- Freeradius-Users - lists.freeradius.org

oauth2 or oidc module for FreeRADIUS
by Việt Đức Trần 20 Dec '22

20 Dec '22

Hi Everyone! I am using FreeRADIUS version 3.2.1 installed on Ubuntu server 22.04 and I need to make a connection from my FreeRADIUS server to an external authentication server by using OAuth2 or OpenID Connect protocol. But I cannot find any available FreeRADIUS modules for OAuth2 or OpenID Connect. If these modules currently don't exist or do not support FreeRADIUS 3.2.1, how can I make the connection from my FreeRADIUS server to external authentication server via OAuth2/OIDC protocol? Thank you so much for your help./

2 2

freeradius 4.0 rlm_kafka
by vaiost SSSS 19 Dec '22

19 Dec '22

Hi,I am experimenting with freeradius 4.0 and it will be great if you share some more info on how we use rlm_kafka functionality so as to send accounting requests using a producer to a kafka server.Thank you in adnvanceRegards

2 1

TLS 1.3 Configuration
by Boby Tharappel 16 Dec '22

16 Dec '22

Hi all, I'm trying to do an EAP TLS connection with TLS 1.3 Device is running wpa_supplicant V 2.10 and openssl 1.1.1q. Server is running Freeradius 3.2.1, openssl 1.1.1f on Ubuntu 20.04. I have set min and max tls version to 1.3 in mods-enabled/eap. I'm running into the following error: (9) Received Access-Request Id 249 from 192.168.0.1:35335 to 192.168.0.109:1812 length 336 (9) User-Name = "babycam" (9) NAS-IP-Address = 192.168.0.1 (9) NAS-Identifier = "RalinkAP0" (9) NAS-Port = 0 (9) Called-Station-Id = "AC-84-C6-60-76-8E" (9) Calling-Station-Id = "08-FB-EA-CF-70-C2" (9) Framed-MTU = 1400 (9) NAS-Port-Type = Wireless-802.11 (9) EAP-Message = 0x020200c40d0016030100b9010000b50303470176dc576b264b7154e9bfedb49482d8ec94cb131322a2700ad8115cf99678000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000054000b000403000102000a000c000a001d0017001e001900180016000000170000000d0030002e040305030603080708080809080a080b080408050806040105010601030302030301020103020202040205020602 (9) State = 0xa6ed9180a6ef9cf4c53afbdf101f92ad (9) Message-Authenticator = 0x17fafa7bdf53feccf5af9f4e6411bf3d (9) Restoring &session-state (9) &session-state:Framed-MTU = 994 (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "babycam", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 2 length 196 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) files: users: Matched entry babycam at line 1 (9) [files] = ok (9) [expiration] = noop (9) [logintime] = noop (9) pap: WARNING: Auth-Type already set. Not setting to PAP (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = eap (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0xa6ed9180a6ef9cf4 (9) eap: Finished EAP session with state 0xa6ed9180a6ef9cf4 (9) eap: Previous EAP request found for state 0xa6ed9180a6ef9cf4, released from the list (9) eap: Peer sent packet with method EAP TLS (13) (9) eap: Calling submodule eap_tls to process data (9) eap_tls: (TLS) EAP Got final fragment (190 bytes) (9) eap_tls: WARNING: (TLS) EAP Total received record fragments (190 bytes), does not equal expected expected data length (0 bytes) (9) eap_tls: (TLS) EAP Done initial handshake (9) eap_tls: (TLS) Handshake state - before SSL initialization (9) eap_tls: (TLS) Handshake state - Server before SSL initialization (9) eap_tls: (TLS) Handshake state - Server before SSL initialization (9) eap_tls: (TLS) recv TLS 1.3 Handshake, ClientHello (9) eap_tls: (TLS) send TLS 1.2 Alert, fatal protocol_version (9) eap_tls: ERROR: (TLS) Alert write:fatal:protocol version (9) eap_tls: ERROR: (TLS) Server : Error in error (9) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (9) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (9) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation (9) eap_tls: ERROR: [eaptls process] = fail (9) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (9) eap: Sending EAP Failure (code 4) ID 2 length 4 (9) eap: Failed in EAP select (9) [eap] = invalid (9) } # authenticate = invalid (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) Post-Auth-Type REJECT { (9) attr_filter.access_reject: EXPAND %{User-Name} (9) attr_filter.access_reject: --> babycam (9) attr_filter.access_reject: Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # Post-Auth-Type REJECT = updated (9) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (9) (9) Discarding duplicate request from client masutest port 35335 - ID: 249 due to delayed response (9) Sending delayed response (9) Sent Access-Reject Id 249 from 192.168.0.109:1812 to 192.168.0.1:35335 length 44 (9) EAP-Message = 0x04020004 (9) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Please assist me with this. Boby Tharappel

3 7

Access-Reject message to SQL
by Steven Walters 13 Dec '22

13 Dec '22

Hi I have enabled SQL under post-auth to send access reject records to a db. Below is the query in queries.conf. Currently it only indicates the packet type but I would like to add the same message written to the radius.log file e.g "Login incorrect (pap: MD5 digest does not match "known good" digest)" to the database. query = "\ INSERT INTO ${..postauth_table} \ (username, reply, authdate) \ VALUES(\ '%{User-Name}', \ '%{reply:Packet-Type}', \ NOW())" Regards Steven

2 1

Acct-Status-Type = Stop
by mohamed almeshal 13 Dec '22

13 Dec '22

I'm struggling with UBNT NAS , But I found a Soultion but I need your confirmation about the code , the solution is simply to code a code that tell the every time UBNT cloud Key close the session the radius response to send disconnect this sesiion by id I tested it manualyy and it's work perfect , now the code for radius is : accounting { if(Acct-Status-Type == Stop){ fire the code here } } is that code is accurate or not please advice

2 1

replay
by mohamed almeshal 11 Dec '22

11 Dec '22

the problem Alan is simply that NAS is UBNT and it's behavior is not predicted , it's close the session even when I set session-timeout so this solution is shortcut to that

2 1

reset sql counter every time user logged in
by mohamed almeshal 11 Dec '22

11 Dec '22

dear Savers I'm in middle of missy code , I need to expire the session every time the user is logged in , I do all my best but I found that best way is to set max-all-session for the session and that will exipre the session every time and regenerate new session id , now my question is how to reset the sql counter every time the user is logged in sqlcounter sql_session_timeout_never { sql_module_instance = sql counter_name = Max-All-Session-Time check_name = Max-All-Session reply_name = Session-Timeout key = User-Name reset = never query = "\ SELECT IFNULL(SUM(AcctSessionTime),0) \ FROM radacct \ WHERE UserName='%{${key}}'" } I must set reset = ? thanks , all

2 1

Unable to start radiusd, permission issues, and minimal configuration
by James Prestwood 02 Dec '22

02 Dec '22

Hi, First off I'm having some problems starting radiusd. I first installed the Fedora package then followed the HOWTO[1]: sudo dnf install freeradius Edit /etc/raddb/users adding a 'testing' user radiusd -X Running as a regular user I get some permission errors since it needs files in /etc but neither sudo nor logging in as root allow me to run it either. Its still got permission issues with server.pem tls: Failed reading certificate file "/etc/raddb/certs/server.pem" tls: error:0200100D:system library:fopen:Permission denied tls: error:20074002:BIO routines:file_ctrl:system lib tls: error:140DC002:SSL routines:use_certificate_chain_file:system lib rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to initialise rlm_eap_tls /etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" I've also got some additional questions as to how difficult it would be to strip down the configuration, hopefully to a few files? I'm trying to add freeradius to our automated testing framework for wifi, which currently uses hostapd's internal radius server for all EAP tests which is basically two config files. The problem is its not testing against a RADIUS server that you would encounter in real life, like freeradius. So I would like to test against freeradius as well and hopefully catch any subtle differences between the two implementations. The framework runs on a minimal kernel VM and all daemon configurations are held in our upstream project (e.g. dbus, dhcpd, radvd, hostapd etc.). The freeradius config is an entire folder structure with many config files so duplicating that upstream isn't really desired. I've seen "don't modify the config" everywhere, but that aside, is a minimal configuration possible? we only need EAP. Regarldess I'd like to get radiusd running in the first place to test, then I can start the sacrilege of modifying the configuration :) [1] https://wiki.freeradius.org/guide/Basic-configuration-HOWTO

3 5

UBNT Freeradius Support
by mohamed almeshal 01 Dec '22

01 Dec '22

Hi savers ... I'm using UBNT Cloud key Gen 2 , it's work fine with some attributes but I'm looking for complete list of attributes that UBNT support . is this list available or not please advice .

2 1

REST module config options
by James Narey 30 Nov '22

30 Nov '22

Hi, I'm working on an existing FreeRADIUS 3.0.25 implementation, in particular the REST module. The current configuration sets the following config items in the tls block: cacertdir cacertfile verify_cert These don't appear in the default rest config for 3.0.x. The do appear in the NetworkRADIUS wiki, though the first two do not have descriptions. This page's 'Default Config' link goes to the same file - mods-available/rest in the 3.0.x branch. I'm unsure which names to be using and, while the names of the top two are descriptive, it would be helpful to see some documentation before continuing to rely on them. It would also be helpful to know whether there is a reason to use verify_cert vs check_cert, though it is clear at least that these do the same thing. Thank you, Jim.

2 2