- Freeradius-Users - lists.freeradius.org

help with changing to use named instance of sql module
by Matt Zagrabelny 31 Jul '23

31 Jul '23

Greetings FR-users, Running freeradius 3.0.21+dfsg-2.2+deb11u1. The default FR configs (obviously!) work wonderfully. Thank you for making a robust system. I am attempting to deviate from those defaults and am hitting a snag. I would like to use multiple databases (within the sql module), thus I am attempting to change: sql { } to sql foo { } After successfully adding "foo", I can then add "bar". >From running -X it appears that I am connecting to "foo" correctly: (0) foo: EXPAND %{User-Name} (0) foo: --> mzagrabe (0) foo: SQL-User-Name set to 'mzagrabe' rlm_sql (foo): Reserved connection (0) (0) foo: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) foo: --> SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = 'mzagrabe' ORDER BY id (0) foo: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = 'mzagrabe' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) foo: User found in radcheck table (0) foo: Conditional check items matched, merging assignment check items (0) foo: Crypt-Password := "REDACTED" (0) foo: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) foo: --> SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = 'mzagrabe' ORDER BY id (0) foo: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = 'mzagrabe' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (foo): Reserved connection (1) rlm_sql (foo): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (foo): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='foo' host='foo-dev.example.com' user='radius_user' password='REDACTED' application_name='FreeRADIUS 3.0.21 - radiusd (foo)' Connected to database 'foo' on 'foo-dev.example.com' server version 130011, protocol version 3, backend PID 1378924 (0) foo: EXPAND SELECT GroupName FROM radius_user_group WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) foo: --> SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority (0) foo: Executing select query: SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 1 (0) foo: User found in the group table (0) foo: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = '%{foo-SQL-Group}' ORDER BY id (0) foo: --> SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = 'network-admin' ORDER BY id (0) foo: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = 'network-admin' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) foo: Group "network-admin": Conditional check items matched (0) foo: Group "network-admin": Merging assignment check items (0) foo: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = '%{foo-SQL-Group}' ORDER BY id (0) foo: --> SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = 'network-admin' ORDER BY id (0) foo: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = 'network-admin' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) foo: Group "network-admin": Merging reply items rlm_sql (foo): Released connection (0) (0) [foo] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) if ("%{client:group}" == 'two-factor-authentication-group') { (0) EXPAND %{client:group} (0) --> network-infrastructure (0) if ("%{client:group}" == 'two-factor-authentication-group') -> FALSE (0) else { (0) update control { (0) Proxy-To-Realm := 'default-authentication-realm' (0) } # update control = noop (0) } # else = noop (0) } # authorize = updated (0) Starting proxy to home server 10.0.0.1 port 1812 (0) server default { (0) } The above -X output is generally the same output as the working default sql configuration output. However, the default working sql configuration does not match the following -X output when I change the configs to use "sql foo {". I am not seeing correct behavior in the post-auth section of sites-enabled/default: [...] (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if ("%{client:group}" == 'network-infrastructure') { (0) EXPAND %{client:group} (0) --> network-infrastructure (0) if ("%{client:group}" == 'network-infrastructure') -> TRUE (0) if ("%{client:group}" == 'network-infrastructure') { (0) if (foo:SQL-Group == 'network-admin') { (0) if (foo:SQL-Group == 'network-admin') -> FALSE (0) else { I am expecting the last FALSE to be TRUE, as in the -X output with the default sql configuration: (0) if (SQL-Group == 'network-admin') { (0) sql_groupcmp (0) EXPAND %{User-Name} (0) --> mzagrabe (0) SQL-User-Name set to 'mzagrabe' rlm_sql (sql): Reserved connection (5) rlm_sql (sql): Reserved connection (6) rlm_sql (sql): Released connection (6) (0) EXPAND SELECT GroupName FROM radius_user_group WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) --> SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority (0) Executing select query: SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 1 (0) sql_groupcmp finished: User is a member of group network-admin rlm_sql (sql): Released connection (5) (0) if (SQL-Group == 'network-admin') -> TRUE Here is what I have added to the top of my post-auth section: post-auth { if ("%{client:group}" == 'network-infrastructure') { if (foo:SQL-Group == 'network-admin') { update reply { APC-Service-Type = Admin # Set user type for Eaton UPS's Service-Type = Administrative-User } } else { reject } } I have also tried changing (in the same post-auth section) the -sql to -foo but it was not successful. Any hints or ideas about where to look next would be very appreciated. Thank you for your time! -m

2 2

Fetch ACL attributes from LDAP groups
by João Miguel Regateiro 31 Jul '23

31 Jul '23

Hello, I have a freeradius connected to openldap and i am testing applying ACL's fetched from LDAP attributes. The attributes are custom from ldap with the syntax as shown in the configuration below. With the following configurations i have managed to fetch the attributes from the user. mods-available/ldap update { control:Password-With-Header += 'userPassword' ... reply:DACL +="acl-entry-001, acl-entry-002 ... acl-entry-255" } dictionary ATTRIBUTE DACL 3000 string sites-available/default foreach &reply:DACL { update reply { cisco-avpair += "%{Foreach-Variable-0}" } Now I am attempting to do the same, but fetching the attributes from the User groups(to avoid writing the same ACL's on different users). I have done some research and tests, but have not managed to fetch any attribute from the groups. For example, I know that the group acl-admins has these attributes. If the user logging in has memberships acl-admins and network-admins. I want to fetch all the attributes "acl-entry-001, acl-entry-002 ... acl-entry-255" from the acl-admins to be able to update the reply with the foreach shown above. Could you provide some guidance in this matter? Best regards, Miguel

1 0

@ \ and " characters in password in freeradius
by Mesut GULNAZ 28 Jul '23

28 Jul '23

isn't it possible to use "@", "\" and " in the password in freeradius? -- İyi çalışmalar... Mesut GÜLNAZ

2 3

Help to increment freeradius wait timeout in
by Kamal Majaiti 28 Jul '23

28 Jul '23

Problem: Good morning, I am trying to perform a 2FA after a correct validation with MSCHAP against active directory, the postauth executes a script that sends an email with a link to confirm and authorize access, when the link is clicked, access is authorized based on data meanwhile the script with a while waits for the access to be confirmed but freeradius doesn't wait and gives me the following error: (0) Executing: /bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}: (0) EXPAND %{User-Name} (0) --> xxx Child PID 17681 is taking too much time: forcing failure and killing child. (0) ERROR: Failed to read from child output Debug output: (0) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (0) mschap: --> --username=xxx (0) mschap: mschap1: 76 (0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (0) mschap: --> --challenge=7698262ed349f8f8 (0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (0) mschap: --> --nt-response=d3ad349cc72bd9f1e9e835f73294102da06097b5f6158d4c (0) mschap: Program returned code (0) and output 'NT_KEY: D0ACA7FDF078A8FEBD326F3E18523349' (0) mschap: adding MS-CHAPv1 MPPE keys (0) [mschap] = ok (0) } # authenticate = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) update control { (0) Session-Timeout := 7200 (0) Executing: /bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}: (0) EXPAND %{User-Name} (0) --> xxx Child PID 17593 is taking too much time: forcing failure and killing child. (0) ERROR: Failed to read from child output (0) } # update control = fail (0) } # post-auth = fail (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> xxx (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop Config section: # Post-Authentication once we KNOW that the user has been authenticated, there are additional steps we can take.and get timeout error. post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY Session-Timeout := 7200 } } update { &reply: += &session-state: } -sql exec update control { Session-Timeout := 7200 Auth-Type := `/bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}` } remove_reply_message_if_eap Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject # Insert EAP-Failure message if the request was # rejected by policy instead of because of an # authentication failure eap # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap } # # Filter access challenges. # Post-Auth-Type Challenge { # remove_reply_message_if_eap # attr_filter.access_challenge.post-auth } Post-Auth-Type Client-Lost { } if (EAP-Key-Name && &reply:EAP-Session-Id) { update reply { &EAP-Key-Name := &reply:EAP-Session-Id } } } Regards, Kamal

2 1

Can't include a Dictionary referenced in radiusd.conf
by Scott Reeve 27 Jul '23

27 Jul '23

Created a new Ubuntu server VM (Ubuntu 22.04.2 LTS) and did 'apt get' for freeradius. All was fine until I tried to pull in a standard dictionary file like I've done many times in the past. It's the Mellanox dictionary file: VENDOR Mellanox 33049 BEGIN-VENDOR Mellanox ATTRIBUTE Local-User-Name 1 string END-VENDOR Mellanox It never complained about lack of braces before, but now I get this: including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnelincluding configuration file /etc/freeradius/3.0/sites-enabled/defaultincluding configuration file /root/mellanoxDictionary/root/mellanoxDictionary[11]: Expecting section start brace '{' after "VENDOR Mellanox"Errors reading or parsing /etc/freeradius/3.0/radiusd.conf Having the same message/error with another dictionary that I also have had no problem with in the past - only recently. (h3cDictionary). I added this line to the bottom of /etc/freeradius/3.0/radiusd.conf: $INCLUDE /root/mellanoxDictionary This has worked fine for years for me, but either the latest Ubuntu and/or the latest FreeRadius somehow do things a bit differently, it seems. Any suggestions?

2 1

Allow update statement to fail
by nabble＠felix.world 26 Jul '23

26 Jul '23

Hi there, is there a way to allow the update statement to fail and just proceed? For example if you want to update a attribute which is "just" for logging pruposes in the authorize section and the update statement failed it returnes 'failed' and stops processing other stuff and resulting in a failed authentication. In the documentation there is the option to rewrite return codes for modules but it seems that the update statement is not really a module or do i missunderstood something here? And i can't find a way in the documentation how to do it. As an example, is there a way to let the following authorize section be processed until the end even if the first update statement is not allowed? I know that it’s not allowed to update the outer request in that context. Just for illustration authorize { update { &outer.request:MyLogAttr := "It would nice to have it in the log but it's ok if not" } eap auth_log } Best regards, lineconnect

1 0

odd messages in radius.log
by Matt H 25 Jul '23

25 Jul '23

Hello - I'm seeing an odd message in /var/log/radius/radius.log - freeradius 3.0.20 Fri Jul 21 11:07:24 2023 : ERROR: (106416) eap_peap: ERROR: TLS Alert read:fatal:unknown CA I would expect that EAP would be failing; it's not, apparently, as users are able to connect and auth (WPA2-Enterprise). I've checked our certs (radius.companyname.crt, pem, etc) and they're up to date. When I run openssl x509 -noout -text -in <file>, everything looks good except that the first cert in the chain has FALSE rather than TRUE for this setting: X509v3 Basic Constraints: critical CA:FALSE Not sure whether or not this is a red herring. Either way, it hasn't changed since the first of June (with no new certs and no other changes ) and the error didn't start showing up in radius.log about the first of July. I haven't provided a full radiusd -X output bc it's a production machine, but can do if necessary. thanks/mh -- Death before dishonour, Nothing before coffee

2 2

question about DHCP-DHCP-Server-Identifier
by Levi Baber 23 Jul '23

23 Jul '23

I'm currently testing my configuration for freeradius as a dhcp server - I'm not yet utilizing any of the radius services - just dhcp. I have multiple vlans (each vlan is an independent network). In my test config, I have two networks defined in raddb/mods-config/files/dhcp under the 'network' section, and I am calling the dhcp_network section from raddb/sites-enabled/dhcp. Everything seems to be working fine with the example options, except it seems I need to set DHCP-DHCP-Server-Identifier somewhere to ensure requests come to the server correctly. Otherwise, I just continue to see discover/offer repeatedly in the debug log. I've currently got it set in the network section of raddb/mods-config/files/dhcp - that seems fine. I've also tried adding it under both DHCP-Discover and DHCP-Request in an 'update reply' - that also worked. If I set DHCP-DHCP-Server-Identifier to my server IP, it all seems to work as expected. I'm confused because: A. this wasn't part of the example options, so I assumed it would not be need to be added B. DHCP-DHCP-Server-Identifier is already defined under "update control" in both DHCP-Discover and DHCP-Request sections of raddb/sites-enabled/dhcp C. comments in raddb/sites-available/dhcp said to use either dhcp_common or dhcp_network - but not both. I noticed the option difference between raddb/policy.d/dhcp and raddb/mods-config/files/dhcp was DHCP-DHCP-Server-Identifier, and adding it has fixed my problem. Basically I just want to be sure I'm not doing something dumb by adding it where I have it, and that I'm correctly understanding how the config files are intended to work. Thank you -- <https://boonecsd.org> 500 7th Street <https://www.google.com/maps/dir//42.0623769,-93.8859242/@42.0624429,-93.886…> | Boone, IA 50036 <https://www.google.com/maps/dir//42.0623769,-93.8859242/@42.0624429,-93.886…> | tel (515) 433-0750 | fax (515) 433-0753Website <https://boonecsd.org> | Twitter <https://twitter.com/BooneSchools> | Facebook <https://www.facebook.com/Boone-Community-School-District-111182762280156> | BooneTV <http://www.boonetv.com/>

2 1

802.1x with GoDaddy Certificates EAP-TTLS
by Torsten Wilms 22 Jul '23

22 Jul '23

I have a little question. I am not sure but does clients need to resolve AAA Server via DNS and need to reach AAA Server if I use EAP-TTLS with GoDaddy x509 Certificates to verify the certificate on e.g. Mobile Devices or does the client need in any other case to reach some endpoint to validate the certificates common name? I have a AAA Server in a separate Network installed which is only reachable for the authenticator (Wireless Controller). The Clients communicate with the AccessPoint. A hand full devices like Android are not able to connect the wireless because of certificate validation error. The other devices has no problems. You see the certificate of the server and after accept, the connection will be established. The AAA Server sends the full chain like RootCA, Intermediate and server certificate. BR. Torsten

6 17

Building freeradius against mariadb client library
by Bill Schoolfield 21 Jul '23

21 Jul '23

We deploy freeradius with our application for a on premise joint solution. We build freeradius from source and include the source and binaries in a installation package. We use rlm_perl and rlm_sql modules With all the issues with Redhat (IBM) we are presently trying to build a new release for Debian 12. It doesn't appear (we could be completely wrong here) that the mysql client libraries are available. I do see mention of them online in a package named default-libmysqlclient-dev but a package search using dpkg-query reveals nothing by that name. I either need the appropriate packages for Debian, or I need to alter the build to use the mariadb library and includes. Perhaps modifying configure.ac to use mariadb_config? What is the solution here?

2 6