- Freeradius-Users - lists.freeradius.org

Changing radacct logs path
by Can Paçacı 23 Jun '23

23 Jun '23

Hi, I changed the radacct log directory location (radacctdir = /aaa/logs/radacct) in the radiud.conf file and also changed the owner of the destination directory and premission but it didn't work. Why? How can I do that. Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

4 5

Vendor specific attributes format eapol_test
by nabble＠felix.world 23 Jun '23

23 Jun '23

Hello, I know it’s not FreeRADIUS related but you may be able to help me to understand how vendor specific attributes work and how to correctly send them with eapol_test. Vendor specific attributes are in the RADIUS attribute 26 So with eapol_test the following flag `-N 26:x:00009f680305010000` would be in detail: 00009f68 = Vendor-Id in hex 03 = Vendor attribute id 05 = length 010000 = Value 05 should be the length if I understand it correctly. But after playing around a bit it confuses me more and more. Why is 010000 of length 05 and e.g. 11000342342342 of length 09? BR, Lineconnect

2 1

Re: FW: FreeRadius TOTP authenticate fail passcode validation
by João Miguel Regateiro 23 Jun '23

23 Jun '23

Hi there, Thanks for the previous response. Now I came across with two different problems, the first is with building the rlm_totp module and the second is during decoding the totp secret. I was able to get the correct totp and authenticate successfully even though the make totp returned some errors. The passcode was indeed incorrect because the module was generating the totp based on the system time. I changed the mods-available/date and set utc=yes and that fixed the problem (that was a misconfiguration on Universal Time vs System Time). I tried to build the rlm_totp (make totp) and got the following errors on undefined references ("fr_hmac_sha1" and "fr_digest_cmp"): rlm_totp.c: In function ‘main’: rlm_totp.c:336:44: warning: format ‘%llu’ expects argument of type ‘long long unsigned int *’, but argument 3 has type ‘uint64_t *’ {aka ‘long unsigned int *’} [-Wformat=] 336 | (void) sscanf(argv[2], "%llu", &now); | ~~~^ ~~~~ | | | | | uint64_t * {aka long unsigned int *} | long long unsigned int * | %lu At top level: rlm_totp.c:50:32: warning: ‘method_env’ defined but not used [-Wunused-const-variable=] 50 | static const call_method_env_t method_env = { | ^~~~~~~~~~ /bin/ld: /tmp/cccE8qoD.o: in function `totp_cmp': /home/mfa/freeradius-server/src/modules/rlm_totp/rlm_totp.c:209: undefined reference to `fr_hmac_sha1' /bin/ld: /home/mfa/freeradius-server/src/modules/rlm_totp/rlm_totp.c:229: undefined reference to `fr_digest_cmp' collect2: error: ld returned 1 exit status make: *** [Makefile:25: totp] Error 1 ------------------------------------------------------------------------------------------ In the last email I was using a standard shared secret just for testing purposes but my TOTP generator creates a 56 characters secret so I am using that and getting this message - “totp: TOTP-Secret cannot be decoded”. I’ve tried smaller secrets and it is always able to decode the secret which made me wonder if you have any restrictions on the secret length? Secret: 3R4VOYWSOR3YWEVRX74HRVXYXLMACQN3A457C24GS2OYG7EINHMBPQZO Base32 encoded: GNJDIVSPLFLVGT2SGNMVORKWKJMDONCIKJLFQWKYJRGUCQ2RJYZUCNBVG5BTENCHKMZE6WKHG5CUSTSIJVBFAUK2J4====== Fri Jun 23 11:42:00 2023 : Info: Ready to process requests Fri Jun 23 11:42:04 2023 : Debug: (2) Received Access-Request Id 192 from 10.56.143.110:59496 to 10.56.143.110:1812 length 73 Fri Jun 23 11:42:04 2023 : Debug: (2) User-Name = "bob" Fri Jun 23 11:42:04 2023 : Debug: (2) User-Password = "testing123123456" Fri Jun 23 11:42:04 2023 : Debug: (2) NAS-IP-Address = 10.56.143.110 Fri Jun 23 11:42:04 2023 : Debug: (2) NAS-Port = 1812 Fri Jun 23 11:42:04 2023 : Debug: (2) Message-Authenticator = 0x7641368bcad58c3250dd31f0e46e76d4 Fri Jun 23 11:42:04 2023 : Debug: (2) session-state: No State attribute Fri Jun 23 11:42:04 2023 : Debug: (2) # Executing section authorize from file /etc/raddb/sites-enabled/default Fri Jun 23 11:42:04 2023 : Debug: (2) authorize { Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authorize]: calling files (rlm_files) Fri Jun 23 11:42:04 2023 : Debug: (2) files: users: Matched entry bob at line 1 Fri Jun 23 11:42:04 2023 : Debug: Hello %{User-Name} Fri Jun 23 11:42:04 2023 : Debug: Parsed xlat tree: Fri Jun 23 11:42:04 2023 : Debug: literal --> Hello Fri Jun 23 11:42:04 2023 : Debug: attribute --> User-Name Fri Jun 23 11:42:04 2023 : Debug: literal --> Fri Jun 23 11:42:04 2023 : Debug: (2) files: EXPAND Hello %{User-Name} Fri Jun 23 11:42:04 2023 : Debug: (2) files: --> Hello bob Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authorize]: returned from files (rlm_files) Fri Jun 23 11:42:04 2023 : Debug: (2) [files] = ok Fri Jun 23 11:42:04 2023 : Debug: (2) if (User-Password !~ /^(.*)([0-9]{6})$/) { Fri Jun 23 11:42:04 2023 : Debug: (2) if (User-Password !~ /^(.*)([0-9]{6})$/) -> FALSE Fri Jun 23 11:42:04 2023 : Debug: (2) update request { Fri Jun 23 11:42:04 2023 : Debug: (2) EXPAND %{1} Fri Jun 23 11:42:04 2023 : Debug: (2) --> testing123 Fri Jun 23 11:42:04 2023 : Debug: (2) User-Password := testing123 Fri Jun 23 11:42:04 2023 : Debug: (2) Overwriting value "testing123123456" with "testing123" Fri Jun 23 11:42:04 2023 : Debug: (2) EXPAND %{2} Fri Jun 23 11:42:04 2023 : Debug: (2) --> 123456 Fri Jun 23 11:42:04 2023 : Debug: (2) TOTP-Password := 123456 Fri Jun 23 11:42:04 2023 : Debug: (2) } # update request = noop Fri Jun 23 11:42:04 2023 : Debug: (2) if (&User-Name == "bob") { Fri Jun 23 11:42:04 2023 : Debug: (2) if (&User-Name == "bob") -> TRUE Fri Jun 23 11:42:04 2023 : Debug: (2) if (&User-Name == "bob") { Fri Jun 23 11:42:04 2023 : Debug: (2) update control { Fri Jun 23 11:42:04 2023 : Debug: (2) TOTP-Secret := GNJDIVSPLFLVGT2SGNMVORKWKJMDONCIKJLFQWKYJRGUCQ2RJYZUCNBVG5BTENCHKMZE6WKHG5CUSTSIJVBFAUK2J4====== Fri Jun 23 11:42:04 2023 : Debug: (2) } # update control = noop Fri Jun 23 11:42:04 2023 : Debug: (2) } # if (&User-Name == "bob") = noop Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authenticate]: calling totp (rlm_totp) Fri Jun 23 11:42:04 2023 : Debug: (2) totp: TOTP-Secret cannot be decoded Fri Jun 23 11:42:04 2023 : Debug: (2) modsingle[authenticate]: returned from totp (rlm_totp) Fri Jun 23 11:42:04 2023 : Debug: (2) [totp.authenticate] = fail Fri Jun 23 11:42:04 2023 : Debug: (2) } # authorize = fail Fri Jun 23 11:42:04 2023 : Debug: (2) Using Post-Auth-Type Reject Fri Jun 23 11:42:04 2023 : Debug: (2) Post-Auth-Type sub-section not found. Ignoring. Fri Jun 23 11:42:04 2023 : Debug: (2) # Executing group from file /etc/raddb/sites-enabled/default Fri Jun 23 11:42:04 2023 : Debug: (2) Delaying response for 1.000000 seconds Fri Jun 23 11:42:04 2023 : Debug: Waking up in 0.3 seconds. Fri Jun 23 11:42:04 2023 : Debug: Waking up in 0.6 seconds. Fri Jun 23 11:42:05 2023 : Debug: (2) Sending delayed response Fri Jun 23 11:42:05 2023 : Debug: (2) Sent Access-Reject Id 192 from 10.56.143.110:1812 to 10.56.143.110:59496 length 32 Fri Jun 23 11:42:05 2023 : Debug: (2) Reply-Message = "Hello bob " Fri Jun 23 11:42:05 2023 : Debug: Waking up in 3.9 seconds. Fri Jun 23 11:42:09 2023 : Debug: (2) Cleaning up request packet ID 192 with timestamp +32 due to cleanup_delay was reached Fri Jun 23 11:42:09 2023 : Info: Ready to process requests Thank you! Best regards, Miguel luis teixeira <luis.carlosteixeira(a)outlook.com> escreveu no dia sexta, 23/06/2023 à(s) 12:19: > > > ------------------------------ > *De:* Freeradius-Users <freeradius-users-bounces+luis.carlosteixeira= > hotmail.com(a)lists.freeradius.org> em nome de Alan DeKok < > aland(a)deployingradius.com> > *Enviado:* 20 de junho de 2023 14:50 > *Para:* FreeRadius users mailing list < > freeradius-users(a)lists.freeradius.org> > *Assunto:* Re: FreeRadius TOTP authenticate fail passcode validation > > On Jun 20, 2023, at 5:06 AM, João Miguel Regateiro <jmregateiro(a)gmail.com> > wrote:, > > > > > > I am working on a TOTP authentication method setup with FreeRadius. For > > starters I created the user “bob” on raddb/users and defined a password > to > > authenticate against the server > > I have got it to work with just normal user and password but when I try > to > > configure the TOTP module and testing using radiusd -X it shows the > > totp.authenticate the return fail. I have made sure that the date time is > > the same UTC +00 on all the environments, and generate the TOTP token > with > > sha-1, 6 digits code and 30seconds time frame. [Generate token in base > 32 = > > JJBFGV2ZGNCFARKIKBFTGUCYKA====== ] and [Generate default token = > > JBSWY3DPEHPK3PXP ] > > If it fails, then the short answer is that the TOTP doesn't match. > There isn't really much else which can go wrong. > > I've pushed changes to the v3.2.x branch which let you do "radiusd -Xx", > and the totp module will now print out the TOTP it expected, and the one it > received. You'll have to download and build v3.2.x in order to use it, > though. > > You can also build a command-line program to test the TOTP. Build the > source as normal, and then do: > > $ cd src/modules/rlm_totp > $ make totp > > And then can use the above key: > > $ ./totp totp 1687268891 JBSWY3DPEHPK3PXP 601664 > Time 1687268891 > Expected 601664 > Received 601664 > > or: > > $ ./totp totp now JBSWY3DPEHPK3PXP 123456 > Time 1687269000 > Expected 895298 > Received 123456 > Fail > > My guess is that the TOTP you're giving it is wrong. But increased > debug output will let you know exactly what's going on. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freer… > <http://www.freeradius.org/list/users.html> >

2 2

Problem building current master
by Ľudovít Mikula 22 Jun '23

22 Jun '23

I am having problem compiling current master (tried on fresh clone): CC src/lib/tls/conf.c src/lib/tls/conf.c:47:12: warning: ‘tls_conf_parse_cache_mode’ used but never defined 47 | static int tls_conf_parse_cache_mode(TALLOC_CTX *ctx, void *out, void *parent, CONF_ITEM *ci, CONF_PARSER const *rule); | ^~~~~~~~~~~~~~~~~~~~~~~~~ and later it fails with: LINK build/lib/libfreeradius-eap-aka-sim.la CC src/lib/server/pair_server_tests.c /usr/bin/ld: build/lib/local/.libs/libfreeradius-tls.so: undefined reference to `tls_conf_parse_cache_mode' collect2: error: ld returned 1 exit status make: *** [scripts/boiler.mk:731: build/bin/local/pair_server_tests] Error 1 Configured with: ./configure --prefix=/opt/freeradius Library configure status report ------------------------------- curl .................... OK eap ..................... OK eap_aka_sim ............. OK io ...................... OK json .................... OK kafka ................... skipping (requires rdkafka.h libhirdkafka) ldap .................... skipping (requires libldap (with async support) lber ldap.h) redis ................... OK server .................. OK sim ..................... OK tls ..................... OK unlang .................. OK util .................... OK Module configure status report ------------------------------ rlm_always .............. OK rlm_attr_filter ......... OK rlm_cache ............... OK rlm_cache_memcached ..... OK rlm_cache_rbtree ........ OK rlm_cache_redis ......... OK rlm_chap ................ OK rlm_cipher .............. OK rlm_client .............. OK rlm_couchbase ........... skipping (requires couchbase.h libcouchbase) rlm_csv ................. OK rlm_date ................ OK rlm_delay ............... OK rlm_detail .............. OK rlm_dhcpv4 .............. OK rlm_dict ................ OK rlm_digest .............. OK rlm_eap ................. OK rlm_eap_aka ............. OK rlm_eap_aka_prime ....... OK rlm_eap_fast ............ OK rlm_eap_gtc ............. OK rlm_eap_md5 ............. OK rlm_eap_mschapv2 ........ OK rlm_eap_peap ............ OK rlm_eap_pwd ............. OK rlm_eap_sim ............. OK rlm_eap_tls ............. OK rlm_eap_ttls ............ OK rlm_escape .............. OK rlm_exec ................ OK rlm_files ............... OK rlm_icmp ................ OK rlm_idn ................. OK rlm_imap ................ OK rlm_isc_dhcp ............ OK rlm_json ................ OK rlm_kafka ............... OK rlm_krb5 ................ OK rlm_ldap ................ OK rlm_linelog ............. OK rlm_logintime ........... OK rlm_logtee .............. OK rlm_lua ................. skipping (requires lua.h) rlm_mruby ............... skipping (requires mruby.h mruby/compile.h mruby/array.h libmruby libm) rlm_mschap .............. OK ... without opendirectory support without direct winbind support rlm_ocsp ................ OK rlm_opendirectory ....... skipping (requires membership.h) rlm_pam ................. OK rlm_pap ................. OK rlm_passwd .............. OK rlm_perl ................ OK rlm_python .............. OK rlm_radius .............. OK rlm_radutmp ............. OK rlm_redis ............... OK rlm_redis_ippool ........ OK rlm_rediswho ............ OK rlm_rest ................ OK rlm_securid ............. skipping (requires acexport.h libaceclnt) rlm_sigtran ............. skipping (requires osmocom/core/msgb.h osmocom/sccp/sccp.h libosmocore libsccp libxua libmtp) rlm_smtp ................ OK rlm_sometimes ........... OK rlm_sql ................. OK rlm_sql_cassandra ....... skipping (requires libcassandra (>= 2.0) cassandra.h) rlm_sql_db2 ............. skipping (requires libdb2 sqlcli.h) rlm_sql_firebird ........ skipping (requires libfbclient ibase.h) rlm_sql_freetds ......... skipping (requires ctpublic.h libct) rlm_sql_mysql ........... OK rlm_sql_null ............ OK rlm_sql_oracle .......... skipping (requires oci.h libclntsh libnnz[9-12]) rlm_sql_postgresql ...... skipping (requires libpq-fe.h libpq) rlm_sql_sqlite .......... skipping (requires libsqlite3 sqlite.h) rlm_sql_unixodbc ........ skipping (requires libodbc sql.h) rlm_sqlcounter .......... OK rlm_sqlippool ........... OK rlm_stats ............... OK rlm_tacacs .............. OK rlm_test ................ OK rlm_totp ................ OK rlm_unbound ............. OK rlm_unix ................ OK rlm_unpack .............. OK rlm_utf8 ................ OK rlm_wimax ............... OK rlm_winbind ............. skipping (requires wbclient.h core/ntstatus.h) rlm_yubikey ............. OK ... without yubikey token decryption support without yubicloud support -- Ludo

2 2

FreeRadius TOTP authenticate fail passcode validation
by João Miguel Regateiro 20 Jun '23

20 Jun '23

Hello, I am working on a TOTP authentication method setup with FreeRadius. For starters I created the user “bob” on raddb/users and defined a password to authenticate against the server I have got it to work with just normal user and password but when I try to configure the TOTP module and testing using radiusd -X it shows the totp.authenticate the return fail. I have made sure that the date time is the same UTC +00 on all the environments, and generate the TOTP token with sha-1, 6 digits code and 30seconds time frame. [Generate token in base 32 = JJBFGV2ZGNCFARKIKBFTGUCYKA====== ] and [Generate default token = JBSWY3DPEHPK3PXP ] This is the configuration file for sites-enable/default: authorize{ #TOTP Authorize if (User-Password !~ /^(.*)([0-9]{6})$/) { reject } update request { User-Password := "%{1}" TOTP-Password := "%{2}" } #Example Use BOB if (&User-Name == "bob") { update control { TOTP-Secret := JJBFGV2ZGNCFARKIKBFTGUCYKA====== } } totp.authenticate if (!ok) { reject } pap } authenticate { Auth-Type PAP { pap } } This is the configuration file of clients.conf : Client network-device { ipaddr = 192.168.1.0/24 secret = testing123 } Note: I have test to send the TOTP-Secret via update control or update request, and that gave me different output when call TOTP.authenticate returns fail or noop . Radius client test: radtest -t pap bob password123456 192.168.1.10:1812 1812 testing123 output radiusd -X Ready to process requests (0) Received Access-Request Id 38 from 192.168.1.10:48110 to 192.168.1.10:1812 length 73 (0) User-Name = "bob" (0) User-Password = "password" (0) NAS-IP-Address = 192.168.1.10 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x66c57ad78dea99a37b8edcf8c79ab46d (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/radius/radacct/ 192.168.1.10/auth-detail-20230619 (0) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.10/auth-detail-20230619 (0) auth_log: EXPAND %t (0) auth_log: --> Mon Jun 19 16:05:09 2023 (0) [auth_log] = ok (0) files: users: Matched entry bob at line 1 (0) files: EXPAND Hello %{User-Name} THE BUILDER :D (0) files: --> Hello bob THE BUILDER :D (0) [files] = ok (0) if (User-Password !~ /^(.*)([0-9]{6})$/) { (0) if (User-Password !~ /^(.*)([0-9]{6})$/) -> TRUE (0) if (User-Password !~ /^(.*)([0-9]{6})$/) { (0) [reject] = reject (0) } # if (User-Password !~ /^(.*)([0-9]{6})$/) = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> bob (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 38 from 192.168.1.10:1812 to 192.168.1.10:48110 length 47 (0) Reply-Message = "Hello bob THE BUILDER :D " Waking up in 3.9 seconds. (0) Cleaning up request packet ID 38 with timestamp +3 due to cleanup_delay was reached Ready to process requests Please let me know if you can help me on this 🙂 Thank you! Best regards, Miguel

2 2

Re: google_ldap and google-ldap-auth
by Mathias Maes 19 Jun '23

19 Jun '23

Hi Alan Thanks for your reply. Disabling the "filter_inner_tunnel' policy does indeed work. I am rather sure I didn't deliberately enable it and rechecked. But It was enabled in the example configuration script, check here on Github: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/sites-ava… I tried to follow the comments in the example Google configuration scripts. It went pretty good up until that point. Now I will try to expand with custom attributes. Thanks! Met vriendelijke groet Mathias Maes ICT-Coördinator Maerlant Atheneum

4 4

google_ldap and google-ldap-auth
by Mathias Maes 19 Jun '23

19 Jun '23

Hello I am trying to get google-ldap-auth working in conjuction with google-ldap. I have enabled the site and the module, also enabled cache-auth and ldap. Configured google-ldap with the right credentials. I changed as little as possible to the Google config (no groups, custom attributes, etc) freeradius -X starts without errors. I have not altered the default or inner-tunnel sites. I keep the example user 'bob" with password "hello" enabled to check if I did not mess anything up. radtest bob hello 127.0.0.1 0 testing123 is working. radtest mathias.maes(a)maerlantatheneum.be mypassword 127.0.0.1:18123 0 testing123 fails. It seems that "User-Name" is required for tunneled authentication. But on the second line of the logs, User-Name is available. and if(&User-Name) returns TRUE However, if (!&outer.request:User-Name || !&User-Name) returns TRUE, I'm not a software developer, but it seems that the User-Name is missing from the outer.request. So my question is, how to test the outer.request.User-name with radtest? Or if I understand the logs totally wrong: Any ideas on what might be happening? Thanks a bunch. Error log: (1) Received Access-Request Id 171 from 127.0.0.1:43929 to 127.0.0.1:18123 length 102 (1) User-Name = "mathias.maes(a)maerlantatheneum.be" (1) User-Password = "mypassword" (1) NAS-IP-Address = 127.0.1.1 (1) NAS-Port = 0 (1) Message-Authenticator = 0x50109b513ed143e12cacfa804d48b950 (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) policy filter_inner_identity { (1) if (!&outer.request:User-Name || !&User-Name) { (1) if (!&outer.request:User-Name || !&User-Name) -> TRUE (1) if (!&outer.request:User-Name || !&User-Name) { (1) update request { (1) Module-Failure-Message = "User-Name is required for tunneled authentication" (1) } # update request = noop (1) [reject] = reject (1) } # if (!&outer.request:User-Name || !&User-Name) = reject (1) } # policy filter_inner_identity = reject (1) } # authorize = reject (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> mathias.maes(a)maerlantatheneum.be (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) if (&control:Auth-Type == ldap) { (1) ERROR: Failed retrieving values required to evaluate condition (1) update control { (1) &Cache-TTL := 0 (1) } # update control = noop (1) cache_ldap_user_dn: EXPAND %{Stripped-User-Name} (1) cache_ldap_user_dn: --> (1) cache_ldap_user_dn: ERROR: Zero length key string is invalid (1) [cache_ldap_user_dn] = invalid (1) } # Post-Auth-Type REJECT = invalid (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 171 from 127.0.0.1:18123 to 127.0.0.1:43929 length 20 Met vriendelijke groet Mathias Maes ICT-Coördinator Maerlant Atheneum

2 1

Python Or Perl Module for Auth and Accounting
by Imdad Hasan 18 Jun '23

18 Jun '23

Hi All, Which module is better from perl and python if doing whole auth and accounting code in native language without using socket or any other language. like perl native code or python native code. Thanks Imdad

2 1

Debian 12 Bookworm packages available
by Matthew Newton 16 Jun '23

16 Jun '23

We've added Debian 12 Bookworm to the Network RADIUS package builds. Both FreeRADIUS 3.2.3 and 3.0.26 are now available. Instructions are on the packages site as usual: https://packages.networkradius.com/ -- Matthew

2 1

Automated XIoT device management GoldenPath
by Michael Maymann 16 Jun '23

16 Jun '23

Hi list, first Q, so please be nice ;) If I am in the wrong list, please just let me know where to ask :) I am in the process of figuring out the architecture of how to automate XIoT device management best possible, and thought the following functionality in Radius would be a good approach. Are these something that is already supported in FreeRadius? Suggestions for better alternatives or guides/links on how to best achieve this are much appreciated :) "ZeroConf" XIoT info: - [MUD](https://datatracker.ietf.org/doc/rfc8520) retrieval (-> asset management system -> XIoTType ACL creation/approval -> provisioning) - [SBOM](https://cyclonedx.org/specification/overview) retrieval (-> asset management system -> continuous lightweight vulnerability scanning -> proactive compromisation actions) ZeroTrust XIoT PNAC 802.1x EAP-TLS authentication: - [FDO](https://github.com/fido-device-onboard) - [KeyLime](https://github.com/keylime) - [Akri](https://github.com/project-akri/akri) ZeroTouch XIoT provisioning: - [AWS IoT Greengrass](https://github.com/aws-greengrass) - [Tinkerbell](https://github.com/tinkerbell/proposals/issues/66) Thanks in advance :) Br. Michael

2 2