- Freeradius-Users - lists.freeradius.org

@ \ and " characters in password in freeradius
by Mesut GULNAZ 28 Jul '23

28 Jul '23

isn't it possible to use "@", "\" and " in the password in freeradius? -- İyi çalışmalar... Mesut GÜLNAZ

2 3

Help to increment freeradius wait timeout in
by Kamal Majaiti 28 Jul '23

28 Jul '23

Problem: Good morning, I am trying to perform a 2FA after a correct validation with MSCHAP against active directory, the postauth executes a script that sends an email with a link to confirm and authorize access, when the link is clicked, access is authorized based on data meanwhile the script with a while waits for the access to be confirmed but freeradius doesn't wait and gives me the following error: (0) Executing: /bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}: (0) EXPAND %{User-Name} (0) --> xxx Child PID 17681 is taking too much time: forcing failure and killing child. (0) ERROR: Failed to read from child output Debug output: (0) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (0) mschap: --> --username=xxx (0) mschap: mschap1: 76 (0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (0) mschap: --> --challenge=7698262ed349f8f8 (0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (0) mschap: --> --nt-response=d3ad349cc72bd9f1e9e835f73294102da06097b5f6158d4c (0) mschap: Program returned code (0) and output 'NT_KEY: D0ACA7FDF078A8FEBD326F3E18523349' (0) mschap: adding MS-CHAPv1 MPPE keys (0) [mschap] = ok (0) } # authenticate = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) update control { (0) Session-Timeout := 7200 (0) Executing: /bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}: (0) EXPAND %{User-Name} (0) --> xxx Child PID 17593 is taking too much time: forcing failure and killing child. (0) ERROR: Failed to read from child output (0) } # update control = fail (0) } # post-auth = fail (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> xxx (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop Config section: # Post-Authentication once we KNOW that the user has been authenticated, there are additional steps we can take.and get timeout error. post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY Session-Timeout := 7200 } } update { &reply: += &session-state: } -sql exec update control { Session-Timeout := 7200 Auth-Type := `/bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}` } remove_reply_message_if_eap Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject # Insert EAP-Failure message if the request was # rejected by policy instead of because of an # authentication failure eap # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap } # # Filter access challenges. # Post-Auth-Type Challenge { # remove_reply_message_if_eap # attr_filter.access_challenge.post-auth } Post-Auth-Type Client-Lost { } if (EAP-Key-Name && &reply:EAP-Session-Id) { update reply { &EAP-Key-Name := &reply:EAP-Session-Id } } } Regards, Kamal

2 1

Can't include a Dictionary referenced in radiusd.conf
by Scott Reeve 27 Jul '23

27 Jul '23

Created a new Ubuntu server VM (Ubuntu 22.04.2 LTS) and did 'apt get' for freeradius. All was fine until I tried to pull in a standard dictionary file like I've done many times in the past. It's the Mellanox dictionary file: VENDOR Mellanox 33049 BEGIN-VENDOR Mellanox ATTRIBUTE Local-User-Name 1 string END-VENDOR Mellanox It never complained about lack of braces before, but now I get this: including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnelincluding configuration file /etc/freeradius/3.0/sites-enabled/defaultincluding configuration file /root/mellanoxDictionary/root/mellanoxDictionary[11]: Expecting section start brace '{' after "VENDOR Mellanox"Errors reading or parsing /etc/freeradius/3.0/radiusd.conf Having the same message/error with another dictionary that I also have had no problem with in the past - only recently. (h3cDictionary). I added this line to the bottom of /etc/freeradius/3.0/radiusd.conf: $INCLUDE /root/mellanoxDictionary This has worked fine for years for me, but either the latest Ubuntu and/or the latest FreeRadius somehow do things a bit differently, it seems. Any suggestions?

2 1

Allow update statement to fail
by nabble＠felix.world 26 Jul '23

26 Jul '23

Hi there, is there a way to allow the update statement to fail and just proceed? For example if you want to update a attribute which is "just" for logging pruposes in the authorize section and the update statement failed it returnes 'failed' and stops processing other stuff and resulting in a failed authentication. In the documentation there is the option to rewrite return codes for modules but it seems that the update statement is not really a module or do i missunderstood something here? And i can't find a way in the documentation how to do it. As an example, is there a way to let the following authorize section be processed until the end even if the first update statement is not allowed? I know that it’s not allowed to update the outer request in that context. Just for illustration authorize { update { &outer.request:MyLogAttr := "It would nice to have it in the log but it's ok if not" } eap auth_log } Best regards, lineconnect

1 0

odd messages in radius.log
by Matt H 25 Jul '23

25 Jul '23

Hello - I'm seeing an odd message in /var/log/radius/radius.log - freeradius 3.0.20 Fri Jul 21 11:07:24 2023 : ERROR: (106416) eap_peap: ERROR: TLS Alert read:fatal:unknown CA I would expect that EAP would be failing; it's not, apparently, as users are able to connect and auth (WPA2-Enterprise). I've checked our certs (radius.companyname.crt, pem, etc) and they're up to date. When I run openssl x509 -noout -text -in <file>, everything looks good except that the first cert in the chain has FALSE rather than TRUE for this setting: X509v3 Basic Constraints: critical CA:FALSE Not sure whether or not this is a red herring. Either way, it hasn't changed since the first of June (with no new certs and no other changes ) and the error didn't start showing up in radius.log about the first of July. I haven't provided a full radiusd -X output bc it's a production machine, but can do if necessary. thanks/mh -- Death before dishonour, Nothing before coffee

2 2

question about DHCP-DHCP-Server-Identifier
by Levi Baber 23 Jul '23

23 Jul '23

I'm currently testing my configuration for freeradius as a dhcp server - I'm not yet utilizing any of the radius services - just dhcp. I have multiple vlans (each vlan is an independent network). In my test config, I have two networks defined in raddb/mods-config/files/dhcp under the 'network' section, and I am calling the dhcp_network section from raddb/sites-enabled/dhcp. Everything seems to be working fine with the example options, except it seems I need to set DHCP-DHCP-Server-Identifier somewhere to ensure requests come to the server correctly. Otherwise, I just continue to see discover/offer repeatedly in the debug log. I've currently got it set in the network section of raddb/mods-config/files/dhcp - that seems fine. I've also tried adding it under both DHCP-Discover and DHCP-Request in an 'update reply' - that also worked. If I set DHCP-DHCP-Server-Identifier to my server IP, it all seems to work as expected. I'm confused because: A. this wasn't part of the example options, so I assumed it would not be need to be added B. DHCP-DHCP-Server-Identifier is already defined under "update control" in both DHCP-Discover and DHCP-Request sections of raddb/sites-enabled/dhcp C. comments in raddb/sites-available/dhcp said to use either dhcp_common or dhcp_network - but not both. I noticed the option difference between raddb/policy.d/dhcp and raddb/mods-config/files/dhcp was DHCP-DHCP-Server-Identifier, and adding it has fixed my problem. Basically I just want to be sure I'm not doing something dumb by adding it where I have it, and that I'm correctly understanding how the config files are intended to work. Thank you -- <https://boonecsd.org> 500 7th Street <https://www.google.com/maps/dir//42.0623769,-93.8859242/@42.0624429,-93.886…> | Boone, IA 50036 <https://www.google.com/maps/dir//42.0623769,-93.8859242/@42.0624429,-93.886…> | tel (515) 433-0750 | fax (515) 433-0753Website <https://boonecsd.org> | Twitter <https://twitter.com/BooneSchools> | Facebook <https://www.facebook.com/Boone-Community-School-District-111182762280156> | BooneTV <http://www.boonetv.com/>

2 1

802.1x with GoDaddy Certificates EAP-TTLS
by Torsten Wilms 22 Jul '23

22 Jul '23

I have a little question. I am not sure but does clients need to resolve AAA Server via DNS and need to reach AAA Server if I use EAP-TTLS with GoDaddy x509 Certificates to verify the certificate on e.g. Mobile Devices or does the client need in any other case to reach some endpoint to validate the certificates common name? I have a AAA Server in a separate Network installed which is only reachable for the authenticator (Wireless Controller). The Clients communicate with the AccessPoint. A hand full devices like Android are not able to connect the wireless because of certificate validation error. The other devices has no problems. You see the certificate of the server and after accept, the connection will be established. The AAA Server sends the full chain like RootCA, Intermediate and server certificate. BR. Torsten

6 17

Building freeradius against mariadb client library
by Bill Schoolfield 21 Jul '23

21 Jul '23

We deploy freeradius with our application for a on premise joint solution. We build freeradius from source and include the source and binaries in a installation package. We use rlm_perl and rlm_sql modules With all the issues with Redhat (IBM) we are presently trying to build a new release for Debian 12. It doesn't appear (we could be completely wrong here) that the mysql client libraries are available. I do see mention of them online in a package named default-libmysqlclient-dev but a package search using dpkg-query reveals nothing by that name. I either need the appropriate packages for Debian, or I need to alter the build to use the mariadb library and includes. Perhaps modifying configure.ac to use mariadb_config? What is the solution here?

2 6

Unable to start freerad with sudo
by Stanislav Lorenc 20 Jul '23

20 Jul '23

Hi, I can`t start freerad with sudo under lxc Under debug mode server is started: sudo -u www-data /usr/sbin/freeradius -f -X Listening on auth address * port 5000 bound to server test_local_pppoe_services Listening on acct address * port 1813 bound to server test_local_pppoe_services Listening on proxy address * port 52599 Ready to process requests but in the service command server failed sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details. I went through all the logs, but I can't find anywhere if the problem is in radius, systemd, lxc or apparmor. Thanks for tips Regards SL

7 10

FR behavior when DB not available
by Anatoliy 20 Jul '23

20 Jul '23

Hi Alan ,team, I am testing scenario when main DB is temporary not available. I set rule in iptables to block all connections to DB. In this situation freeradius should return Accept with some parameters to NAS. authorize section is looks like sql { fail = 1 notfound = 2 } if ( fail ) { update { reply:Class = "outage" control:Auth-Type := Accept reply:Reply-Message := "DB Failed" reply:Acct-Interim-Interval := 600 } } This part works fine, but in traffic dump I see that radius replay with big delay , some times upto 20-30 seconds. In log a lot messages like Mon Jul 17 06:12:23 2023 : Error: Unresponsive child for request 288, in component <core> module Mon Jul 17 06:12:26 2023 : Error: rlm_sql_unixodbc: SQL down 08S01 [Oracle][ODBC][Ora]ORA-03113: end-of-file on communication channel Process ID: 151372 Session ID: 97 Serial number: 5095 Mon Jul 17 06:12:34 2023 : Error: rlm_sql_unixodbc: Connection failed I am trying to tune some parameters for sql connection, but this does not help. pool section retry_delay = 120 lifetime = 30 max_retries = 2 uses = 0 in radius.conf max_request_time = 5 and kernel (for faster detection that tcp session is broken) net.ipv4.tcp_retries2 = 2 net.ipv4.tcp_keepalive_intvl=5 net.ipv4.tcp_keepalive_probes=3 net.ipv4.tcp_keepalive_time=15 Can you recommend which params to change to prevent freeradius stuck on sql connection to DB ? Is it possible to prevent FR trying to connect to DB for some time (i think it is param retry_delay ) for all threads ?

6 15