- Freeradius-Users - lists.freeradius.org

DPSK in 3.2
by Alan DeKok 22 Aug '23

22 Aug '23

I've just pushed patches to make DPSK work in 3.2. The module configuration is available on GitHub: https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-avai… The work isn't quite done yet, but the module works. The one remaining piece is to cache the identity associated with the PSK. As background, some AP vendors permit dynamic PSKs for WiFi access. This uses WPA-PSK, but the PSK is permitted to be different for different users on the same SSID. There are some issues with DPSK. In short, don't use it. It usually requires the server to try all possible PSKs before finding one that works. This process can be ver very slow. i.e. a reasonable modern system can do 100,000 of these PSK tests per second. So if you have 100,000 individual PSKs, then it can only handle one packet per second before the CPU maxes out. If you have 100 PSKs, then you're limited to 1000 packets per second. And that's doing nothing other than PSK checks. So the numbers are likely to be much lower than that in practice. To help with this performance issue, the module can cache PSK entries in memory. The first time it finds an unknown MAC, it has to brute-force the PSK. But once the PSK is found, the module caches the MAC+SSID+PSK. The next time it receives a packet for that MAC+SSID, the module finds the cache entry, and uses it. We've made it as good as possible considering the limitations of DPSK. But we still recommend that people don't use it. The DPSK functionality is simply broken, and there is really no way to make it efficient. Please see the module configuration for more details. Alan DeKok.

2 2

Accounting Start Time in Interim-Update of queries.conf is written differently between MySQL and Postgresql
by Ibrahim Al Mahfooz 18 Aug '23

18 Aug '23

Hello, I'm working on migrating from MySQL to Postgresql and during the process of customization of accounting section inside queries.conf file of Postgresql, I found a discrepancy in the accounting start time of the Interim-Update section made me wondering if there is any reason why not written in the same logic as MySQL queries.conf file, here is what I'm referring to: FR Version: 3.2.3 File paths: 1. Postgresql: /etc/raddb/mods-config/sql/main/postgresql/queries.conf 2. MySQL/etc/raddb/mods-config/sql/main/mysql/queries.conf The differences are in the accounting start time inside the interim-update section: - In mysql it is written as: FROM_UNIXTIME(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \ - While in postgresql it is: ${....event_timestamp}, \ I found that the line in postgresql queries actually causing the start to be inaccurate since it will reflect current time while it should reflect the elapsed time (current time - accounting session time) Having this, I had to change the line to this and it seems to be working: TO_TIMESTAMP(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \ Any reason why it is not written with the same logic of MySQL queries file? Will the change I made impose any risks or issues down the road? Thanks.

2 1

New and better documentation is now online
by Alan DeKok 18 Aug '23

18 Aug '23

We have put new documentation online at https://freeradius.org/documentation/freeradius-server/3.2.4/ The files are automatically generated from the "doc" directory in the source tree. We are using Antora (https://antora.org/) as the underlying layout tool. The result is not only improved documentation, but also documentation which is easier to navigate. Even better, for v4 (coming soon, really!) we have worked hard at documenting just about everything which can be documented. All of the features of "unlang" are documented, with syntax and examples. Almost every configuration file is available in the same documentation tree, with cross-links to modules, unlang, etc. I hope that this effort makes the server easier to use and configure. Alan DeKok.

6 6

How "bind as user" mode works?
by Rodrigo Abrantes Antunes 17 Aug '23

17 Aug '23

Hi, I was following this thread https://lists.freeradius.org/pipermail/freeradius-users/2020-May/098077.html There, is said this: "Check the help in the ldap module. There are update control Auth type lines inside that set the Auth type to ldap and will Auth with bind instead of reading the password from ldap". I have followed this guide and it works with radtest but not with wifi. https://www.nasirhafeez.com/freeradius-with-ldaps-on-azure-ad-domain-servic… Do I need to have access to the user password in active directory to allow wifi authentication with freeradius? I don't have this access and I thought the "bind as user" mode would solve this (bind with the logging in user, just like ldapsearch) but I think it is not what I thought. How can achieve that? Am I restricted to mschap?

3 13

raddebug
by Gerald Vogt 16 Aug '23

16 Aug '23

Hi! For whatever reason "raddebug" doesn't work on our new radius servers. On the old ones I could simply run "raddebug" or "raddebug -t 0" to capture the current debug logs. On the new one it shows nothing. It simply runs without any output. Running freeradius-3.2.3-1.el9.x86_64 on AlmaLinux 9. All the prerequisites mentioned in the raddebug(8) are met: * radmin is in the path. * I start raddebug as root thus permissions shouldn't matter. * control socket is configured in mode rw and is accessible. * It creates a file like "/var/log/radius/radmin.debug.101128" which remains empty as well. * I don't run multiple raddebug processes. So I don't understand why it's not working... Regards, Gerald

2 4

Initial simple test fails. Ver 3.0.20 from Ubuntu
by Pavel Aronsky 16 Aug '23

16 Aug '23

Dear experts, I'm very sorry for a lame help request but really don't know what else to do. I want to try the simplest setup for some small (embedded) client. So decided to begin with MD5 and username-password. Installed freeradius in Win11 WSL environment, Ubuntu 20.04.6 LTS, via apt install as usual. It brings version 3.0.20. As advised in "getting started" docum, made no changes anywhere besides adding a user and a client. In /etc/freeradius/3/0/users: at beginning: (which is symlnk to mods-config/files/authorize) JIG46 Cleartext-Password := "secret" In /etc/freeradius/3/0/clients.conf: after the existing localhost: client myswitch { ipaddr = 10.183.0.110 secret = testing123 require_message_authenticator = no proto = * nas_type = other } Then started the server on localohst and port 1645 (because the default port appears to be busy): sudo freeradius -X -xx -p 1645 -i localhost Then run : radtest -x -t eap-md5 JIG46 secret localhost:1645 0 testing123 Output: Loading input data... including dictionary file /usr/share/freeradius/dictionaryReading input vps from stdin Read 1 element(s) from input: stdin Loaded: 1 input element(s). Adding new socket: src: 0.0.0.0:0, dst: 127.0.0.1:1645 Added new socket: 5 (num sockets: 1) Transaction: 0, sending packet: 0 (id: 151)... Sent Access-Request Id 151 from 0.0.0.0:59783 to 127.0.0.1:1645 length 69 User-Name = "JIG46" Cleartext-Password = "secret" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 EAP-Code = Response EAP-Type-Identity = 0x4a49473436 EAP-Message = 0x024d000a014a49473436 Timeout for transaction: 0, tries (so far): 1 (max: 3)Transaction: 0, sending packet: 1 (id: 151)... ............ two more tries...... Timeout for transaction: 0, tries (so far): 3 (max: 3)No response for transaction: 0, giving upDeallocating (sockfd: 5, id: 151) Main loop: done. The server refuses to start EAP handshake - I don't see any errors due to unknown usernames or wrong passwords? Exactly the same outcome with a real client (a managed switch, with the client id myswitch, defined above). *** The complete log is here. https://gist.github.com/pavel-a/7b0c0c230ad28627218eade7fb0d1c61 Please advise? Is this because of WSL or something wrong in the configuration?? *** Windows firewall is OFF. - ddbug

2 5

freeradius exec module only works in debug mode (freeradius -X)
by Härtl, Calvin 14 Aug '23

14 Aug '23

Hi all, first of all, thank you for all the time and effort you have put into the Freeradius project! Sadly, I have run into a small issue, that I cannot figure out why it happens: In my sites-enabled/default file, I have written a small „Info Mail“ script, which basically just sends out an email with the rejected MAC address of a client: #First I check if the device MAC address is in my database, if not, send out a mail and reject the Access-Request if("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0){ %{exec:/usr/bin/sh -c "echo Unknown device '%{Calling-Station-ID}' at '%{Called-Station-ID}'. This device received a timeout of 5 minutes! | mailx -a 'From:radius001@stud.hs-coburg.de' -s '*** Security-Message ***' Calvin.haertl(a)stud.hs-coburg.de;echo NAC was activated!"} reject } In the debug mode (freeradius -X) everything works out great, and the mail gets sent out: rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) rlm_sql (sql): Reserved connection (2) rlm_sql (sql): Released connection (2) rlm_sql (sql): Reserved connection (3) (0) Executing select query: SELECT COUNT(*) FROM hw WHERE macad1 = '54:99:63:c0:11:4a' OR macad2 = '54:99:63:c0:11:4a' OR macad3 = '54:99:63:c0:11:4a' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (3) (0) EXPAND %{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'} (0) --> 0 (0) if ("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0) -> TRUE (0) if ("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0) { (0) Executing: /usr/bin/sh -c " echo Unknown device '%{Calling-Station-ID}' at '%{Called-Station-ID}'. This device received a timeout of 5 minutes! | mailx -a 'From:radius001@stud.hs-coburg.de' -s '***Security-Message***' Calvin.haertl(a)stud.hs-coburg.de;echo NAC was activated!“: (0) Program returned code (0) and output 'NAC was activated!' (0) EXPAND %{exec:/usr/bin/sh -c "echo Unknown device '%{Calling-Station-ID}' at '%{Called-Station-ID}'. This device received a timeout of 5 minutes! | mailx -a 'From:radius001@stud.hs-coburg.de' -s '*** Security-Message ***' Calvin.haertl(a)stud.hs-coburg.de;echo NAC was activated!"} (0) --> NAC was activated! (0) [reject] = reject (0) } # if ("%{sql:SELECT COUNT(*) FROM hw WHERE macad1 = '%{Calling-Station-ID}' OR macad2 = '%{Calling-Station-ID}' OR macad3 = '%{Calling-Station-ID}'}" == 0) = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> asd (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap: Request was previously rejected, inserting EAP-Failure (0) eap: Sending EAP Failure (code 4) ID 1 length 4 (0) [eap] = updated (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 92 from 10.11.1.17:1812 to 10.11.17.249:60492 length 44 (0) EAP-Message = 0x04010004 (0) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. However, as soon as I exit the debug mode and run freeradius as a daemon (systemctl start freeradius), freeradius still works as expected, but the mail no longer gets sent out. Everything else works just fine (users can hop onto the WiFi, etc.). Am I missing something here? Any help is appreciated! Best regards, Calvin

3 3

Issue with dynamic home servers in 3.2.3
by James Wood 10 Aug '23

10 Aug '23

I am trying to add OpenRoaming support via dynamic DNS lookups to FreeRADIUS 3.2.3 As per the doc at freeradius-server-3.2.3/doc/configuration/dynamic_home_servers.md it states you need to do the following: 1. Enable the control socket 2. Enable dynamic = true and set the directory = ${raddb}/home_servers/ in proxy.conf 3. Ensure the /mods-config/realm/freeradius-naptr-to-home-server.sh is present in order to perform real-time DNS lookups unknown realms. So far so good. The doc gives an example of what to use inside the authorize {} block. Here is my config (added the "aaa+auth:radius.tls.tcp" to the script's third parameter... if (User-Name =~ /(a)(.*)$/) { switch "%{home_server_dynamic:%{1}}" { case "1" { # Proxy to this one particular home server update control { &Home-Server-Name := "%{1}" } } case "0" { # Proxy with home server pool, failover, etc. update control { &Proxy-To-Realm := "%{1}" } } case { # no home server exists, ask DNS update control { # you can add a parameter for the NAPTR tag to look up, e.g. "aaa+auth:radius.tls.tcp" (RFC7585, OpenRoaming) # if the third parameter is omitted, it defaults to "x-eduroam:radius.tls" &Temp-Home-Server-String := `%{config:confdir}/mods-config/realm/freeradius-naptr-to-home-server.sh -d %{config:confdir} %{1} aaa+auth:radius.tls.tcp` } if ("%{control:Temp-Home-Server-String}" == "" ) { update control { &Home-Server-Name := "%{1}" } } else { reject } } } } When testing this, I can see that it is performing the DNS lookup and adding a dynamic home server to the home_servers folder, but it still fails and doesn't actually proxy the request to the dynamically discovered server: (0) if (User-Name =~ /(a)(.*)$/) { (0) if (User-Name =~ /(a)(.*)$/) -> TRUE (0) if (User-Name =~ /(a)(.*)$/) { (0) switch %{home_server_dynamic:%{1}} { (0) EXPAND %{home_server_dynamic:%{1}} (0) --> (0) case { (0) update control { (0) Executing: %{config:confdir}/mods-config/realm/freeradius-naptr-to-home-server.sh -d %{config:confdir} %{1} aaa+auth:radius.tls.tcp: (0) EXPAND confdir (0) --> confdir (0) EXPAND %{config:confdir}/mods-config/realm/freeradius-naptr-to-home-server.sh (0) --> /usr/local/etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh (0) EXPAND confdir (0) --> confdir (0) EXPAND %{config:confdir} (0) --> /usr/local/etc/raddb (0) EXPAND %{1} (0) --> openroaming.goog Waking up in 0.3 seconds. ... new connection request on command socket Listening on command file /usr/local/var/run/radiusd/radiusd.sock Waking up in 0.2 seconds. radmin> add home_server file /usr/local/etc/raddb/home_servers/openroaming.goog including configuration file /usr/local/etc/raddb/home_servers/openroaming.goog including configuration file /usr/local/etc/raddb/home_servers/tls.conf home_server openroaming.goog { nonblock = no ipaddr = radsec.openroaming.goog IPv4 address [146.148.44.172] port = 2083 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } Waking up in 0.1 seconds. ... shutting down socket command file /usr/local/var/run/radiusd/radiusd.sock ... cleaning up socket command file /usr/local/var/run/radiusd/radiusd.sock Waking up in 0.1 seconds. (0) Program returned code (0) and output '' (0) &Temp-Home-Server-String := (0) } # update control = noop (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) if ("%{control:Temp-Home-Server-String}" == "" ) -> TRUE (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) [reject] = reject (0) } # if ("%{control:Temp-Home-Server-String}" == "" ) = reject (0) } # case = reject (0) } # switch %{home_server_dynamic:%{1}} = reject (0) } # if (User-Name =~ /(a)(.*)$/) = reject It seems if ("%{control:Temp-Home-Server-String}" == "" ) { is the offending line. Even though the naptr script succeeds and returns a code 0, it's marking it as failed. So, i reversed the if statement so I could at least test further: if ("%{control:Temp-Home-Server-String}" == "" ) { update control { &Home-Server-Name := "%{1}" } } else { reject } I now get the following: (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) if ("%{control:Temp-Home-Server-String}" == "" ) -> TRUE (0) if ("%{control:Temp-Home-Server-String}" == "" ) { (0) update control { (0) EXPAND %{1} (0) --> openroaming.goog (0) &Home-Server-Name := openroaming.goog (0) } # update control = noop (0) } # if ("%{control:Temp-Home-Server-String}" == "" ) = noop (0) ... skipping else: Preceding "if" was taken (0) } # case = noop (0) } # switch %{home_server_dynamic:%{1}} = noop (0) } # if (User-Name =~ /(a)(.*)$/) = noop (0) Proxying due to Home-Server-Name (0) There was no response configured: rejecting request Any thoughts on this? P.S. I think there is a bug in the freeradius-naptr-to-home-server.sh script, because it doesn't add the lines "secret" and "type" when it dynamically generates the home_server block. I had to modify it to add these lines in, else the radmin command failed to dynamically load it. Thanks

2 3

radtest No "known good" password
by thenderson＠system.de 10 Aug '23

10 Aug '23

Have done much Googling/Binging, cant find a similar situation. Debian 11. Installed with apt-get install freeradius freeradius-mysql freeradius-utils. Added to /etc/freeradius/mods-config/files/authorize: testing Cleartext-Password := password During that process I had to create the folder /etc/freeradius/mods-config/files, it was not already present. Naturally due to this, the authorize file is empty other than the one line I added. Then I: radtest testing password 127.0.0.1 0 testing123 Outputs are: On Terminal A: Sent Access-Request Id 29 from 0.0.0.0:53848 to 127.0.0.1:1812 length 77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "password" Received Access-Reject Id 29 from 127.0.0.1:1812 to 127.0.0.1:53848 length 20 (0) -: Expected Access-Accept got Access-Reject Debug from Terminal B: (8) Received Access-Request Id 29 from 127.0.0.1:53848 to 127.0.0.1:1812 length 77 (8) User-Name = "testing" (8) User-Password = "password" (8) NAS-IP-Address = 127.0.1.1 (8) NAS-Port = 0 (8) Message-Authenticator = 0xbf1bb85fcdf0c1a4fbc4c65ff5c466b0 (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "testing", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: No EAP-Message, not doing EAP (8) [eap] = noop (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = ok (8) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> testing (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 29 from 127.0.0.1:1812 to 127.0.0.1:53848 length 20 Waking up in 3.9 seconds. (8) Cleaning up request packet ID 29 with timestamp +2957 Random thought: is the MySQL package making FreeRadius expect a different configuration method? I thought it was required to install but Im not using any MySQL as far as I know, Im doing a very basic setup, authorizing some Cisco vIOS routers/switches. Im probably missing something fairly obvious. Please help? -- Tristan Henderson Network Support Engineer <mailto:thenderson@system.de> thenderson(a)system.de system.de System & Project GmbH Knesebeckstr. 96, 10623 Berlin <http://www.system.de/> www.system.de T +49 30 2902315 350 F +49 30 2902315 440 Amtsgericht Berlin-Charlottenburg: HRB 53740 Geschäftsführer: Peter Schulte, Wilhelm Boeddinghaus Think before you print!

4 7

Certificate chain untrusted
by Maciej Kowalka 10 Aug '23

10 Aug '23

Hi, I've got configures freeradius 3.2 with eap tls, and working certificates, users can be authorized to network but I get warnings every time : Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /C=PL/ST=MyState/O=MyOrg/CN=Intermediate CA (TLS) untrusted certificate with depth [0] subject name /C=PL/ST=MyState/O=MyOrg/CN=client Is there solution to this or so I have to ignore it, and live with it? Maciej

5 23