- Freeradius-Users - lists.freeradius.org

Compiling support for libkqueue on docker image
by Mark Donnelly 18 Oct '24

18 Oct '24

Good day everyone! I'm trying to create a docker image of FreeRADIUS 3.2.x (on Ubuntu24) with libkqueue support enabled. I had hoped it would be as easy as installing the libkqueue-dev package before building, but it's turning out to be more difficult. First, I ensured that the docker image had libkqueue-dev installed during the build process. (For now I've listed it in debian/control.in as a build dependency.) I can verify that the libkqueue-dev package is installed, but when the build runs ./configure, the configure script detects kqueue support as "no". I found that if I run the configure script manually with the LIBS environment variable set to "-lkqueue", then configure is able to detect kqueue support as "yes". I looked at how configure.ac is set up to look for kqueue, and see that it's on line 1802 as a parameter to the AC_CHECK_FUNCS check. After looking up what that means (I'm new to autoconf), it looks like autoconf has been set up to check for kqueue within existing libraries, but not try to load the libkqueue library before running that check. So, I added a block starting at line 1046: dnl # dnl # Check for -lkqueue dnl # This library may be needed for kqueue. dnl # AC_SEARCH_LIBS([kqueue], [kqueue]) However, my attempts at running autoconf to regenerate the configure file have all failed with lots of warnings or errors. What's the correct way to run autoconf for the FreeRADIUS source tree? Cheers, --Mark

3 2

Issue Building FreeRADIUS 3.2.6 on RedHat 9.4.
by Mucci Andrea 11 Oct '24

11 Oct '24

Hi all, I'm trying to build the RPMs for FreeRadius v.3.2.6 on Red Hat Enterprise Linux release 9.4 (Plow). I need to do this because my database is Oracle. After fixing all dependencies. The "rpmbuild" command returns errors and does not create RPM packages. Three warning: warning: line 52: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-devel warning: line 53: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-libs warning: Macro expanded in comment on line 597: %{_mandir}/man5/rlm_idn.5.gz} One error while compile: CC src/modules/rlm_python/rlm_python.c In file included from src/freeradius-devel/radiusd.h:38, from src/modules/rlm_python/rlm_python.c:33: src/modules/rlm_python/rlm_python.c: In function 'python_error_log': src/modules/rlm_python/rlm_python.c:229:26: warning: implicit declaration of function 'PyString_AsString' [-Wimplicit-function-declaration] 229 | ERROR("%s (%s)", PyString_AsString(p_str_1), PyString_AsString(p_str_2)); | ^~~~~~~~~~~~~~~~~ src/freeradius-devel/log.h:139:55: note: in definition of macro 'ERROR' 139 | #define ERROR(fmt, ...) radlog(L_ERR, fmt, ## __VA_ARGS__) | ^~~~~~~~~~~ src/modules/rlm_python/rlm_python.c:229:15: warning: format '%s' expects argument of type 'char *', but argument 3 has type 'int' [-Wformat=] 229 | ERROR("%s (%s)", PyString_AsString(p_str_1), PyString_AsString(p_str_2)); This is the message at the end: Recommends: freeradius-debugsource(x86-64) = 3.2.6-1.el9 Checking for unpackaged file(s): /usr/lib/rpm/check-files /root/rpmbuild/BUILDROOT/freeradius-3.2.6-1.el9.x86_64 error: Installed (but unpackaged) file(s) found: /etc/raddb/mods-config/python/example.py /etc/raddb/mods-config/python/radiusd.py /usr/lib/debug/usr/lib64/freeradius/rlm_python.so-3.2.6-1.el9.x86_64.debug /usr/lib64/freeradius/rlm_python.so RPM build errors: line 52: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-devel line 53: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-libs Macro expanded in comment on line 597: %{_mandir}/man5/rlm_idn.5.gz} File listed twice: /etc/raddb/certs/bootstrap File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/queries.conf File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/cisco_h323_db_schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf Installed (but unpackaged) file(s) found: /etc/raddb/mods-config/python/example.py /etc/raddb/mods-config/python/radiusd.py /usr/lib/debug/usr/lib64/freeradius/rlm_python.so-3.2.6-1.el9.x86_64.debug /usr/lib64/freeradius/rlm_python.so I think the problem is that RedHat 9 does not support Python 2. Anyone have any idea how I can solve this?? Best Regards Andrea

2 1

Unable to Find Active Directory Group using LDAP Group Lookup module
by Ibrahim Almahfooz 08 Oct '24

08 Oct '24

Hello, We have successfully integrated our FreeRADIUS Version 3.2.6 with active directory using ntlm_auth module and also enabled sqlcounter to permit users with specific daily limit. All working well. However, part of the requirements is to give a specific time quota to users who are part of a specific AD group, which we guess is a common use case. To achieve this, we also integrated FR with ldap by using FreeRadius-ldap package and we populated the ldap configuration file with below: ldap section: server = '192.168.1.1' identity = 'cn=test,cn=Users,dc=domain,dc=com' password = 'xxxxxx' base_dn = 'CN=users,DC=domain,DC=com' ldap Group section: (As-is) In the Authorize or Post-Auth section we added below: if (LDAP-Group == "Office-VPN") { update reply { Reply-Message := "test reply" } } When we run radiusd -X, the ldap part is executed in the authorize section however it says "Search returned no results": (1) authorize { (1) if (LDAP-Group == "Office-VPN") { (1) Searching for user in group "Office-VPN" rlm_ldap (ldap): Reserved connection (1) (1) EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) --> (uid=test) (1) Performing search in "CN=users,DC=domain,DC=com" with filter "(uid=test)", scope "sub" (1) Waiting for search result... (1) Search returned no results rlm_ldap (ldap): Released connection (1) Need more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.1:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) if (LDAP-Group == "Office-VPN") -> FALSE In our active directory the user "test" is part of the "Office-VPN" group and both the user and group are inside "cn=Users,dc=domain,dc=com" Also when we run the ldapsearch command from within FR machine, we get positive results: ldapsearch -x -b "cn=Users,dc=domain,dc=com" -D "cn=test,cn=Users,dc=domain,dc=com" -h 192.168.1.1-w "xxxxxx" '(&(cn=Office-VPN))' # extended LDIF # # LDAPv3 # base <cn=Users,dc=domain,dc=com> with scope subtree # filter: (&(cn=Office-VPN)) # requesting: ALL # # Office-VPN, Users, domain.com dn: CN=Office-VPN,CN=Users,DC= domain,DC=com objectClass: top objectClass: group cn: Office-VPN member: CN=test,CN=Users,DC=domain,DC=com distinguishedName: CN=Office-VPN,CN=Users,DC=domain,DC=com instanceType: 4 whenCreated: 20241008110114.0Z whenChanged: 20241008131130.0Z uSNCreated: 134205037 uSNChanged: 134208547 name: Office-VPN objectGUID:: bJ2ut8zDLUu8jhVkbMh7mQ== objectSid:: AQUAAAAAAAUVAAAAEBY0cDMJoyrnPWkPzxYAAA== sAMAccountName: Office-VPN sAMAccountType: 268435456 groupType: -2147483646 objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=domain,DC=com dSCorePropagationData: 20241008120926.0Z dSCorePropagationData: 20241008114220.0Z dSCorePropagationData: 16010101000000.0Z # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 What do you think could be the issue? By the way, we also tried to change the parameter like filter = '(objectClass=posixGroup)' to use filter = '(objectClass=group)' and that didn't work either. Appreciate your help

2 2

Recommended value for ${db_dir} when using persist_dir
by George Benjin 08 Oct '24

08 Oct '24

I was about to enable persistent storage of sessions with FreeRADIUS 3.2.6 on RHEL 9.4 (installed from the NetworkRADIUS repo). The eap module states the following: The default directory is ${logdir}, for historical reasons. You should ${db_dir} instead. And check the value of db_dir in the main radiusd.conf file. It should not point to ${raddb}. I checked the value of db_dir in the radiusd.conf file as mentioned, and it is set to: ${raddbdir} which evaluates to /etc/raddb. The comment immediately above the line setting the value mentions that it should likely be set to ${localstatedir}/lib/radiusd. I haven't changed these settings from defaults. Should the radiusd.conf settings be updated in the default package, and/or should the guidance be made clearer? File excerpts below. Cheers -------------------------------------------------------------------------------- >From eap: # Simple directory-based storage of sessions. # Two files per session will be written, the SSL # state and the cached VPs. This will persist session # across server restarts. # # The default directory is ${logdir}, for historical # reasons. You should ${db_dir} instead. And check # the value of db_dir in the main radiusd.conf file. # It should not point to ${raddb} # # The server will need write perms, and the directory # should be secured from anyone else. You might want # a script to remove old files from here periodically: # # find ${logdir}/tlscache -mtime +2 -exec rm -f {} \; # # This feature REQUIRES "name" option be set above. # # persist_dir = "${logdir}/tlscache" ----------------------------------------------------------------------------- >From radiusd.conf: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # # name of the running server. See also the "-n" command-line option. name = radiusd # Location of config and logfiles. confdir = ${raddbdir} modconfdir = ${confdir}/mods-config certdir = ${confdir}/certs cadir = ${confdir}/certs run_dir = ${localstatedir}/run/${name} # Should likely be ${localstatedir}/lib/radiusd db_dir = ${raddbdir}

2 2

radmin stats home_server command always reporting zero requests
by paul.moser＠bt.com 03 Oct '24

03 Oct '24

I'm seeing the radmin stats home_server command with IP address and port arguments always report zero requests. The responses, last_packet and various elapsed metrics are incrementing as expected. Access and accounting requests both seem to be affected. I've rolled back to 3.2.4 and the requests metric increments as expected(*), but it does not with 3.2.5 or 3.2.6 The changelog for 3.2.5 does indicate that there was a bug fix around statistics: * Fix packet statistics. Stop double counting some packets, and track packet statistics even if a socket is closed. (*) My assumption is/was that the request metric should increment with every packet to be sent to a home server and that all things being good (no drops, in-flight packets etc) requests should equal responses (or rather responses should equal requests) but my understanding of what the requests metric is might not be correct. Paul

2 3

rest module to send simple API call to Infoblox for Mac Auth
by dominic.stalder＠unibe.ch 30 Sep '24

30 Sep '24

Hi guys Im am trying to combine (1) Mac Auth and (2) 802.1x on FreeRADIUS 3.2. So far, with simple check on a fixed Calling-Station-Id, it works. Now I would like to implement an GET API call to our IPAM (Infoblox) in the following format: https://xyz.domain.com/wapi/v2.11.3/record:host?network=172.25.8.0/21&mac=a… First things first, I enabled the rest module: ln -s ../mods-available/rest /etc/freeradius/mods-enabled/rest 1. With the default configuration, I get the following output: rlm_rest (rest): Opening additional connection (0), 1 of 32 pending slots used rlm_rest (rest): Connecting to http://127.0.0.1/ rlm_rest (rest): Connection failed: 7 - Couldn't connect to server rlm_rest (rest): Opening connection failed (0) rlm_rest (rest): Removing connection pool 2. When I comment the corresponding “connect_uri” like mentioned in the rest module comment, I get the next error: # rlm_rest will open a connection to the server specified in connect_uri # to populate the connection cache, ready for the first request. # The server will not start if the server specified is unreachable. # # If you wish to disable this pre-caching and reachability check, # comment out the configuration item below. # connect_uri = http://127.0.0.1/ including configuration file /etc/freeradius/sites-enabled/control-socket /etc/freeradius/mods-enabled/rest[188]: Reference "${..connect_uri}" not found Errors reading or parsing /etc/freeradius/radiusd.conf As I stated, I would like to start very simple and go step by step from there because I have absolutely no clue how to implement the requested API call so far. But if anyone has a hint to “overcome” this error and maybe has a simple example of an GET API call, I would appreciate. Thanks and best regards Dominic _________________________________ Universität Bern Abteilung Informatikdienste Dominic Stalder Network Engineer Hochschulstrasse 6 CH-3012 Bern Tel. +41 (0)31 684 38 18 dominic.stalder(a)unibe.ch<mailto:dominic.stalder@unibe.ch> www.id.unibe.ch _________________________________

3 12

MAC Authentication Queries
by FreeRAD 27 Sep '24

27 Sep '24

Hi Team, I have recently set up MAC Authentication to happen before my EAP authentication takes over and just had some questions about the configuration I used (found here <https://wiki.freeradius.org/guide/Mac-Auth>). The page states that you should use the below configuration to make this work: if (!ok) { # Reject if the MAC address was not permitted. reject } # If this is NOT 802.1x, mac-auth if (!EAP-Message) { # MAC address has already been checked, so accept update control { Auth-Type := Accept } } else { # Normal FreeRADIUS virtual server config goes here e.g. eap } } But seemingly whenever I enclose the rest of my Authorize config within the final 'else' statement I get an error: */etc/freeradius/3.0/sites-enabled/default[526]: Failed to find "Autz-Type" as a module or policy./etc/freeradius/3.0/sites-enabled/default[526]: Please verify that the configuration exists in /etc/freeradius/3.0/mods-enabled/Autz-Type./etc/freeradius/3.0/sites-enabled/default[526]: Failed to parse "Autz-Type" subsection./etc/freeradius/3.0/sites-enabled/default[285]: Errors parsing authorize section. * If I then take out the 'else' entirely, the error then disappears and my server seems to work fine. It performs the MAC auth, then goes through to doing the EAP-TTLS auth. My question is, is removing the else going to cause issues, and if so, how can I get around my error? Many thanks!

2 13

EAP-TLS certificate untrusted
by Etienne Muesse 27 Sep '24

27 Sep '24

Hi all, I am trying to use freeradius with EAP-TLS but the client certificates are not trusted. We are using client certificates which are signed by our internal CA (signing chain is: client <- int-ca <- root-ca) Here is what I did: - Put the root CA and intermediate CA into "ca_path". - Set server.pem (issued by intermediate CA) - Set key.pem - Disable CRL/OCSP checks (for testing). The result when a client connects: /Certificate chain - 1 intermediate CA cert(s) untrusted To forbid these certificates see 'reject_unknown_intermediate_ca' (TLS) untrusted certificate with depth [2] subject name [ROOT CA CERTIFICATE] (TLS) untrusted certificate with depth [1] subject name [INT CA CERTIFICATE] (TLS) untrusted certificate with depth [0] subject name [CLIENT CERTIFICATE] tls: There are untrusted certificates in the certificate chain. Rejecting. (12) eap_tls: ERROR: (TLS) TLS - Alert write:fatal:internal error (12) eap_tls: ERROR: (TLS) TLS - Server : Error in error (12) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:0A000086:SSL routines::certificate verify failed (12) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (12) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation (12) eap_tls: ERROR: [eaptls process] = fail/ I also tried to chain the CA files or put the whole chain into the client certificate. When I try to verify with openssl, it works fine: openssl verify -CApath certs/ca certs/client.pem Using FreeRADIUS Version 3.2.4 Am I missing something? Best regards, Etienne

2 2

TLS 1.3 enabled or not?
by Luca Borruto 27 Sep '24

27 Sep '24

Hi everyone! Have you enabled TLS 1.3 in your configuration? I read somewhere it can cause issues, but we mostly use recent Windows and macOS machines, and I was wondering if we could benefit from it. tls_min_version = 1.2 tls_max_version = 1.3 Thanks !

3 2

Investigating Slow RADIUS Proxy Request
by Vedsar Kushwaha 27 Sep '24

27 Sep '24

I have a few questions about how the FreeRADIUS proxy handles requests: 1. When proxying a request, does a FreeRADIUS thread remain blocked until a response is received from the home server? 2. Does the max_outstanding flag apply only to health status checks, or does it affect all requests proxied to the home server? * If a FreeRADIUS thread blocks while waiting for a response, does increasing max_outstanding to a high value like 65536 actually allow FreeRADIUS to send that many outstanding requests? Or is the number of threads the limiting factor? * If a proxy request doesn't block a thread, how does FreeRADIUS listen for responses from the home server? 1. We have a request that took 40 minutes to proxy. The snippet below, along with the complete log, shows the details. We're trying to investigate the cause of this delay. ``` 2024-09-17T13:05:52.495Z (44469) Starting proxy to home server 129.170.130.4 port 2083 2024-09-17T13:05:52.495Z (44469) server VS_P_790be815-af8f-4dc5-b8c2-e01b8a107db4 { 2024-09-17T13:05:52.495Z (44469) } 2024-09-17T13:46:55.967Z (44469) Proxying request to home server 129.170.130.4 port 2083 (TLS) timeout 30.000000 ``` Juniper Business Use Only

2 1