- Freeradius-Users - lists.freeradius.org

How to write log only once in Post-Auth-Type REJECT section of EAP module?
by 남혁준 30 Jan '24

30 Jan '24

great. Thank you for your reply. If you summarize your words update "session-state" in "INNER-SERVER", If this "session-state" is available in the Post-Auth REJECT section of "External-SERVER", use it. I understand what you wrote above. So can you please confirm why the comment I mentioned exists? My report said, "There is no reason. I just tried it and it worked." I can't say that. If I update "sesssion-state" in "INNER-SERVER" I actually get usable results as I want. However, the comment related to "session-state" in the Post-Auth REJECT section of "External-SERVER" says "It cannot be used." And what you mean by this is "it doesn't exist." He said. As a result, according to the comments and what you said, I shouldn't be able to use "session-state". But I'm confused because I can use "session-state". Can you explain why I can use it? (I may have misunderstood the comment or what you said.)

2 1

Crypt-Password
by Aurélio de Souza Ribeiro Neto 29 Jan '24

29 Jan '24

Hello All, I'm using FreeRadius and MySQL 5.7 with Crypt-Password and to generate the Crypt Password I'm using MySQL ENCRYPT function with salt. Now I'm trying to go to MySQL 8 and ENCRYPT function is deprecated! What I need to do to generate a salt password for freeradius? Any hint is apreciated. Thanks Aurelio

2 5

Failed reading certificate file error with freeradius container.
by Jonathan Gregoire 29 Jan '24

29 Jan '24

Hi, I'm having an issue when I try to run freeradius in a docker container. In the output that I pasted below, you will notice that I copied the "/etc/freeradius" directory on my host and that I mount the configuration directory $(pwd)/etc/freeradius on the container to make my configuration persistent. The problem is that no matter the permission I set on the $(pwd)/etc/freeradius/certs/server.pem file, I'm always getting an error when I launch the container: tls: (TLS) Failed reading certificate file "/etc/freeradius/certs/server.pem" Do you have an idea? How to reproduce: [root@dockerhost01 ~]# mkdir my-radius [root@dockerhost01 ~]# cd my-radius [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# docker run --privileged --rm --name freeradius -t -d \ > -p 1822-1823:1812-1813/udp \ > -p 1822-1823:1812-1813/tcp \ > freeradius/freeradius-server:3.2.3 -X cd01803e38363c512a67a47998401e180c76d2cbbc34713a527a2e61a74462a1 [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# mkdir etc [root@dockerhost01 my-radius]# docker cp -a freeradius:/etc/freeradius etc/freeradius Successfully copied 1.35MB to /root/my-radius/etc/freeradius [root@dockerhost01 my-radius]# docker stop freeradius freeradius [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# ls -ls etc/freeradius/ total 148 4 drwxr-s--x. 2 root root 4096 May 26 2023 certs 12 -rw-r-----. 1 root root 8323 May 26 2023 clients.conf 4 -rw-r--r--. 1 root root 1420 May 26 2023 dictionary 4 -rw-r-----. 1 root root 2661 May 26 2023 experimental.conf 0 lrwxrwxrwx. 1 root root 28 May 26 2023 hints -> mods-config/preprocess/hints 0 lrwxrwxrwx. 1 root root 33 May 26 2023 huntgroups -> mods-config/preprocess/huntgroups 4 drwxr-xr-x. 2 root root 4096 May 26 2023 mods-available 0 drwxr-xr-x. 11 root root 154 May 26 2023 mods-config 4 drwxr-xr-x. 2 root root 4096 May 26 2023 mods-enabled 4 -rw-r--r--. 1 root root 52 May 26 2023 panic.gdb 4 drwxr-s--x. 2 root root 4096 May 26 2023 policy.d 32 -rw-r-----. 1 root root 29779 May 26 2023 proxy.conf 32 -rw-r-----. 1 root root 30769 May 26 2023 radiusd.conf 24 -rw-r--r--. 1 root root 20754 May 26 2023 README.rst 4 drwxr-s--x. 2 root root 4096 May 26 2023 sites-available 0 drwxr-s--x. 2 root root 41 May 26 2023 sites-enabled 4 -rw-r--r--. 1 root root 3470 May 26 2023 templates.conf 12 -rw-r--r--. 1 root root 8536 May 26 2023 trigger.conf 0 lrwxrwxrwx. 1 root root 27 May 26 2023 users -> mods-config/files/authorize [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# docker run --privileged --rm --name freeradius -t \ > -p 1822-1823:1812-1813/udp \ > -p 1822-1823:1812-1813/tcp \ > -v $(pwd)/etc/freeradius:/etc/freeradius \ > freeradius/freeradius-server:3.2.3 -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A -----OUTPUT OMMITED----- ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } tls: (TLS) Failed reading certificate file "/etc/freeradius/certs/server.pem" tls: (TLS) error:8000000D:system library::Permission denied tls: (TLS) error:10080002:BIO routines::system lib tls: (TLS) error:0A080002:SSL routines::system lib rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to initialise rlm_eap_tls /etc/freeradius/mods-enabled/eap[14]: Instantiation failed for module "eap" [root@dockerhost01 my-radius]#

2 4

redis-ippool and multiple pools
by Miguel Berniz 29 Jan '24

29 Jan '24

Hi, I am having issues understanding how to pass &control.IP-Pool.Name to the module as I need to use different pools for dynamic assignment and fixed assignment for both fixed ip addresses and fixed subnets. If I just use a string with pool name in the module it works, but that way I understand I am limited to use a single pool. Relevant config sections are as follows: -default site recv Access-Request { update control { &Password.cleartext := %redis(hget, radcheck:%{User-Name}, Cleartext-Password) &IP-Pool.name := %redis(hget, radcheck:%{User-Name}, IP-Pool) } -redis_ippool redis_ippool { # # pool_name:: Name of the pool from which leases are allocated. # pool_name = &control.IP-Pool.Name -Example of redis monitor 1706399030.648328 [0 127.0.0.1:50284] "hget" "radcheck:test3" "Cleartext-Password" 1706399030.648554 [0 127.0.0.1:50284] "hget" "radcheck:test3" "IP-Pool" -Radius log (8) Packet-Type = Access-Request (8) Running 'recv Access-Request' from file /usr/local/etc/raddb/sites-enabled/default (8) recv Access-Request { (8) update control { (8) | redis (8) | %{User-Name} (8) | --> test3 (8) REDIS command arguments (8) Reserved connection (0) (8) [1] >>> Sending command(s) to 127.0.0.1:6379 (8) Executing command: hget (8) With arguments (8) [1] radcheck:test3 (8) [2] Cleartext-Password (8) [1] <<< Returned: success (8) Released connection (0) (8) | %redis({hget}{radcheck:, test3}{Cleartext-Password}) (8) | --> test (8) | redis (8) | %{User-Name} (8) | --> test3 (8) REDIS command arguments (8) Reserved connection (0) (8) [1] >>> Sending command(s) to 127.0.0.1:6379 (8) Executing command: hget (8) With arguments (8) [1] radcheck:test3 (8) [2] IP-Pool (8) [1] <<< Returned: success (8) Released connection (0) (8) | %redis({hget}{radcheck:, test3}{IP-Pool}) (8) | --> Dyn_Internet (8) &Password.cleartext := "test" (8) &IP-Pool.name := "Dyn_Internet" (8) } # update control (noop) (8) policy filter_username { (8) if (&State) { (8) | &State (8) | %exists() (8) | --> false (8) ... (8) } (8) elsif (&User-Name) { (8) | &User-Name (8) | %exists() (8) | --> true (8) if (&User-Name =~ / /) { (8) | =~ (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) ... (8) } (8) if (&User-Name =~ /@[^@]*@/ ) { (8) | =~ (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) ... (8) } (8) if (&User-Name =~ /\.\./ ) { (8) | =~ (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) ... (8) } (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)[^.]+(\.[^.]+)+$/)<mailto:/@[%5e.]+(\.%5b%5e.%5d+)+$/)>) { (8) | && (8) | =~ (8) | %logical_and() (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) | %logical_and(...) (8) ... (8) } (8) if (&User-Name =~ /\.$/) { (8) | =~ (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) ... (8) } (8) if (&User-Name =~ /(a)\./<mailto:/@\./>) { (8) | =~ (8) | &User-Name (8) | &User-Name (8) | --> test3 (8) | %reg_eq({test3}) (8) | --> false (8) ... (8) } (8) &session-state.Session-State-User-Name := test3 (8) } # elsif (&User-Name) (noop) (8) } # policy filter_username (noop) (8) chap (noop) (8) digest (noop) (8) pap - Setting &control.Auth-Type = pap (8) pap (updated) (8) } # recv Access-Request (updated) (8) Running 'authenticate pap' from file /usr/local/etc/raddb/sites-enabled/default (8) authenticate pap { (8) pap - Login attempt with password (8) pap - Using "known good" cleartext password Cleartext (8) pap - Comparing with "known-good" Cleartext (4) (8) pap - User authenticated successfully (8) pap (ok) (8) } # authenticate pap (ok) (8) Running 'send Access-Accept' from file /usr/local/etc/raddb/sites-enabled/default (8) send Access-Accept { (8) &reply += { (8) &Session-State-User-Name = test3 (8) } (8) ERROR: Failed to evaluate required module option pool_name = &control.IP-Pool.Name What I am missing? Thanks in advance. This message is intended only for the use of the individual to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure. If the reader of this message is not the intended recipient or an employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender and deleting the original document.

2 5

How to write log only once in Post-Auth-Type REJECT section of EAP module?
by 남혁준 29 Jan '24

29 Jan '24

hello. I'm using the EAP module. Additionally, the REST module is used in the inner-server. If you want to refuse authentication in this situation, the REST module responds with 401 and Module-Failure-Message. This Module-Failure-Message is then correctly delivered to the Post-Auth-Type REJECT section within "Inner-server". Because I had declared rest in this section, the post-auth API was being called correctly and writing logs. However, one additional requirement arose. Logs should also be written when the certificate is incorrect. I added rest to the Post-Auth-Type REJECT section in the default (with external EAP) file. When the certificate was incorrect, the Post-Auth-Type REJECT section of the external EAP was reached, and this was also logged correctly. However, the problem now arises in situations where "Internal EAP" is called. In "Internal EAP", the Post-Auth-Type REJECT REST module log occurs once and Post-Auth-Type REJECT REST module log occurs once in "External EAP". Now, the log has occurred a total of 2 times. “Internal EAP” is the message I sent, but “outer EAP” is the message generated by the EAP-PEAP module. message : "eap_peap: The users session was previously rejected: returning reject (again.)" Logs do not necessarily have to be written from "internal EAP". So I wanted to forward messages originating from the "inner EAP" to the "outer EAP" module and then use them in the Post-Auth-Type REJECT REST module. However, I could not find a way, and only the message generated by the EAP-PEAP module was always delivered as Module-Failure-Message. How do I accomplish what I want?

2 2

dynamic lookup of list entries
by James Potter 29 Jan '24

29 Jan '24

Hi all, Here is the situation I'm trying to get working with FreeRadius, but having tried a load of variations around this I'm still stuck. I have a list of sites with specific VLANs I'd like users to end up on: sites { 1 { vlan = 234 } 2 { vlan = 245 } } I then have some clients, each with a site assigned: client cli1 { ipaddr = 1.2.3.4 secret = asdfasdf site = 1 } I'd now like to assign the VLAN from sites, something like: post-auth { update reply { Tunnel-Private-Group-ID = ${sites[${client.site}].vlan} } } But I've not a found a way of looking up an entry in a map dynamically ${sites.1.vlan} works (gives 234) ${client.site} works (gives 1) But ${sites.${client.site}.vlan} (or variations) doesn't work for me Do you have a way of doing this? (Or a different approach? I've also tried embedding sites in clients by setting client{sites = ${sites.1} } - no banana either). I'm trying to avoid death by switch statement here, one org I work with has 120 sites Any help would be greatly appreciated Thanks, Jim Potter UK

3 5

Unifi AP with FreeRADIUS - INVALID AUTHENTICATOR
by Aneesh Raghavan 28 Jan '24

28 Jan '24

Hello, I am trying to set up FreeRADIUS with my unifi ap. The freeradius server is saying Access-Accept, but clients cannot connect and the ap is saying `No RADIUS RX handler found (type=0 code=2 id=21) [INVALID AUTHENTICATOR] - dropping packet`. A PSK wireless network on the same ap/network works fine. Here is my FreeRADIUS debug log output, which includes the config and the messages when it tries to connect: https://0x0.st/HDih.txt aneesh-mba is the client that I am testing with. Additionally, here is the debug log of the Unifi AP when it tries to connect: https://0x0.st/HDiC.txt Any help would be appreciated.

1 1

Freeradius service does not start
by Dumitru 26 Jan '24

26 Jan '24

Hello, I wanted to start Freeradius server for configuring access with client devices. After installing the Freeradius server the Freeradius service is active but sometimes after the new installation or after executing the systemctl status freeradius command the service is not active. The current output is: ● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; enabled; vendor preset: enabled) Active: activating (auto-restart) (Result: exit-code) since Tue 2024-01-23 07:54:55 CET; 2s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 24003 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=226/NAMESPACE) CPU: 15ms Before the new installation I uninstalled Freeradius with apt purge freeradius and apt autoremove. status=226/NAMESPACE - usually appears sometimes after new Freeradius server installation. Freeradius server sometimes starts after new installation, sometimes not. If the Freeradius service starts, after a while it stops and after running systemctl status freeradius on exit, the message : status=1/FAILURE instead of status=226/NAMESPACE compared to the output above. OS: "Raspbian GNU/Linux 11 (bullseye) Below I place the debug output : radiusd -X 2>&1 | tee debugfileFreeRADIUS Version 3.0.21Copyright (C) 1999-2019 The FreeRADIUS server project and contributorsThere is NO warranty; not even for MERCHANTABILITY or FITNESS FOR APARTICULAR PURPOSEYou may redistribute copies of FreeRADIUS under the terms of theGNU General Public LicenseFor more information about these matters, see the file named COPYRIGHTStarting - reading configuration files ...including dictionary file /usr/share/freeradius/dictionaryincluding dictionary file /usr/share/freeradius/dictionary.dhcpincluding dictionary file /usr/share/freeradius/dictionary.vqpincluding dictionary file /etc/freeradius/3.0/dictionaryincluding configuration file /etc/freeradius/3.0/radiusd.confincluding configuration file /etc/freeradius/3.0/proxy.confincluding configuration file /etc/freeradius/3.0/clients.confincluding files in directory /etc/freeradius/3.0/mods-enabled/including configuration file /etc/freeradius/3.0/mods-enabled/expirationincluding configuration file /etc/freeradius/3.0/mods-enabled/alwaysincluding configuration file /etc/freeradius/3.0/mods-enabled/detail.logincluding configuration file /etc/freeradius/3.0/mods-enabled/passwdincluding configuration file /etc/freeradius/3.0/mods-enabled/papincluding configuration file /etc/freeradius/3.0/mods-enabled/ntlm_authincluding configuration file /etc/freeradius/3.0/mods-enabled/echoincluding configuration file /etc/freeradius/3.0/mods-enabled/radutmpincluding configuration file /etc/freeradius/3.0/mods-enabled/digestincluding configuration file /etc/freeradius/3.0/mods-enabled/utf8including configuration file /etc/freeradius/3.0/mods-enabled/sradutmpincluding configuration file /etc/freeradius/3.0/mods-enabled/sohincluding configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clientsincluding configuration file /etc/freeradius/3.0/mods-enabled/cache_eapincluding configuration file /etc/freeradius/3.0/mods-enabled/attr_filterincluding configuration file /etc/freeradius/3.0/mods-enabled/eapincluding configuration file /etc/freeradius/3.0/mods-enabled/mschapincluding configuration file /etc/freeradius/3.0/mods-enabled/replicateincluding configuration file /etc/freeradius/3.0/mods-enabled/logintimeincluding configuration file /etc/freeradius/3.0/mods-enabled/realmincluding configuration file /etc/freeradius/3.0/mods-enabled/execincluding configuration file /etc/freeradius/3.0/mods-enabled/filesincluding configuration file /etc/freeradius/3.0/mods-enabled/unpackincluding configuration file /etc/freeradius/3.0/mods-enabled/linelogincluding configuration file /etc/freeradius/3.0/mods-enabled/unixincluding configuration file /etc/freeradius/3.0/mods-enabled/detailincluding configuration file /etc/freeradius/3.0/mods-enabled/chapincluding configuration file /etc/freeradius/3.0/mods-enabled/exprincluding configuration file /etc/freeradius/3.0/mods-enabled/preprocessincluding files in directory /etc/freeradius/3.0/policy.d/including configuration file /etc/freeradius/3.0/policy.d/abfab-trincluding configuration file /etc/freeradius/3.0/policy.d/cuiincluding configuration file /etc/freeradius/3.0/policy.d/operator-nameincluding configuration file /etc/freeradius/3.0/policy.d/filterincluding configuration file /etc/freeradius/3.0/policy.d/dhcpincluding configuration file /etc/freeradius/3.0/policy.d/accountingincluding configuration file /etc/freeradius/3.0/policy.d/debugincluding configuration file /etc/freeradius/3.0/policy.d/eapincluding configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-idsincluding configuration file /etc/freeradius/3.0/policy.d/controlincluding configuration file /etc/freeradius/3.0/policy.d/canonicalizationincluding configuration file /etc/freeradius/3.0/policy.d/rfc7542including files in directory /etc/freeradius/3.0/sites-enabled/including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnelincluding configuration file /etc/freeradius/3.0/sites-enabled/defaultmain { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius"}main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes }}radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { }radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 10.17.30.250 { ipv4addr = 10.17.30.250 require_message_authenticator = no secret = <<< secret >>> shortname = "rdses1013-2" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } }Debugger not attachedsystemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digestradiusd: #### Instantiating modules #### modules { # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" }Creating attribute Unix-Group # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } instantiate { } # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.logrlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwdrlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eaprlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filterreading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" disable_tlsv1 = yes disable_tlsv1_1 = yes tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } }Please use tls_min_version and tls_max_version instead of disable_tlsv1Please use tls_min_version and tls_max_version instead of disable_tlsv1_2 # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no }tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no }tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschaprlm_mschap (mschap): using internal authentication # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/filesreading pairlist file /etc/freeradius/3.0/mods-config/files/authorizereading pairlist file /etc/freeradius/3.0/mods-config/files/accountingreading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocessreading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroupsreading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints } # modulesradiusd: #### Loading Virtual Servers ####server { # from file /etc/freeradius/3.0/radiusd.conf} # serverserver inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...}Ignoring "sql" (see raddb/mods-available/README.rst)Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336} # server inner-tunnelserver default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...}} # server defaultradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnelListening on auth address * port 1812 bound to server defaultListening on acct address * port 1813 bound to server defaultListening on proxy address * port 39219Ready to process requests Best Regards.

2 4

Startup Fails with "No such file or directory" for sql queries.conf
by Timothy Weaver 25 Jan '24

25 Jan '24

Hi, I am attempting to use the FreeRADIUS Docker container, but when I try to include the mysql configuration the server fails to start with the following errors: .... including configuration file /etc/freeradius/mods-enabled/sql including configuration file /etc/freeradius/mods-config/sql/main/mysql/queries.conf} Unable to open file "/etc/freeradius/mods-config/sql/main/mysql/queries.conf}": No such file or directory Errors reading or parsing /etc/freeradius/radiusd.conf -------------------------- Here's what I've confirmed: 1. I am using a totally vanilla configuration from the Docker quick start instructions with no changes except to enable MySQL as the datastore. 2. The queries.conf file is present and permissions are correct. 3. Confirmed the database sql has been created with the schema under mods-config/sql/main/mysql/schema.sql 4. Confirmed the MySQL database is accessible with configuration parameters in the mod-available/sql file. Used mysql client to confirm with radius user and grants to all tables in the radius database. 5. In the mods-enabled/sql (linked to mods-available/sql)I have changed: * driver = "rlm_sql_null" to driver = "rlm_sql_mysql" * commented out the TLS section under mysql * confirmed the connection parameters for server, port, login, and password (see #4 above) * confirmed radius_db is set to the correct database name (I used "radius"). * uncommented read_clients = yes * ensured client_table = "nas" is uncommented * confirmed Dockerfile ------------- FROM freeradius/freeradius-server:latest COPY raddb/ /etc/freeradius/ Build ------- docker build -t freeradius -f Dockerfile . docker-compose.yml ---------------------------- version: "3" services: freeradius: image: freeradius:latest container_name: freeradius hostname: freeradius restart: always environment: - TZ="America/Los_Angeles" volumes: - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro

2 1

IPV6-Address accounting
by Hefin James [ahj] (Staff) 25 Jan '24

25 Jan '24

Hello, Quick question. We're currently using linelog to forward accounting information to our firewall for ip<->username matching, which has been working well for years. We've now got a test deployment of IPv6, and I need to do the same ipv6<->username matching. I've got it working, but only to 1 IPv6 address, when there could be many (as shown with the file based accounting log). Is there a way to run through the array of IPv6 addresses and getting a syslog line per IPv6 address? Thu Jan 25 09:41:48 2024 Framed-IP-Address = XXX.XXX.21.202 Framed-IPv6-Address = X:X:X:X:484d:9d72:e002:f00f Framed-IPv6-Address = X:X:X:X:b036:8ae5:2b04:1e52 Framed-IPv6-Address = fe80::30da:576d:c62d:2870 User-Name = "YYYY" Any pointers greatly appreciated. Thanks, Hefin

3 2