- Freeradius-Users - lists.freeradius.org

"switch" statement": would you know a more compact statement?
by Alex Zetaeffesse 26 Apr '23

26 Apr '23

Hi FR people, Is there a more compact way to state what follows? switch { ("%{User-Name}" =~ /(a)tenant101\.bic\.local/) {update control{Proxy-To-Realm := "tenant101"} ("%{User-Name}" =~ /(a)tenant102\.bic\.local/) {update control{Proxy-To-Realm := "tenant102"} ("%{User-Name}" =~ /(a)tenant103\.bic\.local/) {update control{Proxy-To-Realm := "tenant103"} ("%{User-Name}" =~ /(a)tenant104\.bic\.local/) {update control{Proxy-To-Realm := "tenant104"} ("%{User-Name}" =~ /(a)tenant105\.bic\.local/) {update control{Proxy-To-Realm := "tenant105"} ("%{User-Name}" =~ /(a)tenant106\.bic\.local/) {update control{Proxy-To-Realm := "tenant106"} ("%{User-Name}" =~ /(a)tenant107\.bic\.local/) {update control{Proxy-To-Realm := "tenant107"} .... ("%{User-Name}" =~ /(a)tenant170\.bic\.local/) {update control{Proxy-To-Realm := "tenant170"} } Eventually, I may get the value of the Proxy-To-Realm variable, by stripping the 2nd and top level domain and there would not need to repeat the case. Thanks, Alex

2 4

Does eapol_test lie about the data it exchanges with FreeRADIUS?
by Joe Garcia 22 Apr '23

22 Apr '23

I've been debugging an embedded RADIUS client, specifically one that does PEAP auth, using eapol_test, or at least trying to, however I can't see how it could work using the messages it claims to be exchanging with FreeRADIUS. In particular eapol_test claims it replies to the initial identity request with an EAP, not PEAP, message: EAP-PEAP: Encrypting Phase 2 data - hexdump(len=12): 02 a5 00 0c 01 74 65 73 74 33 32 31 when it should be just PEAP, 01 74 65 73 74 33 32 31. Looking at the FreeRADIUS code that handles this (3.2.x, the current version shipping with various Linux distros), src/modules/rlm_eap/types/ rlm_eap_peap:eappeap_process() calls eapmessage_verify() which, for an EAP Response (type = 2) only allows an EAP-TLV and nothing else, in particular not an EAP Identity message as eapol_test claims it's sending. I've verified this by sending the message that eapol_test claims it's sending and getting: eap_peap: Received unexpected EAP-Response, rejecting the session. eap_peap: ERROR: Tunneled data is invalid which is exactly what you'd expect from the code in eapmessage_verify(). So does eapol_test invisibly convert messages to and from EAP/PEAP format when communicating with FreeRADIUS and report the EAP form while using the PEAP form? Further evidence in support of this is what it reports on read of a PEAP Identity Request: EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=1): 01 EAP-PEAP: received Phase 2: code=1 identifier=165 length=5 The first line reports it's read a PEAP message (which is indeed what's being sent) and on the second line it's magically converted itself into an EAP message, which isn't actually sent. Does this mean that eapol_test is an unreliable source of information when it comes to debugging auth issues? JG.

2 2

Freeradius4 DHCPv6 configuration
by Ľudovít Mikula 21 Apr '23

21 Apr '23

Hi experts! I am trying to configure DHCPv6 in freeradius 4. I'd like to be able to assign an IP address from a pool based on Option82 (Remote-Id + Circuit-Id). My problem is that I seem to be unable to find a decent client for testing this setup. There are plenty of test DHCPv4 clients, but not many DHCPv6 clients which also can send custom DHCP options. Any recommendations (ideally linux CLI client/script)? If somebody already did such configuration, I'd be very grateful for any hints. Ludo

2 1

Re: Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

OK. I think I understand. Thanks for the details From: Freeradius-Users <freeradius-users-bounces+daniel.e.white=nasa.gov(a)lists.freeradius.org> on behalf of Alan DeKok <aland(a)deployingradius.com> Reply-To: FreeRADIUS ML <freeradius-users(a)lists.freeradius.org> Date: Thursday, April 20, 2023 at 08:20 To: FreeRADIUS ML <freeradius-users(a)lists.freeradius.org> Subject: [BULK] Re: [EXTERNAL] Mailing list is being Spam Filtered by O-365 On Apr 20, 2023, at 8:14 AM, Noel Butler <noel.butler(a)ausics.net<mailto:noel.butler@ausics.net>> wrote: That is not a freeradius.org server that I can see, completely different network even... /var/mail/corp/n/o/e/noel.butler/Maildir/.Lists.FreeRadius/cur# grep "63.88.93.251" * | wc -l 0 Messages in folder 28047 $ host 63.88.93.251 251.93.88.63.in-addr.arpa domain name pointer smtp.e3a.verizonbusiness.com. i.e. someone is routing mail through internal systems, and then complaining that mail is being routed through internal systems. This is our problem, not under our control, and there is nothing we can do about it. CC'd F/R ML since you also posting this issue over there On 20/04/2023 21:47, White, Daniel E. (GSFC-770.0)[AEGIS] via users wrote: How about this: Received: from BL0GCC02FT019.eop-gcc02.prod.protection.outlook.com (2a01:111:f400:7d05::201) by CYXPR09CA0020.outlook.office365.com (2603:10b6:930:d4::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via Frontend Transport; Thu, 20 Apr 2023 11:27:54 +0000 Authentication-Results: spf=fail (sender IP is 63.88.93.251) <------------------------- smtp.mailfrom=lists.freeradius.org; dkim=none (message not signed) header.d=none;dmarc=fail action=oreject header.from=lists.freeradius.org;compauth=none reason=452 Received-SPF: Fail (protection.outlook.com: domain of lists.freeradius.org <------------------------- does not designate 63.88.93.251 as permitted sender) receiver=protection.outlook.com; client-ip=63.88.93.251; helo=vsmtpx-e100-01.localdomain; -- Regards, Noel Butler

1 0

Re: [EXTERNAL] Re: Mailing list is being Spam Filtered by O-365
by Noel Butler 20 Apr '23

20 Apr '23

That is not a freeradius.org server that I can see, completely different network even... /var/mail/corp/n/o/e/noel.butler/Maildir/.Lists.FreeRadius/cur# grep "63.88.93.251" * | wc -l 0 Messages in folder 28047 CC'd F/R ML since you also posting this issue over there On 20/04/2023 21:47, White, Daniel E. (GSFC-770.0)[AEGIS] via users wrote: > How about this: > > Received: from BL0GCC02FT019.eop-gcc02.prod.protection.outlook.com > (2a01:111:f400:7d05::201) by CYXPR09CA0020.outlook.office365.com > (2603:10b6:930:d4::27) with Microsoft SMTP Server (version=TLS1_2, > cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via > Frontend > Transport; Thu, 20 Apr 2023 11:27:54 +0000 > Authentication-Results: spf=fail (sender IP is 63.88.93.251) > <------------------------- > smtp.mailfrom=lists.freeradius.org; dkim=none (message not signed) > header.d=none;dmarc=fail action=oreject > header.from=lists.freeradius.org;compauth=none reason=452 > Received-SPF: Fail (protection.outlook.com: domain of > lists.freeradius.org <------------------------- > does not designate 63.88.93.251 as permitted sender) > receiver=protection.outlook.com; client-ip=63.88.93.251; > helo=vsmtpx-e100-01.localdomain; -- Regards, Noel Butler This Email, including attachments, may contain legally privileged information, therefore at all times remains confidential and subject to copyright protected under international law. You may not disseminate this message without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message.

2 1

Re: Mailing list is being Spam Filtered by O-365
by Noel Butler 20 Apr '23

20 Apr '23

Ohhhhh, same IP again in this message, you are forwarding your mail via verizon business aren't you, no, there is nothing wrong with SA, FR lists nor Harrys setup.... when you forward, you risk breakage, only you can deal with this. On 20/04/2023 22:08, White, Daniel E. (GSFC-770.0)[AEGIS] via users wrote: > Sorrry. > > Mixing up lists > > Received: from BL0GCC02FT027.eop-gcc02.prod.protection.outlook.com > > (2a01:111:f400:7d05::201) by CY4PR09CA0046.outlook.office365.com > > (2603:10b6:903:c0::32) with Microsoft SMTP Server (version=TLS1_2, > > cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via > Frontend > > Transport; Thu, 20 Apr 2023 11:50:41 +0000 > > Authentication-Results: spf=fail (sender IP is 63.88.93.251) > ß---------------------------- > > smtp.mailfrom=thelounge.net; dkim=none (message not signed) > ß---------------------------- > > header.d=none;dmarc=none action=none > header.from=thelounge.net;compauth=fail > > reason=001 > > Received-SPF: Fail (protection.outlook.com: domain of thelounge.net > does not > > designate 63.88.93.251 as permitted sender) > receiver=protection.outlook.com; > > client-ip=63.88.93.251; helo=vsmtpx-e100-03.localdomain; > > ______________________________________________________________________________________________ > > Daniel E. White > daniel.e.white(a)nasa.gov > > NASCOM Linux Engineer > NASA Goddard Space Flight Center > Office: (301) 286-6919 > > Mobile: (240) 513-5290 > > From: Reindl Harald <h.reindl(a)thelounge.net> > Organization: the lounge interactive design > Date: Thursday, April 20, 2023 at 07:50 > To: Daniel White <daniel.e.white(a)nasa.gov>, > "users(a)spamassassin.apache.org" <users(a)spamassassin.apache.org> > Subject: Re: [EXTERNAL] Re: Mailing list is being Spam Filtered by > O-365 > > CAUTION: This email originated from outside of NASA. Please take care > when clicking links or opening attachments. Use the "Report Message" > button to report suspicious messages to the NASA SOC. > > Am 20.04.23 um 13:47 schrieb White, Daniel E. (GSFC-770.0)[AEGIS] via > users: > >> How about this: > > how about realize that "@lists.freeradius.org" has nothing to do with > > "@spamassassin.apache.org"? > > Received: from BL0GCC02FT019.eop-gcc02.prod.protection.outlook.com > > (2a01:111:f400:7d05::201) by CYXPR09CA0020.outlook.office365.com > > (2603:10b6:930:d4::27) with Microsoft SMTP Server (version=TLS1_2, > > cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via > Frontend > > Transport; Thu, 20 Apr 2023 11:27:54 +0000 > > Authentication-Results: spf=fail (sender IP is 63.88.93.251) > <------------------------- > > smtp.mailfrom=lists.freeradius.org; dkim=none (message not signed) > > header.d=none;dmarc=fail action=oreject > > header.from=lists.freeradius.org;compauth=none reason=452 > > Received-SPF: Fail (protection.outlook.com: domain of > lists.freeradius.org <------------------------- > > does not designate 63.88.93.251 as permitted sender) > > receiver=protection.outlook.com; client-ip=63.88.93.251; > > helo=vsmtpx-e100-01.localdomain; > > From: Reindl Harald <h.reindl(a)thelounge.net> > > Organization: the lounge interactive design > > Date: Thursday, April 20, 2023 at 07:36 > > Subject: [EXTERNAL] Re: Mailing list is being Spam Filtered by O-365 > > Am 20.04.23 um 13:20 schrieb White, Daniel E. (GSFC-770.0)[AEGIS] via > users: > > Is there any chance that SPF and DKIM records could be added to appear > in the headers ? > what makes you believe that SPF is part of mail-headers? > dig +short TXT spamassassin.apache.org; > > "spf2.0/pra ?all" > > "v=spf1 include:_spf.apache.org -all" > > Received-SPF: Pass (mailfrom) identity=mailfrom; > > client-ip=3.227.148.255; helo=mxout1-ec2-va.apache.org -- Regards, Noel Butler This Email, including attachments, may contain legally privileged information, therefore at all times remains confidential and subject to copyright protected under international law. You may not disseminate this message without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message.

1 0

Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

Is there any chance that SPF and DKIM records could be added to appear in the headers ? The gubba-mint folks are getting extremely medieval about email security.

2 1

custom attribute to check NAS
by mohamed almeshal 20 Apr '23

20 Apr '23

dear saver , I'm working on custom that in radcheck table that check if the user is come from it's own NAS but without any Luck. my question is how I can add custom attribute and let it's work like other implmented attribute mohammed

2 1

References to TLS-Client-Cert-Common-Name
by Çağlar Karahan 19 Apr '23

19 Apr '23

Hi, I am using the TLS-Client-Cert-Common-Name attribute to get client certificate common name value and use it in the authorize section. While it does read the issue attributes from CA that comes with it, it ignores the client attribute. How can I get the value of a client certificate? *Here is the debug output:* *Fri Apr 7 09:03:13 2023 : Debug: (5) EAP-Type = TLSFri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Serial := "33ffb07c337ec3bc"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Expiration := "231109075300Z"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Valid-Since := "221109075300Z"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Subject := "/CN=cacert"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Issuer := "/CN=cacert"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Common-Name := "cacert"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:TRUE"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "FA:CF:53:D7:B0:54:5A:DA:12:A0:51:D4:C1:2B:10:C3:2F:C2:17:6E"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:FA:CF:53:D7:B0:54:5A:DA:12:A0:51:D4:C1:2B:10:C3:2F:C2:17:6E\n"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Serial := "55deef44a81709aa"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Expiration := "231109075300Z"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Valid-Since := "221109075600Z"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Subject := "/CN=clientcert/emailAddress=client(a)example.com/serialNumber=ababab0123456 <http://client@example.com/serialNumber=ababab0123456>"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Issuer := "/CN=cacert"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Common-Name := "clientcert"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Subject-Alt-Name-Email := "clientcert(a)example.com <clientcert(a)example.com>"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-Subject-Alt-Name-Dns := "clientcert.copy.com.example.com <http://clientcert.copy.com.example.com>"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "AA:57:43:AC:9D:32:95:F8:DB:E5:4B:7A:8E:0F:D3:5C:52:42:14:EC"Fri Apr 7 09:03:13 2023 : Debug: (5) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:FA:CF:53:D7:B0:54:5A:DA:12:A0:51:D4:C1:2B:10:C3:2F:C2:17:6E\n"Fri Apr 7 09:03:13 2023 : WARNING: (5) Outer and inner identities are the same. User privacy is compromised.Fri Apr 7 09:03:13 2023 : Debug: (5) server eap-tls-check {Fri Apr 7 09:03:13 2023 : Debug: (5) session-state: No cached attributesFri Apr 7 09:03:13 2023 : Debug: (5) # Executing section authorize from file /opt/freeradius/etc/raddb/sites-enabled/inner-tunnelFri Apr 7 09:03:13 2023 : Debug: (5) authorize {Fri Apr 7 09:03:13 2023 : Debug: (5) if ("%{sql:select assignmentvalue from radeaptlsvlan where (instr('%{TLS-Client-Cert-Common-Name}', assignmentvalue) > 0") {Fri Apr 7 09:03:13 2023 : Debug: rlm_sql (sql): Reserved connection (6)Fri Apr 7 09:03:13 2023 : Debug: rlm_sql (sql): Released connection (6)Fri Apr 7 09:03:13 2023 : Debug: rlm_sql (sql): Reserved connection (2)Fri Apr 7 09:03:13 2023 : Debug: rlm_sql (sql): Released connection (2)Fri Apr 7 09:03:13 2023 : Debug: rlm_sql (sql): Reserved connection (3)Fri Apr 7 09:03:13 2023 : Debug: rlm_sql (sql): Released connection (3)Fri Apr 7 09:03:13 2023 : Debug: rlm_sql (sql): Reserved connection (4)Fri Apr 7 09:03:13 2023 : Debug: rlm_sql (sql): Released connection (4)Fri Apr 7 09:03:13 2023 : Debug: %{User-Name}Fri Apr 7 09:03:13 2023 : Debug: Parsed xlat tree:Fri Apr 7 09:03:13 2023 : Debug: attribute --> User-NameFri Apr 7 09:03:13 2023 : Debug: (5) EXPAND %{User-Name}Fri Apr 7 09:03:13 2023 : Debug: (5) --> caglarFri Apr 7 09:03:13 2023 : Debug: (5) SQL-User-Name set to 'caglar'Fri Apr 7 09:03:13 2023 : Debug: rlm_sql (sql): Reserved connection (0)Fri Apr 7 09:03:13 2023 : Debug: (5) Executing select query: select assignmentvalue from radeaptlsvlan where (instr('cacert', assignmentvalue) > 0)* Regards, Caglar

3 4

subsctring from attribute
by Anatoliy 18 Apr '23

18 Apr '23

HI all , How i can get subsctring from attribute ? For example &Any-attr = "test:pass" but in DB I only want put "pass" part Attribut always in default:XXX

2 1