- Freeradius-Users - lists.freeradius.org

Problem using hased passwords
by Michael Schwartzkopff 30 Jun '23

30 Jun '23

Hi, I am trying to use a hased password, but I get the error: pap: ERROR: SHA1 digest does not match "known good" digest from the eap_gtc module. According to the compatibility matrix this should work. My setup: users file: user SHA-Password := "<SHA sum of the password, not salted>" Log: (31) files: users: Matched entry misch3 at line 101 (31) [files] = ok (...) (31) pap: Normalizing SHA-Password from hex encoding, 40 bytes -> 20 bytes (31) pap: WARNING: Auth-Type already set. Not setting to PAP (31) [pap] = noop (31) } # authorize = updated (31) eap_gtc: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (31) eap_gtc: Auth-Type PAP { (31) pap: Login attempt with password (31) pap: Comparing with "known-good" SHA-Password (31) pap: ERROR: SHA1 digest does not match "known good" digest (31) pap: Passwords don't match (31) eap_gtc: [pap] = reject (31) eap_gtc: } # Auth-Type PAP = reject Any ideas? I double checked the passwords and the SHA sum on both ends. Michael.

2 4

EAP TLS fatal protocol version
by roudi＠rjbsoft.co.za 25 Jun '23

25 Jun '23

Hi, I recently got a VPS for my RADIUS server as I am having issues keeping my local server online due to prolonged rolling blackouts. My new server is Ubuntu 22.04.2 and I have installed the latest FreeRADIUS v3.2.3 and I am using MySQL. My FreeRADIUS server is working perfectly for PPPoE authentication on Mikrotik. My problem comes in on my Ubiquiti Sectors where I have WPA2-Enterprise Authentication on the WiFi devices. My old server is running Ubuntu 18 with FreeRadius v3.0, and on that server my WPA2-Enterprise authentication is working perfectly. The error I am getting on the new server looks like this in the log file: (6) eap: Calling submodule eap_peap to process data (6) eap_peap: (TLS) EAP Peer says that the final record size will be 62 bytes (6) eap_peap: (TLS) EAP Got all data (62 bytes) (6) eap_peap: (TLS) Handshake state - before SSL initialization (6) eap_peap: (TLS) Handshake state - Server before SSL initialization (6) eap_peap: (TLS) Handshake state - Server before SSL initialization (6) eap_peap: (TLS) recv TLS 1.3 Handshake, ClientHello (6) eap_peap: (TLS) send TLS 1.0 Alert, fatal protocol_version (6) eap_peap: ERROR: (TLS) Alert write:fatal:protocol version (6) eap_peap: ERROR: (TLS) Server : Error in error (6) eap_peap: ERROR: (TLS) Failed reading from OpenSSL: error:0A000102:SSL routines::unsupported protocol (6) eap_peap: ERROR: (TLS) System call (I/O) error (-1) (6) eap_peap: ERROR: (TLS) EAP Receive handshake failed during operation (6) eap_peap: ERROR: [eaptls process] = fail (6) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (6) eap: Sending EAP Failure (code 4) ID 1 length 4 (6) eap: Failed in EAP select (6) [eap] = invalid (6) } # authenticate = invalid (6) Failed to authenticate the user The problem looks like the client is sending a TLS 1.3 Handshake, and FreeRADIUS is replying with a TLS 1.0 reply. I have also noticed that Ubuntu 22 is using OpenSSL 3.0.2 15 and Ubuntu 18 was using OpenSSL 1.1.1. And this is where, I suspect, my problem is, but I am unsure how to get around this. What I have tried: * Setting TLS Max version to 1.3 in eap config * Removing OpenSSL v3.0 and installing OpenSSL v1.1.1 on ubuntu 22, but this broke and removed a lot of stuff. * Downgraded to FreeRADIUS 3.0, same problem. I could just get a VPS with Ubuntu 18, but this realy defeats the point as Ubuntu 18 is almost at end of life, and having the latest OS would be a good option. Is there anyone out there that got WPA2-Enterprise authentication working on FreeRADIUS 3.0 or 3.2 on Ubuntu 22? Thanks Roudi

2 1

Changing radacct logs path
by Can Paçacı 23 Jun '23

23 Jun '23

Hi, I changed the radacct log directory location (radacctdir = /aaa/logs/radacct) in the radiud.conf file and also changed the owner of the destination directory and premission but it didn't work. Why? How can I do that. Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

4 5

Vendor specific attributes format eapol_test
by nabble＠felix.world 23 Jun '23

23 Jun '23

Hello, I know it’s not FreeRADIUS related but you may be able to help me to understand how vendor specific attributes work and how to correctly send them with eapol_test. Vendor specific attributes are in the RADIUS attribute 26 So with eapol_test the following flag `-N 26:x:00009f680305010000` would be in detail: 00009f68 = Vendor-Id in hex 03 = Vendor attribute id 05 = length 010000 = Value 05 should be the length if I understand it correctly. But after playing around a bit it confuses me more and more. Why is 010000 of length 05 and e.g. 11000342342342 of length 09? BR, Lineconnect

2 1

Re: FW: FreeRadius TOTP authenticate fail passcode validation
by João Miguel Regateiro 23 Jun '23

23 Jun '23

Hi there, Thanks for the previous response. Now I came across with two different problems, the first is with building the rlm_totp module and the second is during decoding the totp secret. I was able to get the correct totp and authenticate successfully even though the make totp returned some errors. The passcode was indeed incorrect because the module was generating the totp based on the system time. I changed the mods-available/date and set utc=yes and that fixed the problem (that was a misconfiguration on Universal Time vs System Time). I tried to build the rlm_totp (make totp) and got the following errors on undefined references ("fr_hmac_sha1" and "fr_digest_cmp"): rlm_totp.c: In function ‘main’: rlm_totp.c:336:44: warning: format ‘%llu’ expects argument of type ‘long long unsigned int *’, but argument 3 has type ‘uint64_t *’ {aka ‘long unsigned int *’} [-Wformat=] 336 | (void) sscanf(argv[2], "%llu", &now); | ~~~^ ~~~~ | | | | | uint64_t * {aka long unsigned int *} | long long unsigned int * | %lu At top level: rlm_totp.c:50:32: warning: ‘method_env’ defined but not used [-Wunused-const-variable=] 50 | static const call_method_env_t method_env = { | ^~~~~~~~~~ /bin/ld: /tmp/cccE8qoD.o: in function `totp_cmp': /home/mfa/freeradius-server/src/modules/rlm_totp/rlm_totp.c:209: undefined reference to `fr_hmac_sha1' /bin/ld: /home/mfa/freeradius-server/src/modules/rlm_totp/rlm_totp.c:229: undefined reference to `fr_digest_cmp' collect2: error: ld returned 1 exit status make: *** [Makefile:25: totp] Error 1 ------------------------------------------------------------------------------------------ In the last email I was using a standard shared secret just for testing purposes but my TOTP generator creates a 56 characters secret so I am using that and getting this message - “totp: TOTP-Secret cannot be decoded”. I’ve tried smaller secrets and it is always able to decode the secret which made me wonder if you have any restrictions on the secret length? Secret: 3R4VOYWSOR3YWEVRX74HRVXYXLMACQN3A457C24GS2OYG7EINHMBPQZO Base32 encoded: GNJDIVSPLFLVGT2SGNMVORKWKJMDONCIKJLFQWKYJRGUCQ2RJYZUCNBVG5BTENCHKMZE6WKHG5CUSTSIJVBFAUK2J4====== Fri Jun 23 11:42:00 2023 : Info: Ready to process requests Fri Jun 23 11:42:04 2023 : Debug: (2) Received Access-Request Id 192 from 10.56.143.110:59496 to 10.56.143.110:1812 length 73 Fri Jun 23 11:42:04 2023 : Debug: (2) User-Name = "bob" Fri Jun 23 11:42:04 2023 : Debug: (2) User-Password = "testing123123456" Fri Jun 23 11:42:04 2023 : Debug: (2) NAS-IP-Address = 10.56.143.110 Fri Jun 23 11:42:04 2023 : Debug: (2) NAS-Port = 1812 Fri Jun 23 11:42:04 2023 : Debug: (2) Message-Authenticator = 0x7641368bcad58c3250dd31f0e46e76d4 Fri Jun 23 11:42:04 2023 : Debug: (2) session-state: No State attribute Fri Jun 23 11:42:04 2023 : Debug: (2) # Executing section authorize from file /etc/raddb/sites-enabled/default Fri Jun 23 11:42:04 2023 : Debug: (2) authorize { Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authorize]: calling files (rlm_files) Fri Jun 23 11:42:04 2023 : Debug: (2) files: users: Matched entry bob at line 1 Fri Jun 23 11:42:04 2023 : Debug: Hello %{User-Name} Fri Jun 23 11:42:04 2023 : Debug: Parsed xlat tree: Fri Jun 23 11:42:04 2023 : Debug: literal --> Hello Fri Jun 23 11:42:04 2023 : Debug: attribute --> User-Name Fri Jun 23 11:42:04 2023 : Debug: literal --> Fri Jun 23 11:42:04 2023 : Debug: (2) files: EXPAND Hello %{User-Name} Fri Jun 23 11:42:04 2023 : Debug: (2) files: --> Hello bob Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authorize]: returned from files (rlm_files) Fri Jun 23 11:42:04 2023 : Debug: (2) [files] = ok Fri Jun 23 11:42:04 2023 : Debug: (2) if (User-Password !~ /^(.*)([0-9]{6})$/) { Fri Jun 23 11:42:04 2023 : Debug: (2) if (User-Password !~ /^(.*)([0-9]{6})$/) -> FALSE Fri Jun 23 11:42:04 2023 : Debug: (2) update request { Fri Jun 23 11:42:04 2023 : Debug: (2) EXPAND %{1} Fri Jun 23 11:42:04 2023 : Debug: (2) --> testing123 Fri Jun 23 11:42:04 2023 : Debug: (2) User-Password := testing123 Fri Jun 23 11:42:04 2023 : Debug: (2) Overwriting value "testing123123456" with "testing123" Fri Jun 23 11:42:04 2023 : Debug: (2) EXPAND %{2} Fri Jun 23 11:42:04 2023 : Debug: (2) --> 123456 Fri Jun 23 11:42:04 2023 : Debug: (2) TOTP-Password := 123456 Fri Jun 23 11:42:04 2023 : Debug: (2) } # update request = noop Fri Jun 23 11:42:04 2023 : Debug: (2) if (&User-Name == "bob") { Fri Jun 23 11:42:04 2023 : Debug: (2) if (&User-Name == "bob") -> TRUE Fri Jun 23 11:42:04 2023 : Debug: (2) if (&User-Name == "bob") { Fri Jun 23 11:42:04 2023 : Debug: (2) update control { Fri Jun 23 11:42:04 2023 : Debug: (2) TOTP-Secret := GNJDIVSPLFLVGT2SGNMVORKWKJMDONCIKJLFQWKYJRGUCQ2RJYZUCNBVG5BTENCHKMZE6WKHG5CUSTSIJVBFAUK2J4====== Fri Jun 23 11:42:04 2023 : Debug: (2) } # update control = noop Fri Jun 23 11:42:04 2023 : Debug: (2) } # if (&User-Name == "bob") = noop Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authenticate]: calling totp (rlm_totp) Fri Jun 23 11:42:04 2023 : Debug: (2) totp: TOTP-Secret cannot be decoded Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authenticate]: returned from totp (rlm_totp) Fri Jun 23 11:42:04 2023 : Debug: (2) [totp.authenticate] = fail Fri Jun 23 11:42:04 2023 : Debug: (2) } # authorize = fail Fri Jun 23 11:42:04 2023 : Debug: (2) Using Post-Auth-Type Reject Fri Jun 23 11:42:04 2023 : Debug: (2) Post-Auth-Type sub-section not found. Ignoring. Fri Jun 23 11:42:04 2023 : Debug: (2) # Executing group from file /etc/raddb/sites-enabled/default Fri Jun 23 11:42:04 2023 : Debug: (2) Delaying response for 1.000000 seconds Fri Jun 23 11:42:04 2023 : Debug: Waking up in 0.3 seconds. Fri Jun 23 11:42:04 2023 : Debug: Waking up in 0.6 seconds. Fri Jun 23 11:42:05 2023 : Debug: (2) Sending delayed response Fri Jun 23 11:42:05 2023 : Debug: (2) Sent Access-Reject Id 192 from 10.56.143.110:1812 to 10.56.143.110:59496 length 32 Fri Jun 23 11:42:05 2023 : Debug: (2) Reply-Message = "Hello bob " Fri Jun 23 11:42:05 2023 : Debug: Waking up in 3.9 seconds. Fri Jun 23 11:42:09 2023 : Debug: (2) Cleaning up request packet ID 192 with timestamp +32 due to cleanup_delay was reached Fri Jun 23 11:42:09 2023 : Info: Ready to process requests Thank you! Best regards, Miguel luis teixeira <luis.carlosteixeira(a)outlook.com> escreveu no dia sexta, 23/06/2023 à(s) 12:19: > > > ------------------------------ > *De:* Freeradius-Users <freeradius-users-bounces+luis.carlosteixeira= > hotmail.com(a)lists.freeradius.org> em nome de Alan DeKok < > aland(a)deployingradius.com> > *Enviado:* 20 de junho de 2023 14:50 > *Para:* FreeRadius users mailing list < > freeradius-users(a)lists.freeradius.org> > *Assunto:* Re: FreeRadius TOTP authenticate fail passcode validation > > On Jun 20, 2023, at 5:06 AM, João Miguel Regateiro <jmregateiro(a)gmail.com> > wrote:, > > > > > > I am working on a TOTP authentication method setup with FreeRadius. For > > starters I created the user “bob” on raddb/users and defined a password > to > > authenticate against the server > > I have got it to work with just normal user and password but when I try > to > > configure the TOTP module and testing using radiusd -X it shows the > > totp.authenticate the return fail. I have made sure that the date time is > > the same UTC +00 on all the environments, and generate the TOTP token > with > > sha-1, 6 digits code and 30seconds time frame. [Generate token in base > 32 = > > JJBFGV2ZGNCFARKIKBFTGUCYKA====== ] and [Generate default token = > > JBSWY3DPEHPK3PXP ] > > If it fails, then the short answer is that the TOTP doesn't match. > There isn't really much else which can go wrong. > > I've pushed changes to the v3.2.x branch which let you do "radiusd -Xx", > and the totp module will now print out the TOTP it expected, and the one it > received. You'll have to download and build v3.2.x in order to use it, > though. > > You can also build a command-line program to test the TOTP. Build the > source as normal, and then do: > > $ cd src/modules/rlm_totp > $ make totp > > And then can use the above key: > > $ ./totp totp 1687268891 JBSWY3DPEHPK3PXP 601664 > Time 1687268891 > Expected 601664 > Received 601664 > > or: > > $ ./totp totp now JBSWY3DPEHPK3PXP 123456 > Time 1687269000 > Expected 895298 > Received 123456 > Fail > > My guess is that the TOTP you're giving it is wrong. But increased > debug output will let you know exactly what's going on. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freer… > <http://www.freeradius.org/list/users.html> >

2 2

Problem building current master
by Ľudovít Mikula 22 Jun '23

22 Jun '23

I am having problem compiling current master (tried on fresh clone): CC src/lib/tls/conf.c src/lib/tls/conf.c:47:12: warning: ‘tls_conf_parse_cache_mode’ used but never defined 47 | static int tls_conf_parse_cache_mode(TALLOC_CTX *ctx, void *out, void *parent, CONF_ITEM *ci, CONF_PARSER const *rule); | ^~~~~~~~~~~~~~~~~~~~~~~~~ and later it fails with: LINK build/lib/libfreeradius-eap-aka-sim.la CC src/lib/server/pair_server_tests.c /usr/bin/ld: build/lib/local/.libs/libfreeradius-tls.so: undefined reference to `tls_conf_parse_cache_mode' collect2: error: ld returned 1 exit status make: *** [scripts/boiler.mk:731: build/bin/local/pair_server_tests] Error 1 Configured with: ./configure --prefix=/opt/freeradius Library configure status report ------------------------------- curl .................... OK eap ..................... OK eap_aka_sim ............. OK io ...................... OK json .................... OK kafka ................... skipping (requires rdkafka.h libhirdkafka) ldap .................... skipping (requires libldap (with async support) lber ldap.h) redis ................... OK server .................. OK sim ..................... OK tls ..................... OK unlang .................. OK util .................... OK Module configure status report ------------------------------ rlm_always .............. OK rlm_attr_filter ......... OK rlm_cache ............... OK rlm_cache_memcached ..... OK rlm_cache_rbtree ........ OK rlm_cache_redis ......... OK rlm_chap ................ OK rlm_cipher .............. OK rlm_client .............. OK rlm_couchbase ........... skipping (requires couchbase.h libcouchbase) rlm_csv ................. OK rlm_date ................ OK rlm_delay ............... OK rlm_detail .............. OK rlm_dhcpv4 .............. OK rlm_dict ................ OK rlm_digest .............. OK rlm_eap ................. OK rlm_eap_aka ............. OK rlm_eap_aka_prime ....... OK rlm_eap_fast ............ OK rlm_eap_gtc ............. OK rlm_eap_md5 ............. OK rlm_eap_mschapv2 ........ OK rlm_eap_peap ............ OK rlm_eap_pwd ............. OK rlm_eap_sim ............. OK rlm_eap_tls ............. OK rlm_eap_ttls ............ OK rlm_escape .............. OK rlm_exec ................ OK rlm_files ............... OK rlm_icmp ................ OK rlm_idn ................. OK rlm_imap ................ OK rlm_isc_dhcp ............ OK rlm_json ................ OK rlm_kafka ............... OK rlm_krb5 ................ OK rlm_ldap ................ OK rlm_linelog ............. OK rlm_logintime ........... OK rlm_logtee .............. OK rlm_lua ................. skipping (requires lua.h) rlm_mruby ............... skipping (requires mruby.h mruby/compile.h mruby/array.h libmruby libm) rlm_mschap .............. OK ... without opendirectory support without direct winbind support rlm_ocsp ................ OK rlm_opendirectory ....... skipping (requires membership.h) rlm_pam ................. OK rlm_pap ................. OK rlm_passwd .............. OK rlm_perl ................ OK rlm_python .............. OK rlm_radius .............. OK rlm_radutmp ............. OK rlm_redis ............... OK rlm_redis_ippool ........ OK rlm_rediswho ............ OK rlm_rest ................ OK rlm_securid ............. skipping (requires acexport.h libaceclnt) rlm_sigtran ............. skipping (requires osmocom/core/msgb.h osmocom/sccp/sccp.h libosmocore libsccp libxua libmtp) rlm_smtp ................ OK rlm_sometimes ........... OK rlm_sql ................. OK rlm_sql_cassandra ....... skipping (requires libcassandra (>= 2.0) cassandra.h) rlm_sql_db2 ............. skipping (requires libdb2 sqlcli.h) rlm_sql_firebird ........ skipping (requires libfbclient ibase.h) rlm_sql_freetds ......... skipping (requires ctpublic.h libct) rlm_sql_mysql ........... OK rlm_sql_null ............ OK rlm_sql_oracle .......... skipping (requires oci.h libclntsh libnnz[9-12]) rlm_sql_postgresql ...... skipping (requires libpq-fe.h libpq) rlm_sql_sqlite .......... skipping (requires libsqlite3 sqlite.h) rlm_sql_unixodbc ........ skipping (requires libodbc sql.h) rlm_sqlcounter .......... OK rlm_sqlippool ........... OK rlm_stats ............... OK rlm_tacacs .............. OK rlm_test ................ OK rlm_totp ................ OK rlm_unbound ............. OK rlm_unix ................ OK rlm_unpack .............. OK rlm_utf8 ................ OK rlm_wimax ............... OK rlm_winbind ............. skipping (requires wbclient.h core/ntstatus.h) rlm_yubikey ............. OK ... without yubikey token decryption support without yubicloud support -- Ludo

2 2

FreeRadius TOTP authenticate fail passcode validation
by João Miguel Regateiro 20 Jun '23

20 Jun '23

Hello, I am working on a TOTP authentication method setup with FreeRadius. For starters I created the user “bob” on raddb/users and defined a password to authenticate against the server I have got it to work with just normal user and password but when I try to configure the TOTP module and testing using radiusd -X it shows the totp.authenticate the return fail. I have made sure that the date time is the same UTC +00 on all the environments, and generate the TOTP token with sha-1, 6 digits code and 30seconds time frame. [Generate token in base 32 = JJBFGV2ZGNCFARKIKBFTGUCYKA====== ] and [Generate default token = JBSWY3DPEHPK3PXP ] This is the configuration file for sites-enable/default: authorize{ #TOTP Authorize if (User-Password !~ /^(.*)([0-9]{6})$/) { reject } update request { User-Password := "%{1}" TOTP-Password := "%{2}" } #Example Use BOB if (&User-Name == "bob") { update control { TOTP-Secret := JJBFGV2ZGNCFARKIKBFTGUCYKA====== } } totp.authenticate if (!ok) { reject } pap } authenticate { Auth-Type PAP { pap } } This is the configuration file of clients.conf : Client network-device { ipaddr = 192.168.1.0/24 secret = testing123 } Note: I have test to send the TOTP-Secret via update control or update request, and that gave me different output when call TOTP.authenticate returns fail or noop . Radius client test: radtest -t pap bob password123456 192.168.1.10:1812 1812 testing123 output radiusd -X Ready to process requests (0) Received Access-Request Id 38 from 192.168.1.10:48110 to 192.168.1.10:1812 length 73 (0) User-Name = "bob" (0) User-Password = "password" (0) NAS-IP-Address = 192.168.1.10 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x66c57ad78dea99a37b8edcf8c79ab46d (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/radius/radacct/ 192.168.1.10/auth-detail-20230619 (0) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.10/auth-detail-20230619 (0) auth_log: EXPAND %t (0) auth_log: --> Mon Jun 19 16:05:09 2023 (0) [auth_log] = ok (0) files: users: Matched entry bob at line 1 (0) files: EXPAND Hello %{User-Name} THE BUILDER :D (0) files: --> Hello bob THE BUILDER :D (0) [files] = ok (0) if (User-Password !~ /^(.*)([0-9]{6})$/) { (0) if (User-Password !~ /^(.*)([0-9]{6})$/) -> TRUE (0) if (User-Password !~ /^(.*)([0-9]{6})$/) { (0) [reject] = reject (0) } # if (User-Password !~ /^(.*)([0-9]{6})$/) = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> bob (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 38 from 192.168.1.10:1812 to 192.168.1.10:48110 length 47 (0) Reply-Message = "Hello bob THE BUILDER :D " Waking up in 3.9 seconds. (0) Cleaning up request packet ID 38 with timestamp +3 due to cleanup_delay was reached Ready to process requests Please let me know if you can help me on this 🙂 Thank you! Best regards, Miguel

2 2

Re: google_ldap and google-ldap-auth
by Mathias Maes 19 Jun '23

19 Jun '23

Hi Alan Thanks for your reply. Disabling the "filter_inner_tunnel' policy does indeed work. I am rather sure I didn't deliberately enable it and rechecked. But It was enabled in the example configuration script, check here on Github: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/sites-ava… I tried to follow the comments in the example Google configuration scripts. It went pretty good up until that point. Now I will try to expand with custom attributes. Thanks! Met vriendelijke groet Mathias Maes ICT-Coördinator Maerlant Atheneum

4 4

google_ldap and google-ldap-auth
by Mathias Maes 19 Jun '23

19 Jun '23

Hello I am trying to get google-ldap-auth working in conjuction with google-ldap. I have enabled the site and the module, also enabled cache-auth and ldap. Configured google-ldap with the right credentials. I changed as little as possible to the Google config (no groups, custom attributes, etc) freeradius -X starts without errors. I have not altered the default or inner-tunnel sites. I keep the example user 'bob" with password "hello" enabled to check if I did not mess anything up. radtest bob hello 127.0.0.1 0 testing123 is working. radtest mathias.maes(a)maerlantatheneum.be mypassword 127.0.0.1:18123 0 testing123 fails. It seems that "User-Name" is required for tunneled authentication. But on the second line of the logs, User-Name is available. and if(&User-Name) returns TRUE However, if (!&outer.request:User-Name || !&User-Name) returns TRUE, I'm not a software developer, but it seems that the User-Name is missing from the outer.request. So my question is, how to test the outer.request.User-name with radtest? Or if I understand the logs totally wrong: Any ideas on what might be happening? Thanks a bunch. Error log: (1) Received Access-Request Id 171 from 127.0.0.1:43929 to 127.0.0.1:18123 length 102 (1) User-Name = "mathias.maes(a)maerlantatheneum.be" (1) User-Password = "mypassword" (1) NAS-IP-Address = 127.0.1.1 (1) NAS-Port = 0 (1) Message-Authenticator = 0x50109b513ed143e12cacfa804d48b950 (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) policy filter_inner_identity { (1) if (!&outer.request:User-Name || !&User-Name) { (1) if (!&outer.request:User-Name || !&User-Name) -> TRUE (1) if (!&outer.request:User-Name || !&User-Name) { (1) update request { (1) Module-Failure-Message = "User-Name is required for tunneled authentication" (1) } # update request = noop (1) [reject] = reject (1) } # if (!&outer.request:User-Name || !&User-Name) = reject (1) } # policy filter_inner_identity = reject (1) } # authorize = reject (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> mathias.maes(a)maerlantatheneum.be (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) if (&control:Auth-Type == ldap) { (1) ERROR: Failed retrieving values required to evaluate condition (1) update control { (1) &Cache-TTL := 0 (1) } # update control = noop (1) cache_ldap_user_dn: EXPAND %{Stripped-User-Name} (1) cache_ldap_user_dn: --> (1) cache_ldap_user_dn: ERROR: Zero length key string is invalid (1) [cache_ldap_user_dn] = invalid (1) } # Post-Auth-Type REJECT = invalid (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 171 from 127.0.0.1:18123 to 127.0.0.1:43929 length 20 Met vriendelijke groet Mathias Maes ICT-Coördinator Maerlant Atheneum

2 1

Python Or Perl Module for Auth and Accounting
by Imdad Hasan 18 Jun '23

18 Jun '23

Hi All, Which module is better from perl and python if doing whole auth and accounting code in native language without using socket or any other language. like perl native code or python native code. Thanks Imdad

2 1