- Freeradius-Users - lists.freeradius.org

snmptrap on start/shutdown
by Anatoliy Kushner 03 Apr '23

03 Apr '23

Hi ream, is it possible to send snmp traps on start/shutdown of freeradius ? \ AK

2 2

New deployment for wisp company
by ‪Mustafa Nassir‬ 01 Apr '23

01 Apr '23

1 0

Multiple questions about the way FreeRADIUS works
by florentvercourt＠gmail.com 30 Mar '23

30 Mar '23

Hello everyone, I want to thank you in advance for taking the time to help me, as well as apologize if I ask bogus questions or questions that have already been answered. Ive been trying to implement a FreeRADIUS service inside of a University for the past 3 months, Ive read as much documentation as possible (books : FreeRADIUS Beginner guide and Authentication réseau avec RADIUS, all resources on freeradius <https://wiki.freeradius.org/Home> and networkradius <https://networkradius.com/doc/3.0.10/index.html> ) before asking questions. Im implementing 802.1X protocol on our wired network using EAP-TTLS/PAP protocol for communications between supplicants and our radius server. Were using LDAP as our main user storage, and a file with rlm_files modules for devices which doesnt support EAP. My radius infrastructure is composed as following: I got 2 VM running FreeRADIUS version 3.2.1 I have several questions: I- Session-State : 1. What is the purpose of the State attribute defined in RFC2865 (I read it but doesnt fully understand the purpose of this attribute), and is it linked in any way to the Session-State list? Also, Is there any documentation about the Session-State list? 2. Are attributes stored in Session-State list automatically retrieved when a new request is incoming and added to the Request list? 3. Does attributes stored in Session-State list persist between all packets of a conversation (from the first Access-request to the Access-Accept/Reject), and does the same Session-State list still exist for the accounting, or is it reinitialize once an Access-Accept/Reject has been sent? II- Attributes : I would like to have some information about those attributes to know, what they are supposed to store and how they are supposed to be used: 1) Session-Type: What does it refer? 2) Allow-Session-Resumption: Does this attribute is set to Yes by default, or does it have to be added somewhere, and what is the difference with EAP-Session-Resumed? 3) Cached-Session-Policy: For applying a policy to the cache, do I have to store the file path to the policy, or just the name of the policy that I want to apply? 4) SSHA2-256-Password: my passwords are stored in my LDAP with a salt and a sha256 hash, does it will be stored in Password-With-Header or also in SSHA2-256-Password ? 5) EAP : a. EAP-Session-Id : Does this value is set automatically the value of this attribute the ID of the EAP-Session will be the same, b. What is the difference between EAP-Id and EAP-Session-Id? 6) TLS : a. TLS-Cache-Method : Does the value of this attribute trigger instantiation of the module rlm_cache defined inside of tls-cache virtual server? b. TLS-Session-Data : Can I retrieve data from this attribute, or does it exist simply to store data that pass through my TLS tunnel? c. TLS-Cache-Filename : What is the difference between this attribute and Cached-Session-Policy? III- TLS : 1. When were setting virtual_server = "inner-tunnel" inside of module rlm_eap, is it just that the module rlm_eap knows when the TLS tunnel is set up and then for the inner exchange itll use this one or is it considerate as a proxy to the inner-tunnel server from the default server? IV- Cache : Because were a university I want to implement the fast resumption of sessions, I want to cache living sessions for a duration of 6 hours, so if a user doesnt re-authenticate during this period it will have to perform a complete re-authentication. 1. Does the cache section inside of the module rlm_eap, automatically store (session-Id, User-Name, Stripped-User-Name, Cached-Session-Policy), how can the session be resumed from this entry? 2. What is the difference between module rlm_cache and the session-state list in the persistence of information stored? V- Log : 1. I use the cui attribute as follows to have a unique identifier for a user inside of my TTLS tunnel (I know the attribute is originally designed to serve as an alias identifier of the username identity according to rfc4372) : %{sha1:${policy.cui_hash_key}%{request:Stripped-User-Name}%{ request:Operator-Name}%{request:User-Password}}, with policy.cui_hash_key which is a salt added to the hash 2. In order to retrieve my cache session, I plan to use CUI as my key, is there a better way to do so? 3. Once a device has been granted access to the network and once it retrieves an IP address, does the IP address will be included in the accounting packets? VI- Charge of the server : 1. Is there a way to know the live charge of a radius server as a String expansion to decide whether or not to proxy the request to another radius server (I dont know if the parameter max_requests is designed for this purpose)? 2. To do load-balancing between my VMs, is possible natively with FreeRADIUS or do I have to use an external load-balancer? VII- Home server : I got the following proxy.conf file: proxy server { default_fallback = no dynamic = no } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 1812 proto = udp secret = << secret >> response_window = 20 zombie_period = 40 status_check = status-server check_interval = 10 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 65536 } home_server ru-freeradius-as2 { type = auth ipaddr = 10.101.0.10 port = 1812 proto = udp secret = << secret >> response_window = 20 zombie_period = 40 status_check = status-server check_interval = 10 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 32268 } home_server_pool my_auth_failover { type = fail-over home_server = localhost home_server = ru-freeradius-as2 virtual_server = pre_post_proxy_for_pool } realm my.realm { auth_pool = my_auth_failover } If I use the suffix instance of the module rlm_realm in the configuration of the default server in the authorize section, and the given User-Name is user@my.realm 1. Does my request will be passed through the my_auth_failover pool, and so being proxied to the home_server localhost server and set Proxy-To-Realm = LOCAL. Is this server to which the request is being proxy the default server? Again, Thank you for reading this long message with many questions, and for your help! I really appreciate it. Florent VERCOURT

2 1

How safely update from 3.0 to 3.2 (Debian Bullseye)
by Thiago Martins 30 Mar '23

30 Mar '23

Hi! I'm trying to find a step by step to safely update from 3.0 to 3.2. The usual "apt-get update" says I'm in the latest version... I did not find any source about this yet, just to update from 2.x to 3.x. Do you guys can help me? Thanks a lot! -- TGM -- <https://www.itaueira.com/> Siga nossas redes sociais @itaueirareialimentos <https://www.instagram.com/itaueirareialimentos/> @melaorei <https://www.instagram.com/melaorei/> @pimentaorei <https://www.instagram.com/pimentaorei/> @melanciadamagali <https://www.instagram.com/melanciadamagali/> Esta mensagem é endereçada exclusivamente ao seu destinatário e poderá conter informações confidenciais. O uso não autorizado de tais informações é proibido e estará sujeito às penalidades cabíveis. *This message is intended exclusively for its addressee and may contain information that is confidential. * *Unauthorized use of such information is prohibited and subject to applicable penalties.*

2 1

Machine authentication with client certificate to Samba DC
by Tim ODriscoll 30 Mar '23

30 Mar '23

Dear All, I'm trying to set up my radiusd server to authenticate Windows 11 machines using their computer name and a client certificate (deployed through GPO), and then put them in a specific VLAN based on either machine name or group membership. I'm running Rocky OS and Samba as an AD (separate machines). ldapsearch is working well using the DC's certificate from the radiusd box. The plan is to have one WiFi SSID with every domain-joined laptop automatically joining it using a deployed CA and client cert and the machine credentials. If possible, it would be good to allow BYOD on the same SSID using a users AD credentials as long as they have both the CA and client cert installed. I've got the radiusd self-generated CA deployed via GPO and I've got the WiFi GPO deployed and sending out the machine name. I see the machine trying to authenticate and fail. I try with a username/password and I get my VLAN accept packet. How can I get the machine to authenticate, and how do I enforce the client certificate and install it through a GPO? I've done the CA, but the client certificate doesn't have an obvious place? Attached is the debug output from a failed machine auth session, which tells me that there is no machine password in the access request...? It all goes wrong around packet 7, lines 1962 - 1986. Thank you, Tim

3 11

Certificate issue after upgrade in the LDAP module - Let's Encrypt certs not working either
by Kaya Saman 30 Mar '23

30 Mar '23

Hi everyone, it's been ages!! Unfortunately my health took a downturn and I have not been keeping up with anything and now finding myself needing to upgrade many almost archaic builds now. What was working on a previous version of FR seems to have stopped and now FR is complaining at me :-( I'm using StartTLS in OpenLDAP so FR got provisioned eons ago with a working setup which has been flawless for may years, I created an raddb/ldap folder where I put my ldap TLS certs. I performed an upgrade recently and then noticed that some services had gone down. This is the relevant output of radiusd -X: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://fqdn:389 TLS certificate verification: Error, self signed certificate TLS: can't connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed certificate). rlm_ldap (ldap): Could not start TLS: Connect error rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap" my ldap module in FR contains these lines: start_tls = yes #ca_file = /etc/ssl/cert.crt ca_file = /usr/local/etc/raddb/ldap/cert.pem #ca_path = /etc/ssl/ ca_path = /usr/local/etc/raddb/ldap/ #certificate_file = /etc/ssl/cert.crt certificate_file = /usr/local/etc/raddb/ldap/cert.pem #private_key_file = /etc/ssl/cert.key private_key_file = /usr/local/etc/raddb/ldap/privkey.pem Originally I had a cert.crt and cert.key file which I believe I generated using openssl? Judging from the records in the shell history I think it was something like this that I used: cd /etc/ssl openssl genrsa -out cert.key 1024 openssl req -new -key cert.key -out cert.csr openssl x509 -req -in cert.csr -days 365 -signkey cert.key -out cert.crt openssl x509 -req -in cert.csr -days 365 -signkey cert.key -out cert.crt of which I tried regenerating using the exact same lines as I thought originally that the cert had expired. From the radd -X error it's obvious that it doesn't like the certificate as it was self signed. As I'm not using a certificate provider since this is in my home lab, I thought about using Let's Encrypt so I manually generated certificates using the certbot tool. Unfortunately the error from radd -X is the same and is calling the certificate "self signed". I think the culprit is that LE doesn't have a CA associated with it. Does anyone have any advice on how to either get FR working with my certificates or would my only options be to either turn TLS in OpenLDAP off or to use an authoritative signing body? Many thanks in advance. Kaya

2 3

Freeradius giving certificate error
by Dhanushka Parakrama 29 Mar '23

29 Mar '23

Hi All . We are running freeradius 2.1.10 with WPA Enterprise authentication with EAP-TTLS and setup is working is fine Then we have regenerated the new certificates via .*/bootstrap *command Then we tried to login to WIFI . but our freeradius stared to throw the below error Wed Mar 29 20:26:02 2023 : Error: TLS Alert read:fatal:bad certificate Wed Mar 29 20:26:02 2023 : Error: TLS_accept: failed in SSLv3 read client certificate A Wed Mar 29 20:26:02 2023 : Error: rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Wed Mar 29 20:26:02 2023 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. Wed Mar 29 20:26:02 2023 : Auth: Login incorrect (TLS Alert read:fatal:bad certificate): [user(a)email.com] (from client ManagementAPs port 1 cli e8-84-a5-e0-49-d0) Is there any reason for the above error ? How can I fix it ? , Please advice Thank You Dhanushka

3 2

Is there a XLAT IF(..) like expansion?
by g4-lisz＠tonarchiv.ch 29 Mar '23

29 Mar '23

Hello again I'm trying to accomplish the following (pseudo code): In rlm_rest module config: authenticate { body = "json" data = '{ "token" : "xxxxxxx", "states": [ "x", "y" ], "resourceIds: PSEUDO_CODE>> IF(%{control:Cust-Resource-Uuid}, [ "%{control:Cust-Resource-Uuid}" ], null) <<PSEUDO_CODE , }' } I.e. when the custom attribute is set, the JSON's "resourcesIds" property should be an array containing the attribute's string content, otherwise "null". Your help is much appreciated! Cheers, Till

2 2

EAP tunnel username problem
by ST Wong (ITSC) 29 Mar '23

29 Mar '23

Hi all, We're running freeRADIUS 3.0.21 for 802.1x authentication. It works all the time. However, we note that occasionally in log entries for successful login, the username logged by default site is different from the real username,e.g. 1. Username changed to "user" while domain part remains unchanged: Wed Mar 22 17:28:20 2023 : Auth: (23249490) Login OK: [skywalker(a)mydomain.hk] (from client ctrl01 port 0 via TLS tunnel) Wed Mar 22 17:28:20 2023 : Auth: (23249491) Login OK: [user(a)mydomain.hk] (from client ctrl01 port 0 cli 67A2ED8ECBAF) 1. First character in username is stripped: Wed Mar 22 15:39:12 2023 : Auth: (23080299) Login OK: [s1234567890(a)mydomain.hk] (from client ctrl01 port 0 via TLS tunnel) Wed Mar 22 15:39:12 2023 : Auth: (23080300) Login OK: [1234567890(a)mydomain.hk] (from client ctrl01 port 0 cli 73D2ED9CABEB) I've no idea as over 99% of the logs look good. Would anyone please help? Thanks a lot. Best Rgds /st wong

2 2

Re: RE: Edit User-Name based on regex
by Hermann.Lauer＠uni-heidelberg.de 28 Mar '23

28 Mar '23

On Mon, Mar 27, 2023 at 12:10:26PM +0000, ANGEL LUIS MATEO MARTINEZ wrote: > I'm stuck trying to remove the ":" chars from the string. try something like: if ( &Calling-Station-Id =~ /^([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})$/i ) newusername = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" > The example in the docs for regex is a username comparison (first google hit), and there are many examples all over stackexchange of mac address regexes. And yes, it's often used. Greetings Hermann > Are you stuck on where to do the username comparison, or how to remove the :'s from > the string or ? > > > On Mar 27, 2023, at 6:20 AM, ANGEL LUIS MATEO MARTINEZ <amateo(a)um.es> wrote: > > > > Hello, > > > > I have a scenario where I need to modify User-Name, before any AAA operation, based on a regex substitution. To be precise, the users are sending a MAC as the username, in the form "00:11:22:33:44:55" and I need to transform this to "001122334455". > > > > This may be a silly question, but I haven't found how to do it. Is there any way to do it? Thank you. > > > > -- > > Angel L. Mateo Martínez > > Sección de Telemática > > Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) > > http://www.um.es/atica > > Tfo: 868889150 > > Fax: 868888337 > > - > > List info/subscribe/unsubscribe? See https://urldefense.com/v3/__http://www.freeradius.org/list/users.html__;!!D… > > - > List info/subscribe/unsubscribe? See https://urldefense.com/v3/__http://www.freeradius.org/list/users.html__;!!D… -- Administration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 205; 69120 Heidelberg; Tel: (06221)54-14405 Fax: -14427 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

1 0