- Freeradius-Users - lists.freeradius.org

Encode REST response with base64
by nabble＠felix.world 11 Jun '24

11 Jun '24

Hi, Is there a way to get a binary response from an http endpoint with the rest module so that it get’s base64 encoded as a attribute to process the response further? BR, Lineconnect

1 0

Failed retrieving values
by Çağlar Karahan 11 Jun '24

11 Jun '24

I got an error "Failed retrieving values required to evaluate condition" when checking service-type in if condition in default config file. It seems that the client does not send requests with service-type attributes. My question is, is it necessary to send service-type attribute by client side or do we need to check also if there is a service-type attribute? Thanks for your suggestions.

2 2

LDAP + OTP
by Jon Gerdes 10 Jun '24

10 Jun '24

Dear all (FreeRADIUS 3.0.26 on Ubuntu 22.04) I am trying to get a MFA setup working with an initial LDAP direct bind against Microsoft AD (MAD) and then a second pass with the same username and a OTP. I can get both the LDAP and OTP working fine individually. I am using the wiki Howto: https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy as a model. This howto uses "State" to determine which Auth-Type it is at in the process. At the end of the howto there is a section that describes filtering out the State attribute for Pre-Proxy and I think this is where I am getting things wrong. I'm not sure what "State" is. I am unable to find docs about it but it is the only input difference I can see when running "freeradius -fX" so I think I need to filter it out. I'm not sure why I should filter it out either! If attr_filter is what I should do to get this to work, I'd be grateful for some help. I've also deviated from the howto example by trying to decompose "challenge" into what it actually does: update control { Response-Packet-Type := Access-Challenge { With the site-enabled config below, the debug logs show that the initial user/pass against LDAP works fine and State gets set to a 16 random char. Then it tries to do a second pass and I can see the username and password (which is now the PIN for the OTP) passed through and so is the "State" that got set by stage one. This second pass fails and when I compare the logs against just the OTP method that works, "State" is the only additional input. Cheers Jon # LDAP with direct bind as the user logging in - Active Directory # then prompt for a PIN, and pass that to PrivacyIdea # JG 04 Jun 2024 server active-directory { listen { type = auth ipaddr = 10.77.10.10 port = 1812 clients = external } authorize { if (!State) { if (&User-Password) { update control { Ldap-UserDN := "%{User-Name}(a)blueloop.net" Auth-Type := AD } } else { reject } } else { #### attr_filter.access_challenge ? #################### I think this is where I am going wrong perl-privacyidea if (ok || updated) { update control { Auth-Type := Perl } } } } authenticate { Auth-Type AD { ldap if (ok) { update reply { State := "%{randstr:aaaaaaaaaaaaaaaa}" Reply-Message := "Please enter PIN" } update control { Response-Packet-Type := Access-Challenge } } } Auth-Type Perl { perl-privacyidea } } }

2 5

Prometheus module on FreeRADIUS 3.2.4
by dominic.stalder＠unibe.ch 08 Jun '24

08 Jun '24

Hi guys First of all, I wanted to let you know, that I was – w/o any problems – able to upgrade from FreeRADIUS 3.0.26 (Ubuntu own packages: /etc/freeradius/3.0) to FreeRADIUS 3.2.4 (networkRADIUS packages: /etc/freeradius); thanks for that. Now I would like to start from scratch with monitoring our FreeRADIUS infrastructure and would like to use Prometheus to export the data (primarly service status and RADIUS statistics) and Grafana to visualize it: 1. Does this setup sound reasonable to you guys? 2. I read, that FreeRADIUS does come with the Prometheus (exporter) module included, but I can not find it in /etc/freeradius/mods-available. If not, how can I install / enable the Prometheus module for a FreeRADIUS 3.2.4 version? The github repo for Prometheus says: Prometheus exporter for FreeRADIUS metrics. Supports FreeRADIUS 3.0.x. 3. Does anyone have FreeRADIUS 3.2 and Prometheus already working right now? Thanks a lot for any help provided and best regards Dominic _________________________________ Universität Bern Abteilung Informatikdienste Dominic Stalder Network Engineer Hochschulstrasse 6 CH-3012 Bern Tel. +41 (0)31 684 38 18 dominic.stalder(a)unibe.ch<mailto:dominic.stalder@unibe.ch> www.id.unibe.ch _________________________________

2 2

Assign user to a realm.
by Deepansha Gaur 03 Jun '24

03 Jun '24

Hi team, I am trying to assign VLANs to different realms, and only a few users to be part of a given realm. E.g.: user1 and user2 are part of @staff and should be assigned VLAN 123 user3 and user4 are part of @student and should be assigned 98 If a user is not part of a realm, he should be denied. Could you please help me on how I can assign a user to a realm? Thanks for your help. Regards, *Deepansha Gaur*

2 6

EAP Fast Reauth fails
by deepika parmar 03 Jun '24

03 Jun '24

Hello, I have configured *EAP-AKA virtual-server in FreeRADIUS to perform authentication. I have enabled eap cache so that fast reauth will work and session data will be stored in cache. However during store session i could not restore Counter and hence reauth fails. Logs are: Debug : (0.0) h9-auth-server - store session { Debug : (0.0) h9-auth-server - | debug_attr INFO : (0.0) h9-auth-server - Attributes matching "&session-state" INFO : (0.0) h9-auth-server - &session-State.session-State = { INFO : (0.0) h9-auth-server - Permanent-Identity = 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org INFO : (0.0) h9-auth-server - SIM-Ki = 0x465b5ce8b199b49faa5f0a2ee238a6bc INFO : (0.0) h9-auth-server - SIM-OPc = 0xcd63cb71954a9f4e48a5994e37a02baf INFO : (0.0) h9-auth-server - SIM-SQN = 528 INFO : (0.0) h9-auth-server - Identity = 27CL9C1yARfBU1l(a)wlan.mnc11343.mcc0.3gppnetwork.org INFO : (0.0) h9-auth-server - Session-Data = 0xd9407284e28f09c788dd047dbd2350adcf91a5ef INFO : (0.0) h9-auth-server - Counter = 0 >>>>>>>>>>>>>>>>> Counter is available here....>>>>>> INFO : (0.0) h9-auth-server - } Debug : (0.0) h9-auth-server - | eap-aka-sim.Session-ID Debug : (0.0) h9-auth-server - | %{eap-aka-sim.Session-ID} Debug : (0.0) h9-auth-server - | --> 0x34374631353345367a547775664157 Debug : (0.0) eap_aka_cache - No cache entry found for "47F153E6zTwufAW" Debug : (0.0) eap_aka_cache - Creating new cache entry Debug : (0.0) eap_aka_cache - &session-State.Session-Data := &session-State.Session-Data -> 0xd9407284e28f09c788dd047dbd2350adcf91a5ef Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Permanent-Identity} Debug : (0.0) eap_aka_cache - | session-state.Permanent-Identity Debug : (0.0) eap_aka_cache - | %{session-state.Permanent-Identity} Debug : (0.0) eap_aka_cache - | --> 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org Debug : (0.0) eap_aka_cache - --> 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org Debug : (0.0) eap_aka_cache - &session-State.Permanent-Identity := "10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org" Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Encr-Data.Counter} Debug : (0.0) eap_aka_cache - | session-state.Encr-Data.Counter Debug : (0.0) eap_aka_cache - | %{session-state.Encr-Data.Counter} Debug : (0.0) eap_aka_cache - (null) Debug : (0.0) eap_aka_cache - --> Debug : (0.0) eap_aka_cache - Skipping %{session-state.Encr-Data.Counter} Debug : (0.0) eap_aka_cache - Committed entry, TTL 150 seconds Debug : (0.0) h9-auth-server - eap_aka_cache (updated) Session is stored in eap cache however it could not store Counter as its value is nil in Encr-Data and direct access to Counter in session-state is failing. During Reauth request , it could fetch the session from the cache but as Counter is not there, fast reauth is failing... Debug : (2.0) h9-auth-server - New EAP-AKA session Debug : (2.0) h9-auth-server - Changed state INIT -> REAUTHENTICATION Debug : (2.0) h9-auth-server - load session { Debug : (2.0) h9-auth-server - | eap-aka-sim.Session-ID Debug : (2.0) h9-auth-server - | %{eap-aka-sim.Session-ID} Debug : (2.0) h9-auth-server - | --> 0x34374631353345367a547775664157 Debug : (2.0) eap_aka_cache - Found entry for "47F153E6zTwufAW" Debug : (2.0) eap_aka_cache - Merging cache entry into request Debug : (2.0) eap_aka_cache - &session-State.Session-Data := 0xd9407284e28f09c788dd047dbd2350adcf91a5ef Debug : (2.0) eap_aka_cache - &session-State.Permanent-Identity := '10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org' Debug : (2.0) h9-auth-server - eap_aka_cache (updated) Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - | debug_attr INFO : (2.0) h9-auth-server - Attributes matching "&session-state" INFO : (2.0) h9-auth-server - &session-State.session-State = { INFO : (2.0) h9-auth-server - Session-Data = 0xd9407284e28f09c788dd047dbd2350adcf91a5ef INFO : (2.0) h9-auth-server - Permanent-Identity = 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org INFO : (2.0) h9-auth-server - } Debug : (2.0) h9-auth-server - | %debug_attr({&session-state}) Debug : (2.0) h9-auth-server - } # send Reauthentication-Request (ok) Debug : (2.0) h9-auth-server - Generating new session keys Debug : (2.0) h9-auth-server - No &session-state.Counter attribute found, can't calculate re-auth keys Debug : (2.0) h9-auth-server - Composing EAP-Request/Reauthentication failed. Clearing reply attributes and requesting additional Identity Debug : (2.0) h9-auth-server - Changed state REAUTHENTICATION -> AKA-IDENTITY Debug : (2.0) h9-auth-server - send Identity-Request { Store session setting in virtual server: store session { "%(debug_attr:&session-state)" eap_aka_cache "%(debug_attr:&session-state)" ok } Currently my eap_cache is cache eap_aka_cache { # # key:: Cache key. # key = "%{eap-aka-sim.Session-ID}" # # ttl:: TTL for cache entries. # ttl = 150 # # update <section> { ... }:: # update session-state { &session-state.Session-Data := &session-state.Session-Data &Permanent-Identity := "%{session-state.Permanent-Identity}" &Encr-Data.Counter := "%{session-state.Encr-Data.Counter}" } } If i add accessing Counter, it fails as follows: &session-state.Counter := &session-state.Counter Debug : Compiling policies in - store session {...} Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: Failed parsing attribute reference &session-state.Counter - Unresolved attributes are not allowed here Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: &session-state.Counter Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: ^ Error : /usr/local/etc/raddb/mods-enabled/eap-cache[22]: Failed creating map from '&session-state.Counter = &session-state.Counter' Error : /usr/local/etc/raddb/mods-enabled/eap-cache[1]: Failed parsing configuration section update Error : /usr/local/etc/raddb/sites-enabled/h9-auth-server[1006]: Invalid keyword "eap_aka_cache". Am i missing any configuration? Can anyone help? Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch synced on 10th May 2024. * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Thanks, Deepika

2 4

IP Addr Comparison
by BOUILLOUD Corentin 03 Jun '24

03 Jun '24

Hi Team, I would like to ask your help about IP address comparisons in FreeRADIUS 3.0.27. I want to restrict a mac-address to a network, but comparison of ip address with a subnet doesn't seems to work as a check items : 11-22-33-44-55-66 NAS-IP-Address < 192.168.8.0/22 /etc/freeradius/3.0/authorized_macs[10]: Parse error (check) for entry 11-22-33-44-55-66: Invalid IPv4 mask length "/22". Only "/32" permitted for non-prefix types Yet, documentation says it should be possible. "The syntax allows conditions such as 192.0.2.1 < 192.0.2/24. This condition will return true, as the IP address 192.0.2.1' is within the network `192.0.2/24." I also tried casting the attribute, without success : 11-22-33-44-55-66 <ipaddr>NAS-IP-Address < "192.168.8.0/22" /etc/freeradius/3.0/authorized_macs[10]: Parse error (check) for entry 11-22-33-44-55-66: Invalid attribute name Do user files have a different behaviour for comparisons and casting ? I could use regex as a backup solution but it's quickly going to get difficult to read in the file : 11-22-33-44-55-66 NAS-IP-Address =~ "/^192\.168\.(8|9|10|11)\./" https://freeradius.org/documentation/freeradius-server/4.0.0/raddb/mods-con… https://freeradius.org/documentation/freeradius-server/3.0.27/unlang/condit… https://freeradius.org/documentation/freeradius-server/3.0.27/unlang/condit… Regards, Corentin BOUILLOUD ======================================================== This message has been scanned for malware. This message and any attachments (the "message") are confidential, intended solely for the addressees, and may contain legally privileged information. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither our company or any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified. ========================================================= Ce message a ete verifie et ne contient pas de programme malveillant. Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et susceptibles de contenir des informations couvertes par le secret professionnel. Ce message est etabli a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Notre societe et ses filiales declinent toute responsabilite au titre de ce message s'il a ete altere, deforme falsifie. O =========================================================

3 5

Access-Request counter on accounting server with TCP/TLS & Freeradius Proxy
by Marcin Majkowski 31 May '24

31 May '24

Greetings, I've encountered a rising number of Access-Request, when I've switched proxy.conf from Replicate-To-Realm by udp to Proxy-To-Realm with tcp+tls. Number of Access-Request is gathered via builtin status server in accounting server. [echo -e "Message-Authenticator = 0x00\nFreeRADIUS-Statistics-Type = 3" | radclient -x 127.0.0.1:18121 status pass-pass ] What I mean by rising, from noise level ~1 req/s upto 200 req/s. After some debug, to my surprise there is no significant number of Access-Request in stdout when running freeradius acct in foreground mode as freeradius -fxxx -l stdout. Apart from Access-Accept sent to Status-Server which is expected/fine. Setup is: 3 hosts (proxy/auth/acct) with: radiusd: FreeRADIUS Version 3.2.4 (git #7e8f34ec5) [ FreeRADIUS Version 3.2.3 (git #db3d1924d) - was also affected ] 1st host is acting only as proxy, it forwards request to acct and auth servers via local haproxy(tcp+tls). Haproxy is configured to listen on different ports for both and in proxy.conf servers are set as different under same realm. (I've also set them to different realms accordingly, no change) Is it a expected behaviour when using Proxy-To-Realm instead of Replicate-To-Realm?

2 1

3.2.4 Debian Bookworm via networkradius.com packages
by Jack Carter 30 May '24

30 May '24

Hi all, Can someone confirm if I’m using the freeRADIUS Packages from networkradius.com and select the following that I should be running 3.2.4? * FreeRADIUS 3.2 - stable with latest features (recommended)<https://networkradius.com/packages/#fr32> * Debian * Debian 12 “Bookworm” When I run freedradius -v it says 3.2.1 which looks like the main Debian package version. Interestingly when I saw Alan’s email about 3.2.4 and I ran sudo apt update and sudo apt upgrade freeradius-common was upgraded. I have confirmed the NetworkRADIUS PGP public key is present as well as APT preferences file and sources list plus when I run sudo apt update I can see the following: Hit:1 http://packages.networkradius.com/freeradius-3.2/debian/bookworm bookworm InRelease Again, if someone could confirm if 3.2.1 is correct or if this method should install 3.2.4 that would be great. I’m running on a Raspberry Pi 3B+ Linux 6.6.28+rpt-rpi-v8 #1 SMP PREEMPT Debian 1:6.6.28-1+rpt1 (2024-04-22) aarch64 GNU/Linux. Many thanks, Jack

2 2

Tuning freeradius memory usage for small footprint machines
by Peter Thomas (pethoma2) 30 May '24

30 May '24

I'm working on setting up FreeRADIUS on some pretty small servers with limited memory. I was wondering if anyone here has tips or tricks for reducing the memory footprint of FreeRADIUS. Are there any config tweaks to lower memory usage? I am running version 3.2.3 and the servers have about 256MB of RAM. Thanks, Pete

3 6