- Freeradius-Users - lists.freeradius.org

Freeradius service does not start
by Dumitru 26 Jan '24

26 Jan '24

Hello, I wanted to start Freeradius server for configuring access with client devices. After installing the Freeradius server the Freeradius service is active but sometimes after the new installation or after executing the systemctl status freeradius command the service is not active. The current output is: ● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; enabled; vendor preset: enabled) Active: activating (auto-restart) (Result: exit-code) since Tue 2024-01-23 07:54:55 CET; 2s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 24003 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=226/NAMESPACE) CPU: 15ms Before the new installation I uninstalled Freeradius with apt purge freeradius and apt autoremove. status=226/NAMESPACE - usually appears sometimes after new Freeradius server installation. Freeradius server sometimes starts after new installation, sometimes not. If the Freeradius service starts, after a while it stops and after running systemctl status freeradius on exit, the message : status=1/FAILURE instead of status=226/NAMESPACE compared to the output above. OS: "Raspbian GNU/Linux 11 (bullseye) Below I place the debug output : radiusd -X 2>&1 | tee debugfileFreeRADIUS Version 3.0.21Copyright (C) 1999-2019 The FreeRADIUS server project and contributorsThere is NO warranty; not even for MERCHANTABILITY or FITNESS FOR APARTICULAR PURPOSEYou may redistribute copies of FreeRADIUS under the terms of theGNU General Public LicenseFor more information about these matters, see the file named COPYRIGHTStarting - reading configuration files ...including dictionary file /usr/share/freeradius/dictionaryincluding dictionary file /usr/share/freeradius/dictionary.dhcpincluding dictionary file /usr/share/freeradius/dictionary.vqpincluding dictionary file /etc/freeradius/3.0/dictionaryincluding configuration file /etc/freeradius/3.0/radiusd.confincluding configuration file /etc/freeradius/3.0/proxy.confincluding configuration file /etc/freeradius/3.0/clients.confincluding files in directory /etc/freeradius/3.0/mods-enabled/including configuration file /etc/freeradius/3.0/mods-enabled/expirationincluding configuration file /etc/freeradius/3.0/mods-enabled/alwaysincluding configuration file /etc/freeradius/3.0/mods-enabled/detail.logincluding configuration file /etc/freeradius/3.0/mods-enabled/passwdincluding configuration file /etc/freeradius/3.0/mods-enabled/papincluding configuration file /etc/freeradius/3.0/mods-enabled/ntlm_authincluding configuration file /etc/freeradius/3.0/mods-enabled/echoincluding configuration file /etc/freeradius/3.0/mods-enabled/radutmpincluding configuration file /etc/freeradius/3.0/mods-enabled/digestincluding configuration file /etc/freeradius/3.0/mods-enabled/utf8including configuration file /etc/freeradius/3.0/mods-enabled/sradutmpincluding configuration file /etc/freeradius/3.0/mods-enabled/sohincluding configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clientsincluding configuration file /etc/freeradius/3.0/mods-enabled/cache_eapincluding configuration file /etc/freeradius/3.0/mods-enabled/attr_filterincluding configuration file /etc/freeradius/3.0/mods-enabled/eapincluding configuration file /etc/freeradius/3.0/mods-enabled/mschapincluding configuration file /etc/freeradius/3.0/mods-enabled/replicateincluding configuration file /etc/freeradius/3.0/mods-enabled/logintimeincluding configuration file /etc/freeradius/3.0/mods-enabled/realmincluding configuration file /etc/freeradius/3.0/mods-enabled/execincluding configuration file /etc/freeradius/3.0/mods-enabled/filesincluding configuration file /etc/freeradius/3.0/mods-enabled/unpackincluding configuration file /etc/freeradius/3.0/mods-enabled/linelogincluding configuration file /etc/freeradius/3.0/mods-enabled/unixincluding configuration file /etc/freeradius/3.0/mods-enabled/detailincluding configuration file /etc/freeradius/3.0/mods-enabled/chapincluding configuration file /etc/freeradius/3.0/mods-enabled/exprincluding configuration file /etc/freeradius/3.0/mods-enabled/preprocessincluding files in directory /etc/freeradius/3.0/policy.d/including configuration file /etc/freeradius/3.0/policy.d/abfab-trincluding configuration file /etc/freeradius/3.0/policy.d/cuiincluding configuration file /etc/freeradius/3.0/policy.d/operator-nameincluding configuration file /etc/freeradius/3.0/policy.d/filterincluding configuration file /etc/freeradius/3.0/policy.d/dhcpincluding configuration file /etc/freeradius/3.0/policy.d/accountingincluding configuration file /etc/freeradius/3.0/policy.d/debugincluding configuration file /etc/freeradius/3.0/policy.d/eapincluding configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-idsincluding configuration file /etc/freeradius/3.0/policy.d/controlincluding configuration file /etc/freeradius/3.0/policy.d/canonicalizationincluding configuration file /etc/freeradius/3.0/policy.d/rfc7542including files in directory /etc/freeradius/3.0/sites-enabled/including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnelincluding configuration file /etc/freeradius/3.0/sites-enabled/defaultmain { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius"}main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes }}radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { }radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 10.17.30.250 { ipv4addr = 10.17.30.250 require_message_authenticator = no secret = <<< secret >>> shortname = "rdses1013-2" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } }Debugger not attachedsystemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digestradiusd: #### Instantiating modules #### modules { # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" }Creating attribute Unix-Group # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } instantiate { } # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.logrlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwdrlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eaprlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" disable_tlsv1 = yes disable_tlsv1_1 = yes tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } }Please use tls_min_version and tls_max_version instead of disable_tlsv1Please use tls_min_version and tls_max_version instead of disable_tlsv1_2 # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no }tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no }tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschaprlm_mschap (mschap): using internal authentication # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/filesreading pairlist file /etc/freeradius/3.0/mods-config/files/authorizereading pairlist file /etc/freeradius/3.0/mods-config/files/accountingreading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocessreading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroupsreading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints } # modulesradiusd: #### Loading Virtual Servers ####server { # from file /etc/freeradius/3.0/radiusd.conf} # serverserver inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...}Ignoring "sql" (see raddb/mods-available/README.rst)Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336} # server inner-tunnelserver default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...}} # server defaultradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnelListening on auth address * port 1812 bound to server defaultListening on acct address * port 1813 bound to server defaultListening on proxy address * port 39219Ready to process requests Best Regards.

2 4

Startup Fails with "No such file or directory" for sql queries.conf
by Timothy Weaver 25 Jan '24

25 Jan '24

Hi, I am attempting to use the FreeRADIUS Docker container, but when I try to include the mysql configuration the server fails to start with the following errors: .... including configuration file /etc/freeradius/mods-enabled/sql including configuration file /etc/freeradius/mods-config/sql/main/mysql/queries.conf} Unable to open file "/etc/freeradius/mods-config/sql/main/mysql/queries.conf}": No such file or directory Errors reading or parsing /etc/freeradius/radiusd.conf -------------------------- Here's what I've confirmed: 1. I am using a totally vanilla configuration from the Docker quick start instructions with no changes except to enable MySQL as the datastore. 2. The queries.conf file is present and permissions are correct. 3. Confirmed the database sql has been created with the schema under mods-config/sql/main/mysql/schema.sql 4. Confirmed the MySQL database is accessible with configuration parameters in the mod-available/sql file. Used mysql client to confirm with radius user and grants to all tables in the radius database. 5. In the mods-enabled/sql (linked to mods-available/sql)I have changed: * driver = "rlm_sql_null" to driver = "rlm_sql_mysql" * commented out the TLS section under mysql * confirmed the connection parameters for server, port, login, and password (see #4 above) * confirmed radius_db is set to the correct database name (I used "radius"). * uncommented read_clients = yes * ensured client_table = "nas" is uncommented * confirmed Dockerfile ------------- FROM freeradius/freeradius-server:latest COPY raddb/ /etc/freeradius/ Build ------- docker build -t freeradius -f Dockerfile . docker-compose.yml ---------------------------- version: "3" services: freeradius: image: freeradius:latest container_name: freeradius hostname: freeradius restart: always environment: - TZ="America/Los_Angeles" volumes: - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro

2 1

IPV6-Address accounting
by Hefin James [ahj] (Staff) 25 Jan '24

25 Jan '24

Hello, Quick question. We're currently using linelog to forward accounting information to our firewall for ip<->username matching, which has been working well for years. We've now got a test deployment of IPv6, and I need to do the same ipv6<->username matching. I've got it working, but only to 1 IPv6 address, when there could be many (as shown with the file based accounting log). Is there a way to run through the array of IPv6 addresses and getting a syslog line per IPv6 address? Thu Jan 25 09:41:48 2024 Framed-IP-Address = XXX.XXX.21.202 Framed-IPv6-Address = X:X:X:X:484d:9d72:e002:f00f Framed-IPv6-Address = X:X:X:X:b036:8ae5:2b04:1e52 Framed-IPv6-Address = fe80::30da:576d:c62d:2870 User-Name = "YYYY" Any pointers greatly appreciated. Thanks, Hefin

3 2

Is it possible to specify a message in the 403 response in Rest Module?
by 남혁준 25 Jan '24

25 Jan '24

First of all, I would like to inform you that the problem is not that I cannot be authenticated or that I cannot set it up. I mainly use the Rest module. So, I tried to use 401 and 403 separately as response types. In the case of a 401 response, it says "Use the body" and the message I responded to is parsed correctly. For 403 responses, the body is "not used." It says. Perhaps for that reason, no matter what response I send, it doesn't have much meaning. However, I confirmed that "Module-Failure-Message" in the 403 response contained the message "rest: Server returned:". It looks like it could be connected by conveying an additional message. If possible, I want the message to be delivered together and appended to the end, even if it responds with a 403 rejection. ex) rest: Server returned: Sorry, Server Reject" Is this possible behavior?

6 26

Mac-Auth or 802.1x
by Alpers, Andreas 24 Jan '24

24 Jan '24

Hello, My experience with Freeradius is still in the beginning. My requirements in the first step are not very high. I want to configure Freeradius so that users can be authenticated via 802.1x or via MAC-Auth. I followed these instructions exactly: https://wiki.freeradius.org/guide/mac-auth#mac-auth-or-802-1x Unfortunately, it does not work. I have created a username and password and also entered a Mac address in the file. But neither the user nor the Mac address work. I always get a reject, although it should work according to the instructions. I get the following answer when I run radtest: radtest andreas andreas123 127.0.0.1 1812 testing123 Sent Access-Request Id 123 from 0.0.0.0:51323 to 127.0.0.1:1812 length 77 User-Name = "andreas" User-Password = "andreas123" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "andreas123" Received Access-Reject Id 123 from 127.0.0.1:1812 to 127.0.0.1:51323 length 20 (0) -: Expected Access-Accept got Access-Reject Here are the individual files. I am very grateful for any help. /etc/freeradius/3.0/mods-available/files: files { moddir = ${modconfdir}/${.:instance} filename = ${moddir}/authorize acctusersfile = ${moddir}/accounting preproxy_usersfile = ${moddir}/pre-proxy } files authorized_macs { key = "%{Calling-Station-ID}" usersfile = ${confdir}/authorized_macs } # The instructions also say here # compat = no # but if I leave this in, I get an error message and the server no longer starts. Why does this happen? /etc/freeradius/3.0/authorized_macs 00-11-22-33-44-55 Reply-Message = "Device with MAC Address %{Calling-Station-Id} authorized for network access" /etc/freeradius/3.0/sites-available/default server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { preprocess # If cleaning up the Calling-Station-Id... rewrite_calling_station_id # If this is NOT 802.1x, assume mac-auth. We check this by testing # for the presence of the EAP-Message attribute in the request. if (!EAP-Message) { # Now check against the authorized_macs file authorized_macs if (!ok) { reject } else { # accept update control { Auth-Type := Accept } } } else { # Normal FreeRADIUS virtual server config goes here e.g. eap } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap digest eap } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } Thank you all for your help. Regards Andy

2 3

Freeradius configuration cannot be stored on a mapped Docker volume
by Timothy Weaver 23 Jan '24

23 Jan '24

When attempting to include a volume mapping to anything under either the /etc/raddb or /etc/freeradius container folders, the container crashes on startup. Despite the original ticket being closed as a Docker issue, the behavior does not occur with non Freeradius containers. For example, if the docker-compose.yml file includes: volumes: - ./freeradius:/etc/freeradius or volumes: - ./raddb:/etc/raddb This will not allow the container to start. Only a mapping to a specific file will work, but is sub-optimal because then you cannot persist anything in the mods-enabled folder. While the documentation explicitly handles this persistence with the `COPY raddb/ /etc/raddb/` line, it seems this is a workaround to supporting a very standard way of handling it in the docker-compose.yml.

4 5

LDAP group authorization with MSAD
by Nick Schmalenberger 23 Jan '24

23 Jan '24

I have Freeradius 3.0.20 from Ubuntu 20.04 working with bind as user to my Active Directory servers. https://freeradius.org/documentation/freeradius-server/3.2.4/concepts/modul… I’m hoping to use this for network equipment to have a centralized login system. I’m having trouble figuring out how, with only the username like user(a)example.com used for the authentication, how do I look up their group membership for authorization. In the below configuration files I have sanitized my company name. Here is my file /etc/freeradius/3.0/sites-enabled/netauth: # THIS FILE IS MANAGED BY ANSIBLE server netauth { listen { ipaddr = * port = 1814 type = auth } authorize { auth_log update control { LDAP-UserDN := "%{User-Name}(a)example.com" Auth-Type := LDAP } if (LDAP-Group == "techops") { update reply { Juniper-Local-User-Name := "techops" } } elsif (LDAP-Group == "obsmonitor") { update reply { Juniper-Local-User-Name := "monitor" } } else { reject } } authenticate { Auth-Type LDAP { ldap } } client 10-0-0-0-8 { ipaddr = 10.0.0.0/8 secret = xxxxxx } client 172-16-0-0-12 { ipaddr = 172.16.0.0/12 secret = xxxxxx } } Here is my file /etc/freeradius/3.0/mods-enabled/ldap # THIS FILE IS MANAGED BY ANSIBLE ldap { # use the HAProxy on this same host server = 'ldap://localhost' identity = 'CN=Ldap Readonly,OU=svc_accounts,OU=Service,OU=Example Users,DC=ad,DC=example,DC=com' password = 'yyyyyyyy' group { base_dn = 'OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com' filter = '(objectClass=group)' membership_filter = '' } } Here is the debug output during a successful login. The testobs user is in the "obsmonitor" group and NOT the "techops" group, but they are matching "techops" anyway I think because of membership_filter = "" ? I think membership_filter = "" allows any user to match the group, is that right? Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Received Access-Request Id 248 from 172.30.255.19:57489 to 10.30.0.229:1814 length 86 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) User-Name = "testobs" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) User-Password = "Example123!" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) NAS-Identifier = "sw102-2.sql1.corp" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Calling-Station-Id = "172.16.240.5" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) NAS-IP-Address = 172.30.255.19 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/netauth Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) authorize { Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) auth_log: --> /var/log/freeradius/radacct/172.30.255.19/auth-detail-20240123 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.255.19/auth-detail-20240123 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) auth_log: EXPAND %t Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) auth_log: --> Tue Jan 23 04:49:52 2024 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) [auth_log] = ok Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) update control { Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) EXPAND %{User-Name}(a)example.com Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) --> testobs(a)example.com Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) LDAP-UserDN := testobs(a)example.com Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Auth-Type := LDAP Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) } # update control = noop Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) if (LDAP-Group == "techops") { Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Searching for user in group "techops" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 154 seconds Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): You probably need to lower "min" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 154 seconds Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): You probably need to lower "min" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 154 seconds Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): You probably need to lower "min" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 154 seconds Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): You probably need to lower "min" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 154 seconds Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): You probably need to lower "min" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Opening additional connection (5), 1 of 10 pending slots used Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Connecting to ldap://localhost:389 Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Waiting for bind result... Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Bind successful Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Reserved connection (5) Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Using user DN from request "testobs(a)example.com" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Checking for user in group objects Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) EXPAND (&(cn=techops)(objectClass=group)) Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) --> (&(cn=techops)(objectClass=group)) Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Performing search in "OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com" with filter "(&(cn=techops)(objectClass=group))", scope "sub" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Waiting for search result... Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) User found in group object "OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Released connection (5) Jan 23 04:49:52 ldaps3 freeradius[2798965]: Need 4 more connections to reach min connections (5) Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Opening additional connection (6), 1 of 9 pending slots used Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Connecting to ldap://localhost:389 Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Waiting for bind result... Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Bind successful Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) if (LDAP-Group == "techops") -> TRUE Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) if (LDAP-Group == "techops") { Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) update reply { Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Juniper-Local-User-Name := "techops" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) } # update reply = noop Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) } # if (LDAP-Group == "techops") = noop Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ... skipping elsif: Preceding "if" was taken Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ... skipping else: Preceding "if" was taken Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) } # authorize = ok Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Found Auth-Type = LDAP Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/netauth Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Auth-Type LDAP { Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Reserved connection (5) Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ldap: Login attempt by "testobs" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ldap: Using user DN from request "testobs(a)example.com" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ldap: Waiting for bind result... Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ldap: Bind successful Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ldap: Bind as user "testobs(a)example.com" was successful Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Released connection (5) Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) [ldap] = ok Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) } # Auth-Type LDAP = ok Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Sent Access-Accept Id 248 from 10.30.0.229:1814 to 172.30.255.19:57489 length 0 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Juniper-Local-User-Name := "techops" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Finished request Jan 23 04:49:52 ldaps3 freeradius[2798965]: Waking up in 4.9 seconds. Jan 23 04:49:57 ldaps3 freeradius[2798965]: (0) Cleaning up request packet ID 248 with timestamp +154 Jan 23 04:49:57 ldaps3 freeradius[2798965]: Ready to process requests I read https://freeradius.org/documentation/freeradius-server/4.0.0/howto/modules/… explaining the different ways looking up groups with some different LDAP schemas. In my user definitions I have memberOf attributes like with the testobs user: memberOf: CN=obsmonitor,OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com I have member attributes in n the group definitions like with the obsmonitor group for the testobs user: member: CN=Observium Test,OU=OKTA Test Accounts,OU=Service,OU=Example Users,DC=ad,DC=example,DC=com I can use ldapsearch and binding as our read only LDAP user to query the group with a membership filter: nicks@eel:~$ ldapsearch -x -H ldaps://sjc-1.ldap.example.com -D "CN=Ldap Readonly,OU=svc_accounts,OU=Service,OU=Example Users,DC=ad,DC=example,DC=com" -W -b 'OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com' '(&(cn=obsmonitor)(objectClass=group)(member=CN=Observium Test,OU=OKTA Test Accounts,OU=Service,OU=Example Users,DC=ad,DC=example,DC=com))' Enter LDAP Password: # extended LDIF # # LDAPv3 # base <OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com> with scope subtree # filter: (&(cn=obsmonitor)(objectClass=group)(member=CN=Observium Test,OU=OKTA Test Accounts,OU=Service,OU=Example Users,DC=ad,DC=example,DC=com)) # requesting: ALL # # obsmonitor, LDAP PROXY, Global Groups, Users, Example Users, ad.example.com dn: CN=obsmonitor,OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC= ad,DC=example,DC=com objectClass: top objectClass: group cn: obsmonitor member: CN=Observium Test,OU=OKTA Test Accounts,OU=Service,OU=Example Users,DC =ad,DC=example,DC=com distinguishedName: CN=obsmonitor,OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Co nviva Users,DC=ad,DC=example,DC=com instanceType: 4 whenCreated: 20231125033343.0Z whenChanged: 20231125041833.0Z uSNCreated: 14442815 uSNChanged: 14442906 name: obsmonitor objectGUID:: /joNsBrPiUqDzN52+a7D0Q== objectSid:: AQUAAAAAAAUVAAAAaaNyTpKL8mVbop3/gVgAAA== sAMAccountName: obsmonitor sAMAccountType: 268435456 groupType: -2147483646 objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=ad,DC=example,DC=com dSCorePropagationData: 16010101000000.0Z # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 nicks@eel:~$ With binding as the original user though, it only seems to bind and doesn't seem to query the user object, so how can I get the user's DN to check group membership in this way and with my MSAD LDAP schema? Thank you! -Nick Schmalenberger

2 3

What exactly does the configuration of the policy subfield in the ca_default section of the ca.cnf file mean?
by 남혁준 23 Jan '24

23 Jan '24

I don't know if I can post questions frequently. I apologize in advance for your understanding. Also, thank you for answering my existing questions. I'm trying to figure out exactly what the certificate consists of. Currently, both certificate issuance and certificate authentication are available. However, while studying how to set it up "properly," I had a question about the ca.cnf file. As far as I can see, if you specify policy_match in the policy of server.cnf, it will be compared with the CA certificate based on the [policy_match] section to decide whether to generate it or not. However, the policy in ca.cnf Specifying policy_match and changing the settings in the policy_match section didn't cause any problems. What is the significance of this section's existence? PS) This is my first time using this site. Can I only receive emails about the questions I asked? Unless you opt out of receiving all emails, there is a problem because all posts are sent via email no matter what settings you change.

2 1

When performing the Authorize section using the REst module, is it possible to add a module failure message to the 403 response?
by 남혁준 23 Jan '24

23 Jan '24

First of all, please understand that I am not able to receive replies to existing questions due to incorrect system settings, so I cannot reply and am asking a new question. The link to the existing question is this. https://lists.freeradius.org/pipermail/freeradius-users/2024-January/104052… rlm_rest (rest): Reserved connection (2) (16) rest: Expanding URI components (16) rest: EXPAND http://0.0.0.0:9012 (16) rest: --> http://0.0.0.0:9012 (16) rest: EXPAND /auth/user/%{User-Name}?callingStationId=%{Calling-Station-Id}&calledStationId=%{Called-Station-Id}&eapType=%{EAP-Type} (16) rest: --> /auth/user/test?callingStationId=00-D7-B2-E6-FA-00&calledStationId=00-03-84-B6-00-CC%3Aradius%20122&eapType=PEAP (16) rest: Sending HTTP GET to " http://0.0.0.0:9012/auth/user/test?callingStationId=00-00-B0-E0-0A-80&calle… " (16) rest: Processing response header (16) rest: Status : 403 () (16) rest: Type : json (application/json) (16) rest: Adding reply:REST-HTTP-Status-Code = "403" (16) rest: ERROR: Server returned: (16) rest: ERROR: {"request:Module-Failure-Message":"add message but..."} rlm_rest (rest): Released connection (2) Need more connections to reach 10 spares rlm_rest (rest): Opening additional connection (6), 1 of 26 pending slots used rlm_rest (rest): Connecting to "http://0.0.0.0:9012" (16) [rest] = userlock (16) } # if (!&outer.session-state:Done-Rest) = userlock (16) } # authorize = userlock (16) Using Post-Auth-Type Reject (16) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (16) Post-Auth-Type REJECT { (16) update { (16) &Calling-Station-Id = &outer.request:Calling-Station-Id -> '00-00-00-00-00-00' (16) &Called-Station-Id = &outer.request:Called-Station-Id -> '00-03-00-00-00-00:radius' (16) &EAP-Type := &outer.request:EAP-Type -> PEAP (16) } # update = noop First of all, I am from Korea and it is difficult to translate what you are saying. The FreeRADIUS version I am using is 3.0.24. To summarize the question again, When performing the Authorize step in a Rest Module, is it possible to (rest.authorize) deliver a 403 HTTP Status Code response and a message and attach it to "Module-Failure-Message"? Alan DeKok said it was in "Sure" and in "rlm_rest.c". Probably "rlm_rest.c" is I think you mean "mods-enabled/rest". However, I find this module difficult to handle. No matter how many explanations I read, I couldn't find an answer to this. sorry. I guess it's hard for me to interpret Alan DeKok's answer because I'm not very smart. Is it “possible” or “I can figure it out if I read the description of this module.” Which of the two did you mean? Looking at the message you wrote later, I don't know whether you meant "It's possible" or "It's impossible and I'll think about it." I'm really sorry, but I wonder if what I want to do is possible. If possible, please explain in more detail what section I should refer to.

2 1

EAP-TLS Auth. Issues
by SENECAUX Ludovic 23 Jan '24

23 Jan '24

Hi, I'm having an issue with FreeRADIUS 3.2.3 and the EAP module. It doesn't take into account my private PKI. I have to set the reject_unknown_intermediate_ca parameter to no for EAP-TLS authentication to work. I have no issues with FreeRADIUS 3.0.x My server is running RHEL 8 and my OpenSSL version is 1.1.1K Thanks for your help, Regards, -- > mods-enabled/eap eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} md5 { } gtc { auth_type = PAP } tls-config tls-common { private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem ca_file = ${cadir}/chain.pem ca_path = ${cadir} reject_unknown_intermediate_ca = no cipher_list = "DEFAULT" cipher_server_preference = no tls_min_version = "1.2" tls_max_version = "1.2" ecdh_curve = "" cache { enable = no store { Tunnel-Private-Group-Id } } verify { } ocsp { enable = yes override_cert_url = no url = "http://127.0.0.1/ocsp/" } } tls { tls = tls-common } ttls { tls = tls-common default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } > ls -l certs total 32 lrwxrwxrwx. 1 root root 17 Jan 23 12:17 3377b39c.0 -> subca.pem lrwxrwxrwx. 1 root root 18 Jan 23 12:17 72f73b82.0 -> rootca.pem -rw-r-----. 1 root radiusd 4111 Jan 23 10:16 chain.pem -rw-r-----. 1 root radiusd 1818 Jan 23 10:17 rootca.pem -rw-r-----. 1 root radiusd 2293 Jan 23 10:17 subca.pem -rw-r-----. 1 root radiusd 1704 Jan 23 10:18 server.key -rw-r-----. 1 root radiusd 8567 Jan 23 10:18 server.pem > debug (if reject_unknown_intermediate_ca = yes) [...] Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /CN=SubCA (TLS) untrusted certificate with depth [0] subject name /CN=device tls: There are untrusted certificates in the certificate chain. Rejecting. (10) eap_tls: (TLS) send TLS 1.2 Alert, fatal internal_error (10) eap_tls: ERROR: (TLS) Alert write:fatal:internal error (10) eap_tls: ERROR: (TLS) Server : Error in error (10) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (10) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (10) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation (10) eap_tls: ERROR: [eaptls process] = fail (10) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (10) eap: Sending EAP Failure (code 4) ID 26 length 4 (10) eap: Failed in EAP select (10) [eap] = invalid (10) } # authenticate = invalid (10) Failed to authenticate the user (10) Using Post-Auth-Type Reject [...]

1 0