- Freeradius-Users - lists.freeradius.org

RE: Control socket directory doesn't exist after systemd stopping service
by Matthew McTague 30 Nov '22

30 Nov '22

1 0

Autoreload of freeradius configuration files
by Amit Prajapati 30 Nov '22

30 Nov '22

Hi, I am using freeradius 3.0.20 for one of the projects. For my requirement I am using it as a proxy server. I am able to update the required configuration file (client.conf, proxy.conf and site-enabled/default) with the clients, realms and home-server details, to proxy the incoming request to the home server. My query is that for this requirement I need to add/delete the new/old clients in "clients.conf" or add/delete home-server configuration in the "proxy.conf" file. But for every change in these files I have to restart the server in-order for the change to become effective. Is there any way to dynamically read these configuration files ((client.conf, proxy.conf and site-enabled/default)) without restarting the server? I have tried the HUP signal method, but it's reloading only the freeradius modules even when I changed any of these three files. Kindly advise. Thanks & Regards, Amit

3 2

Freeradius: Force user to change password on first login
by Cristian Ciobanu 30 Nov '22

30 Nov '22

Hello, I'm running FreeRADIUS for authenticating and assigning IP addresses to users connected to a SSLVPN server (OCserv). As an authentication source for FreeRADIUS I am using an LDAP server. The setup is working fine and users can connect successfully using RADIUS+LDAP authentication and receive an IP address. After I create the user account on the LDAP server I want to force the user to change its assigned password on first login or if the account has already expired and he is trying to connect to VPN. Is this possible to be done using Freeradius ? I did not find any information in the documentation or solution to explain if this can be done or if it is supported when using RADIUS+LDAP authentication Thank you and kind regards,

2 1

dhcp as non root: Failed adding ARP entry in DISCOVER
by Hermann.Lauer＠uni-heidelberg.de 30 Nov '22

30 Nov '22

Hello All, while trying to setup dhcp on a local network I get: (38) } # dhcp DHCP-Discover = ok (38) DHCP: Reply will be unicast to your-ip-address (38) Failed adding ARP entry: Failed to add entry in ARP cache: Operation not permitted (1) NO ENCODE! The server (3.2.0) is running on debian testing as user "freeradius", and I did and verified the "setcap cap_net_admin=ei /usr/sbin/freeradius". Which setup is needed in the dhcp server config section? At the moment it is: ipaddr = 0.0.0.0 src_ipaddr = <ip of interface> port = 67 interface = <interface name> broadcast = yes Thanks and greetings Hermann

3 2

Control socket directory doesn't exist after systemd stopping service
by Matthew McTague 30 Nov '22

30 Nov '22

Hi all, I have a weird bug where the control socket directory `/var/run/radiusd` gets deleted after `systemctl stop radiusd`, and `radiusd -X` doesn't re-create it. I'm using the Rocky repo as there's no AlmaLinux repo available, although I'm expecting this would be compatible. Extra information is below in case it's needed for context. Excerpt from radiusd -X output: radiusd: #### Opening IP addresses and Ports #### listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" mode = "rw" peercred = yes } Failed creating control socket "/var/run/radiusd/radiusd.sock": Failed binding to /var/run/radiusd/radiusd.sock: No such file or directory The directory doesn't exist: # ls -lah /var/run/radiusd ls: cannot access '/var/run/radiusd': No such file or directory # cat /etc/os-release NAME="AlmaLinux" VERSION="8.6 (Sky Tiger)" ID="almalinux" ID_LIKE="rhel centos fedora" VERSION_ID="8.6" PLATFORM_ID="platform:el8" PRETTY_NAME="AlmaLinux 8.6 (Sky Tiger)" ANSI_COLOR="0;34" CPE_NAME="cpe:/o:almalinux:almalinux:8::baseos" HOME_URL=https://almalinux.org/ DOCUMENTATION_URL=https://wiki.almalinux.org/ BUG_REPORT_URL=https://bugs.almalinux.org/ ALMALINUX_MANTISBT_PROJECT="AlmaLinux-8" ALMALINUX_MANTISBT_PROJECT_VERSION="8.6" # yum list freeradius Last metadata expiration check: 2:53:04 ago on Wed 30 Nov 2022 06:40:50 NZDT. Installed Packages freeradius.x86_64 3.2.1-1.el8 @networkradius # cat /etc/yum.repos.d/networkradius.repo [networkradius] name=NetworkRADIUS-$releasever baseurl=http://packages.networkradius.com/freeradius-3.2/rocky/$releasever/ enabled=1 gpgcheck=1 gpgkey=https://packages.networkradius.com/pgp/packages%40networkradius.com I tried radiusd -X with strace attached, showed the same thing, excerpt below: write(1, "listen {\n", 9listen { ) = 9 write(1, " \ttype = \"control\"\n", 19 type = "control" ) = 19 write(1, " listen {\n", 10 listen { ) = 10 write(1, " \tsocket = \"/var/run/radiusd/rad"..., 43 socket = "/var/run/radiusd/radiusd.sock" ) = 43 write(1, " \tmode = \"rw\"\n", 14 mode = "rw" ) = 14 write(1, " \tpeercred = yes\n", 17 peercred = yes ) = 17 write(1, " }\n", 3 } ) = 3 socket(AF_UNIX, SOCK_STREAM, 0) = 22 stat("/var/run/radiusd/radiusd.sock", 0x7fff5e30c580) = -1 ENOENT (No such file or directory) bind(22, {sa_family=AF_UNIX, sun_path="/var/run/radiusd/radiusd.sock"}, 31) = -1 ENOENT (No such file or directory) futex(0x7fe3b3ac0840, FUTEX_WAKE_PRIVATE, 2147483647) = 0 close(22) = 0 write(1, "\33[31mFailed creating control soc"..., 148Failed creating control socket "/var/run/radiusd/radiusd.sock": Failed binding to /var/run/radiusd/radiusd.sock: No such file or directory ) = 148 write(2, "Debugger detected, raising SIGTR"..., 35Debugger detected, raising SIGTRAP ) = 35 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [], 8) = 0 getpid() = 154664 gettid() = 154664 tgkill(154664, 154664, SIGTRAP) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGTRAP {si_signo=SIGTRAP, si_code=SI_TKILL, si_pid=154664, si_uid=0} --- +++ killed by SIGTRAP (core dumped) +++ Trace/breakpoint trap (core dumped) If I enable the dnf module for freeradius from the AlmaLinux appstream repo, I get an older version. I list duplicates from the networkradius repo first as a baseline. # dnf --showduplicates list freeradius Last metadata expiration check: 0:04:02 ago on Wed 30 Nov 2022 09:45:47 NZDT. Installed Packages freeradius.x86_64 3.2.1-1.el8 @networkradius Available Packages freeradius.x86_64 3.2.0-1.el8 networkradius freeradius.x86_64 3.2.1-1.el8 networkradius # dnf module list freeradius Last metadata expiration check: 0:00:58 ago on Wed 30 Nov 2022 09:45:47 NZDT. AlmaLinux 8 - AppStream Name Stream Profiles Summary freeradius 3.0 [d][x] server [d] High-performance and highly configurable free RADIUS server Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled # dnf module enable freeradius Last metadata expiration check: 0:01:12 ago on Wed 30 Nov 2022 09:45:47 NZDT. Dependencies resolved. ============================================================================================================================================================= Package Architecture Version Repository Size ============================================================================================================================================================= Enabling module streams: freeradius 3.0 Transaction Summary ============================================================================================================================================================= Is this ok [y/N]: y Complete! # dnf --showduplicates list freeradius Last metadata expiration check: 0:01:19 ago on Wed 30 Nov 2022 09:45:47 NZDT. Installed Packages freeradius.x86_64 3.2.1-1.el8 @networkradius Available Packages freeradius.x86_64 3.0.20-12.module_el8.6.0+2865+fd6928c8 appstream Warm Regards, .[cid:vg-email_e752d47f-182a-48d0-8808-3796b2df8d4a.png]<https://www.vetta.nz> .[cid:058_line_9bae9502-1e3a-48a3-ba5e-34ed9cd44185.png] Matthew McTague Head of Infrastructure [cid:bea-finalist-email_2ddba0ed-b9bb-4ab9-b680-84aa7f54077f.png] [cid:bea-winner-banner-email_590096c3-05a6-4c98-b071-1c4d748c3534.png] . D +64 3 222 6013<tel:+64%203%20222%206013> | P +64 3 684 5770 E matthew.mctague(a)vetta.nz<mailto:matthew.mctague@vetta.nz> | W www.vetta.nz<https://www.vetta.nz> ? Christmas/New Year Holiday Period ? During the period from 22rd December to 9th January, our offices will be closed, with our teams available via our after-hours service methods, focused on service continuity and restoration only. For more details, click here<https://vetta.link/xmas22email> . Vetta Group Ltd and its subsidiaries accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company, its subsidiaries, partners or contractors. .

3 5

Robust Proxy Accounting problem after switch from 2.2.10 to 3.2.1
by Martin Zaharinov 29 Nov '22

29 Nov '22

Hi all i try to switch from freeradius 2.2.10 to 3.2.1 After fix all configs and dictionary go to this problem real radius server not respons : 10.10.10.1 is proxy radius 192.168.10.1 is real radius server. with freeradius 2.2.10 with old config real radius respons on query. but after switch to freeradius 3.2.1 radius stop respons on query. May be i make wrong config or ? See log : Wed Nov 23 20:08:23 2022 : Debug: } Wed Nov 23 20:08:23 2022 : Debug: Listening on acct address * port 1813 Wed Nov 23 20:08:23 2022 : Debug: Listening on detail file /var/log/freeradius/radacct/detail.example.com/detail-*:* as server home.example.com Wed Nov 23 20:08:23 2022 : Info: Ready to process requests Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - User-Name = "test_bgbras" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - NAS-Identifier = "demo-bng" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - NAS-IP-Address = 10.10.10.1 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - NAS-Port = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - NAS-Port-Id = "vlan100" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - NAS-Port-Type = Virtual Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Service-Type = Framed-User Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Framed-Protocol = PPP Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Calling-Station-Id = "f6:cb:f6:40:1f:a0" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Called-Station-Id = "1a:27:b5:27:bb:53" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Class = 0x6375693d746573745f6267627261732c73753d3934323033392c736b3d686c3677777564716138396d2c626b69643d32323534303038392c626b7269643d332c6d763d3532393135313830303939372c6d743d3630353333342c676d743d3630343830302c73703d312c73723d2c61633d312c75693d3934323033392c6363693d3138382c63633d47656e6572616c2c61733d312c636f3d2c64623d3130323430302c75623d3130323430302c63626b69643d3232353430303930 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Status-Type = Start Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Authentic = RADIUS Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Session-Id = "16fecbef21f8c2cf" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Session-Time = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Input-Octets = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Output-Octets = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Input-Packets = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Output-Packets = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Input-Gigawords = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Output-Gigawords = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Framed-IP-Address = 10.0.0.3 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Event-Timestamp = "Nov 23 2022 19:59:44 IST" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Unique-Session-Id = "319ef2e5f83ff3c6e82f09959978097b" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Read packet from /var/log/freeradius/radacct/detail.example.com/detail.work User-Name = "test_bgbras" NAS-Identifier = "demo-bng" NAS-IP-Address = 10.10.10.1 NAS-Port = 0 NAS-Port-Id = "vlan100" NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "f6:cb:f6:40:1f:a0" Called-Station-Id = "1a:27:b5:27:bb:53" Class = 0x6375693d746573745f6267627261732c73753d3934323033392c736b3d686c3677777564716138396d2c626b69643d32323534303038392c626b7269643d332c6d763d3532393135313830303939372c6d743d3630353333342c676d743d3630343830302c73703d312c73723d2c61633d312c75693d3934323033392c6363693d3138382c63633d47656e6572616c2c61733d312c636f3d2c64623d3130323430302c75623d3130323430302c63626b69643d3232353430303930 Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Session-Id = "16fecbef21f8c2cf" Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Framed-IP-Address = 10.0.0.3 Event-Timestamp = "Nov 23 2022 19:59:44 IST" Acct-Unique-Session-Id = "319ef2e5f83ff3c6e82f09959978097b" Packet-Original-Timestamp = "Nov 23 2022 19:59:44 IST" Acct-Delay-Time = 519 Packet-Transmit-Counter = 1 Wed Nov 23 20:08:23 2022 : Debug: (0) Empty preacct section in virtual server "home.example.com". Using default return values. Wed Nov 23 20:08:23 2022 : Debug: (0) # Executing section accounting from file /etc/freeradius/sites-enabled/robust-proxy-accounting Wed Nov 23 20:08:23 2022 : Debug: (0) accounting { Wed Nov 23 20:08:23 2022 : Debug: (0) update control { Wed Nov 23 20:08:23 2022 : Debug: (0) &Proxy-To-Realm := 'acct_realm.example.com' Wed Nov 23 20:08:23 2022 : Debug: (0) } # update control = noop Wed Nov 23 20:08:23 2022 : Debug: (0) } # accounting = noop Wed Nov 23 20:08:23 2022 : Debug: Using home pool acct for realm acct_realm.example.com Wed Nov 23 20:08:23 2022 : Debug: (0) Starting proxy to home server 192.168.10.1 port 1813 Wed Nov 23 20:08:23 2022 : Debug: (0) server home.example.com { Wed Nov 23 20:08:23 2022 : Debug: (0) Empty pre-proxy section in virtual server "home.example.com". Using default return values. Wed Nov 23 20:08:23 2022 : Debug: (0) } Wed Nov 23 20:08:23 2022 : Debug: (0) proxy: Trying to allocate ID (0/2) Wed Nov 23 20:08:23 2022 : Debug: (0) proxy: Trying to open a new listener to the home server Wed Nov 23 20:08:23 2022 : Debug: Opened new proxy socket 'proxy address 10.10.10.1 port 48401' Wed Nov 23 20:08:23 2022 : Debug: Listening on proxy address 10.10.10.1 port 48401 Wed Nov 23 20:08:23 2022 : Debug: (0) proxy: Trying to allocate ID (1/2) Wed Nov 23 20:08:23 2022 : Debug: (0) proxy: request is now in proxy hash Wed Nov 23 20:08:23 2022 : Debug: (0) proxy: allocating destination 192.168.10.1 port 1813 - Id 122 Wed Nov 23 20:08:23 2022 : Debug: (0) Proxying request to home server 192.168.10.1 port 1813 timeout 6.000000 Wed Nov 23 20:08:23 2022 : Debug: Waking up in 0.3 seconds. Wed Nov 23 20:08:23 2022 : Debug: Ignoring spoofed proxy reply. Signature is invalid Wed Nov 23 20:08:23 2022 : Debug: Waking up in 0.1 seconds. Wed Nov 23 20:08:24 2022 : Debug: (0) Expecting proxy response no later than 5.666547 seconds from now Wed Nov 23 20:08:24 2022 : Debug: Waking up in 5.6 seconds. Wed Nov 23 20:08:29 2022 : Debug: (0) No proxy response, giving up on request and marking it done Wed Nov 23 20:08:29 2022 : Proxy: Marking home server 192.168.10.1 port 1813 as zombie (it has not responded in 6.000000 seconds). Wed Nov 23 20:08:29 2022 : Debug: (1) proxy: Trying to allocate ID (0/2) Wed Nov 23 20:08:29 2022 : Debug: (1) proxy: request is now in proxy hash Wed Nov 23 20:08:29 2022 : Debug: (1) proxy: allocating destination 192.168.10.1 port 1813 - Id 198 Wed Nov 23 20:08:29 2022 : Debug: PING: Waiting 4 seconds for response to ping Wed Nov 23 20:08:29 2022 : Debug: (1) Sent Accounting-Request Id 198 from 10.10.10.1:48401 to 192.168.10.1:1813 length 98 Wed Nov 23 20:08:29 2022 : Debug: (1) User-Name := "test_user_status_check" Wed Nov 23 20:08:29 2022 : Debug: (1) Acct-Status-Type := Stop Wed Nov 23 20:08:29 2022 : Debug: (1) Acct-Session-Id := "00000000" Wed Nov 23 20:08:29 2022 : Debug: (1) Event-Timestamp := "Nov 23 2022 20:08:29 IST" Wed Nov 23 20:08:29 2022 : Debug: (1) NAS-Identifier := "Status Check 0. Are you alive?" Wed Nov 23 20:08:29 2022 : Debug: PING: Next status packet in 30 seconds Wed Nov 23 20:08:29 2022 : ERROR: (0) Failing proxied request for user "test_bgbras", due to lack of any response from home server 192.168.10.1 port 1813 Wed Nov 23 20:08:29 2022 : Debug: (0) Clearing existing &reply: attributes Wed Nov 23 20:08:29 2022 : Debug: (0) Found Post-Proxy-Type Fail-Accounting Wed Nov 23 20:08:29 2022 : Debug: (0) server home.example.com { Wed Nov 23 20:08:29 2022 : Debug: (0) # Executing group from file /etc/freeradius/sites-enabled/robust-proxy-accounting Wed Nov 23 20:08:29 2022 : Debug: (0) Post-Proxy-Type Fail-Accounting { Wed Nov 23 20:08:29 2022 : Debug: (0) modsingle[post-proxy]: calling detail.example.com (rlm_detail) Wed Nov 23 20:08:29 2022 : Debug: /var/log/freeradius/radacct/detail.example.com/detail-%Y%m%d:%H:%G Wed Nov 23 20:08:29 2022 : Debug: Parsed xlat tree: Wed Nov 23 20:08:29 2022 : Debug: literal --> /var/log/freeradius/radacct/detail.example.com/detail- Wed Nov 23 20:08:29 2022 : Debug: percent --> Y Wed Nov 23 20:08:29 2022 : Debug: percent --> m Wed Nov 23 20:08:29 2022 : Debug: percent --> d Wed Nov 23 20:08:29 2022 : Debug: literal --> : Wed Nov 23 20:08:29 2022 : Debug: percent --> H Wed Nov 23 20:08:29 2022 : Debug: literal --> : Wed Nov 23 20:08:29 2022 : Debug: percent --> G Wed Nov 23 20:08:29 2022 : Debug: (0) detail.example.com: EXPAND /var/log/freeradius/radacct/detail.example.com/detail-%Y%m%d:%H:%G Wed Nov 23 20:08:29 2022 : Debug: (0) detail.example.com: --> /var/log/freeradius/radacct/detail.example.com/detail-20221123:20:08 Wed Nov 23 20:08:29 2022 : Debug: (0) detail.example.com: /var/log/freeradius/radacct/detail.example.com/detail-%Y%m%d:%H:%G expands to /var/log/freeradius/radacct/detail.example.com/detail-20221123:20:08 Wed Nov 23 20:08:29 2022 : WARNING: (0) detail.example.com: Suppressing infinite loop Wed Nov 23 20:08:29 2022 : Debug: (0) modsingle[post-proxy]: returned from detail.example.com (rlm_detail) Wed Nov 23 20:08:29 2022 : Debug: (0) [detail.example.com] = noop Wed Nov 23 20:08:29 2022 : Debug: (0) } # Post-Proxy-Type Fail-Accounting = noop Wed Nov 23 20:08:29 2022 : Debug: (0) } Wed Nov 23 20:08:29 2022 : Debug: (0) detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): No response to request. Will retry in 30 seconds Wed Nov 23 20:08:29 2022 : Debug: (0) Finished request Wed Nov 23 20:08:29 2022 : Debug: (0) Cleaning up request packet ID 0 with timestamp +0 due to done Wed Nov 23 20:08:29 2022 : Debug: Waking up in 3.9 seconds. Wed Nov 23 20:08:29 2022 : Debug: Ignoring spoofed proxy reply. Signature is invalid Wed Nov 23 20:08:29 2022 : Debug: Waking up in 3.8 seconds. Wed Nov 23 20:08:33 2022 : Error: No response to status check 1 ID 198 for home server 192.168.10.1 port 1813 Wed Nov 23 20:08:33 2022 : Debug: Waking up in 25.3 seconds. Best regards, Martin

2 16

Allow all MAC address
by Pascal Legrand 29 Nov '22

29 Nov '22

Hello, I use freeradius to limit the access to our network by filtering MAC address: XXXXXXXXXXXX Cleartext-Password := "XXXXXXXXXXXX", Machine-Name := "COMPUTER_1" When we receive new computers, we use the FOG software to deploy a clean image on all new computers. The problem is that we have not yet set up Freeradius to allow these news computers to access our network. My question is the following: is it possible to authorize punctually all MAC addresses to access the network while we recover them to configure Freeradius? The idea would be to add a line like : ALL_MAC_ADDRESS Cleartext-Password := "ALL_MAC_ADDRESS", Machine-Name := "NEW_MACHINE" Does Freeradius allow regular expressions in its configuration file? If yes, what should be the form of this regular expression? Thank you in advance for your help. Pascal

4 4

eap_peap error messages
by Stefan Paetow 24 Nov '22

24 Nov '22

Hi Alan et al, Just a quick question – when eap_peap encounters a TLS error, is that available in the Module-Error-Message? i.e. let’s take this example: (2) eap_peap: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error (2) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (2) eap_peap: ERROR: System call (I/O) error (-1) Would the three ‘ERROR:’ messages be in &request:Module-Failure-Message (or &session-state: Module-Failure-Message)? I can’t particularly With kind regards Stefan Paetow Federated Roaming Technical Specialist eduroam(UK), Jisc email/teams: stefan.paetow(a)jisc.ac.uk gpg: 0x3FCE5142 On Mondays and Wednesdays, I am not available between 12:00 and 15:00. For eduroam support, please contact us via help(a)jisc.ac.uk and mark it for the eduroam team’s attention. jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

2 2

oauth2 proxy mode
by Laurent Estevez 24 Nov '22

24 Nov '22

Hi, Do you have any feedback on oauth2* authentication and freeradius 3. I would like to connect MS Azure on a freeRaius standard package installation with this mode, but I am having problems implementing this module (error run freeradius service) Thanks in advance, * source : https://github.com/jimdigriz/freeradius-oauth2-perl

4 5

Is there something like a post-dhcp section?
by Hermann.Lauer＠uni-heidelberg.de 23 Nov '22

23 Nov '22

Hello All, is something like a post-dhcp section in the virtual dhcp server possible, i.e. executed after the packet type specific DHCP-Request or DHCP-Request section are finished, the reply is setup and the server had decided what to do with the request? Sorry if I missed that in the documentation. Thanks and greetings Hermann

2 1