- Freeradius-Users - lists.freeradius.org

Linelog and get rid of No Failure Reason
by TS 03 Aug '23

03 Aug '23

Hello, I am trying to consolidate logs and have only one log file with all needed data in it. This setup with Freeradius 3.2.3 with OpenLDAP 2.5.15. We are using EAP + MSCHAPv2, LDAP contains an attribute with NT Password. I am trying to get rid of "No Failure Reason" value of "reply:Reply-Message" variable in cases where: 1. user not found in LDAP 2. user's password is incorrect 3. user has Phase1 (EAP/TLS/...) or Phase2 (MSCHAPv2/GTC/...) misconfigured. I have pretty default configuration with small changes. I know I should modify Reply-Message but in which file and within which section(s)? Snippet from my custom linelog: reference = "inner_auth_log.%{%{reply:Packet-Type}:-format}" inner_auth_log { Access-Accept = "%d.%m.%Y@%H:%G|RESULT=OK |USER=%{User-Name}|WIFI_AP_IP=%{NAS-IP-Address}|CLIENT_MAC_ADDR=%{%{Calling-Station-Id}:-Unknown Caller Id}" Access-Reject = "%d.%m.%Y@%H:%G|RESULT=ERR|USER=%{User-Name}|WIFI_AP_IP=%{NAS-IP-Address}|CLIENT_MAC_ADDR=%{%{Calling-Station-Id}:-Unknown Caller Id}|MSG=%{%{reply:Reply-Message}:-No Failure Reason}" }

2 1

Samba radius authentication
by Jarosław Kłopotek 02 Aug '23

02 Aug '23

Hi, Is it possible to login in into samba share by using freeradius and get propper group assignment? I try switch as much authorize mechanizm as I could to freeradius. Tried to find native mechanizm in samba documentation but no info there :( -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

2 5

status-server
by Anatoliy 02 Aug '23

02 Aug '23

Hi team , when I am try to query status server for specific client I receive global stats and stats for specific client Is this expected behavior for FR , or it should return only stats for client ? For example # echo "Message-Authenticator = 0x00,FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-Number = 3" | radclient -x localhost:18121 status adminsecret Sent Status-Server Id 112 from 0.0.0.0:d5a0 to 127.0.0.1:18121 length 62 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = 35 FreeRADIUS-Stats-Client-Number = 3 Received Access-Accept Id 112 from 127.0.0.1:46c9 to 127.0.0.1:54688 length 476 FreeRADIUS-Total-Access-Requests = 430666 <<<<<<<<<< global stats for FR FreeRADIUS-Total-Access-Accepts = 679 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 679 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Auth-Conflicts = 0 FreeRADIUS-Total-Accounting-Requests = 1518800 FreeRADIUS-Total-Accounting-Responses = 1518800 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Acct-Conflicts = 0 FreeRADIUS-Stats-Client-Number = 3 FreeRADIUS-Stats-Client-IP-Address = 100.64.0.2 <<<<<<<< after this line , stats for this client. FreeRADIUS-Total-Access-Requests = 0 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 2404 FreeRADIUS-Total-Accounting-Responses = 2404 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0

2 2

Freeradius 2FA
by Jarosław Kłopotek 02 Aug '23

02 Aug '23

Hi guys, go a question - Is it possible to use freeradius with some 2FA somehow? Most perfect scenario would be: - try to log in on remote hosts, - remote server communicates with freeradius, - radius gives a question to some phone 2FA app, - then we get click "ALLOW" on the mobile 2FA app, - tadam we are logged in, -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

3 7

help with changing to use named instance of sql module
by Matt Zagrabelny 31 Jul '23

31 Jul '23

Greetings FR-users, Running freeradius 3.0.21+dfsg-2.2+deb11u1. The default FR configs (obviously!) work wonderfully. Thank you for making a robust system. I am attempting to deviate from those defaults and am hitting a snag. I would like to use multiple databases (within the sql module), thus I am attempting to change: sql { } to sql foo { } After successfully adding "foo", I can then add "bar". >From running -X it appears that I am connecting to "foo" correctly: (0) foo: EXPAND %{User-Name} (0) foo: --> mzagrabe (0) foo: SQL-User-Name set to 'mzagrabe' rlm_sql (foo): Reserved connection (0) (0) foo: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) foo: --> SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = 'mzagrabe' ORDER BY id (0) foo: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = 'mzagrabe' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) foo: User found in radcheck table (0) foo: Conditional check items matched, merging assignment check items (0) foo: Crypt-Password := "REDACTED" (0) foo: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) foo: --> SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = 'mzagrabe' ORDER BY id (0) foo: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = 'mzagrabe' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (foo): Reserved connection (1) rlm_sql (foo): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (foo): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='foo' host='foo-dev.example.com' user='radius_user' password='REDACTED' application_name='FreeRADIUS 3.0.21 - radiusd (foo)' Connected to database 'foo' on 'foo-dev.example.com' server version 130011, protocol version 3, backend PID 1378924 (0) foo: EXPAND SELECT GroupName FROM radius_user_group WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) foo: --> SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority (0) foo: Executing select query: SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 1 (0) foo: User found in the group table (0) foo: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = '%{foo-SQL-Group}' ORDER BY id (0) foo: --> SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = 'network-admin' ORDER BY id (0) foo: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = 'network-admin' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) foo: Group "network-admin": Conditional check items matched (0) foo: Group "network-admin": Merging assignment check items (0) foo: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = '%{foo-SQL-Group}' ORDER BY id (0) foo: --> SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = 'network-admin' ORDER BY id (0) foo: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = 'network-admin' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) foo: Group "network-admin": Merging reply items rlm_sql (foo): Released connection (0) (0) [foo] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) if ("%{client:group}" == 'two-factor-authentication-group') { (0) EXPAND %{client:group} (0) --> network-infrastructure (0) if ("%{client:group}" == 'two-factor-authentication-group') -> FALSE (0) else { (0) update control { (0) Proxy-To-Realm := 'default-authentication-realm' (0) } # update control = noop (0) } # else = noop (0) } # authorize = updated (0) Starting proxy to home server 10.0.0.1 port 1812 (0) server default { (0) } The above -X output is generally the same output as the working default sql configuration output. However, the default working sql configuration does not match the following -X output when I change the configs to use "sql foo {". I am not seeing correct behavior in the post-auth section of sites-enabled/default: [...] (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if ("%{client:group}" == 'network-infrastructure') { (0) EXPAND %{client:group} (0) --> network-infrastructure (0) if ("%{client:group}" == 'network-infrastructure') -> TRUE (0) if ("%{client:group}" == 'network-infrastructure') { (0) if (foo:SQL-Group == 'network-admin') { (0) if (foo:SQL-Group == 'network-admin') -> FALSE (0) else { I am expecting the last FALSE to be TRUE, as in the -X output with the default sql configuration: (0) if (SQL-Group == 'network-admin') { (0) sql_groupcmp (0) EXPAND %{User-Name} (0) --> mzagrabe (0) SQL-User-Name set to 'mzagrabe' rlm_sql (sql): Reserved connection (5) rlm_sql (sql): Reserved connection (6) rlm_sql (sql): Released connection (6) (0) EXPAND SELECT GroupName FROM radius_user_group WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) --> SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority (0) Executing select query: SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 1 (0) sql_groupcmp finished: User is a member of group network-admin rlm_sql (sql): Released connection (5) (0) if (SQL-Group == 'network-admin') -> TRUE Here is what I have added to the top of my post-auth section: post-auth { if ("%{client:group}" == 'network-infrastructure') { if (foo:SQL-Group == 'network-admin') { update reply { APC-Service-Type = Admin # Set user type for Eaton UPS's Service-Type = Administrative-User } } else { reject } } I have also tried changing (in the same post-auth section) the -sql to -foo but it was not successful. Any hints or ideas about where to look next would be very appreciated. Thank you for your time! -m

2 2

Fetch ACL attributes from LDAP groups
by João Miguel Regateiro 31 Jul '23

31 Jul '23

Hello, I have a freeradius connected to openldap and i am testing applying ACL's fetched from LDAP attributes. The attributes are custom from ldap with the syntax as shown in the configuration below. With the following configurations i have managed to fetch the attributes from the user. mods-available/ldap update { control:Password-With-Header += 'userPassword' ... reply:DACL +="acl-entry-001, acl-entry-002 ... acl-entry-255" } dictionary ATTRIBUTE DACL 3000 string sites-available/default foreach &reply:DACL { update reply { cisco-avpair += "%{Foreach-Variable-0}" } Now I am attempting to do the same, but fetching the attributes from the User groups(to avoid writing the same ACL's on different users). I have done some research and tests, but have not managed to fetch any attribute from the groups. For example, I know that the group acl-admins has these attributes. If the user logging in has memberships acl-admins and network-admins. I want to fetch all the attributes "acl-entry-001, acl-entry-002 ... acl-entry-255" from the acl-admins to be able to update the reply with the foreach shown above. Could you provide some guidance in this matter? Best regards, Miguel

1 0

@ \ and " characters in password in freeradius
by Mesut GULNAZ 28 Jul '23

28 Jul '23

isn't it possible to use "@", "\" and " in the password in freeradius? -- İyi çalışmalar... Mesut GÜLNAZ

2 3

Help to increment freeradius wait timeout in
by Kamal Majaiti 28 Jul '23

28 Jul '23

Problem: Good morning, I am trying to perform a 2FA after a correct validation with MSCHAP against active directory, the postauth executes a script that sends an email with a link to confirm and authorize access, when the link is clicked, access is authorized based on data meanwhile the script with a while waits for the access to be confirmed but freeradius doesn't wait and gives me the following error: (0) Executing: /bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}: (0) EXPAND %{User-Name} (0) --> xxx Child PID 17681 is taking too much time: forcing failure and killing child. (0) ERROR: Failed to read from child output Debug output: (0) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (0) mschap: --> --username=xxx (0) mschap: mschap1: 76 (0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (0) mschap: --> --challenge=7698262ed349f8f8 (0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (0) mschap: --> --nt-response=d3ad349cc72bd9f1e9e835f73294102da06097b5f6158d4c (0) mschap: Program returned code (0) and output 'NT_KEY: D0ACA7FDF078A8FEBD326F3E18523349' (0) mschap: adding MS-CHAPv1 MPPE keys (0) [mschap] = ok (0) } # authenticate = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) update control { (0) Session-Timeout := 7200 (0) Executing: /bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}: (0) EXPAND %{User-Name} (0) --> xxx Child PID 17593 is taking too much time: forcing failure and killing child. (0) ERROR: Failed to read from child output (0) } # update control = fail (0) } # post-auth = fail (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> xxx (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop Config section: # Post-Authentication once we KNOW that the user has been authenticated, there are additional steps we can take.and get timeout error. post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY Session-Timeout := 7200 } } update { &reply: += &session-state: } -sql exec update control { Session-Timeout := 7200 Auth-Type := `/bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}` } remove_reply_message_if_eap Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject # Insert EAP-Failure message if the request was # rejected by policy instead of because of an # authentication failure eap # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap } # # Filter access challenges. # Post-Auth-Type Challenge { # remove_reply_message_if_eap # attr_filter.access_challenge.post-auth } Post-Auth-Type Client-Lost { } if (EAP-Key-Name && &reply:EAP-Session-Id) { update reply { &EAP-Key-Name := &reply:EAP-Session-Id } } } Regards, Kamal

2 1

Can't include a Dictionary referenced in radiusd.conf
by Scott Reeve 27 Jul '23

27 Jul '23

Created a new Ubuntu server VM (Ubuntu 22.04.2 LTS) and did 'apt get' for freeradius. All was fine until I tried to pull in a standard dictionary file like I've done many times in the past. It's the Mellanox dictionary file: VENDOR Mellanox 33049 BEGIN-VENDOR Mellanox ATTRIBUTE Local-User-Name 1 string END-VENDOR Mellanox It never complained about lack of braces before, but now I get this: including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnelincluding configuration file /etc/freeradius/3.0/sites-enabled/defaultincluding configuration file /root/mellanoxDictionary/root/mellanoxDictionary[11]: Expecting section start brace '{' after "VENDOR Mellanox"Errors reading or parsing /etc/freeradius/3.0/radiusd.conf Having the same message/error with another dictionary that I also have had no problem with in the past - only recently. (h3cDictionary). I added this line to the bottom of /etc/freeradius/3.0/radiusd.conf: $INCLUDE /root/mellanoxDictionary This has worked fine for years for me, but either the latest Ubuntu and/or the latest FreeRadius somehow do things a bit differently, it seems. Any suggestions?

2 1

Allow update statement to fail
by nabble＠felix.world 26 Jul '23

26 Jul '23

Hi there, is there a way to allow the update statement to fail and just proceed? For example if you want to update a attribute which is "just" for logging pruposes in the authorize section and the update statement failed it returnes 'failed' and stops processing other stuff and resulting in a failed authentication. In the documentation there is the option to rewrite return codes for modules but it seems that the update statement is not really a module or do i missunderstood something here? And i can't find a way in the documentation how to do it. As an example, is there a way to let the following authorize section be processed until the end even if the first update statement is not allowed? I know that it’s not allowed to update the outer request in that context. Just for illustration authorize { update { &outer.request:MyLogAttr := "It would nice to have it in the log but it's ok if not" } eap auth_log } Best regards, lineconnect

1 0