- Freeradius-Users - lists.freeradius.org

Certificate chain untrusted
by Maciej Kowalka 10 Aug '23

10 Aug '23

Hi, I've got configures freeradius 3.2 with eap tls, and working certificates, users can be authorized to network but I get warnings every time : Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /C=PL/ST=MyState/O=MyOrg/CN=Intermediate CA (TLS) untrusted certificate with depth [0] subject name /C=PL/ST=MyState/O=MyOrg/CN=client Is there solution to this or so I have to ignore it, and live with it? Maciej

5 23

crl cache refresh
by Peter Lee 08 Aug '23

08 Aug '23

Hi, A couple of questions regarding the crl cache auto refresh settings with fr release 3.2.2 check_crl = yes ca_path = ${cadir} ca_path_reload_interval = 86400 1. Does the reloading interval timer reset each time freeradius restart? 2. Is there a way to set an initial crl start time so that reloading at each interval can happen at expected time regardless when freeradius starts/restart? To make sure the crl update and fr reloading are in-sync. 3. Can ca_path_reload_interval interval be dynamically updated without restarting freeradius? Thanks.

2 1

Fwd: RADSEC / TLS errors but not sure why
by James Wood 08 Aug '23

08 Aug '23

Hi All, I'm currently testing out RADSEC/TLS on the latest version, 3.2.3, with openssl 3.0 on Ubuntu 22.04. The key, certificate and CA are correct and have been validated to match before using in the Freeradius config. When I start the daemon there are no errors indicating the key/cert don't match so I assume all is well. However, when a client connects over RADSEC/TLS (port 2083), Freeradius displays an SSL error. I've also tried the openssl s_client command and the same error is thrown. openssl s_client -showcerts -connect radius.hostname:2083 The key/cert is secp384r1 based. mods-enabled/eap: --------------------------- tls-config tls-common { private_key_password = whatever private_key_file = ${certdir}/my_key.key certificate_file = ${certdir}/my_key.crt ca_file = ${certdir}/my_key.ca dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "secp384r1" } --------------------------- sites-enabled/tls: --------------------------- listen { ipaddr = * port = 2083 type = auth+acct proto = tcp virtual_server = default clients = radsec limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } tls { private_key_password = whatever private_key_file = ${certdir}/my_key.key certificate_file = ${certdir}/my_key.key ca_file = ${certdir}/my_key.key dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" cipher_server_preference = no require_client_cert = no } } clients radsec { client all { ipaddr = 0.0.0.0/0 proto = tls secret = radsec } } home_server tls { ipaddr = 127.0.0.1 port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { private_key_password = whatever private_key_file = ${certdir}/purple.key certificate_file = ${certdir}/purple.crt ca_file = ${certdir}/purple.ca dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 8192 ca_path = ${cadir} cipher_list = "DEFAULT" } } home_server_pool tls { type = fail-over home_server = tls } realm tls { auth_pool = tls } --------------------------- radius debug: [snip] Listening on auth+acct proto tcp address * port 2083 (TLS) bound to server default Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 40253 Ready to process requests ... new connection request on TCP socket Listening on auth+acct from client (1.2.3.4, 38639) -> (*, 2083, virtual-server=default) Waking up in 0.9 seconds. (0) (TLS) Initiating new session (0) (TLS) Handshake state - before/accept initialization (0) (TLS) Handshake state - Server before/accept initialization (0) (TLS) recv TLS 1.2 Handshake, ClientHello (0) (TLS) send TLS 1.2 Alert, fatal handshake_failure (0) ERROR: (TLS) Alert write:fatal:handshake failure (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 38639 If I query a public radsec radius server on port 2083 using the openssl s_client command it returns the certificate list correctly etc. Is it a problem with my key/cert, openssl, or the client? Thanks

3 17

Restricting access for some devices to some groups
by Jarosław Kłopotek 07 Aug '23

07 Aug '23

Hi, I would like to restrict access to some devices (using ipaddresses). How do You assign group privileges with freeradius? (I tried to find some docs but without good results) I try: In SQL database: 1. I added table "nasgrouprestrictions" (id, nasname, groupname), Example DB results: (1, 10.100.0.1, superadm) (2, 10.100.0.1, users) (3, 10.100.0.2, superadm) (4, 10.100.0.3, users) 2. I created group "superadm" and assigned users in table radusergroup, login1, login2 are in "users" group login3 is in "superadm" and "users" group How to allow: login3 to login into all 10.100.0.{1,2,3} hosts and login1, login2 to login into only 10.100.0.{1,3} hosts ? But where to put SQL query? -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

3 4

Freeradius+AD - Login with EmployeeID
by Rodrigo Abrantes Antunes 07 Aug '23

07 Aug '23

Hello, I have a freeradius server authenticating users with active directory, the users login with the samaccountname. This is the ldap filter: (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}}) Now I need to enable the users to login with the employeeID. This is the ldap filter I tried: (employeeID=%{mschap_default:User-Name:-%{User-Name}})" The filter works in ldapsearch but not in freeradius. # Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group authorize { Mon Aug 7 10:23:44 2023 : Debug: [ad_all] performing user authorization for 1638828 Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: (employeeID=%{mschap_default:User-Name:-%{User-Name}}) -> (employeeID=1638828) Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: DC=xx,DC=xx,DC=xx,DC=xx -> DC=xx,DC=xx,DC=xx,DC=xx Mon Aug 7 10:23:44 2023 : Debug: ++[ad_all] = fail Mon Aug 7 10:23:44 2023 : Debug: +} # group authorize = fail Mon Aug 7 10:23:44 2023 : Debug: Using Post-Auth-Type REJECT Mon Aug 7 10:23:44 2023 : Debug: # Executing group from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group REJECT { Mon Aug 7 10:23:44 2023 : Debug: [attr_filter.access_reject] expand: %{User-Name} -> 1638828 Mon Aug 7 10:23:44 2023 : Debug: ++[attr_filter.access_reject] = updated Mon Aug 7 10:23:44 2023 : Debug: +} # group REJECT = updated Why freeradius can't filter with the employeeID attribute? Thanks.

2 5

Linelog and get rid of No Failure Reason
by TS 03 Aug '23

03 Aug '23

Hello, I am trying to consolidate logs and have only one log file with all needed data in it. This setup with Freeradius 3.2.3 with OpenLDAP 2.5.15. We are using EAP + MSCHAPv2, LDAP contains an attribute with NT Password. I am trying to get rid of "No Failure Reason" value of "reply:Reply-Message" variable in cases where: 1. user not found in LDAP 2. user's password is incorrect 3. user has Phase1 (EAP/TLS/...) or Phase2 (MSCHAPv2/GTC/...) misconfigured. I have pretty default configuration with small changes. I know I should modify Reply-Message but in which file and within which section(s)? Snippet from my custom linelog: reference = "inner_auth_log.%{%{reply:Packet-Type}:-format}" inner_auth_log { Access-Accept = "%d.%m.%Y@%H:%G|RESULT=OK |USER=%{User-Name}|WIFI_AP_IP=%{NAS-IP-Address}|CLIENT_MAC_ADDR=%{%{Calling-Station-Id}:-Unknown Caller Id}" Access-Reject = "%d.%m.%Y@%H:%G|RESULT=ERR|USER=%{User-Name}|WIFI_AP_IP=%{NAS-IP-Address}|CLIENT_MAC_ADDR=%{%{Calling-Station-Id}:-Unknown Caller Id}|MSG=%{%{reply:Reply-Message}:-No Failure Reason}" }

2 1

Samba radius authentication
by Jarosław Kłopotek 02 Aug '23

02 Aug '23

Hi, Is it possible to login in into samba share by using freeradius and get propper group assignment? I try switch as much authorize mechanizm as I could to freeradius. Tried to find native mechanizm in samba documentation but no info there :( -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

2 5

status-server
by Anatoliy 02 Aug '23

02 Aug '23

Hi team , when I am try to query status server for specific client I receive global stats and stats for specific client Is this expected behavior for FR , or it should return only stats for client ? For example # echo "Message-Authenticator = 0x00,FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-Number = 3" | radclient -x localhost:18121 status adminsecret Sent Status-Server Id 112 from 0.0.0.0:d5a0 to 127.0.0.1:18121 length 62 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = 35 FreeRADIUS-Stats-Client-Number = 3 Received Access-Accept Id 112 from 127.0.0.1:46c9 to 127.0.0.1:54688 length 476 FreeRADIUS-Total-Access-Requests = 430666 <<<<<<<<<< global stats for FR FreeRADIUS-Total-Access-Accepts = 679 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 679 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Auth-Conflicts = 0 FreeRADIUS-Total-Accounting-Requests = 1518800 FreeRADIUS-Total-Accounting-Responses = 1518800 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Acct-Conflicts = 0 FreeRADIUS-Stats-Client-Number = 3 FreeRADIUS-Stats-Client-IP-Address = 100.64.0.2 <<<<<<<< after this line , stats for this client. FreeRADIUS-Total-Access-Requests = 0 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 2404 FreeRADIUS-Total-Accounting-Responses = 2404 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0

2 2

Freeradius 2FA
by Jarosław Kłopotek 02 Aug '23

02 Aug '23

Hi guys, go a question - Is it possible to use freeradius with some 2FA somehow? Most perfect scenario would be: - try to log in on remote hosts, - remote server communicates with freeradius, - radius gives a question to some phone 2FA app, - then we get click "ALLOW" on the mobile 2FA app, - tadam we are logged in, -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

3 7

help with changing to use named instance of sql module
by Matt Zagrabelny 31 Jul '23

31 Jul '23

Greetings FR-users, Running freeradius 3.0.21+dfsg-2.2+deb11u1. The default FR configs (obviously!) work wonderfully. Thank you for making a robust system. I am attempting to deviate from those defaults and am hitting a snag. I would like to use multiple databases (within the sql module), thus I am attempting to change: sql { } to sql foo { } After successfully adding "foo", I can then add "bar". >From running -X it appears that I am connecting to "foo" correctly: (0) foo: EXPAND %{User-Name} (0) foo: --> mzagrabe (0) foo: SQL-User-Name set to 'mzagrabe' rlm_sql (foo): Reserved connection (0) (0) foo: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) foo: --> SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = 'mzagrabe' ORDER BY id (0) foo: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = 'mzagrabe' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) foo: User found in radcheck table (0) foo: Conditional check items matched, merging assignment check items (0) foo: Crypt-Password := "REDACTED" (0) foo: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) foo: --> SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = 'mzagrabe' ORDER BY id (0) foo: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = 'mzagrabe' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (foo): Reserved connection (1) rlm_sql (foo): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (foo): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='foo' host='foo-dev.example.com' user='radius_user' password='REDACTED' application_name='FreeRADIUS 3.0.21 - radiusd (foo)' Connected to database 'foo' on 'foo-dev.example.com' server version 130011, protocol version 3, backend PID 1378924 (0) foo: EXPAND SELECT GroupName FROM radius_user_group WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) foo: --> SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority (0) foo: Executing select query: SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 1 (0) foo: User found in the group table (0) foo: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = '%{foo-SQL-Group}' ORDER BY id (0) foo: --> SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = 'network-admin' ORDER BY id (0) foo: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = 'network-admin' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) foo: Group "network-admin": Conditional check items matched (0) foo: Group "network-admin": Merging assignment check items (0) foo: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = '%{foo-SQL-Group}' ORDER BY id (0) foo: --> SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = 'network-admin' ORDER BY id (0) foo: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = 'network-admin' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) foo: Group "network-admin": Merging reply items rlm_sql (foo): Released connection (0) (0) [foo] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) if ("%{client:group}" == 'two-factor-authentication-group') { (0) EXPAND %{client:group} (0) --> network-infrastructure (0) if ("%{client:group}" == 'two-factor-authentication-group') -> FALSE (0) else { (0) update control { (0) Proxy-To-Realm := 'default-authentication-realm' (0) } # update control = noop (0) } # else = noop (0) } # authorize = updated (0) Starting proxy to home server 10.0.0.1 port 1812 (0) server default { (0) } The above -X output is generally the same output as the working default sql configuration output. However, the default working sql configuration does not match the following -X output when I change the configs to use "sql foo {". I am not seeing correct behavior in the post-auth section of sites-enabled/default: [...] (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if ("%{client:group}" == 'network-infrastructure') { (0) EXPAND %{client:group} (0) --> network-infrastructure (0) if ("%{client:group}" == 'network-infrastructure') -> TRUE (0) if ("%{client:group}" == 'network-infrastructure') { (0) if (foo:SQL-Group == 'network-admin') { (0) if (foo:SQL-Group == 'network-admin') -> FALSE (0) else { I am expecting the last FALSE to be TRUE, as in the -X output with the default sql configuration: (0) if (SQL-Group == 'network-admin') { (0) sql_groupcmp (0) EXPAND %{User-Name} (0) --> mzagrabe (0) SQL-User-Name set to 'mzagrabe' rlm_sql (sql): Reserved connection (5) rlm_sql (sql): Reserved connection (6) rlm_sql (sql): Released connection (6) (0) EXPAND SELECT GroupName FROM radius_user_group WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) --> SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority (0) Executing select query: SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 1 (0) sql_groupcmp finished: User is a member of group network-admin rlm_sql (sql): Released connection (5) (0) if (SQL-Group == 'network-admin') -> TRUE Here is what I have added to the top of my post-auth section: post-auth { if ("%{client:group}" == 'network-infrastructure') { if (foo:SQL-Group == 'network-admin') { update reply { APC-Service-Type = Admin # Set user type for Eaton UPS's Service-Type = Administrative-User } } else { reject } } I have also tried changing (in the same post-auth section) the -sql to -foo but it was not successful. Any hints or ideas about where to look next would be very appreciated. Thank you for your time! -m

2 2