTIME(1729070924), FROM_UNIXTIME(1729070924), NULL, '0', 'RADIUS', '', '', '0', '0', '', '0C:DC:B7:B1:00:00', '', 'Framed-User', 'PPP', '10.10.10.254', '', '', '', '' ) (1) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('81b00000', 'c8cfd558bded834454aa713d62999e75', 'saied', '', '192.168.122.30', 'ether2', 'Ethernet', FROM_UNIXTIME(1729070924), FROM_UNIXTIME(1729070924), NULL, '0', 'RADIUS', '', '', '0', '0', '', '0C:DC:B7:B1:00:00', '', 'Framed-User', 'PPP', '10.10.10.254', '', '', '', '' ) (1) sql: rlm_sql_mysql: ERROR 1062 (Duplicate entry 'c8cfd558bded834454aa713d62999e75' for key 'acctuniqueid'): 23000 (1) sql: SQL query returned: need alt query (1) sql: Trying next query... (1) sql: EXPAND UPDATE radacct SET acctstarttime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctupdatetime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), connectinfo_start = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' (1) sql: --> UPDATE radacct SET acctstarttime = FROM_UNIXTIME(1729070924), acctupdatetime = FROM_UNIXTIME(1729070924), connectinfo_start = '' WHERE AcctUniqueId = 'c8cfd558bded834454aa713d62999e75' (1) sql: Executing query: UPDATE radacct SET acctstarttime = FROM_UNIXTIME(1729070924), acctupdatetime = FROM_UNIXTIME(1729070924), connectinfo_start = '' WHERE AcctUniqueId = 'c8cfd558bded834454aa713d62999e75' rlm_sql_mysql: Rows matched: 1 Changed: 1 Warnings: 0 (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (1) (1) [sql] = ok (1) [exec] = noop (1) attr_filter.accounting_response: EXPAND %{User-Name} (1) attr_filter.accounting_response: --> saied (1) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated (1) } # accounting = updated (1) Sent Accounting-Response Id 92 from 67.205.156.27:1813 to 143.198.146.8:53796 length 20 (1) Finished request (1) Cleaning up request packet ID 92 with timestamp +91 due to done Waking up in 4.9 seconds. Here is what sql shows when I look in the Database. Database changed MariaDB [radius]> select * from radacct; +-----------+---------------+----------------------------------+----------+-------+----------------+-----------+-------------+---------------------+---------------------+---------------------+--------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+-------------------+---------------------+-------------+----------------+-----------------+-------------------+------------------+-------------------+---------------------+-------+ | radacctid | acctsessionid | acctuniqueid | username | realm | nasipaddress | nasportid | nasporttype | acctstarttime | acctupdatetime | acctstoptime | acctinterval | acctsessiontime | acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets | acctoutputoctets | calledstationid | callingstationid | acctterminatecause | servicetype | framedprotocol | framedipaddress | framedipv6address | framedipv6prefix | framedinterfaceid | delegatedipv6prefix | class | +-----------+---------------+----------------------------------+----------+-------+----------------+-----------+-------------+---------------------+---------------------+---------------------+--------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+-------------------+---------------------+-------------+----------------+-----------------+-------------------+------------------+-------------------+---------------------+-------+ | 1 | 81b00001 | c5b520f5f99234b6ed61f3b91a217a49 | saied | | 192.168.122.30 | ether2 | Ethernet | 2024-10-16 09:34:03 | 2024-10-16 12:01:17 | 2024-10-16 12:01:17 | NULL | 8834 | RADIUS | | | 19722 | 38 | | 0C:DC:B7:B1:00:00 | NAS-Request | Framed-User | PPP | 10.10.10.254 | | | | | NULL | | 2 | 81b00002 | a36501de59fc00c13cfe1a011de4fd1c | saied | | 192.168.122.30 | ether2 | Ethernet | 2024-10-16 12:01:17 | 2024-10-16 12:01:17 | 2024-10-16 12:02:16 | NULL | 59 | | | | 304 | 38 | | 0C:DC:B7:B1:00:00 | NAS-Request | Framed-User | NULL | | | | | | NULL | | 4 | 81b00003 | b7c690ca4602a8df92e3c1d2472eedea | saied | | 192.168.122.30 | ether2 | Ethernet | 2024-10-16 12:02:16 | 2024-10-16 12:02:16 | 2024-10-16 12:02:16 | NULL | 0 | | | NULL | 0 | 0 | | 0C:DC:B7:B1:00:00 | Clear-Stale Session | Framed-User | NULL | | | | | | NULL | | 6 | 81b00008 | eb0f29a1415fe5bdfa7acbcb7b4101c5 | saied | | 192.168.122.30 | ether2 | Ethernet | 2024-10-16 12:04:12 | 2024-10-16 12:04:12 | 2024-10-16 12:05:29 | NULL | 77 | | | | 304 | 38 | | 0C:DC:B7:B1:00:00 | User-Request | Framed-User | NULL | | | | | | NULL | | 8 | 81b00009 | 14647eb912c0c8314f7061cfae10bb30 | saied | | 192.168.122.30 | ether2 | Ethernet | 2024-10-16 12:05:30 | 2024-10-16 12:05:30 | 2024-10-16 12:10:34 | NULL | 305 | | | | 836 | 38 | service1 | 0C:DC:B7:B1:00:00 | User-Request | Framed-User | NULL | | | | | | NULL | | 10 | 81b0000a | 6e08adb4e8f5983f43c6bd20e3df5009 | saied | | 192.168.122.30 | ether2 | Ethernet | 2024-10-16 12:10:46 | 2024-10-16 12:10:46 | 2024-10-16 12:11:20 | NULL | 34 | | | | 304 | 38 | service1 | 0C:DC:B7:B1:00:00 | NAS-Request | Framed-User | NULL | | | | | | NULL | | 12 | 81b0000b | 7499c503b3b2bc4c69f3dec28fe60f86 | saied | | 192.168.122.30 | ether2 | Ethernet | 2024-10-16 12:11:20 | 2024-10-16 12:11:20 | NULL | NULL | 0 | | | NULL | 0 | 0 | service1 | 0C:DC:B7:B1:00:00 | | Framed-User | NULL | | | | | | NULL | +-----------+---------------+----------------------------------+----------+-------+----------------+-----------+-------------+---------------------+---------------------+---------------------+--------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+-------------------+---------------------+-------------+----------------+-----------------+-------------------+------------------+-------------------+---------------------+-------+

2 2

Compiling support for libkqueue on docker image
by Mark Donnelly 18 Oct '24

18 Oct '24

Good day everyone! I'm trying to create a docker image of FreeRADIUS 3.2.x (on Ubuntu24) with libkqueue support enabled. I had hoped it would be as easy as installing the libkqueue-dev package before building, but it's turning out to be more difficult. First, I ensured that the docker image had libkqueue-dev installed during the build process. (For now I've listed it in debian/control.in as a build dependency.) I can verify that the libkqueue-dev package is installed, but when the build runs ./configure, the configure script detects kqueue support as "no". I found that if I run the configure script manually with the LIBS environment variable set to "-lkqueue", then configure is able to detect kqueue support as "yes". I looked at how configure.ac is set up to look for kqueue, and see that it's on line 1802 as a parameter to the AC_CHECK_FUNCS check. After looking up what that means (I'm new to autoconf), it looks like autoconf has been set up to check for kqueue within existing libraries, but not try to load the libkqueue library before running that check. So, I added a block starting at line 1046: dnl # dnl # Check for -lkqueue dnl # This library may be needed for kqueue. dnl # AC_SEARCH_LIBS([kqueue], [kqueue]) However, my attempts at running autoconf to regenerate the configure file have all failed with lots of warnings or errors. What's the correct way to run autoconf for the FreeRADIUS source tree? Cheers, --Mark

3 2

Issue Building FreeRADIUS 3.2.6 on RedHat 9.4.
by Mucci Andrea 11 Oct '24

11 Oct '24

Hi all, I'm trying to build the RPMs for FreeRadius v.3.2.6 on Red Hat Enterprise Linux release 9.4 (Plow). I need to do this because my database is Oracle. After fixing all dependencies. The "rpmbuild" command returns errors and does not create RPM packages. Three warning: warning: line 52: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-devel warning: line 53: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-libs warning: Macro expanded in comment on line 597: %{_mandir}/man5/rlm_idn.5.gz} One error while compile: CC src/modules/rlm_python/rlm_python.c In file included from src/freeradius-devel/radiusd.h:38, from src/modules/rlm_python/rlm_python.c:33: src/modules/rlm_python/rlm_python.c: In function 'python_error_log': src/modules/rlm_python/rlm_python.c:229:26: warning: implicit declaration of function 'PyString_AsString' [-Wimplicit-function-declaration] 229 | ERROR("%s (%s)", PyString_AsString(p_str_1), PyString_AsString(p_str_2)); | ^~~~~~~~~~~~~~~~~ src/freeradius-devel/log.h:139:55: note: in definition of macro 'ERROR' 139 | #define ERROR(fmt, ...) radlog(L_ERR, fmt, ## __VA_ARGS__) | ^~~~~~~~~~~ src/modules/rlm_python/rlm_python.c:229:15: warning: format '%s' expects argument of type 'char *', but argument 3 has type 'int' [-Wformat=] 229 | ERROR("%s (%s)", PyString_AsString(p_str_1), PyString_AsString(p_str_2)); This is the message at the end: Recommends: freeradius-debugsource(x86-64) = 3.2.6-1.el9 Checking for unpackaged file(s): /usr/lib/rpm/check-files /root/rpmbuild/BUILDROOT/freeradius-3.2.6-1.el9.x86_64 error: Installed (but unpackaged) file(s) found: /etc/raddb/mods-config/python/example.py /etc/raddb/mods-config/python/radiusd.py /usr/lib/debug/usr/lib64/freeradius/rlm_python.so-3.2.6-1.el9.x86_64.debug /usr/lib64/freeradius/rlm_python.so RPM build errors: line 52: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-devel line 53: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-libs Macro expanded in comment on line 597: %{_mandir}/man5/rlm_idn.5.gz} File listed twice: /etc/raddb/certs/bootstrap File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/queries.conf File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/cisco_h323_db_schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf Installed (but unpackaged) file(s) found: /etc/raddb/mods-config/python/example.py /etc/raddb/mods-config/python/radiusd.py /usr/lib/debug/usr/lib64/freeradius/rlm_python.so-3.2.6-1.el9.x86_64.debug /usr/lib64/freeradius/rlm_python.so I think the problem is that RedHat 9 does not support Python 2. Anyone have any idea how I can solve this?? Best Regards Andrea

2 1

Unable to Find Active Directory Group using LDAP Group Lookup module
by Ibrahim Almahfooz 08 Oct '24

08 Oct '24

Hello, We have successfully integrated our FreeRADIUS Version 3.2.6 with active directory using ntlm_auth module and also enabled sqlcounter to permit users with specific daily limit. All working well. However, part of the requirements is to give a specific time quota to users who are part of a specific AD group, which we guess is a common use case. To achieve this, we also integrated FR with ldap by using FreeRadius-ldap package and we populated the ldap configuration file with below: ldap section: server = '192.168.1.1' identity = 'cn=test,cn=Users,dc=domain,dc=com' password = 'xxxxxx' base_dn = 'CN=users,DC=domain,DC=com' ldap Group section: (As-is) In the Authorize or Post-Auth section we added below: if (LDAP-Group == "Office-VPN") { update reply { Reply-Message := "test reply" } } When we run radiusd -X, the ldap part is executed in the authorize section however it says "Search returned no results": (1) authorize { (1) if (LDAP-Group == "Office-VPN") { (1) Searching for user in group "Office-VPN" rlm_ldap (ldap): Reserved connection (1) (1) EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) --> (uid=test) (1) Performing search in "CN=users,DC=domain,DC=com" with filter "(uid=test)", scope "sub" (1) Waiting for search result... (1) Search returned no results rlm_ldap (ldap): Released connection (1) Need more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.1:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) if (LDAP-Group == "Office-VPN") -> FALSE In our active directory the user "test" is part of the "Office-VPN" group and both the user and group are inside "cn=Users,dc=domain,dc=com" Also when we run the ldapsearch command from within FR machine, we get positive results: ldapsearch -x -b "cn=Users,dc=domain,dc=com" -D "cn=test,cn=Users,dc=domain,dc=com" -h 192.168.1.1-w "xxxxxx" '(&(cn=Office-VPN))' # extended LDIF # # LDAPv3 # base <cn=Users,dc=domain,dc=com> with scope subtree # filter: (&(cn=Office-VPN)) # requesting: ALL # # Office-VPN, Users, domain.com dn: CN=Office-VPN,CN=Users,DC= domain,DC=com objectClass: top objectClass: group cn: Office-VPN member: CN=test,CN=Users,DC=domain,DC=com distinguishedName: CN=Office-VPN,CN=Users,DC=domain,DC=com instanceType: 4 whenCreated: 20241008110114.0Z whenChanged: 20241008131130.0Z uSNCreated: 134205037 uSNChanged: 134208547 name: Office-VPN objectGUID:: bJ2ut8zDLUu8jhVkbMh7mQ== objectSid:: AQUAAAAAAAUVAAAAEBY0cDMJoyrnPWkPzxYAAA== sAMAccountName: Office-VPN sAMAccountType: 268435456 groupType: -2147483646 objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=domain,DC=com dSCorePropagationData: 20241008120926.0Z dSCorePropagationData: 20241008114220.0Z dSCorePropagationData: 16010101000000.0Z # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 What do you think could be the issue? By the way, we also tried to change the parameter like filter = '(objectClass=posixGroup)' to use filter = '(objectClass=group)' and that didn't work either. Appreciate your help

2 2

Recommended value for ${db_dir} when using persist_dir
by George Benjin 08 Oct '24

08 Oct '24

I was about to enable persistent storage of sessions with FreeRADIUS 3.2.6 on RHEL 9.4 (installed from the NetworkRADIUS repo). The eap module states the following: The default directory is ${logdir}, for historical reasons. You should ${db_dir} instead. And check the value of db_dir in the main radiusd.conf file. It should not point to ${raddb}. I checked the value of db_dir in the radiusd.conf file as mentioned, and it is set to: ${raddbdir} which evaluates to /etc/raddb. The comment immediately above the line setting the value mentions that it should likely be set to ${localstatedir}/lib/radiusd. I haven't changed these settings from defaults. Should the radiusd.conf settings be updated in the default package, and/or should the guidance be made clearer? File excerpts below. Cheers -------------------------------------------------------------------------------- >From eap: # Simple directory-based storage of sessions. # Two files per session will be written, the SSL # state and the cached VPs. This will persist session # across server restarts. # # The default directory is ${logdir}, for historical # reasons. You should ${db_dir} instead. And check # the value of db_dir in the main radiusd.conf file. # It should not point to ${raddb} # # The server will need write perms, and the directory # should be secured from anyone else. You might want # a script to remove old files from here periodically: # # find ${logdir}/tlscache -mtime +2 -exec rm -f {} \; # # This feature REQUIRES "name" option be set above. # # persist_dir = "${logdir}/tlscache" ----------------------------------------------------------------------------- >From radiusd.conf: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # # name of the running server. See also the "-n" command-line option. name = radiusd # Location of config and logfiles. confdir = ${raddbdir} modconfdir = ${confdir}/mods-config certdir = ${confdir}/certs cadir = ${confdir}/certs run_dir = ${localstatedir}/run/${name} # Should likely be ${localstatedir}/lib/radiusd db_dir = ${raddbdir}

2 2

radmin stats home_server command always reporting zero requests
by paul.moser＠bt.com 03 Oct '24

03 Oct '24

I'm seeing the radmin stats home_server command with IP address and port arguments always report zero requests. The responses, last_packet and various elapsed metrics are incrementing as expected. Access and accounting requests both seem to be affected. I've rolled back to 3.2.4 and the requests metric increments as expected(*), but it does not with 3.2.5 or 3.2.6 The changelog for 3.2.5 does indicate that there was a bug fix around statistics: * Fix packet statistics. Stop double counting some packets, and track packet statistics even if a socket is closed. (*) My assumption is/was that the request metric should increment with every packet to be sent to a home server and that all things being good (no drops, in-flight packets etc) requests should equal responses (or rather responses should equal requests) but my understanding of what the requests metric is might not be correct. Paul

2 3

rest module to send simple API call to Infoblox for Mac Auth
by dominic.stalder＠unibe.ch 30 Sep '24

30 Sep '24

Hi guys Im am trying to combine (1) Mac Auth and (2) 802.1x on FreeRADIUS 3.2. So far, with simple check on a fixed Calling-Station-Id, it works. Now I would like to implement an GET API call to our IPAM (Infoblox) in the following format: https://xyz.domain.com/wapi/v2.11.3/record:host?network=172.25.8.0/21&mac=a… First things first, I enabled the rest module: ln -s ../mods-available/rest /etc/freeradius/mods-enabled/rest 1. With the default configuration, I get the following output: rlm_rest (rest): Opening additional connection (0), 1 of 32 pending slots used rlm_rest (rest): Connecting to http://127.0.0.1/ rlm_rest (rest): Connection failed: 7 - Couldn't connect to server rlm_rest (rest): Opening connection failed (0) rlm_rest (rest): Removing connection pool 2. When I comment the corresponding “connect_uri” like mentioned in the rest module comment, I get the next error: # rlm_rest will open a connection to the server specified in connect_uri # to populate the connection cache, ready for the first request. # The server will not start if the server specified is unreachable. # # If you wish to disable this pre-caching and reachability check, # comment out the configuration item below. # connect_uri = http://127.0.0.1/ including configuration file /etc/freeradius/sites-enabled/control-socket /etc/freeradius/mods-enabled/rest[188]: Reference "${..connect_uri}" not found Errors reading or parsing /etc/freeradius/radiusd.conf As I stated, I would like to start very simple and go step by step from there because I have absolutely no clue how to implement the requested API call so far. But if anyone has a hint to “overcome” this error and maybe has a simple example of an GET API call, I would appreciate. Thanks and best regards Dominic _________________________________ Universität Bern Abteilung Informatikdienste Dominic Stalder Network Engineer Hochschulstrasse 6 CH-3012 Bern Tel. +41 (0)31 684 38 18 dominic.stalder(a)unibe.ch<mailto:dominic.stalder@unibe.ch> www.id.unibe.ch _________________________________

3 12