- Freeradius-Users - lists.freeradius.org

How to bypass some logic during EAP-TLS auth?
by Alexey D. Filimonov 03 Nov '24

03 Nov '24

Currently I have several if()s in authorize{} before eap and I think I can not move it past EAP call But during EAP authentication I see this logic gets executed 8(!) times in -X debug session. Can I wrap those if()s into some rule like "If session is new, then execute wrapped logic, else - just bypass wrapped block"? authorize { if (!(&NAS-Port-Type && &NAS-Port-Type == Wireless-802.11)) { update request { &Module-Failure-Message += 'Rejected: NAS-Port-Type is not Wireless-802.11.' } reject } rewrite_called_station_id if (!Called-Station-SSID) { update request { &Module-Failure-Message += 'Rejected: No SSID in Called-Station-Id' } reject } if ("%{client:vlan_for_%{Called-Station-SSID}}") { update session-state { Tunnel-Type := VLAN # rfc3580 Tunnel-Medium-Type := IEEE-802 #rfc2628 Tunnel-Private-Group-Id := "%{client:vlan_for_%{Called-Station-SSID}}" # string, rfc2628 } } else { update request { &Module-Failure-Message += "Rejected: No vlan_for_%{Called-Station-SSID} defined for client %{client:shortname}" } reject } if (!(&User-Name)) { update request { &Module-Failure-Message += 'Rejected: User-Name not provided.' } reject } eap_wifi { ok = return updated = return } } authenticate { eap_wifi }

3 2

dynamic client
by mohamed almeshal 03 Nov '24

03 Nov '24

dear all this config file for dynamic client work fine without any problems but my goal is to accept any connection from any nas I try to do * in ipaddr but didn't work also I try it with listen part but also not work # SQL_LISTEN_CONFIG_START listen { type = auth port = 1812 ipaddr = * proto = udp limit { max_pps = 1000 } } listen { type = acct port = 1813 ipaddr = * proto = udp limit { max_pps = 1000 } } # SQL_LISTEN_CONFIG_END client dynamic { # CLIENT_IPADDR_START ipaddr = 0.0.0.0/0 # CLIENT_IPADDR_END dynamic_clients = dynamic_clients lifetime = 1 } server dynamic_clients { authorize { if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { update control { &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" &FreeRADIUS-Client-Require-MA = no &FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" } ok } } }

1 0

Ignoring duplicate packet from client
by Mamun Ahmed 02 Nov '24

02 Nov '24

Hello, I'm using Ubuntu server 22.04 and FreeRADIUS Version 3.0.26 I'm trying to connect with Mikrotik and my mikrotik has 267 users but when users are trying to connect to freeradius the freeradius Error: (0) Ignoring duplicate packet from client SaraNet port 46328 - ID: 175 due to unfinished request in component authorize module sql. my database server is capable of handling 267 users and also freeradius server. database resource 2GB Memory and 2 CPU freeradius resource 1GB Memory and 1CPU can you guide me? how can I prevent duplicate packet from client. Is Freeradius have by default configuration to prevent duplicate packet from client or any configuration?. I need to solve this error anyway. I'm trying to solve this problem by changing some the freeradius configuration but I can't solve it. Fri Sep 6 07:03:22 2024 : Info: Loaded virtual server inner-tunnel Fri Sep 6 07:03:22 2024 : Info: Ready to process requests Fri Sep 6 07:06:44 2024 : Error: (0) Ignoring duplicate packet from client SaraNet port 46328 - ID: 175 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (1) Ignoring duplicate packet from client SaraNet port 45985 - ID: 176 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (2) Ignoring duplicate packet from client SaraNet port 54469 - ID: 177 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (3) Ignoring duplicate packet from client SaraNet port 57714 - ID: 178 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (4) Ignoring duplicate packet from client SaraNet port 37314 - ID: 179 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (5) Ignoring duplicate packet from client SaraNet port 52315 - ID: 180 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (7) Ignoring duplicate packet from client SaraNet port 38181 - ID: 182 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (6) Ignoring duplicate packet from client SaraNet port 48777 - ID: 181 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (8) Ignoring duplicate packet from client SaraNet port 49147 - ID: 183 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (9) Ignoring duplicate packet from client SaraNet port 38949 - ID: 184 due to unfinished request in component authorize module sql *Sincerly* Mamun Ahmed

3 2

IP assignment based on AD group
by Rodrigo Abrantes Antunes 31 Oct '24

31 Oct '24

Hi, I currently have vlan assignment based on ad group working flawlessly for my wireless clients. Now I want ip assignment, is it possible? I tried to achieve that with the ippool module but I think I am missing something. How should I configure the wlc or the dhcp server? mods-enabled/ippool ippool professores-cstsi { filename = ${db_dir}/ippools/professores-cstsi.ippool range_start = 172.17.10.1 range_stop = 172.17.10.20 netmask = 255.255.0.0 cache_size = 20 ip_index = ${db_dir}/ippools/professores-cstsi.ipindex override = yes maximum_timeout = 0 } users DEFAULT LDAP-Group == "test", Pool-Name := "professores-cstsi" Thanks.

5 14

Pass client attributes from client.conf to post-auth section
by Alexey D. Filimonov 30 Oct '24

30 Oct '24

Is it possible to have client shortname (from clients.conf) or any custom per-client property inside post-auth and post-proxy block? Problem: I have multiple physical locations of different "types", each location type has it's own requirement for Tunnel-Private-Group-Id. With MS NPS, I have AAA clients named location-a@location-type-x@ap1 location-a@location-type-x@ap2 location-b@location-type-x@ap1 location-c@location-type-z@ap1 location-c@location-type-z@ap2 And I build access rules logic with conditions like "rule when client name match /@location-type-x@/" and "another rule when client name match /@location-type-z@/". With FreeRADIUS I found no information about client shortname in debug_all output inside post-auth block. I can build huge ruleset of additional unlang logic like this, or maybe more simple... if (&NAS-IP-Address == "1.1.1.1" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "100" } } elsif (&NAS-IP-Address == "1.1.1.1" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "101" } } elsif (&NAS-IP-Address == "1.1.1.2" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "100" } } elsif (&NAS-IP-Address == "1.1.1.2" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "101" } } elsif (&NAS-IP-Address == "1.1.2.1" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "203" } } elsif (&NAS-IP-Address == "1.1.2.1" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "204" } } ... But in my opinion, 1) there must be a way not to duplicate client address information in both post-auth and clients.conf 2) amount of code looks stupid when scaled to tens of locations.

2 2

Can I use diffrent root CA certificates while dynamic loading certificate chains?
by James Fan 28 Oct '24

28 Oct '24

Hi, we have a case that, with multi-tenancy, there will be multiple CA certificates in our FreeRadius server, so we need to load the certificate chains dynamically. But when I use the statements below, I can't include the CA certificates in the certificate files I set. The TLS-Session-Cert-File looks like it is only for the server certificate and intermediate CA certificates. Is there any chance of dynamic loading certificate chains with root CA certificates? Thanks. authenticate { ... Auth-Type eap { if ("%{unpack:&EAP-Message 4 byte}" == 1) { update control { TLS-Session-Cert-File := "${certdir}/realms/%{Realm}" } } eap } ... }

4 8

General Issues
by mohamed almeshal 28 Oct '24

28 Oct '24

Dear Savers , I'm doing lot's of work with FreeRadius , but I'm stuck with 3 major issues. * What is the best max_pps that can handle heavy load , also what is best database software that can handle heavy load . * Doing some modifications to default sites-available what is best way to implement modifications in database queries for custom purpose . * Is modified the queries of the FreeRadius to lower the load like shrink the data being inserted or updated. Will effect the FreerRadius as all Thanks ,

2 1

radiusd service start timeout
by Alan Smith 24 Oct '24

24 Oct '24

Hi all, I am using freeradius 3.0.20 with MariaDB. Radius clients are stored in the database. When I try to start the service, it will attempt to start the service. Then 1 minute 30 seconds later, it will log error message timed out.In /var/log/radius/radius.log, I can check the clients are still being loaded (not completed yet).The output of systemctl status radiusd is as follows. Oct 24 15:17:19 servername systemd[1]: Starting FreeRADIUS high performance RADIUS server....Oct 24 15:18:49 servername systemd[1]: radiusd.service start-pre operation timed out. Terminating.Oct 24 15:18:49 servername systemd[1]: radiusd.service Failed with result 'timeout'.Oct 24 15:18:49 servername systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. May I know how this can be fixed? Thank you in advance.

2 1

Question / Updated RADIUS attribute before proxying (pre-proxy) not sent to proxy server
by dominic.stalder＠unibe.ch 24 Oct '24

24 Oct '24

Hi guys I would like to achieve this: - if RADIUS request is arriving from a specific IP address (for test purpuses also added 127.0.0.1) and Called-Station-SSID attribute is empty, set this attribute BEFORE proxying to a value “00-11-22-33-44-55:eduroam” - I added the following to the pre-proxy section in /etc/freeradius/sites-enabled/default: pre-proxy { if (Packet-Src-IP-Address == 130.59.31.24 || Packet-Src-IP-Address == 130.59.31.25 || Packet-Src-IP-Address == 127.0.0.1) { if (!&Called-Station-SSID) { update request { &Called-Station-Id := "00-11-22-33-44-55:eduroam" } } } attr_filter.pre-proxy } *** /etc/freeradius/mods-config/attr_filter/pre-proxy looks like this: DEFAULT User-Name =* ANY, User-Password =* ANY, MS-CHAP-Challenge =* ANY, MS-CHAP-Response =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, State =* ANY, NAS-IP-Address =* ANY, NAS-Identifier =* ANY, NAS-Port-Type =* ANY, Calling-Station-Id =* ANY, Called-Station-Id =* ANY, Proxy-State =* ANY, Operator-Name := "1unibe.ch" *** In the debug output, I can see, that the request is updated to "00-11-22-33-44-55:eduroam", but it does not reflect it in the RADIUS proxy request to the backend server, it does not send the Called-Station-Id set before: (8) Starting proxy to home server 130.92.14.27 port 1812 (8) server default { (8) # Executing section pre-proxy from file /etc/freeradius/sites-enabled/default (8) pre-proxy { (8) if (Packet-Src-IP-Address == 130.59.31.24 || Packet-Src-IP-Address == 130.59.31.25 || Packet-Src-IP-Address == 127.0.0.1) { (8) EXPAND Packet-Src-IP-Address (8) --> 127.0.0.1 (8) EXPAND Packet-Src-IP-Address (8) --> 127.0.0.1 (8) EXPAND Packet-Src-IP-Address (8) --> 127.0.0.1 (8) if (Packet-Src-IP-Address == 130.59.31.24 || Packet-Src-IP-Address == 130.59.31.25 || Packet-Src-IP-Address == 127.0.0.1) -> TRUE (8) if (Packet-Src-IP-Address == 130.59.31.24 || Packet-Src-IP-Address == 130.59.31.25 || Packet-Src-IP-Address == 127.0.0.1) { (8) if (!&Called-Station-SSID) { (8) if (!&Called-Station-SSID) -> TRUE (8) if (!&Called-Station-SSID) { (8) update request { (8) &Called-Station-Id := "00-11-22-33-44-55:eduroam" (8) } # update request = noop (8) } # if (!&Called-Station-SSID) = noop (8) } # if (Packet-Src-IP-Address == 130.59.31.24 || Packet-Src-IP-Address == 130.59.31.25 || Packet-Src-IP-Address == 127.0.0.1) = noop (8) } # pre-proxy = noop (8) } (8) Proxying request to home server 130.92.14.27 port 1812 timeout 20.000000 (8) Sent Access-Request Id 8 from 0.0.0.0:42294 to 130.92.14.27:1812 length 187 (8) EAP-Message = 0x02fd0028016964696e662e7465737473747564656e744073747564656e74732e756e6962652e6368 (8) User-Name = idinf.teststudent(a)students.unibe.ch<mailto:idinf.teststudent@students.unibe.ch> (8) NAS-IP-Address = 127.0.0.1 (8) Calling-Station-Id := "02-00-00-00-00-01" (8) Framed-MTU = 1400 (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) Connect-Info = "CONNECT 11Mbps 802.11b" (8) Message-Authenticator = 0x (8) Proxy-State = 0x38 What am I missing in this context or am I updating the wrong “context” (= request)? Thanks and best regards Dominic

2 5

Setting up CoA properly.
by Saied Ahadi 24 Oct '24

24 Oct '24

I hope someone can point me in the right direction. I am trying to setup CoA properly. In Free radius 2, we would simply change the clients.conf and proxy.conf file and list our NAS. What is the process like in free radius 3. We currently have CoA working in Freeradius 3 but I am not 100% sure if this is the proper method.

2 7