- Freeradius-Users - lists.freeradius.org

Is it possible to specify a message in the 403 response in Rest Module?
by 남혁준 25 Jan '24

25 Jan '24

First of all, I would like to inform you that the problem is not that I cannot be authenticated or that I cannot set it up. I mainly use the Rest module. So, I tried to use 401 and 403 separately as response types. In the case of a 401 response, it says "Use the body" and the message I responded to is parsed correctly. For 403 responses, the body is "not used." It says. Perhaps for that reason, no matter what response I send, it doesn't have much meaning. However, I confirmed that "Module-Failure-Message" in the 403 response contained the message "rest: Server returned:". It looks like it could be connected by conveying an additional message. If possible, I want the message to be delivered together and appended to the end, even if it responds with a 403 rejection. ex) rest: Server returned: Sorry, Server Reject" Is this possible behavior?

6 26

Mac-Auth or 802.1x
by Alpers, Andreas 24 Jan '24

24 Jan '24

Hello, My experience with Freeradius is still in the beginning. My requirements in the first step are not very high. I want to configure Freeradius so that users can be authenticated via 802.1x or via MAC-Auth. I followed these instructions exactly: https://wiki.freeradius.org/guide/mac-auth#mac-auth-or-802-1x Unfortunately, it does not work. I have created a username and password and also entered a Mac address in the file. But neither the user nor the Mac address work. I always get a reject, although it should work according to the instructions. I get the following answer when I run radtest: radtest andreas andreas123 127.0.0.1 1812 testing123 Sent Access-Request Id 123 from 0.0.0.0:51323 to 127.0.0.1:1812 length 77 User-Name = "andreas" User-Password = "andreas123" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "andreas123" Received Access-Reject Id 123 from 127.0.0.1:1812 to 127.0.0.1:51323 length 20 (0) -: Expected Access-Accept got Access-Reject Here are the individual files. I am very grateful for any help. /etc/freeradius/3.0/mods-available/files: files { moddir = ${modconfdir}/${.:instance} filename = ${moddir}/authorize acctusersfile = ${moddir}/accounting preproxy_usersfile = ${moddir}/pre-proxy } files authorized_macs { key = "%{Calling-Station-ID}" usersfile = ${confdir}/authorized_macs } # The instructions also say here # compat = no # but if I leave this in, I get an error message and the server no longer starts. Why does this happen? /etc/freeradius/3.0/authorized_macs 00-11-22-33-44-55 Reply-Message = "Device with MAC Address %{Calling-Station-Id} authorized for network access" /etc/freeradius/3.0/sites-available/default server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { preprocess # If cleaning up the Calling-Station-Id... rewrite_calling_station_id # If this is NOT 802.1x, assume mac-auth. We check this by testing # for the presence of the EAP-Message attribute in the request. if (!EAP-Message) { # Now check against the authorized_macs file authorized_macs if (!ok) { reject } else { # accept update control { Auth-Type := Accept } } } else { # Normal FreeRADIUS virtual server config goes here e.g. eap } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap digest eap } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } Thank you all for your help. Regards Andy

2 3

Freeradius configuration cannot be stored on a mapped Docker volume
by Timothy Weaver 23 Jan '24

23 Jan '24

When attempting to include a volume mapping to anything under either the /etc/raddb or /etc/freeradius container folders, the container crashes on startup. Despite the original ticket being closed as a Docker issue, the behavior does not occur with non Freeradius containers. For example, if the docker-compose.yml file includes: volumes: - ./freeradius:/etc/freeradius or volumes: - ./raddb:/etc/raddb This will not allow the container to start. Only a mapping to a specific file will work, but is sub-optimal because then you cannot persist anything in the mods-enabled folder. While the documentation explicitly handles this persistence with the `COPY raddb/ /etc/raddb/` line, it seems this is a workaround to supporting a very standard way of handling it in the docker-compose.yml.

4 5

LDAP group authorization with MSAD
by Nick Schmalenberger 23 Jan '24

23 Jan '24

I have Freeradius 3.0.20 from Ubuntu 20.04 working with bind as user to my Active Directory servers. https://freeradius.org/documentation/freeradius-server/3.2.4/concepts/modul… I’m hoping to use this for network equipment to have a centralized login system. I’m having trouble figuring out how, with only the username like user(a)example.com used for the authentication, how do I look up their group membership for authorization. In the below configuration files I have sanitized my company name. Here is my file /etc/freeradius/3.0/sites-enabled/netauth: # THIS FILE IS MANAGED BY ANSIBLE server netauth { listen { ipaddr = * port = 1814 type = auth } authorize { auth_log update control { LDAP-UserDN := "%{User-Name}(a)example.com" Auth-Type := LDAP } if (LDAP-Group == "techops") { update reply { Juniper-Local-User-Name := "techops" } } elsif (LDAP-Group == "obsmonitor") { update reply { Juniper-Local-User-Name := "monitor" } } else { reject } } authenticate { Auth-Type LDAP { ldap } } client 10-0-0-0-8 { ipaddr = 10.0.0.0/8 secret = xxxxxx } client 172-16-0-0-12 { ipaddr = 172.16.0.0/12 secret = xxxxxx } } Here is my file /etc/freeradius/3.0/mods-enabled/ldap # THIS FILE IS MANAGED BY ANSIBLE ldap { # use the HAProxy on this same host server = 'ldap://localhost' identity = 'CN=Ldap Readonly,OU=svc_accounts,OU=Service,OU=Example Users,DC=ad,DC=example,DC=com' password = 'yyyyyyyy' group { base_dn = 'OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com' filter = '(objectClass=group)' membership_filter = '' } } Here is the debug output during a successful login. The testobs user is in the "obsmonitor" group and NOT the "techops" group, but they are matching "techops" anyway I think because of membership_filter = "" ? I think membership_filter = "" allows any user to match the group, is that right? Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Received Access-Request Id 248 from 172.30.255.19:57489 to 10.30.0.229:1814 length 86 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) User-Name = "testobs" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) User-Password = "Example123!" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) NAS-Identifier = "sw102-2.sql1.corp" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Calling-Station-Id = "172.16.240.5" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) NAS-IP-Address = 172.30.255.19 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/netauth Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) authorize { Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) auth_log: --> /var/log/freeradius/radacct/172.30.255.19/auth-detail-20240123 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.255.19/auth-detail-20240123 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) auth_log: EXPAND %t Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) auth_log: --> Tue Jan 23 04:49:52 2024 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) [auth_log] = ok Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) update control { Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) EXPAND %{User-Name}(a)example.com Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) --> testobs(a)example.com Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) LDAP-UserDN := testobs(a)example.com Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Auth-Type := LDAP Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) } # update control = noop Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) if (LDAP-Group == "techops") { Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Searching for user in group "techops" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 154 seconds Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): You probably need to lower "min" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 154 seconds Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): You probably need to lower "min" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 154 seconds Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): You probably need to lower "min" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 154 seconds Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): You probably need to lower "min" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 154 seconds Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): You probably need to lower "min" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Opening additional connection (5), 1 of 10 pending slots used Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Connecting to ldap://localhost:389 Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Waiting for bind result... Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Bind successful Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Reserved connection (5) Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Using user DN from request "testobs(a)example.com" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Checking for user in group objects Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) EXPAND (&(cn=techops)(objectClass=group)) Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) --> (&(cn=techops)(objectClass=group)) Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Performing search in "OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com" with filter "(&(cn=techops)(objectClass=group))", scope "sub" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Waiting for search result... Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) User found in group object "OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com" Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Released connection (5) Jan 23 04:49:52 ldaps3 freeradius[2798965]: Need 4 more connections to reach min connections (5) Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Opening additional connection (6), 1 of 9 pending slots used Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Connecting to ldap://localhost:389 Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Waiting for bind result... Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Bind successful Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) if (LDAP-Group == "techops") -> TRUE Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) if (LDAP-Group == "techops") { Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) update reply { Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Juniper-Local-User-Name := "techops" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) } # update reply = noop Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) } # if (LDAP-Group == "techops") = noop Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ... skipping elsif: Preceding "if" was taken Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ... skipping else: Preceding "if" was taken Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) } # authorize = ok Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Found Auth-Type = LDAP Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/netauth Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Auth-Type LDAP { Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Reserved connection (5) Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ldap: Login attempt by "testobs" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ldap: Using user DN from request "testobs(a)example.com" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ldap: Waiting for bind result... Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ldap: Bind successful Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) ldap: Bind as user "testobs(a)example.com" was successful Jan 23 04:49:52 ldaps3 freeradius[2798965]: rlm_ldap (ldap): Released connection (5) Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) [ldap] = ok Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) } # Auth-Type LDAP = ok Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Sent Access-Accept Id 248 from 10.30.0.229:1814 to 172.30.255.19:57489 length 0 Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Juniper-Local-User-Name := "techops" Jan 23 04:49:52 ldaps3 freeradius[2798965]: (0) Finished request Jan 23 04:49:52 ldaps3 freeradius[2798965]: Waking up in 4.9 seconds. Jan 23 04:49:57 ldaps3 freeradius[2798965]: (0) Cleaning up request packet ID 248 with timestamp +154 Jan 23 04:49:57 ldaps3 freeradius[2798965]: Ready to process requests I read https://freeradius.org/documentation/freeradius-server/4.0.0/howto/modules/… explaining the different ways looking up groups with some different LDAP schemas. In my user definitions I have memberOf attributes like with the testobs user: memberOf: CN=obsmonitor,OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com I have member attributes in n the group definitions like with the obsmonitor group for the testobs user: member: CN=Observium Test,OU=OKTA Test Accounts,OU=Service,OU=Example Users,DC=ad,DC=example,DC=com I can use ldapsearch and binding as our read only LDAP user to query the group with a membership filter: nicks@eel:~$ ldapsearch -x -H ldaps://sjc-1.ldap.example.com -D "CN=Ldap Readonly,OU=svc_accounts,OU=Service,OU=Example Users,DC=ad,DC=example,DC=com" -W -b 'OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com' '(&(cn=obsmonitor)(objectClass=group)(member=CN=Observium Test,OU=OKTA Test Accounts,OU=Service,OU=Example Users,DC=ad,DC=example,DC=com))' Enter LDAP Password: # extended LDIF # # LDAPv3 # base <OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC=ad,DC=example,DC=com> with scope subtree # filter: (&(cn=obsmonitor)(objectClass=group)(member=CN=Observium Test,OU=OKTA Test Accounts,OU=Service,OU=Example Users,DC=ad,DC=example,DC=com)) # requesting: ALL # # obsmonitor, LDAP PROXY, Global Groups, Users, Example Users, ad.example.com dn: CN=obsmonitor,OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Example Users,DC= ad,DC=example,DC=com objectClass: top objectClass: group cn: obsmonitor member: CN=Observium Test,OU=OKTA Test Accounts,OU=Service,OU=Example Users,DC =ad,DC=example,DC=com distinguishedName: CN=obsmonitor,OU=LDAP PROXY,OU=Global Groups,OU=Users,OU=Co nviva Users,DC=ad,DC=example,DC=com instanceType: 4 whenCreated: 20231125033343.0Z whenChanged: 20231125041833.0Z uSNCreated: 14442815 uSNChanged: 14442906 name: obsmonitor objectGUID:: /joNsBrPiUqDzN52+a7D0Q== objectSid:: AQUAAAAAAAUVAAAAaaNyTpKL8mVbop3/gVgAAA== sAMAccountName: obsmonitor sAMAccountType: 268435456 groupType: -2147483646 objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=ad,DC=example,DC=com dSCorePropagationData: 16010101000000.0Z # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 nicks@eel:~$ With binding as the original user though, it only seems to bind and doesn't seem to query the user object, so how can I get the user's DN to check group membership in this way and with my MSAD LDAP schema? Thank you! -Nick Schmalenberger

2 3

What exactly does the configuration of the policy subfield in the ca_default section of the ca.cnf file mean?
by 남혁준 23 Jan '24

23 Jan '24

I don't know if I can post questions frequently. I apologize in advance for your understanding. Also, thank you for answering my existing questions. I'm trying to figure out exactly what the certificate consists of. Currently, both certificate issuance and certificate authentication are available. However, while studying how to set it up "properly," I had a question about the ca.cnf file. As far as I can see, if you specify policy_match in the policy of server.cnf, it will be compared with the CA certificate based on the [policy_match] section to decide whether to generate it or not. However, the policy in ca.cnf Specifying policy_match and changing the settings in the policy_match section didn't cause any problems. What is the significance of this section's existence? PS) This is my first time using this site. Can I only receive emails about the questions I asked? Unless you opt out of receiving all emails, there is a problem because all posts are sent via email no matter what settings you change.

2 1

When performing the Authorize section using the REst module, is it possible to add a module failure message to the 403 response?
by 남혁준 23 Jan '24

23 Jan '24

First of all, please understand that I am not able to receive replies to existing questions due to incorrect system settings, so I cannot reply and am asking a new question. The link to the existing question is this. https://lists.freeradius.org/pipermail/freeradius-users/2024-January/104052… rlm_rest (rest): Reserved connection (2) (16) rest: Expanding URI components (16) rest: EXPAND http://0.0.0.0:9012 (16) rest: --> http://0.0.0.0:9012 (16) rest: EXPAND /auth/user/%{User-Name}?callingStationId=%{Calling-Station-Id}&calledStationId=%{Called-Station-Id}&eapType=%{EAP-Type} (16) rest: --> /auth/user/test?callingStationId=00-D7-B2-E6-FA-00&calledStationId=00-03-84-B6-00-CC%3Aradius%20122&eapType=PEAP (16) rest: Sending HTTP GET to " http://0.0.0.0:9012/auth/user/test?callingStationId=00-00-B0-E0-0A-80&calle… " (16) rest: Processing response header (16) rest: Status : 403 () (16) rest: Type : json (application/json) (16) rest: Adding reply:REST-HTTP-Status-Code = "403" (16) rest: ERROR: Server returned: (16) rest: ERROR: {"request:Module-Failure-Message":"add message but..."} rlm_rest (rest): Released connection (2) Need more connections to reach 10 spares rlm_rest (rest): Opening additional connection (6), 1 of 26 pending slots used rlm_rest (rest): Connecting to "http://0.0.0.0:9012" (16) [rest] = userlock (16) } # if (!&outer.session-state:Done-Rest) = userlock (16) } # authorize = userlock (16) Using Post-Auth-Type Reject (16) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (16) Post-Auth-Type REJECT { (16) update { (16) &Calling-Station-Id = &outer.request:Calling-Station-Id -> '00-00-00-00-00-00' (16) &Called-Station-Id = &outer.request:Called-Station-Id -> '00-03-00-00-00-00:radius' (16) &EAP-Type := &outer.request:EAP-Type -> PEAP (16) } # update = noop First of all, I am from Korea and it is difficult to translate what you are saying. The FreeRADIUS version I am using is 3.0.24. To summarize the question again, When performing the Authorize step in a Rest Module, is it possible to (rest.authorize) deliver a 403 HTTP Status Code response and a message and attach it to "Module-Failure-Message"? Alan DeKok said it was in "Sure" and in "rlm_rest.c". Probably "rlm_rest.c" is I think you mean "mods-enabled/rest". However, I find this module difficult to handle. No matter how many explanations I read, I couldn't find an answer to this. sorry. I guess it's hard for me to interpret Alan DeKok's answer because I'm not very smart. Is it “possible” or “I can figure it out if I read the description of this module.” Which of the two did you mean? Looking at the message you wrote later, I don't know whether you meant "It's possible" or "It's impossible and I'll think about it." I'm really sorry, but I wonder if what I want to do is possible. If possible, please explain in more detail what section I should refer to.

2 1

EAP-TLS Auth. Issues
by SENECAUX Ludovic 23 Jan '24

23 Jan '24

Hi, I'm having an issue with FreeRADIUS 3.2.3 and the EAP module. It doesn't take into account my private PKI. I have to set the reject_unknown_intermediate_ca parameter to no for EAP-TLS authentication to work. I have no issues with FreeRADIUS 3.0.x My server is running RHEL 8 and my OpenSSL version is 1.1.1K Thanks for your help, Regards, -- > mods-enabled/eap eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} md5 { } gtc { auth_type = PAP } tls-config tls-common { private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem ca_file = ${cadir}/chain.pem ca_path = ${cadir} reject_unknown_intermediate_ca = no cipher_list = "DEFAULT" cipher_server_preference = no tls_min_version = "1.2" tls_max_version = "1.2" ecdh_curve = "" cache { enable = no store { Tunnel-Private-Group-Id } } verify { } ocsp { enable = yes override_cert_url = no url = "http://127.0.0.1/ocsp/" } } tls { tls = tls-common } ttls { tls = tls-common default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } > ls -l certs total 32 lrwxrwxrwx. 1 root root 17 Jan 23 12:17 3377b39c.0 -> subca.pem lrwxrwxrwx. 1 root root 18 Jan 23 12:17 72f73b82.0 -> rootca.pem -rw-r-----. 1 root radiusd 4111 Jan 23 10:16 chain.pem -rw-r-----. 1 root radiusd 1818 Jan 23 10:17 rootca.pem -rw-r-----. 1 root radiusd 2293 Jan 23 10:17 subca.pem -rw-r-----. 1 root radiusd 1704 Jan 23 10:18 server.key -rw-r-----. 1 root radiusd 8567 Jan 23 10:18 server.pem > debug (if reject_unknown_intermediate_ca = yes) [...] Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /CN=SubCA (TLS) untrusted certificate with depth [0] subject name /CN=device tls: There are untrusted certificates in the certificate chain. Rejecting. (10) eap_tls: (TLS) send TLS 1.2 Alert, fatal internal_error (10) eap_tls: ERROR: (TLS) Alert write:fatal:internal error (10) eap_tls: ERROR: (TLS) Server : Error in error (10) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (10) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (10) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation (10) eap_tls: ERROR: [eaptls process] = fail (10) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (10) eap: Sending EAP Failure (code 4) ID 26 length 4 (10) eap: Failed in EAP select (10) [eap] = invalid (10) } # authenticate = invalid (10) Failed to authenticate the user (10) Using Post-Auth-Type Reject [...]

1 0

tls: Using cached TLS configuration from previous invocation
by Jack Carter 23 Jan '24

23 Jan '24

Hi there, I’m pretty new to FreeRADIUS but so far it’s working well for me. I have been running it on a Raspberry Pi 4 running Bookworm (FreeRADIUS Version 3.2.1) but wanted to run on my two HA Raspberry Pi Network Tools Pi 3B+’s running Bullseye (FreeRADIUS Version 3.0.21). Config had been running great on the Pi 4 so I copied the contents of the following and pasted it into the same files running on the Pi 3. /etc/freeradius/3.0/mods-enabled/eap /etc/freeradius/3.0/clients.conf /etc/freeradius/3.0/users All seems well and when I test the PEAP config for my WiFi it all works as expected… however, I am seeing the below logged in the service status which differs considerably from the Pi 4. Why would it not be taking my TLS config and instead using the cached from previous invocation? Do I need to be worried or is everything running as it should? ——————————————— ● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2024-01-23 00:35:01 GMT; 42min ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 163580 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS) Process: 186968 ExecReload=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cxm -lstdout (code=exited, status=0/SUCCESS) Process: 186969 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS) Main PID: 163581 (freeradius) Status: "Processing requests" Tasks: 6 (limit: 779) CPU: 1.450s CGroup: /system.slice/freeradius.service └─163581 /usr/sbin/freeradius -f Jan 23 01:17:04 3kl-ns-01 freeradius[186968]: rlm_mschap (mschap): using internal authentication Jan 23 01:17:04 3kl-ns-01 freeradius[186968]: rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked Jan 23 01:17:04 3kl-ns-01 freeradius[186968]: tls: Using cached TLS configuration from previous invocation Jan 23 01:17:04 3kl-ns-01 freeradius[186968]: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output Jan 23 01:17:04 3kl-ns-01 freeradius[186968]: Ignoring "sql" (see raddb/mods-available/README.rst) Jan 23 01:17:04 3kl-ns-01 freeradius[186968]: Ignoring "ldap" (see raddb/mods-available/README.rst) Jan 23 01:17:04 3kl-ns-01 freeradius[186968]: # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336 Jan 23 01:17:04 3kl-ns-01 freeradius[186968]: radiusd: #### Skipping IP addresses and Ports #### Jan 23 01:17:04 3kl-ns-01 freeradius[186968]: Configuration appears to be OK Jan 23 01:17:04 3kl-ns-01 systemd[1]: Reloaded FreeRADIUS multi-protocol policy server. ——————————————— Any assistance would be much appreciated. Many thanks in advance, Jack Output from freeradius -X: FreeRADIUS Version 3.0.21 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/realm including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/rfc7542 including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/eap including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 3KL-Management { ipaddr = 10.165.11.0/27 require_message_authenticator = yes secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } instantiate { } # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "HIGH" ecdh_curve = "prime256v1" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-peap" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls-config tls-peap { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/letsencrypt/privkey.pem" certificate_file = "/etc/freeradius/3.0/certs/letsencrypt/fullchain.pem" dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "HIGH" ecdh_curve = "prime256v1" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336 } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 Failed binding to auth address 127.0.0.1 port 18120 bound to server inner-tunnel: Address already in use /etc/freeradius/3.0/sites-enabled/inner-tunnel[33]: Error binding to port for 127.0.0.1 port 18120

2 1

Redis in Freeradius v4
by Miguel Berniz 22 Jan '24

22 Jan '24

Hi, I was using redis module for authentication using this in authorization section of the default site: update control { Cleartext-Password := "%{redis:hget radcheck:%{User-Name} \"Cleartext-Password\"}" } However, this no longer works in FreeRADIUS version 4.0.32319 (git #f7582607) What would be the new mechanism to achieve above? I am trying to move to v4 because the redis sqlippool module. Thanks in advance. Miguel This message is intended only for the use of the individual to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure. If the reader of this message is not the intended recipient or an employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender and deleting the original document.

2 3

Reject authorization if realm is not found
by filip.m.nikolic＠roamingnetworks.rs 22 Jan '24

22 Jan '24

Dear, I need your help regarding one challenge that I have. I created several realms on my radius. And now I am testing establishing of session with account with realm that is not defined on radius (In proxy.conf) How can I reject this type of the authorization if I am getting this type of message. It is in authorize section: authorize { (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "example.com" for User-Name = test(a)example.com <mailto:test@example.com> (0) suffix: No such realm "example.com" (0) [suffix] = noop I want here to reject authorization 😊 Thanks in advance for your response, Filip

2 1