- Freeradius-Users - lists.freeradius.org

traffic quota control
by ReZa Esfahani 02 May '23

02 May '23

hi I want to control traffic quota for users in freeradius, for example, I want to set a monthly 20GB traffic quota for a specific group. How can I do that ? and after the traffic quota is reached , freeradius disconnects the user? and my last question is rlm_quota module in freeradius for this or do we have to do it in another way? thank you

3 3

Is it possible to query freeradius' certificate expiration remotely?
by Matt H 02 May '23

02 May '23

Is it possible to query freeradius' certificate expiration date remotely for the cert in /etc/raddb/certs? I'm trying to set up an alert so there's notification when the cert is <60 days from requiring renewal. I'm trying the following but the command returns connection refused on all of the ports I expected it to work on: openssl s_client -servername rad2.domain.com -connect rad2.domain.com:1813 | openssl x509 -noout -dates I've tried ports 443, 8080, 88, 1812, 1813, 1645, 1646, and everything else I can find that might be listening, to no avail. Thanks for any guidance /mh

5 4

radperf and radius returns challenge
by Mesut GULNAZ 29 Apr '23

29 Apr '23

I am trying to make a performance test for a radius server that sends challenge instead of Access-Accepted but radperf marks all responses as fail Total failed : 100 this is the command I used. radperf -q -s -a pap -c 100 -T test.rad -f user.csv -p 100 -r 1 -t 60 localhost:1812 auth testing123 what can I do? any help is highly appreciated.

2 1

FW: Need help with EAP-AKA configuration
by Mrudul Dighe 26 Apr '23

26 Apr '23

Hello, I am trying to configure EAP-AKA virtual-server in FreeRADIUS to perform authentication of multiple sim cards we own. We have followed the documentation and configured below in sites-enabled/eap-aka-sim and able to authenticate successful with EAPOL_TEST tool using same Ki and OPc: <<<<<<<<<<<<<<<<<<<<<<<<<<<< send Challenge-Request { &control.SIM-Ki := 0x465b5ce8b199b49faa5f0a2ee238a6bc &control.SIM-Opc := 0xcd63cb71954a9f4e48a5994e37a02baf &control.SIM-SQN := 3 } >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> However, this helps in authenticating only the imsi with above Ki/OPc. But our requirement is to authenticate multiple such IMSIs/SIMs with their Ki/OPc whose values we are aware of. May I know how to specify the list of imsi/Users and make it work instead of hardcoding like above? We tried adding following line in 'users' file in raddb/ folder and removed above hardcoding in Challenge-Response part of eap-aka-sim virtual-server configuration : "315010000000002(a)wlan.mnc010.mcc315.3gppnetwork.org<mailto:315010000000002@wlan.mnc010.mcc315.3gppnetwork.org> SIM-Ki := 770db7f9275c47eb3d12b2024caa3548, SIM-Opc := 6245aedadf3ebbb82b0f62df52e0de12, SIM-SQN := 3" But it's not working. I have attached the radiusd Logs with the mail. Where I see following error - """ (0.0) eap-aka-sim - WARNING: Could not find or derive data for UMTS vector (0.0) eap-aka-sim - ERROR: Failed retrieving UMTS vectors """ Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Any help would be greatly appreciated. Thank you in advance. Best regards, Mrudul Dighe.

2 1

"switch" statement": would you know a more compact statement?
by Alex Zetaeffesse 26 Apr '23

26 Apr '23

Hi FR people, Is there a more compact way to state what follows? switch { ("%{User-Name}" =~ /(a)tenant101\.bic\.local/) {update control{Proxy-To-Realm := "tenant101"} ("%{User-Name}" =~ /(a)tenant102\.bic\.local/) {update control{Proxy-To-Realm := "tenant102"} ("%{User-Name}" =~ /(a)tenant103\.bic\.local/) {update control{Proxy-To-Realm := "tenant103"} ("%{User-Name}" =~ /(a)tenant104\.bic\.local/) {update control{Proxy-To-Realm := "tenant104"} ("%{User-Name}" =~ /(a)tenant105\.bic\.local/) {update control{Proxy-To-Realm := "tenant105"} ("%{User-Name}" =~ /(a)tenant106\.bic\.local/) {update control{Proxy-To-Realm := "tenant106"} ("%{User-Name}" =~ /(a)tenant107\.bic\.local/) {update control{Proxy-To-Realm := "tenant107"} .... ("%{User-Name}" =~ /(a)tenant170\.bic\.local/) {update control{Proxy-To-Realm := "tenant170"} } Eventually, I may get the value of the Proxy-To-Realm variable, by stripping the 2nd and top level domain and there would not need to repeat the case. Thanks, Alex

2 4

Does eapol_test lie about the data it exchanges with FreeRADIUS?
by Joe Garcia 22 Apr '23

22 Apr '23

I've been debugging an embedded RADIUS client, specifically one that does PEAP auth, using eapol_test, or at least trying to, however I can't see how it could work using the messages it claims to be exchanging with FreeRADIUS. In particular eapol_test claims it replies to the initial identity request with an EAP, not PEAP, message: EAP-PEAP: Encrypting Phase 2 data - hexdump(len=12): 02 a5 00 0c 01 74 65 73 74 33 32 31 when it should be just PEAP, 01 74 65 73 74 33 32 31. Looking at the FreeRADIUS code that handles this (3.2.x, the current version shipping with various Linux distros), src/modules/rlm_eap/types/ rlm_eap_peap:eappeap_process() calls eapmessage_verify() which, for an EAP Response (type = 2) only allows an EAP-TLV and nothing else, in particular not an EAP Identity message as eapol_test claims it's sending. I've verified this by sending the message that eapol_test claims it's sending and getting: eap_peap: Received unexpected EAP-Response, rejecting the session. eap_peap: ERROR: Tunneled data is invalid which is exactly what you'd expect from the code in eapmessage_verify(). So does eapol_test invisibly convert messages to and from EAP/PEAP format when communicating with FreeRADIUS and report the EAP form while using the PEAP form? Further evidence in support of this is what it reports on read of a PEAP Identity Request: EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=1): 01 EAP-PEAP: received Phase 2: code=1 identifier=165 length=5 The first line reports it's read a PEAP message (which is indeed what's being sent) and on the second line it's magically converted itself into an EAP message, which isn't actually sent. Does this mean that eapol_test is an unreliable source of information when it comes to debugging auth issues? JG.

2 2

Freeradius4 DHCPv6 configuration
by Ľudovít Mikula 21 Apr '23

21 Apr '23

Hi experts! I am trying to configure DHCPv6 in freeradius 4. I'd like to be able to assign an IP address from a pool based on Option82 (Remote-Id + Circuit-Id). My problem is that I seem to be unable to find a decent client for testing this setup. There are plenty of test DHCPv4 clients, but not many DHCPv6 clients which also can send custom DHCP options. Any recommendations (ideally linux CLI client/script)? If somebody already did such configuration, I'd be very grateful for any hints. Ludo

2 1

Re: Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

OK. I think I understand. Thanks for the details From: Freeradius-Users <freeradius-users-bounces+daniel.e.white=nasa.gov(a)lists.freeradius.org> on behalf of Alan DeKok <aland(a)deployingradius.com> Reply-To: FreeRADIUS ML <freeradius-users(a)lists.freeradius.org> Date: Thursday, April 20, 2023 at 08:20 To: FreeRADIUS ML <freeradius-users(a)lists.freeradius.org> Subject: [BULK] Re: [EXTERNAL] Mailing list is being Spam Filtered by O-365 On Apr 20, 2023, at 8:14 AM, Noel Butler <noel.butler(a)ausics.net<mailto:noel.butler@ausics.net>> wrote: That is not a freeradius.org server that I can see, completely different network even... /var/mail/corp/n/o/e/noel.butler/Maildir/.Lists.FreeRadius/cur# grep "63.88.93.251" * | wc -l 0 Messages in folder 28047 $ host 63.88.93.251 251.93.88.63.in-addr.arpa domain name pointer smtp.e3a.verizonbusiness.com. i.e. someone is routing mail through internal systems, and then complaining that mail is being routed through internal systems. This is our problem, not under our control, and there is nothing we can do about it. CC'd F/R ML since you also posting this issue over there On 20/04/2023 21:47, White, Daniel E. (GSFC-770.0)[AEGIS] via users wrote: How about this: Received: from BL0GCC02FT019.eop-gcc02.prod.protection.outlook.com (2a01:111:f400:7d05::201) by CYXPR09CA0020.outlook.office365.com (2603:10b6:930:d4::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via Frontend Transport; Thu, 20 Apr 2023 11:27:54 +0000 Authentication-Results: spf=fail (sender IP is 63.88.93.251) <------------------------- smtp.mailfrom=lists.freeradius.org; dkim=none (message not signed) header.d=none;dmarc=fail action=oreject header.from=lists.freeradius.org;compauth=none reason=452 Received-SPF: Fail (protection.outlook.com: domain of lists.freeradius.org <------------------------- does not designate 63.88.93.251 as permitted sender) receiver=protection.outlook.com; client-ip=63.88.93.251; helo=vsmtpx-e100-01.localdomain; -- Regards, Noel Butler

1 0

Re: [EXTERNAL] Re: Mailing list is being Spam Filtered by O-365
by Noel Butler 20 Apr '23

20 Apr '23

That is not a freeradius.org server that I can see, completely different network even... /var/mail/corp/n/o/e/noel.butler/Maildir/.Lists.FreeRadius/cur# grep "63.88.93.251" * | wc -l 0 Messages in folder 28047 CC'd F/R ML since you also posting this issue over there On 20/04/2023 21:47, White, Daniel E. (GSFC-770.0)[AEGIS] via users wrote: > How about this: > > Received: from BL0GCC02FT019.eop-gcc02.prod.protection.outlook.com > (2a01:111:f400:7d05::201) by CYXPR09CA0020.outlook.office365.com > (2603:10b6:930:d4::27) with Microsoft SMTP Server (version=TLS1_2, > cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via > Frontend > Transport; Thu, 20 Apr 2023 11:27:54 +0000 > Authentication-Results: spf=fail (sender IP is 63.88.93.251) > <------------------------- > smtp.mailfrom=lists.freeradius.org; dkim=none (message not signed) > header.d=none;dmarc=fail action=oreject > header.from=lists.freeradius.org;compauth=none reason=452 > Received-SPF: Fail (protection.outlook.com: domain of > lists.freeradius.org <------------------------- > does not designate 63.88.93.251 as permitted sender) > receiver=protection.outlook.com; client-ip=63.88.93.251; > helo=vsmtpx-e100-01.localdomain; -- Regards, Noel Butler This Email, including attachments, may contain legally privileged information, therefore at all times remains confidential and subject to copyright protected under international law. You may not disseminate this message without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message.

2 1

Re: Mailing list is being Spam Filtered by O-365
by Noel Butler 20 Apr '23

20 Apr '23

Ohhhhh, same IP again in this message, you are forwarding your mail via verizon business aren't you, no, there is nothing wrong with SA, FR lists nor Harrys setup.... when you forward, you risk breakage, only you can deal with this. On 20/04/2023 22:08, White, Daniel E. (GSFC-770.0)[AEGIS] via users wrote: > Sorrry. > > Mixing up lists > > Received: from BL0GCC02FT027.eop-gcc02.prod.protection.outlook.com > > (2a01:111:f400:7d05::201) by CY4PR09CA0046.outlook.office365.com > > (2603:10b6:903:c0::32) with Microsoft SMTP Server (version=TLS1_2, > > cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via > Frontend > > Transport; Thu, 20 Apr 2023 11:50:41 +0000 > > Authentication-Results: spf=fail (sender IP is 63.88.93.251) > ß---------------------------- > > smtp.mailfrom=thelounge.net; dkim=none (message not signed) > ß---------------------------- > > header.d=none;dmarc=none action=none > header.from=thelounge.net;compauth=fail > > reason=001 > > Received-SPF: Fail (protection.outlook.com: domain of thelounge.net > does not > > designate 63.88.93.251 as permitted sender) > receiver=protection.outlook.com; > > client-ip=63.88.93.251; helo=vsmtpx-e100-03.localdomain; > > ______________________________________________________________________________________________ > > Daniel E. White > daniel.e.white(a)nasa.gov > > NASCOM Linux Engineer > NASA Goddard Space Flight Center > Office: (301) 286-6919 > > Mobile: (240) 513-5290 > > From: Reindl Harald <h.reindl(a)thelounge.net> > Organization: the lounge interactive design > Date: Thursday, April 20, 2023 at 07:50 > To: Daniel White <daniel.e.white(a)nasa.gov>, > "users(a)spamassassin.apache.org" <users(a)spamassassin.apache.org> > Subject: Re: [EXTERNAL] Re: Mailing list is being Spam Filtered by > O-365 > > CAUTION: This email originated from outside of NASA. Please take care > when clicking links or opening attachments. Use the "Report Message" > button to report suspicious messages to the NASA SOC. > > Am 20.04.23 um 13:47 schrieb White, Daniel E. (GSFC-770.0)[AEGIS] via > users: > >> How about this: > > how about realize that "@lists.freeradius.org" has nothing to do with > > "@spamassassin.apache.org"? > > Received: from BL0GCC02FT019.eop-gcc02.prod.protection.outlook.com > > (2a01:111:f400:7d05::201) by CYXPR09CA0020.outlook.office365.com > > (2603:10b6:930:d4::27) with Microsoft SMTP Server (version=TLS1_2, > > cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via > Frontend > > Transport; Thu, 20 Apr 2023 11:27:54 +0000 > > Authentication-Results: spf=fail (sender IP is 63.88.93.251) > <------------------------- > > smtp.mailfrom=lists.freeradius.org; dkim=none (message not signed) > > header.d=none;dmarc=fail action=oreject > > header.from=lists.freeradius.org;compauth=none reason=452 > > Received-SPF: Fail (protection.outlook.com: domain of > lists.freeradius.org <------------------------- > > does not designate 63.88.93.251 as permitted sender) > > receiver=protection.outlook.com; client-ip=63.88.93.251; > > helo=vsmtpx-e100-01.localdomain; > > From: Reindl Harald <h.reindl(a)thelounge.net> > > Organization: the lounge interactive design > > Date: Thursday, April 20, 2023 at 07:36 > > Subject: [EXTERNAL] Re: Mailing list is being Spam Filtered by O-365 > > Am 20.04.23 um 13:20 schrieb White, Daniel E. (GSFC-770.0)[AEGIS] via > users: > > Is there any chance that SPF and DKIM records could be added to appear > in the headers ? > what makes you believe that SPF is part of mail-headers? > dig +short TXT spamassassin.apache.org; > > "spf2.0/pra ?all" > > "v=spf1 include:_spf.apache.org -all" > > Received-SPF: Pass (mailfrom) identity=mailfrom; > > client-ip=3.227.148.255; helo=mxout1-ec2-va.apache.org -- Regards, Noel Butler This Email, including attachments, may contain legally privileged information, therefore at all times remains confidential and subject to copyright protected under international law. You may not disseminate this message without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message.

1 0