- Freeradius-Users - lists.freeradius.org

raddebug
by Gerald Vogt 16 Aug '23

16 Aug '23

Hi! For whatever reason "raddebug" doesn't work on our new radius servers. On the old ones I could simply run "raddebug" or "raddebug -t 0" to capture the current debug logs. On the new one it shows nothing. It simply runs without any output. Running freeradius-3.2.3-1.el9.x86_64 on AlmaLinux 9. All the prerequisites mentioned in the raddebug(8) are met: * radmin is in the path. * I start raddebug as root thus permissions shouldn't matter. * control socket is configured in mode rw and is accessible. * It creates a file like "/var/log/radius/radmin.debug.101128" which remains empty as well. * I don't run multiple raddebug processes. So I don't understand why it's not working... Regards, Gerald

2 4

Initial simple test fails. Ver 3.0.20 from Ubuntu
by Pavel Aronsky 16 Aug '23

16 Aug '23

Dear experts, I'm very sorry for a lame help request but really don't know what else to do. I want to try the simplest setup for some small (embedded) client. So decided to begin with MD5 and username-password. Installed freeradius in Win11 WSL environment, Ubuntu 20.04.6 LTS, via apt install as usual. It brings version 3.0.20. As advised in "getting started" docum, made no changes anywhere besides adding a user and a client. In /etc/freeradius/3/0/users: at beginning: (which is symlnk to mods-config/files/authorize) JIG46 Cleartext-Password := "secret" In /etc/freeradius/3/0/clients.conf: after the existing localhost: client myswitch { ipaddr = 10.183.0.110 secret = testing123 require_message_authenticator = no proto = * nas_type = other } Then started the server on localohst and port 1645 (because the default port appears to be busy): sudo freeradius -X -xx -p 1645 -i localhost Then run : radtest -x -t eap-md5 JIG46 secret localhost:1645 0 testing123 Output: Loading input data... including dictionary file /usr/share/freeradius/dictionaryReading input vps from stdin Read 1 element(s) from input: stdin Loaded: 1 input element(s). Adding new socket: src: 0.0.0.0:0, dst: 127.0.0.1:1645 Added new socket: 5 (num sockets: 1) Transaction: 0, sending packet: 0 (id: 151)... Sent Access-Request Id 151 from 0.0.0.0:59783 to 127.0.0.1:1645 length 69 User-Name = "JIG46" Cleartext-Password = "secret" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 EAP-Code = Response EAP-Type-Identity = 0x4a49473436 EAP-Message = 0x024d000a014a49473436 Timeout for transaction: 0, tries (so far): 1 (max: 3)Transaction: 0, sending packet: 1 (id: 151)... ............ two more tries...... Timeout for transaction: 0, tries (so far): 3 (max: 3)No response for transaction: 0, giving upDeallocating (sockfd: 5, id: 151) Main loop: done. The server refuses to start EAP handshake - I don't see any errors due to unknown usernames or wrong passwords? Exactly the same outcome with a real client (a managed switch, with the client id myswitch, defined above). *** The complete log is here. https://gist.github.com/pavel-a/7b0c0c230ad28627218eade7fb0d1c61 Please advise? Is this because of WSL or something wrong in the configuration?? *** Windows firewall is OFF. - ddbug

2 5

freeradius exec module only works in debug mode (freeradius -X)
by Härtl, Calvin 14 Aug '23

14 Aug '23

Hi all, first of all, thank you for all the time and effort you have put into the Freeradius project! Sadly, I have run into a small issue, that I cannot figure out why it happens: In my sites-enabled/default file, I have written a small „Info Mail“ script, which basically just sends out an email with the rejected MAC address of a client: #First I check if the device MAC address is in my database, if not, send out a mail and reject the Access-Request if("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0){ %{exec:/usr/bin/sh -c "echo Unknown device '%{Calling-Station-ID}' at '%{Called-Station-ID}'. This device received a timeout of 5 minutes! | mailx -a 'From:radius001@stud.hs-coburg.de' -s '*** Security-Message ***' Calvin.haertl(a)stud.hs-coburg.de;echo NAC was activated!"} reject } In the debug mode (freeradius -X) everything works out great, and the mail gets sent out: rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) rlm_sql (sql): Reserved connection (2) rlm_sql (sql): Released connection (2) rlm_sql (sql): Reserved connection (3) (0) Executing select query: SELECT COUNT(*) FROM hw WHERE macad1 = '54:99:63:c0:11:4a' OR macad2 = '54:99:63:c0:11:4a' OR macad3 = '54:99:63:c0:11:4a' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (3) (0) EXPAND %{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'} (0) --> 0 (0) if ("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0) -> TRUE (0) if ("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0) { (0) Executing: /usr/bin/sh -c " echo Unknown device '%{Calling-Station-ID}' at '%{Called-Station-ID}'. This device received a timeout of 5 minutes! | mailx -a 'From:radius001@stud.hs-coburg.de' -s '***Security-Message***' Calvin.haertl(a)stud.hs-coburg.de;echo NAC was activated!“: (0) Program returned code (0) and output 'NAC was activated!' (0) EXPAND %{exec:/usr/bin/sh -c "echo Unknown device '%{Calling-Station-ID}' at '%{Called-Station-ID}'. This device received a timeout of 5 minutes! | mailx -a 'From:radius001@stud.hs-coburg.de' -s '*** Security-Message ***' Calvin.haertl(a)stud.hs-coburg.de;echo NAC was activated!"} (0) --> NAC was activated! (0) [reject] = reject (0) } # if ("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0) = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> asd (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap: Request was previously rejected, inserting EAP-Failure (0) eap: Sending EAP Failure (code 4) ID 1 length 4 (0) [eap] = updated (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 92 from 10.11.1.17:1812 to 10.11.17.249:60492 length 44 (0) EAP-Message = 0x04010004 (0) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. However, as soon as I exit the debug mode and run freeradius as a daemon (systemctl start freeradius), freeradius still works as expected, but the mail no longer gets sent out. Everything else works just fine (users can hop onto the WiFi, etc.). Am I missing something here? Any help is appreciated! Best regards, Calvin

3 3

Issue with dynamic home servers in 3.2.3
by James Wood 10 Aug '23

10 Aug '23

I am trying to add OpenRoaming support via dynamic DNS lookups to FreeRADIUS 3.2.3 As per the doc at freeradius-server-3.2.3/doc/configuration/dynamic_home_servers.md it states you need to do the following: 1. Enable the control socket 2. Enable dynamic = true and set the directory = ${raddb}/home_servers/ in proxy.conf 3. Ensure the /mods-config/realm/freeradius-naptr-to-home-server.sh is present in order to perform real-time DNS lookups unknown realms. So far so good. The doc gives an example of what to use inside the authorize {} block. Here is my config (added the "aaa+auth:radius.tls.tcp" to the script's third parameter... if (User-Name =~ /(a)(.*)$/) { switch "%{home_server_dynamic:%{1}}" { case "1" { # Proxy to this one particular home server update control { &Home-Server-Name := "%{1}" } } case "0" { # Proxy with home server pool, failover, etc. update control { &Proxy-To-Realm := "%{1}" } } case { # no home server exists, ask DNS update control { # you can add a parameter for the NAPTR tag to look up, e.g. "aaa+auth:radius.tls.tcp" (RFC7585, OpenRoaming) # if the third parameter is omitted, it defaults to "x-eduroam:radius.tls" &Temp-Home-Server-String := `%{config:confdir}/mods-config/realm/freeradius-naptr-to-home-server.sh -d %{config:confdir} %{1} aaa+auth:radius.tls.tcp` } if ("%{control:Temp-Home-Server-String}" == "" ) { update control { &Home-Server-Name := "%{1}" } } else { reject } } } } When testing this, I can see that it is performing the DNS lookup and adding a dynamic home server to the home_servers folder, but it still fails and doesn't actually proxy the request to the dynamically discovered server: (0) if (User-Name =~ /(a)(.*)$/) { (0) if (User-Name =~ /(a)(.*)$/) -> TRUE (0) if (User-Name =~ /(a)(.*)$/) { (0) switch %{home_server_dynamic:%{1}} { (0) EXPAND %{home_server_dynamic:%{1}} (0) --> (0) case { (0) update control { (0) Executing: %{config:confdir}/mods-config/realm/freeradius-naptr-to-home-server.sh -d %{config:confdir} %{1} aaa+auth:radius.tls.tcp: (0) EXPAND confdir (0) --> confdir (0) EXPAND %{config:confdir}/mods-config/realm/freeradius-naptr-to-home-server.sh (0) --> /usr/local/etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh (0) EXPAND confdir (0) --> confdir (0) EXPAND %{config:confdir} (0) --> /usr/local/etc/raddb (0) EXPAND %{1} (0) --> openroaming.goog Waking up in 0.3 seconds. ... new connection request on command socket Listening on command file /usr/local/var/run/radiusd/radiusd.sock Waking up in 0.2 seconds. radmin> add home_server file /usr/local/etc/raddb/home_servers/openroaming.goog including configuration file /usr/local/etc/raddb/home_servers/openroaming.goog including configuration file /usr/local/etc/raddb/home_servers/tls.conf home_server openroaming.goog { nonblock = no ipaddr = radsec.openroaming.goog IPv4 address [146.148.44.172] port = 2083 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } Waking up in 0.1 seconds. ... shutting down socket command file /usr/local/var/run/radiusd/radiusd.sock ... cleaning up socket command file /usr/local/var/run/radiusd/radiusd.sock Waking up in 0.1 seconds. (0) Program returned code (0) and output '' (0) &Temp-Home-Server-String := (0) } # update control = noop (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) if ("%{control:Temp-Home-Server-String}" == "" ) -> TRUE (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) [reject] = reject (0) } # if ("%{control:Temp-Home-Server-String}" == "" ) = reject (0) } # case = reject (0) } # switch %{home_server_dynamic:%{1}} = reject (0) } # if (User-Name =~ /(a)(.*)$/) = reject It seems if ("%{control:Temp-Home-Server-String}" == "" ) { is the offending line. Even though the naptr script succeeds and returns a code 0, it's marking it as failed. So, i reversed the if statement so I could at least test further: if ("%{control:Temp-Home-Server-String}" == "" ) { update control { &Home-Server-Name := "%{1}" } } else { reject } I now get the following: (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) if ("%{control:Temp-Home-Server-String}" == "" ) -> TRUE (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) update control { (0) EXPAND %{1} (0) --> openroaming.goog (0) &Home-Server-Name := openroaming.goog (0) } # update control = noop (0) } # if ("%{control:Temp-Home-Server-String}" == "" ) = noop (0) ... skipping else: Preceding "if" was taken (0) } # case = noop (0) } # switch %{home_server_dynamic:%{1}} = noop (0) } # if (User-Name =~ /(a)(.*)$/) = noop (0) Proxying due to Home-Server-Name (0) There was no response configured: rejecting request Any thoughts on this? P.S. I think there is a bug in the freeradius-naptr-to-home-server.sh script, because it doesn't add the lines "secret" and "type" when it dynamically generates the home_server block. I had to modify it to add these lines in, else the radmin command failed to dynamically load it. Thanks

2 3

radtest No "known good" password
by thenderson＠system.de 10 Aug '23

10 Aug '23

Have done much Googling/Binging, cant find a similar situation. Debian 11. Installed with apt-get install freeradius freeradius-mysql freeradius-utils. Added to /etc/freeradius/mods-config/files/authorize: testing Cleartext-Password := password During that process I had to create the folder /etc/freeradius/mods-config/files, it was not already present. Naturally due to this, the authorize file is empty other than the one line I added. Then I: radtest testing password 127.0.0.1 0 testing123 Outputs are: On Terminal A: Sent Access-Request Id 29 from 0.0.0.0:53848 to 127.0.0.1:1812 length 77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "password" Received Access-Reject Id 29 from 127.0.0.1:1812 to 127.0.0.1:53848 length 20 (0) -: Expected Access-Accept got Access-Reject Debug from Terminal B: (8) Received Access-Request Id 29 from 127.0.0.1:53848 to 127.0.0.1:1812 length 77 (8) User-Name = "testing" (8) User-Password = "password" (8) NAS-IP-Address = 127.0.1.1 (8) NAS-Port = 0 (8) Message-Authenticator = 0xbf1bb85fcdf0c1a4fbc4c65ff5c466b0 (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "testing", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: No EAP-Message, not doing EAP (8) [eap] = noop (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = ok (8) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> testing (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 29 from 127.0.0.1:1812 to 127.0.0.1:53848 length 20 Waking up in 3.9 seconds. (8) Cleaning up request packet ID 29 with timestamp +2957 Random thought: is the MySQL package making FreeRadius expect a different configuration method? I thought it was required to install but Im not using any MySQL as far as I know, Im doing a very basic setup, authorizing some Cisco vIOS routers/switches. Im probably missing something fairly obvious. Please help? -- Tristan Henderson Network Support Engineer <mailto:thenderson@system.de> thenderson(a)system.de system.de System & Project GmbH Knesebeckstr. 96, 10623 Berlin <http://www.system.de/> www.system.de T +49 30 2902315 350 F +49 30 2902315 440 Amtsgericht Berlin-Charlottenburg: HRB 53740 Geschäftsführer: Peter Schulte, Wilhelm Boeddinghaus Think before you print!

4 7

Certificate chain untrusted
by Maciej Kowalka 10 Aug '23

10 Aug '23

Hi, I've got configures freeradius 3.2 with eap tls, and working certificates, users can be authorized to network but I get warnings every time : Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /C=PL/ST=MyState/O=MyOrg/CN=Intermediate CA (TLS) untrusted certificate with depth [0] subject name /C=PL/ST=MyState/O=MyOrg/CN=client Is there solution to this or so I have to ignore it, and live with it? Maciej

5 23

crl cache refresh
by Peter Lee 08 Aug '23

08 Aug '23

Hi, A couple of questions regarding the crl cache auto refresh settings with fr release 3.2.2 check_crl = yes ca_path = ${cadir} ca_path_reload_interval = 86400 1. Does the reloading interval timer reset each time freeradius restart? 2. Is there a way to set an initial crl start time so that reloading at each interval can happen at expected time regardless when freeradius starts/restart? To make sure the crl update and fr reloading are in-sync. 3. Can ca_path_reload_interval interval be dynamically updated without restarting freeradius? Thanks.

2 1

Fwd: RADSEC / TLS errors but not sure why
by James Wood 08 Aug '23

08 Aug '23

Hi All, I'm currently testing out RADSEC/TLS on the latest version, 3.2.3, with openssl 3.0 on Ubuntu 22.04. The key, certificate and CA are correct and have been validated to match before using in the Freeradius config. When I start the daemon there are no errors indicating the key/cert don't match so I assume all is well. However, when a client connects over RADSEC/TLS (port 2083), Freeradius displays an SSL error. I've also tried the openssl s_client command and the same error is thrown. openssl s_client -showcerts -connect radius.hostname:2083 The key/cert is secp384r1 based. mods-enabled/eap: --------------------------- tls-config tls-common { private_key_password = whatever private_key_file = ${certdir}/my_key.key certificate_file = ${certdir}/my_key.crt ca_file = ${certdir}/my_key.ca dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "secp384r1" } --------------------------- sites-enabled/tls: --------------------------- listen { ipaddr = * port = 2083 type = auth+acct proto = tcp virtual_server = default clients = radsec limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } tls { private_key_password = whatever private_key_file = ${certdir}/my_key.key certificate_file = ${certdir}/my_key.key ca_file = ${certdir}/my_key.key dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no require_client_cert = no } } clients radsec { client all { ipaddr = 0.0.0.0/0 proto = tls secret = radsec } } home_server tls { ipaddr = 127.0.0.1 port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { private_key_password = whatever private_key_file = ${certdir}/purple.key certificate_file = ${certdir}/purple.crt ca_file = ${certdir}/purple.ca dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" } } home_server_pool tls { type = fail-over home_server = tls } realm tls { auth_pool = tls } --------------------------- radius debug: [snip] Listening on auth+acct proto tcp address * port 2083 (TLS) bound to server default Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 40253 Ready to process requests ... new connection request on TCP socket Listening on auth+acct from client (1.2.3.4, 38639) -> (*, 2083, virtual-server=default) Waking up in 0.9 seconds. (0) (TLS) Initiating new session (0) (TLS) Handshake state - before/accept initialization (0) (TLS) Handshake state - Server before/accept initialization (0) (TLS) recv TLS 1.2 Handshake, ClientHello (0) (TLS) send TLS 1.2 Alert, fatal handshake_failure (0) ERROR: (TLS) Alert write:fatal:handshake failure (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 38639 If I query a public radsec radius server on port 2083 using the openssl s_client command it returns the certificate list correctly etc. Is it a problem with my key/cert, openssl, or the client? Thanks

3 17

Restricting access for some devices to some groups
by Jarosław Kłopotek 07 Aug '23

07 Aug '23

Hi, I would like to restrict access to some devices (using ipaddresses). How do You assign group privileges with freeradius? (I tried to find some docs but without good results) I try: In SQL database: 1. I added table "nasgrouprestrictions" (id, nasname, groupname), Example DB results: (1, 10.100.0.1, superadm) (2, 10.100.0.1, users) (3, 10.100.0.2, superadm) (4, 10.100.0.3, users) 2. I created group "superadm" and assigned users in table radusergroup, login1, login2 are in "users" group login3 is in "superadm" and "users" group How to allow: login3 to login into all 10.100.0.{1,2,3} hosts and login1, login2 to login into only 10.100.0.{1,3} hosts ? But where to put SQL query? -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

3 4

Freeradius+AD - Login with EmployeeID
by Rodrigo Abrantes Antunes 07 Aug '23

07 Aug '23

Hello, I have a freeradius server authenticating users with active directory, the users login with the samaccountname. This is the ldap filter: (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}}) Now I need to enable the users to login with the employeeID. This is the ldap filter I tried: (employeeID=%{mschap_default:User-Name:-%{User-Name}})" The filter works in ldapsearch but not in freeradius. # Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group authorize { Mon Aug 7 10:23:44 2023 : Debug: [ad_all] performing user authorization for 1638828 Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: (employeeID=%{mschap_default:User-Name:-%{User-Name}}) -> (employeeID=1638828) Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: DC=xx,DC=xx,DC=xx,DC=xx -> DC=xx,DC=xx,DC=xx,DC=xx Mon Aug 7 10:23:44 2023 : Debug: ++[ad_all] = fail Mon Aug 7 10:23:44 2023 : Debug: +} # group authorize = fail Mon Aug 7 10:23:44 2023 : Debug: Using Post-Auth-Type REJECT Mon Aug 7 10:23:44 2023 : Debug: # Executing group from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group REJECT { Mon Aug 7 10:23:44 2023 : Debug: [attr_filter.access_reject] expand: %{User-Name} -> 1638828 Mon Aug 7 10:23:44 2023 : Debug: ++[attr_filter.access_reject] = updated Mon Aug 7 10:23:44 2023 : Debug: +} # group REJECT = updated Why freeradius can't filter with the employeeID attribute? Thanks.

2 5