- Freeradius-Users - lists.freeradius.org

FreeRadius TOTP authenticate fail passcode validation
by João Miguel Regateiro 20 Jun '23

20 Jun '23

Hello, I am working on a TOTP authentication method setup with FreeRadius. For starters I created the user “bob” on raddb/users and defined a password to authenticate against the server I have got it to work with just normal user and password but when I try to configure the TOTP module and testing using radiusd -X it shows the totp.authenticate the return fail. I have made sure that the date time is the same UTC +00 on all the environments, and generate the TOTP token with sha-1, 6 digits code and 30seconds time frame. [Generate token in base 32 = JJBFGV2ZGNCFARKIKBFTGUCYKA====== ] and [Generate default token = JBSWY3DPEHPK3PXP ] This is the configuration file for sites-enable/default: authorize{ #TOTP Authorize if (User-Password !~ /^(.*)([0-9]{6})$/) { reject } update request { User-Password := "%{1}" TOTP-Password := "%{2}" } #Example Use BOB if (&User-Name == "bob") { update control { TOTP-Secret := JJBFGV2ZGNCFARKIKBFTGUCYKA====== } } totp.authenticate if (!ok) { reject } pap } authenticate { Auth-Type PAP { pap } } This is the configuration file of clients.conf : Client network-device { ipaddr = 192.168.1.0/24 secret = testing123 } Note: I have test to send the TOTP-Secret via update control or update request, and that gave me different output when call TOTP.authenticate returns fail or noop . Radius client test: radtest -t pap bob password123456 192.168.1.10:1812 1812 testing123 output radiusd -X Ready to process requests (0) Received Access-Request Id 38 from 192.168.1.10:48110 to 192.168.1.10:1812 length 73 (0) User-Name = "bob" (0) User-Password = "password" (0) NAS-IP-Address = 192.168.1.10 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x66c57ad78dea99a37b8edcf8c79ab46d (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/radius/radacct/ 192.168.1.10/auth-detail-20230619 (0) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.10/auth-detail-20230619 (0) auth_log: EXPAND %t (0) auth_log: --> Mon Jun 19 16:05:09 2023 (0) [auth_log] = ok (0) files: users: Matched entry bob at line 1 (0) files: EXPAND Hello %{User-Name} THE BUILDER :D (0) files: --> Hello bob THE BUILDER :D (0) [files] = ok (0) if (User-Password !~ /^(.*)([0-9]{6})$/) { (0) if (User-Password !~ /^(.*)([0-9]{6})$/) -> TRUE (0) if (User-Password !~ /^(.*)([0-9]{6})$/) { (0) [reject] = reject (0) } # if (User-Password !~ /^(.*)([0-9]{6})$/) = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> bob (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 38 from 192.168.1.10:1812 to 192.168.1.10:48110 length 47 (0) Reply-Message = "Hello bob THE BUILDER :D " Waking up in 3.9 seconds. (0) Cleaning up request packet ID 38 with timestamp +3 due to cleanup_delay was reached Ready to process requests Please let me know if you can help me on this 🙂 Thank you! Best regards, Miguel

2 2

Re: google_ldap and google-ldap-auth
by Mathias Maes 19 Jun '23

19 Jun '23

Hi Alan Thanks for your reply. Disabling the "filter_inner_tunnel' policy does indeed work. I am rather sure I didn't deliberately enable it and rechecked. But It was enabled in the example configuration script, check here on Github: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/sites-ava… I tried to follow the comments in the example Google configuration scripts. It went pretty good up until that point. Now I will try to expand with custom attributes. Thanks! Met vriendelijke groet Mathias Maes ICT-Coördinator Maerlant Atheneum

4 4

google_ldap and google-ldap-auth
by Mathias Maes 19 Jun '23

19 Jun '23

Hello I am trying to get google-ldap-auth working in conjuction with google-ldap. I have enabled the site and the module, also enabled cache-auth and ldap. Configured google-ldap with the right credentials. I changed as little as possible to the Google config (no groups, custom attributes, etc) freeradius -X starts without errors. I have not altered the default or inner-tunnel sites. I keep the example user 'bob" with password "hello" enabled to check if I did not mess anything up. radtest bob hello 127.0.0.1 0 testing123 is working. radtest mathias.maes(a)maerlantatheneum.be mypassword 127.0.0.1:18123 0 testing123 fails. It seems that "User-Name" is required for tunneled authentication. But on the second line of the logs, User-Name is available. and if(&User-Name) returns TRUE However, if (!&outer.request:User-Name || !&User-Name) returns TRUE, I'm not a software developer, but it seems that the User-Name is missing from the outer.request. So my question is, how to test the outer.request.User-name with radtest? Or if I understand the logs totally wrong: Any ideas on what might be happening? Thanks a bunch. Error log: (1) Received Access-Request Id 171 from 127.0.0.1:43929 to 127.0.0.1:18123 length 102 (1) User-Name = "mathias.maes(a)maerlantatheneum.be" (1) User-Password = "mypassword" (1) NAS-IP-Address = 127.0.1.1 (1) NAS-Port = 0 (1) Message-Authenticator = 0x50109b513ed143e12cacfa804d48b950 (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) policy filter_inner_identity { (1) if (!&outer.request:User-Name || !&User-Name) { (1) if (!&outer.request:User-Name || !&User-Name) -> TRUE (1) if (!&outer.request:User-Name || !&User-Name) { (1) update request { (1) Module-Failure-Message = "User-Name is required for tunneled authentication" (1) } # update request = noop (1) [reject] = reject (1) } # if (!&outer.request:User-Name || !&User-Name) = reject (1) } # policy filter_inner_identity = reject (1) } # authorize = reject (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> mathias.maes(a)maerlantatheneum.be (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) if (&control:Auth-Type == ldap) { (1) ERROR: Failed retrieving values required to evaluate condition (1) update control { (1) &Cache-TTL := 0 (1) } # update control = noop (1) cache_ldap_user_dn: EXPAND %{Stripped-User-Name} (1) cache_ldap_user_dn: --> (1) cache_ldap_user_dn: ERROR: Zero length key string is invalid (1) [cache_ldap_user_dn] = invalid (1) } # Post-Auth-Type REJECT = invalid (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 171 from 127.0.0.1:18123 to 127.0.0.1:43929 length 20 Met vriendelijke groet Mathias Maes ICT-Coördinator Maerlant Atheneum

2 1

Python Or Perl Module for Auth and Accounting
by Imdad Hasan 18 Jun '23

18 Jun '23

Hi All, Which module is better from perl and python if doing whole auth and accounting code in native language without using socket or any other language. like perl native code or python native code. Thanks Imdad

2 1

Debian 12 Bookworm packages available
by Matthew Newton 16 Jun '23

16 Jun '23

We've added Debian 12 Bookworm to the Network RADIUS package builds. Both FreeRADIUS 3.2.3 and 3.0.26 are now available. Instructions are on the packages site as usual: https://packages.networkradius.com/ -- Matthew

2 1

Automated XIoT device management GoldenPath
by Michael Maymann 16 Jun '23

16 Jun '23

Hi list, first Q, so please be nice ;) If I am in the wrong list, please just let me know where to ask :) I am in the process of figuring out the architecture of how to automate XIoT device management best possible, and thought the following functionality in Radius would be a good approach. Are these something that is already supported in FreeRadius? Suggestions for better alternatives or guides/links on how to best achieve this are much appreciated :) "ZeroConf" XIoT info: - [MUD](https://datatracker.ietf.org/doc/rfc8520) retrieval (-> asset management system -> XIoTType ACL creation/approval -> provisioning) - [SBOM](https://cyclonedx.org/specification/overview) retrieval (-> asset management system -> continuous lightweight vulnerability scanning -> proactive compromisation actions) ZeroTrust XIoT PNAC 802.1x EAP-TLS authentication: - [FDO](https://github.com/fido-device-onboard) - [KeyLime](https://github.com/keylime) - [Akri](https://github.com/project-akri/akri) ZeroTouch XIoT provisioning: - [AWS IoT Greengrass](https://github.com/aws-greengrass) - [Tinkerbell](https://github.com/tinkerbell/proposals/issues/66) Thanks in advance :) Br. Michael

2 2

Fwd: compilation problem deprecated: Since OpenSSL 3.0
by Joost Ringoot 15 Jun '23

15 Jun '23

I am crossposting this, first on hostap, but some of you may have encountered/resolved this as well. I will crosspost the solution as well, when I have it. I forgot to mention, I tried the wpa_supplicant-2.10 as found on https://w1.fi/wpa_supplicant/ ----- Forwarded Message ----- > To: "hostap" <hostap(a)lists.infradead.org> > Sent: Thursday, 15 June, 2023 12:30:47 > Subject: compilation problem deprecated: Since OpenSSL 3.0 > Hello all, > > I am trying to compile eampol_test > > "make eapol_test" > > (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) > chapter 6 -EAP authentication, Pg 46,47) > > I've set > > "CONFIG_EAPOL_TEST=y" > > in the .config > > I get plenty of "deprecated: Since OpenSSL 3.0" errors. (on Ubuntu 22.04.2 LTS) > The full output is below. > > Thanks in advance for your advice, > > Joost > > =======Start compilation > output========================================================================================================= > > CC config.c > CC notify.c > CC bss.c > CC eap_register.c > CC ../src/utils/common.c > CC ../src/utils/config.c > CC ../src/utils/wpa_debug.c > CC ../src/utils/wpabuf.c > CC ../src/utils/bitfield.c > CC ../src/utils/ip_addr.c > CC ../src/utils/crc32.c > CC op_classes.c > CC rrm.c > CC twt.c > CC robust_av.c > CC wmm_ac.c > CC ../src/utils/os_unix.c > CC ../src/utils/eloop.c > CC config_file.c > CC ../src/rsn_supp/wpa_ft.c > CC ../src/common/sae.c > CC ../src/common/dpp.c > CC ../src/common/dpp_auth.c > CC ../src/common/dpp_backup.c > CC ../src/common/dpp_crypto.c > CC ../src/common/dpp_pkex.c > CC ../src/common/dpp_reconfig.c > CC ../src/common/dpp_tcp.c > CC dpp_supplicant.c > CC ../src/rsn_supp/tdls.c > CC ../src/rsn_supp/wpa.c > CC ../src/rsn_supp/preauth.c > CC ../src/rsn_supp/pmksa_cache.c > CC ../src/rsn_supp/wpa_ie.c > CC ../src/common/wpa_common.c > CC ibss_rsn.c > CC p2p_supplicant.c > CC p2p_supplicant_sd.c > CC ../src/p2p/p2p.c > CC ../src/p2p/p2p_utils.c > CC ../src/p2p/p2p_parse.c > CC ../src/p2p/p2p_build.c > CC ../src/p2p/p2p_go_neg.c > CC ../src/p2p/p2p_sd.c > CC ../src/p2p/p2p_pd.c > CC ../src/p2p/p2p_invitation.c > CC ../src/p2p/p2p_dev_disc.c > CC ../src/p2p/p2p_group.c > CC ../src/ap/p2p_hostapd.c > CC wifi_display.c > CC hs20_supplicant.c > CC interworking.c > CC ../src/eap_peer/eap_tls.c > CC ../src/eap_peer/eap_peap.c > CC ../src/eap_common/eap_peap_common.c > CC ../src/eap_peer/eap_ttls.c > CC ../src/eap_peer/eap_md5.c > CC ../src/eap_peer/eap_mschapv2.c > CC ../src/eap_peer/mschapv2.c > CC ../src/eap_peer/eap_gtc.c > CC ../src/eap_peer/eap_otp.c > CC ../src/eap_peer/eap_leap.c > CC ../src/eap_peer/eap_fast.c > CC ../src/eap_peer/eap_fast_pac.c > CC ../src/eap_common/eap_fast_common.c > CC ../src/eap_peer/eap_pax.c > CC ../src/eap_common/eap_pax_common.c > CC ../src/eap_peer/eap_sake.c > CC ../src/eap_common/eap_sake_common.c > CC ../src/eap_peer/eap_gpsk.c > CC ../src/eap_common/eap_gpsk_common.c > CC ../src/eap_peer/eap_pwd.c > CC ../src/eap_common/eap_pwd_common.c > CC wps_supplicant.c > CC ../src/utils/uuid.c > CC ../src/eap_peer/eap_wsc.c > CC ../src/eap_common/eap_wsc_common.c > CC ../src/wps/wps.c > CC ../src/wps/wps_common.c > CC ../src/wps/wps_attr_parse.c > CC ../src/wps/wps_attr_build.c > CC ../src/wps/wps_attr_process.c > CC ../src/wps/wps_dev_attr.c > CC ../src/wps/wps_enrollee.c > CC ../src/wps/wps_registrar.c > CC ../src/eap_peer/eap_ikev2.c > CC ../src/eap_peer/ikev2.c > CC ../src/eap_common/eap_ikev2_common.c > CC ../src/eap_common/ikev2_common.c > CC ../src/eap_peer/eap_tnc.c > CC ../src/eap_peer/tncc.c > CC wpas_kay.c > CC ../src/pae/ieee802_1x_cp.c > CC ../src/pae/ieee802_1x_kay.c > CC ../src/pae/ieee802_1x_key.c > CC ../src/pae/ieee802_1x_secy_ops.c > CC ../src/ap/wpa_auth_kay.c > CC ../src/eapol_supp/eapol_supp_sm.c > CC ../src/eap_peer/eap.c > CC ../src/eap_peer/eap_methods.c > CC ap.c > CC ../src/ap/hostapd.c > CC ../src/ap/wpa_auth_glue.c > CC ../src/ap/utils.c > CC ../src/ap/authsrv.c > CC ../src/ap/ap_config.c > CC ../src/ap/sta_info.c > CC ../src/ap/tkip_countermeasures.c > CC ../src/ap/ap_mlme.c > CC ../src/ap/ieee802_1x.c > CC ../src/eapol_auth/eapol_auth_sm.c > CC ../src/ap/ieee802_11_auth.c > CC ../src/ap/ieee802_11_shared.c > CC ../src/ap/drv_callbacks.c > CC ../src/ap/ap_drv_ops.c > CC ../src/ap/beacon.c > CC ../src/ap/bss_load.c > CC ../src/ap/eap_user_db.c > CC ../src/ap/neighbor_db.c > CC ../src/ap/rrm.c > CC ../src/ap/ieee802_11_ht.c > CC ../src/ap/ieee802_11_vht.c > CC ../src/ap/ctrl_iface_ap.c > CC ../src/eap_server/eap_server.c > CC ../src/eap_server/eap_server_identity.c > CC ../src/eap_server/eap_server_methods.c > CC ../src/ap/wmm.c > CC ../src/ap/ap_list.c > CC ../src/ap/ieee802_11.c > CC ../src/ap/hw_features.c > CC ../src/ap/dfs.c > CC ../src/ap/wps_hostapd.c > CC ../src/eap_server/eap_server_wsc.c > CC ../src/ap/dpp_hostapd.c > CC ../src/ap/gas_query_ap.c > CC ../src/ap/gas_serv.c > CC ../src/ap/hs20.c > CC ../src/ap/wpa_auth.c > CC ../src/ap/wpa_auth_ie.c > CC ../src/ap/pmksa_cache_auth.c > CC ../src/common/dragonfly.c > CC ../src/crypto/ms_funcs.c > CC ../src/eap_common/chap.c > CC ../src/eap_peer/eap_tls_common.c > ../src/crypto/tls_openssl.c: In function ‘tls_engine_load_dynamic_generic’: > ../src/crypto/tls_openssl.c:799:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 799 | engine = ENGINE_by_id(id); > | ^~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:814:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 814 | engine = ENGINE_by_id(dynamic_id); > | ^~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:825:17: error: ‘ENGINE_ctrl_cmd_string’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 825 | if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == > 0) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:479:5: note: declared here > 479 | int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char > *arg, > | ^~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:829:25: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 829 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:839:9: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 839 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:841:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 841 | engine = ENGINE_by_id(id); > | ^~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:850:17: error: ‘ENGINE_ctrl_cmd_string’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 850 | if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == > 0) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:479:5: note: declared here > 479 | int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char > *arg, > | ^~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:854:25: error: ‘ENGINE_remove’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 854 | ENGINE_remove(engine); > | ^~~~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:332:27: note: declared here > 332 | OSSL_DEPRECATEDIN_3_0 int ENGINE_remove(ENGINE *e); > | ^~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:855:25: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 855 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:860:9: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 860 | ENGINE_free(engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_init’: > ../src/crypto/tls_openssl.c:1089:9: error: ‘ENGINE_load_builtin_engines’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 1089 | ENGINE_load_builtin_engines(); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:358:28: note: declared here > 358 | OSSL_DEPRECATEDIN_3_0 void ENGINE_load_builtin_engines(void); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_engine_init’: > ../src/crypto/tls_openssl.c:1213:9: error: ‘ENGINE_by_id’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1213 | conn->engine = ENGINE_by_id(engine_id); > | ^~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:336:31: note: declared here > 336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); > | ^~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1219:9: error: ‘ENGINE_init’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1219 | if (ENGINE_init(conn->engine) != 1) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:620:27: note: declared here > 620 | OSSL_DEPRECATEDIN_3_0 int ENGINE_init(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1228:9: error: ‘ENGINE_ctrl_cmd_string’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 1228 | if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == > 0) { > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:479:5: note: declared here > 479 | int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char > *arg, > | ^~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1245:17: error: ‘ENGINE_load_private_key’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 1245 | conn->private_key = ENGINE_load_private_key(conn->engine, > | ^~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:638:11: note: declared here > 638 | EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id, > | ^~~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1268:17: error: ‘ENGINE_ctrl’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1268 | if (!ENGINE_ctrl(conn->engine, > ENGINE_CTRL_GET_CMD_FROM_NAME, > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:429:27: note: declared here > 429 | OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c:1281:17: error: ‘ENGINE_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1281 | ENGINE_free(conn->engine); > | ^~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:493:27: note: declared here > 493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); > | ^~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_engine_deinit’: > ../src/crypto/tls_openssl.c:1307:17: error: ‘ENGINE_finish’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 1307 | ENGINE_finish(conn->engine); > | ^~~~~~~~~~~~~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:628:27: note: declared here > 628 | OSSL_DEPRECATEDIN_3_0 int ENGINE_finish(ENGINE *e); > | ^~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_engine_get_cert’: > ../src/crypto/tls_openssl.c:3605:9: error: ‘ENGINE_ctrl_cmd’ is deprecated: > Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3605 | if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL", > | ^~ > In file included from ../src/crypto/tls_openssl.c:25: > /usr/include/openssl/engine.h:450:27: note: declared here > 450 | OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name, > | ^~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_connection_private_key’: > ../src/crypto/tls_openssl.c:3827:17: error: ‘SSL_use_RSAPrivateKey_ASN1’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3827 | if (SSL_use_RSAPrivateKey_ASN1(conn->ssl, > | ^~ > In file included from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/ssl.h:1652:12: note: declared here > 1652 | __owur int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, > | ^~~~~~~~~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_connection_dh’: > ../src/crypto/tls_openssl.c:3966:9: error: ‘PEM_read_bio_DHparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3966 | dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); > | ^~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:469:1: note: declared here > 469 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DHparams, DH) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:3977:17: error: ‘PEM_read_bio_DSAparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 3977 | dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); > | ^~~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:455:1: note: declared here > 455 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DSAparams, DSA) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:3987:17: error: ‘DSA_dup_DH’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 3987 | dh = DSA_dup_DH(dsa); > | ^~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:198:27: note: declared here > 198 | OSSL_DEPRECATEDIN_3_0 DH *DSA_dup_DH(const DSA *r); > | ^~~~~~~~~~ > ../src/crypto/tls_openssl.c:3988:17: error: ‘DSA_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 3988 | DSA_free(dsa); > | ^~~~~~~~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:127:28: note: declared here > 127 | OSSL_DEPRECATEDIN_3_0 void DSA_free(DSA *r); > | ^~~~~~~~ > ../src/crypto/tls_openssl.c:4007:17: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4007 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > ../src/crypto/tls_openssl.c:4010:9: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4010 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > ../src/crypto/tls_openssl.c: In function ‘tls_global_dh’: > ../src/crypto/tls_openssl.c:4041:9: error: ‘PEM_read_bio_DHparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 4041 | dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); > | ^~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:469:1: note: declared here > 469 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DHparams, DH) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:4052:17: error: ‘PEM_read_bio_DSAparams’ is > deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations] > 4052 | dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); > | ^~~ > In file included from /usr/include/openssl/ssl.h:36, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/pem.h:455:1: note: declared here > 455 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DSAparams, DSA) > | ^~~~~~~~~~~~~~~~~~~ > ../src/crypto/tls_openssl.c:4062:17: error: ‘DSA_dup_DH’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4062 | dh = DSA_dup_DH(dsa); > | ^~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:198:27: note: declared here > 198 | OSSL_DEPRECATEDIN_3_0 DH *DSA_dup_DH(const DSA *r); > | ^~~~~~~~~~ > ../src/crypto/tls_openssl.c:4063:17: error: ‘DSA_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4063 | DSA_free(dsa); > | ^~~~~~~~ > In file included from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dsa.h:127:28: note: declared here > 127 | OSSL_DEPRECATEDIN_3_0 void DSA_free(DSA *r); > | ^~~~~~~~ > ../src/crypto/tls_openssl.c:4082:17: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4082 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > ../src/crypto/tls_openssl.c:4085:9: error: ‘DH_free’ is deprecated: Since > OpenSSL 3.0 [-Werror=deprecated-declarations] > 4085 | DH_free(dh); > | ^~~~~~~ > In file included from /usr/include/openssl/dsa.h:51, > from /usr/include/openssl/x509.h:37, > from /usr/include/openssl/ssl.h:31, > from ../src/crypto/tls_openssl.c:19: > /usr/include/openssl/dh.h:200:28: note: declared here > 200 | OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); > | ^~~~~~~ > cc1: all warnings being treated as errors > make: *** [../src/build.rules:86: > /root/radiusconfig/wpa_supplicant-2.10/build/wpa_supplicant/src/crypto/tls_openssl.o] > Error 1 > > ======End compilation > output============================================================================================================== > > _______________________________________________ > Hostap mailing list > Hostap(a)lists.infradead.org > http://lists.infradead.org/mailman/listinfo/hostap

2 2

Log some errors to file or database
by Fabricio Viana 15 Jun '23

15 Jun '23

Hello! When running freeradius -X to debug network problems I got three type of messages: Received Accounting-Request Id 2 from x.x.x.x:1813 to y.y.y.y:1813 length 416. Dropping packet without response because of error: Received Accounting-Request packet from client x.x.x.x with invalid Request Authenticator! (Shared secret is incorrect.) Ignoring request to acct address * port 1813 bound to server default from unknown client x.x.x.x port 58428 proto udp Ignoring request to auth address * port 1812 bound to server default from unknown client x.x.x.x port 36350 proto udp I know how to solve these problems. But to catch these errors I need to enter debug mode (freeradius -X). This sometimes takes some time as it requires someone with shell access to the server. Is it possible to log these messages into a file or database without having to enter debug mode? Thanks! Fabricio

2 1

Using libkqueue, how stable it is with freeradius 3.x?
by work vlpl 15 Jun '23

15 Jun '23

Hi, I want to try to use freeradius 3.2.x which is compiled with libkquueue. In my tests, it is working fine. But I also see the list of know issues https://github.com/mheily/libkqueue/blob/master/BUGS.md of libkqueue and just want to double-check if I should not use it. But I hope that since freeradius 4.x by default will use it the library integration is fine and the listed issues are not affecting freeradius 4.x or 3.x. Best regards, Vladimir

2 7

DHCP Radius proxy (IPv4 and IPv6)
by Ľudovít Mikula 09 Jun '23

09 Jun '23

Hi all, I have a relay-agent which does only DHCP and is not capable of talking to RADIUS server (using auth/acct). However the requirement is to be able to use freeradius with it for the additional functionalities and configurability, over both IPv4 and IPv6. The "authentication" should be done only by checking Option82 circuit-id/remote-id against configured user in freeradius. What are the options for configuring it over IPv6? Probably some dhcp to radius proxy able to do message conversion like: DHCP Discover/Solicit -> RADIUS Access-Request RADIUS Access-Accept -> DHCP Offer/Advertise What would be the best approach to handle this use case (unfortunately I cannot change the hardware). Regards -- Ludo Mikula

2 8