- Freeradius-Users - lists.freeradius.org

checkrad alternative
by Igor Smitran 30 Oct '23

30 Oct '23

Hi list, I have a new Cisco ASR. There is no SNMP OID on it for checking simultaneous use with checkrad. Is there an alternative? Am i able to use COA instead of checkrad? If so, any help would be appreciated. Thanx

4 11

auto scaling freeradius instance on openshift and state-ID problem
by Mesut GULNAZ 29 Oct '23

29 Oct '23

I was able to run freeradius instance on kubernetes / openshift. and I am using 2FA via freeradius. my problem is; when I auto-scale the freeradius to more than 1, openshift platform is unable to send the response coming from the client side with state-ID to the correct radius POD. The other radius pod is rejecting the reply coming from the client because of the state created by the other radius POD. is there a solution or workaround for this case? best regards.

4 8

Connect sql with eap-PEAP /MSchapv2
by Laurent Estévez 27 Oct '23

27 Oct '23

hello I have a functional configuration with ntlm_auth link in EAP-PEAP/MSchapv2. I would like to add an sql database as a source, is this possible ? I've done some tests OK with EAP-TTLS, but not with my current configuration, Thanks in advance, Laurent --

3 3

Updating/overwriting attribute with rlm_python
by Norman Elton 26 Oct '23

26 Oct '23

I’m using rlm_python, returning a tuple to update attributes in the reply. I’ve noticed that if the request already has a value for that attribute, it is not overwritten. That is, my operation becomes a no-op. I suppose this matches the behavior of the “=“ operator. Is there a way to behave like the “:=“ operator, overwriting the existing value? Or should I strip the value prior to invoking my python module? Thanks, Norman

2 1

PEAP/mschapv2 password fail log guestion
by 박지연 25 Oct '23

25 Oct '23

1 0

Stuck at "More than 50 roundtrips"
by thomas＠habets.se 24 Oct '23

24 Oct '23

Hi. I'm trying to set up EAP-TLS with certificates with an Android Pixel 7 Pro, latest OS, via a Unifi U6 Pro, using FreeRadius 3.0.17 on a raspberry pi 4. I took the default config, and changed as little as possible: clients.conf, added: client wifi_aps { ipaddr = 192.168.123.0/24 secret = radiuspasswordhere } In case it would help, I also added a user. PEAP auth with username/password works. wifi Cleartext-Password := "XXXXXXX" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "13", Reply-Message = "Hello there!" Made the certificates by editing the .cnf files and doing "make ca.pem", "make server.pem", and "make client.pem". I loaded the .p12 on the Android phone, and changed the paths in mod-enabled/eap. I changed default_eap_type to tls, and added use_tunneled_reply to tls-config. Here's a selection of the output of freeradius -X: First access request in packet 1: (1) Received Access-Request Id 61 from 192.168.XX.Z:59545 to 192.168.XX.Y:1812 length 216 SSL handshake done by packet 8: (8) eap_tls: SSL Connection Established (with client cert details shown) After that there's just a bunch of apparently empty-ish repeating Access-Request/Access-Challenge[1], and it's stuck that way until: (52) eap: ERROR: rlm_eap (EAP): Aborting! More than 50 roundtrips made in session with state 0x8e36e001bc25ed47 What am I doing wrong? In this example I'm putting "wifi" as identity, in case it helps that it's present in the user config. I expect that at some point the server should reply Accepted, instead of a new challenge. I guess the client cert was not enough auth? Is there a config I need to change so that cert is sufficient? I'd appreciate any help. Thanks. [1] (14) Received Access-Request Id 74 from 192.168.XX.Z:59545 to 192.168.XX.Y:1812 length 231 (14) User-Name = "wifi" (14) NAS-IP-Address = 192.168.XX.Z (14) NAS-Identifier = "xxx" (14) Called-Station-Id = "xx-xx-xx-xx-xx-xx:secnet2" (14) NAS-Port-Type = Wireless-802.11 (14) Service-Type = Framed-User (14) Calling-Station-Id = "xx-xx-xx-xx-xx-xx" (14) Connect-Info = "CONNECT 0Mbps 802.11b" (14) Acct-Session-Id = "3E1F2B0282D15C98" (14) Acct-Multi-Session-Id = "3870EEE1F7155662" (14) WLAN-Pairwise-Cipher = 1027076 (14) WLAN-Group-Cipher = 1027076 (14) WLAN-AKM-Suite = 1027073 (14) Framed-MTU = 1400 (14) EAP-Message = 0x02ed00060d00 (14) State = 0x8e36e00182dbed476556c84932fcf3de (14) Message-Authenticator = 0x03a0ae965bd12781a50f91cd3ac1aaf6 (14) session-state: No cached attributes (14) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (14) authorize { (14) policy filter_username { (14) if (&User-Name) { (14) if (&User-Name) -> TRUE (14) if (&User-Name) { (14) if (&User-Name =~ / /) { (14) if (&User-Name =~ / /) -> FALSE (14) if (&User-Name =~ /@[^@]*@/ ) { (14) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (14) if (&User-Name =~ /\.\./ ) { (14) if (&User-Name =~ /\.\./ ) -> FALSE (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (14) if (&User-Name =~ /\.$/) { (14) if (&User-Name =~ /\.$/) -> FALSE (14) if (&User-Name =~ /(a)\./) { (14) if (&User-Name =~ /(a)\./) -> FALSE (14) } # if (&User-Name) = notfound (14) } # policy filter_username = notfound (14) [preprocess] = ok (14) [chap] = noop (14) [mschap] = noop (14) [digest] = noop (14) suffix: Checking for suffix after "@" (14) suffix: No '@' in User-Name = "wifi", looking up realm NULL (14) suffix: No such realm "NULL" (14) [suffix] = noop (14) eap: Peer sent EAP Response (code 2) ID 237 length 6 (14) eap: No EAP Start, assuming it's an on-going EAP conversation (14) [eap] = updated (14) files: users: Matched entry wifi at line 90 (14) [files] = ok (14) [expiration] = noop (14) [logintime] = noop (14) pap: WARNING: Auth-Type already set. Not setting to PAP (14) [pap] = noop (14) } # authorize = updated (14) Found Auth-Type = eap (14) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (14) authenticate { (14) eap: Expiring EAP session with state 0x8e36e00182dbed47 (14) eap: Finished EAP session with state 0x8e36e00182dbed47 (14) eap: Previous EAP request found for state 0x8e36e00182dbed47, released from the list (14) eap: Peer sent packet with method EAP TLS (13) (14) eap: Calling submodule eap_tls to process data (14) eap_tls: Continuing EAP-TLS (14) eap_tls: Peer ACKed our handshake fragment (14) eap_tls: [eaptls verify] = request (14) eap_tls: [eaptls process] = handled (14) eap: Sending EAP Request (code 1) ID 238 length 10 (14) eap: EAP session adding &reply:State = 0x8e36e00183d8ed47 (14) [eap] = handled (14) } # authenticate = handled (14) Using Post-Auth-Type Challenge (14) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (14) Challenge { ... } # empty sub-section is ignored (14) Sent Access-Challenge Id 74 from 192.168.XX.Y:1812 to 192.168.XX.Z:59545 length 0 (14) Tunnel-Type = VLAN (14) Tunnel-Medium-Type = IEEE-802 (14) Tunnel-Private-Group-Id = "13" (14) Reply-Message = "Hello there!" (14) EAP-Message = 0x01ee000a0d8000000000 (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x8e36e00183d8ed476556c84932fcf3de (14) Finished request -- typedef struct me_s { char name[] = { "Thomas Habets" }; char email[] = { "thomas(a)habets.se" }; char kernel[] = { "Linux" }; char *pgpKey[] = { "http://www.habets.pp.se/pubkey.txt" }; char pgp[] = { "9907 8698 8A24 F52F 1C2E 87F6 39A4 9EEA 460A 0169" }; char coolcmd[] = { "echo '. ./_&. ./_'>_;. ./_" }; } me_t;

2 3

Identify the site in logging
by Stephane Bourque 24 Oct '23

24 Oct '23

Hello, We have a need to be able to identify the virtual-server that is generating the log messages. How would you approach this? - Is there a way to get a different logging configuration per server? - Is there a way to add the server name in logging statements? We are not too sure of how to proceed. Thanks for your guidance. -- *Stephane Bourque* *CEO & Founder* *Arilia Wireless Inc.* *"Everything connected"* stephane.bourque(a)arilia.com +1(778)558-3524 *www.arilia.com <http://www.arilia.com>*

3 3

Unable to start freeradius as service - Couldn't connect to MySQL server
by vira vva 24 Oct '23

24 Oct '23

root@ngw40:/etc/freeradius/mods-enabled# freeradius -v radiusd: FreeRADIUS Version 3.2.3 (git #db3d1924d), for host x86_64-pc-linux-gnu FreeRADIUS Version 3.2.3 running on terminal without any issue *freeradius -X* Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 44685 Listening on proxy address :: port 57364 *run as as service always failed with sql connection issue* Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: # Instantiating module "sql" from file /etc/freeradius/mods-enabled/sql Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Info: rlm_sql_mysql: libmysql version: 8.0.34 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: mysql { Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: tls { Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011ca_file = "/etc/ssl/certs/my_ca.crt" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011ca_path = "/etc/ssl/certs/" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011certificate_file = "/etc/ssl/certs/private/client.crt" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011private_key_file = "/etc/ssl/certs/private/client.key" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011cipher = "DHE-RSA-AES256-SHA:AES128-SHA" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011tls_required = yes Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011check_cert = no Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011check_cert_cn = no Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Warning: /etc/freeradius/mods-enabled/sql[94]: The item 'tls_check_cert' is defined, but is unused by the configuration Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Warning: /etc/freeradius/mods-enabled/sql[95]: The item 'tls_check_cert_cn' is defined, but is unused by the configuration Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: } Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011warnings = "auto" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: } Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Info: rlm_sql (sql): Attempting to connect to database "radius" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql): Initialising connection pool Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: pool { Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011start = 5 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011min = 3 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011max = 32 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011spare = 10 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011uses = 0 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011lifetime = 0 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011cleanup_interval = 30 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011idle_timeout = 60 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011retry_delay = 30 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011max_retries = 5 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011spread = no Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: } Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql): Processing generate_sql_clients Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Info: rlm_sql (sql): Opening additional connection (0), 1 of 1 pending slots used Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql_mysql: Starting connect to MySQL server Oct 24 14:42:43 ngw40 freeradius[168957]: WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: rlm_sql_mysql: Couldn't connect to MySQL server radius@localhost:radius Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: rlm_sql_mysql: MySQL error: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql_mysql: Socket destructor called, closing socket Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: rlm_sql (sql): Opening connection failed (0) Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: Failed to load clients from SQL Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: /etc/freeradius/mods-enabled/sql[27]: Instantiation failed for module "sql"

2 1

How to match Vendor specific attribute
by Vishnu 23 Oct '23

23 Oct '23

Hi, I am using freeradius as a proxy, I want to match the VSA with the if statement and add another VSA based on that. Below mentioned is my custom policy config. custom_policy { if (NAS-Identifier =~ /DUBDC1-EX2200-*/) { if (%{Switch-User-Policy} =~ /.*switch-superuser.*/) update reply { Juniper-Local-User-Name = "switch-superuser" } } } } if i use .* instead of /.*switch-superuser.*/ it works. but i want to match the string. Please let me know how i can achieve this. Below is the Access accept message. (0) Sent Access-Accept Id 203 from 10.108.25.102:1812 to 10.108.25.29:56849 length 44 (0) Switch-User-Policy = "switch-superuser" Thanks, Vishnu

2 1

supported os
by Andrei Katsuk 23 Oct '23

23 Oct '23

Hello! I found on https://wiki.freeradius.org/building/Platforms that Officially supported linux platforms are: CentOS Red Hat Debian Ubuntu Also I found on https://hub.docker.com/r/freeradius/freeradius-server/ that freeradius docker image is based on alpine image. Does it mean that alpine os is also officially supported ? Which linux os you suggest to use as the base os for docker image with freeradius ? Thanks in advance, Andrei

5 6