- Freeradius-Users - lists.freeradius.org

Freeradius support for password compatibility
by florentvercourt＠gmail.com 09 Feb '23

09 Feb '23

Hello, I would like to have some information about Freeradius supports for RADIUS protocol and password compatibility. I already looked at https://networkradius.com/articles/2021/08/23/protocols-and-password-compati bility.html. I use EAP-TTLS/PAP to authenticate my users, and I would like to know if freeradius is able to apply a hash to the cleartext password transmitted within PAP module, when passwords are stored with an SHA256 or SHA512 encryption in an LDAP; or do I have to use "ldap bind as users" instead of the PAP module to authenticate my users. Thank you for your help, Florent VERCOURT

2 1

Re: Respond with access-accept when password incorrect
by Steven Walters 09 Feb '23

09 Feb '23

Thanks for the response Alan. I tested it and it worked. Just made a small change as below to apply the accept to guest account only. I just would like to understand why (purpose) one needs to set 'reject=1'? If I remove the statement the policy doesn't work. Auth-Type PAP { pap{ reject=1 } if (reject && User-Name == "guest") { accept } } Thanks Steven On Wed, 8 Feb 2023 at 14:00, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: kqueue support (work vlpl) > 2. Re: kqueue support (Alan DeKok) > 3. Respond with access-accept when password incorrect > (Steven Walters) > 4. Re: Respond with access-accept when password incorrect > (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 7 Feb 2023 14:01:58 +0100 > From: work vlpl <thework.vlpl(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: kqueue support > Message-ID: > < > CAPt3fZjsrb3hGzMLd5+WcOsBpmwF9oskA2p5QEu9K_1PjGz18w(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > On Mon, 6 Feb 2023 at 22:05, Matthew Newton via Freeradius-Users > <freeradius-users(a)lists.freeradius.org> wrote: > > > > > You don't need kqueue for FreeRADIUS < v4, so there is no need to build > it. > > I am confused a bit, I know I don't need kqueue to compile versions > 3.0.x and 3.2.x. But can I compile it? I want to try to use kqueue > instead of select. > > > ------------------------------ > > Message: 2 > Date: Tue, 7 Feb 2023 08:07:01 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: kqueue support > Message-ID: <0CC83890-26F3-4C42-A3A4-A95A55FF6591(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 7, 2023, at 8:01 AM, work vlpl <thework.vlpl(a)gmail.com> wrote: > > I am confused a bit, I know I don't need kqueue to compile versions > > 3.0.x and 3.2.x. But can I compile it? I want to try to use kqueue > > instead of select. > > You have the source code. Go look. It's how everyone else learned. > > If you don't have time to understand the source code, then there's no > point in trying to switch FreeRADIUS to use kqueue. > > This list is for people using FreeRADIUS, not for people learning how > kqueue works. > > Alan DeKok. > > > > ------------------------------ > > Message: 3 > Date: Tue, 7 Feb 2023 23:01:58 +0200 > From: Steven Walters <steven.walters1(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Respond with access-accept when password incorrect > Message-ID: > <CALF=EMLEFyzGukeZRb45=X86= > VdrRUkBZPzT7cDhWW4tTk5XYQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi > > We have guest broadband user accounts. I would like RADIUS to respond with > access-accept on PAP even if the password is incorrect. I will then write > to the database to indicate the session has an incorrect password and allow > the PPPoE to connect to the internet. > > This will allow the agent to access the CPE to update the password. > > What is the best way to achieve this, that is to respond with an > authentication success even if the password is incorrect for a specific > username? > > Regards > Steven > > > ------------------------------ > > Message: 4 > Date: Tue, 7 Feb 2023 16:13:52 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Respond with access-accept when password incorrect > Message-ID: <1D55996B-2930-483F-9535-0D05C7CE8A84(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 7, 2023, at 4:01 PM, Steven Walters <steven.walters1(a)gmail.com> > wrote: > > > > We have guest broadband user accounts. I would like RADIUS to respond > with > > access-accept on PAP even if the password is incorrect. I will then write > > to the database to indicate the session has an incorrect password and > allow > > the PPPoE to connect to the internet. > > > > This will allow the agent to access the CPE to update the password. > > > > What is the best way to achieve this, that is to respond with an > > authentication success even if the password is incorrect for a specific > > username? > > You can just use the "accept" policy: > > authorize { > ... > accept > } > > And it will accept the user. > > If you're actually checking passwords, it will have to be a bit > different: > > authenticate { > ... > Auth-Type pap { > pap { > reject = 1 > } > > if (reject) { > accept > } > > } > > } > > Though I would strongly recommend putting these users into a limited > VLAN. They should have access to update the password, but shouldn't be > allowed to connect to the internet. > > Alan DeKok. > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 214, Issue 6 > ************************************************ > -- Warm Regards Steven Walters 0814287179

2 1

Respond with access-accept when password incorrect
by Steven Walters 07 Feb '23

07 Feb '23

Hi We have guest broadband user accounts. I would like RADIUS to respond with access-accept on PAP even if the password is incorrect. I will then write to the database to indicate the session has an incorrect password and allow the PPPoE to connect to the internet. This will allow the agent to access the CPE to update the password. What is the best way to achieve this, that is to respond with an authentication success even if the password is incorrect for a specific username? Regards Steven

2 1

kqueue support
by work vlpl 07 Feb '23

07 Feb '23

Hi, May I ask about kqueue support as library? I see in many places receipts on how to install packages on Linux. And on the official wiki page next note "libkqueue or native kqueue support (since >= v4.0.x)". Is it mean that as a library it is supported only from v4.0.x? version. Or it is a hard dependency since that version? Best regards, Vladimir

3 6

Skip authorize if proxy? Preprocess deprecated?
by contact＠brindereseau.fr 03 Feb '23

03 Feb '23

Hello, Thanks for FreeRADIUS and the incredible amount of work. The more I use it, the more I love it, especially Unlang which allows for flexible and specific pre and post processing. I just wonder about the RADIUS sequence (v3 but v4 may be also concerned): why neither the default sequence or the doc suggests to employ such a below logic? authorize { filter_username suffix if (!&control:Proxy-To-Realm) { # or check "&control.Auth-Type" in v4 sql my_super_module my_other_module # some other things... chap pap } } My point being: once we know that proxy is needed (told by "suffix" usually), it seems to me the rest of "authorize" section can be skipped *in most cases*. It would gain some time and prevent potential side effects by subsequent modules (depending on what they do, of course). Or am I wrong? Did I miss something? Also, yet not related, is "preprocess" actually deprecated in favor of a custom module in Unlang? Or is there a reason to still use it (execution time, backward compatibility)? It seems to have disappeared in v4. Thanks!

2 2

Re: Extracting a value from an LDAP attribute
by florentvercourt＠gmail.com 02 Feb '23

02 Feb '23

>If the returned value always matches the same kind of format, I would suggest using a regex to extract the relevant part, so, after the call to the ldap module something like: > >if (&reply:Tunnel-Private-Group-ID =~ /vlan:([0-9]+)/) { ??? update reply { ??? ??? &Tunnel-Private-Group-ID := "%{1}" > ??? } >} > >That's looking for any digits after vlan: in the returned value - you will have to understand the possible formats of the returned data to know whether that will work. > Thank you, I try your solution and it works

1 0

Extracting a value from an LDAP attribute
by florentvercourt＠gmail.com 02 Feb '23

02 Feb '23

Hello all, I have been looking for a way to extract a part of an LDAP attribute that I retrieved and map to the RADIUS attribute " Tunnel-Private-Group-Id". The syntax of my LDAP attribute: "schacUserStatus : urn:mace:terena.org:schac:userStatus:FR:vlan:13+mode=manuel" I want to extract the number of the vlan, to affect it to " Tunnel-Private-Group-Id" attribute. With the given example, I want to only have "13" stored in " Tunnel-Private-Group-Id". I tried that in the ldap module : update { control:Password-With-Header += 'userPassword' reply:Tunnel-Private-Group-ID := 'schacUserStatus' } However, with this solution I retrieve "urn:mace:terena.org:schac:userStatus:FR:vlan:13+mode=manuel" in " Tunnel-Private-Group-Id". I also try to split it, but its length is 1. I read all the documentations at https://networkradius.com/doc/3.0.10 and I still don't know if there is a way to do that in unlang, and if so, do I have to do it in the ldap module, or in my virtual server configuration; or if it's possible to parse the LDAP attribute using Bash commands. Thank you for your advice and help, Florent VERCOURT

2 1

RADIUS failing to start correctly when remote DB is unavailable.
by Sea Gull 31 Jan '23

31 Jan '23

Hi, Good afternoon! I have a setup where RADIUS is set to write to multiple DBs simultaneously. I have set this as follows: 1. Copied the SQL instance in /etc/raddb/mods-enabled/sql and had it renamed and configured accordingly. 2. Called them both 3. In the pool, I have set start=0 4. Set read_client to no Although from debug these seem to be correctly set, I am still getting the message that RADIUS is trying to connect to the DB when it is unavailable. After quite a number of minutes and 3 retries, RADIUS fails to start. I have attached the full debug and included some explanation too along the way. Thanks in advance. Kind Regards, SG

3 9

packages.networkradius.com down?
by Rens Houben 31 Jan '23

31 Jan '23

Hello, At my workplace we're planning a major infrastructure migration which involves (re)installing FreeRADIUS from the networkradius.com repositories. I've been using vms and ansible scripting to test the migration path this past month and it has always gone just fine; however when I ran a general rehearsal test this morning several errors occurred involving intermittent connection timeouts downloading packages from the packages.networkradius.com source. Proxies didn't help, and attempting a manual download via browser or wget similarly times out during the download. Is this a known issue? --Rens

2 3

Using attribute reference from variable content in unlang
by Charles-Antoine Guillat-Guignard 30 Jan '23

30 Jan '23

Hello, I am trying to implement some db based attribute handling (names, operator and values from db), and I am struggling with a dynamic handling of attributes references (names). Looking at https://freeradius.org/radiusd/man/unlang.txt (ATTRIBUTE REFERENCES section), I see no exemple matching what I want to do (attribute name is always known, and static). What I try to achieve would look a bit like that (which doesn't work) : : # Exemple for Attributes-Actions values # A-AL-AAA,:=,1 # A-AL-DHCP,:=,0 foreach &Attributes-Actions { update request { Attributes-Action := "%{Foreach-Variable-2}" } %{explode:Attributes-Action ,} update reply { # for debugging, contains expected value Reply-Message += "index 0 : %{Attributes-Action[0]}" # this fails "%{Attributes-Action[0]}" := "%{Attributes-Action[2]}" } } Am I missing something? Is there another way to achieve dynamic handling of attributes names, to be able to modify an attribute whose name/reference is not pre-declared in unlang script (unknown in unlang script, but ofc declared in dictionary). Thank you in advance. Kind regards, Charles-Antoine Guillat-Guignard

2 4