- Freeradius-Users - lists.freeradius.org

Auth with Agent Remote ID
by Florian Traxler (mieX GmbH) 16 Nov '23

16 Nov '23

Hello! I use FreeRADIUS version 3.0.20 and would like to allow the user to authenticate using "Agent Remote ID". Is there a way to supplement the configuration according to this parameter "access-accept". Thanks for the support.

2 3

set up tls configuration
by Andrei Katsuk 14 Nov '23

14 Nov '23

Hi, I want to set ca_file in the tls config section to env variable as follows: tls { ca_file = $ENV{LDAP_CERT} } and skip it if $ENV{LDAP_CERT} is empty. If it is empty FreeRADIUS shows next error: =========== Unable to check file "": No such file or directory /etc/raddb/mods-enabled/ldap[488]: Failed parsing configuration item "ca_file" ================ How can I skip it in this case? Andrei

2 1

EAP-TLS with CRLs broken on RHEL 8.8
by Fraser Hess 13 Nov '23

13 Nov '23

We have a working FreeRADIUS implementation. It is configured for EAP-TLS. Our production systems use stock rpms for FreeRADIUS and OpenSSL on CentOS 7.9. Current RPMs: freeradius-3.0.13-15.el7.x86_64 and openssl-1.0.2k-26.el7_9.x86_64 We are moving to Red Hat Enterprise Linux 8.8. We built a test system from scratch, installed our RADIUS config and our tests failed. The RPMs in RHEL 8.8 are: freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.x86_64 and openssl-1.1.1k-9.el8_7.x86_64 The failure occurs in CRL checking. With check_crl = yes and check_all_crl = yes, FreeRADIUS is unable to find our root CA's CRL to validate the intermediate CA. Setting either check_crl or check_all_crl to no resolves the issue. (8) eap_tls: TLS-Cert-Serial := "XXX" (8) eap_tls: TLS-Cert-Expiration := "250901211201Z" (8) eap_tls: TLS-Cert-Subject := "/C=US/O=Organization/CN=Organization Intermediate CA" (8) eap_tls: TLS-Cert-Issuer := "/C=US/O=Organization/CN=Organization Root CA" (8) eap_tls: TLS-Cert-Common-Name := "Organization Intermediate CA" (8) eap_tls: ERROR: SSL says error 3 : unable to get certificate CRL (8) eap_tls: >>> send TLS 1.2 [length 0002] (8) eap_tls: ERROR: TLS Alert write:fatal:unknown CA tls: TLS_accept: Error in error (8) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (8) eap_tls: ERROR: System call (I/O) error (-1) (8) eap_tls: ERROR: TLS receive handshake failed during operation (8) eap_tls: ERROR: [eaptls process] = fail (8) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed Checking the leaf certificate against the intermediate CA appears to work. All of the certificates in /etc/raddb/certs have the correct hashed symlinks. We have tried setting tls_min_version = 1.2 and auto_chain = no, adding the intermediate CA certificate to the certificate_file. The same error results. I can break our production servers in the same manner by removing the hash symlink to the root CA's CRL file. In our test system, it's as if the hash symlink doesn't exist. The permissions on the files are correct - radiusd can read them all. Thank you for any help/suggestions Fraser Hess Workstation Engineer Pinnacol Assurance -- This communication and any attachments are for the sole use of the intended recipient and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer.

2 1

Reg: Freeradius 4.0 TACACS testing support
by shalini arivazhagan 10 Nov '23

10 Nov '23

Hi, I recently downloaded the 4.0 freeradius version to start my TACACS authentication. But I am facing an issue in authentication Added a new client in tacacs file. Add added a user<test> in the /etc/raddb/users file. But authentication is failed, it is giving error "No "known good" password found for user". Kindly help me on the TACACS testing. Where to add users for TACACS authentication in conf file. Thanks, Salini

2 1

Odd behavior on authentication
by Philip Prindeville 10 Nov '23

10 Nov '23

Hi, I had a test client (Ubuntu 22.04) set up, and I was running tcpdump on the server (also Ubuntu, running Freeradius 3.0). I had created a username & password on the Radius server, and if I tried to log into the client with those credentials, it failed. But as soon as I created a "cut out" on the client (same username, but '*' password in the shadow file), I could log in because the server was no longer rejecting the authorization request. I don't get it. How would the server know if there was a local user or not? Nothing in the messages seems to be different, other than the things you'd expect (the message id, and the random seed that the password gets hashed with). All other parts of the message looked to be identical. How was the client conveying to the server that there wasn't a local account present? Also, I've run "pam-auth-update --enable radius" to get pam_radius_auth.so plugged into the PAM stack, but how do I integrate it into /etc/nsswitch.conf as well? This is on Ubuntu so I don't have authconfig/authselect which are RedHat only. Thanks

3 5

deployment with two completely different sets of certificates
by Marek Zarychta 08 Nov '23

08 Nov '23

Dear List, I am considering use case with two completely different sets of certificates (different keys, certificates signed by different CAs). First, original set, will be used for clients without the realm and clients from old.realm. The new set, signed by well-know CA, will be used for TTLS-EAP and PEAP authentications only for the new.realm. If such a scenario requires deploying anther instance of FreeRADIUS, then please let me know, but most likely current instance could be configured to handle it. So far I have extended mods-enabled/eap and have there: eap eap1 { old realm / without realm settings } eap eap2 { new realm settings } eap { old realm / without realm settings } then added to sites-enabled/old.realm: if ((User-Name =~ /new\.realm$/) || ( Inner-Realm-Name =~ /new\.realm$/)) { update control { Auth-Type := eap2 } } but the authentications though successful, are still handled by eap1: (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "new.realm" for User-Name = "anonymous(a)new.realm" (0) suffix: Found realm "new.realm" (0) suffix: Adding Stripped-User-Name = "anonymous" (0) suffix: Adding Realm = "new.realm" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) eap1: Peer sent EAP Response (code 2) ID 130 length 29 (0) eap1: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap1] = ok (0) } # authorize = ok (0) Found Auth-Type = eap2 (0) Found Auth-Type = eap1 (0) ERROR: Warning: Found 2 auth-types on request for user 'anonymous' (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/old.realm (0) authenticate { (0) eap1: Peer sent packet with method EAP Identity (1) (0) eap1: Calling submodule eap_peap to process data (0) eap_peap: (TLS) Initiating new session (0) eap1: Sending EAP Request (code 1) ID 131 length 6 (0) eap1: EAP session adding &reply:State = 0x16f700fc167419f8 (0) [eap1] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge So I am stuck. Please, any clues helping to proceed this further will be appreciated. Cheers ! -- Marek Zarychta

2 2

FreeRADIUS CoA Proxy [invalid Message-Authenticator] in response
by Alexander Shulgin 31 Oct '23

31 Oct '23

I am trying to configure the coa proxy in latest Radius docker image 3.2.3. I have defined a client with a proper shared secret (message initiator) and also defined a home server with a shared secret (message destination). When I send the CoA message I see in debug that the radius server is proxying the request, the NAS at destination receiving it, it responds back to the radius server and then the radius server forwards that message back to the initiator. The problem is when I receive the final message from the radius server it has invalid message-authenticator. "Reply verification failed: Received packet from 192.168.2.157 with invalid Message-Authenticator! (Shared secret is incorrect.) I checked the shared secret on all sides, everything is as expected but somehow it signs the final message incorrectly. Thanks in advance. Attached is a debugfile of the freeradius And the request command and output is: echo " NAS-IP-Address = 192.168.2.224 Calling-Station-Id = 'BC:54:51:EF:70:AE' Event-Timestamp = $(date +%s) " | radclient -x 192.168.2.157:3799 disconnect testing123 Sent Disconnect-Request Id 7 from 0.0.0.0:33184 to 192.168.2.157:3799 length 51 NAS-IP-Address = 192.168.2.224 Calling-Station-Id = "BC:54:51:EF:70:AE" Event-Timestamp = "Oct 31 2023 13:29:27 MDT" (0) Reply verification failed: Received packet from 192.168.2.157 with invalid Message-Authenticator! (Shared secret is incorrect.)

2 4

OTP support - OATH compliant 2FA with freeradius
by Michael Hawkins 31 Oct '23

31 Oct '23

Hello all, Way back when, freeradius supported otp. Has that support been removed? What is it replaced with? Or, to put it another way. If I wanted to use some form of 2FA that used a server that was code running on a LINUX box, that was open source, that worked with freeradius, what might it be? The 2FA piece would support OATH compliant event (not time based) tokens - hardware or software. Many thanks, -- Michael A Hawkins Stamford, CT 06902 USA Mobile: 203-550-5502

2 1

File module processing error "Invalid operator"
by Chinnapaiyan, Nagamani 31 Oct '23

31 Oct '23

Hi, I am seeing "Invalid operator" error on a file module. # /usr/sbin/radiusd -X Info : Copyright 1999-2023 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/raddb/dictionary" Debug : including configuration file /etc/raddb/radiusd.conf Debug : Including files in directory "/etc/raddb/template.d/" Debug : including configuration file /etc/raddb/template.d/default Debug : including configuration file /etc/raddb/clients.conf Debug : Including files in directory "/etc/raddb/global.d/" Debug : including configuration file /etc/raddb/global.d/ldap Debug : Including files in directory "/etc/raddb/mods-enabled/" Debug : including configuration file /etc/raddb/mods-enabled/always Debug : including configuration file /etc/raddb/mods-enabled/files Debug : including configuration file /etc/raddb/mods-enabled/ldap Debug : including configuration file /etc/raddb/mods-enabled/linelog_dhcp Debug : including configuration file /etc/raddb/mods-enabled/redis Debug : including configuration file /etc/raddb/mods-enabled/redis_ippool Debug : including configuration file /etc/raddb/mods-enabled/unpack Debug : Including files in directory "/etc/raddb/policy.d/" ... ... Debug : rlm_redis (redis) [1] - Reserved connection (0) Debug : rlm_redis (redis) [1] - Released connection (0) Debug : Instantiating rlm_always "reject" Debug : Instantiating rlm_files "subnet_policy" Debug : Reading file /etc/raddb/mods-config/files/subnet_policies Error : /etc/raddb/mods-config/files/subnet_policies[1692]: dhcpv4.Router-Address := 25.26.0.1, Error : /etc/raddb/mods-config/files/subnet_policies[1692]: ^ Invalid operator Error : Failed reading /etc/raddb/mods-config/files/subnet_policies Error : /etc/raddb/mods-enabled/files[25]: Instantiation failed for module "subnet_policy" After removing some commented lines or adding some empty lines or empty spaces in the file module, the error goes away. pwd:/etc/raddb/mods-config/files subnet_policies is the file module which gives this error. below is the diff between the problematic file and working file. Just removed a line. # wc subnet_policies* 4438 7982 111085 subnet_policies 4439 7983 111161 subnet_policies.problem # diff subnet_policies.problem subnet_policies 1d0 < ########################################################################### Debug : rlm_redis (redis) [1] - Reserved connection (0) Debug : rlm_redis (redis) [1] - Released connection (0) Debug : Instantiating rlm_always "reject" Debug : Instantiating rlm_files "subnet_policy" Debug : Reading file /etc/raddb/mods-config/files/subnet_policies Debug : Instantiating rlm_files "subscriber_host_policy" Debug : Reading file /etc/raddb/mods-config/files/host_policies Regards, Nagamani Chinnapaiyan

2 3

Will radiusd reload certificates on hup command?
by James Fan 31 Oct '23

31 Oct '23

Assuming that the FreeRADIUS configuration files have changed, will the hup command make the server reload its certificates, keys, etc.? Thanks.

3 4