December 2011 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Huntgroup Checking
by simonm123 28 Feb '13

28 Feb '13

Am new to freeradius but have it mainly set up just fine. It's a fantastic tool and I'm enjoying using it :) Just one thing I'm struggling with is the huntgroups. I've followed the wiki to the letter and can see the server checking in the debug log. What I basically want to do is restrict users to certain networks, as per the wiki. If their huntgroup-name matches their huntgroup based on nasip, they can get online, otherwise they're rejected. I've put Huntgroup-Name = NetworkA in my radgroupcheck folder. In my radhuntgroup table, I have the nasip and groupname = NetworkA Then, in the authorize section of my default host, I put: update request { Huntgroup-Name := "%{sql:SELECT `groupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'}" } if (Huntgroup-Name == ''){ reject } All as per the tutorial In my debug log, if there is no match by IP, Huntgroup-Name is blank and the user is rejected. However, if the nasip address match but the name is different, the user is still allowed on. Do I need a more advanced query in the if section and if so,could you please advise what it should be Simon -- View this message in context: http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-tp4950385p495038… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Re: rlm_perl authentication override
by Henry 20 Nov '12

20 Nov '12

Quoting tnt(a)kalik.net: >>>> Is there a way to change the reply from Access-Reject, to Access-Accept? >>>> > > Change freeradius.internal attribute Packet-Type in Post-Auth-Type Reject > section. Changing freeradius.internal Packet-Type from Access-Reject to Access-Accept would affect ALL logins - even logins which *should* be rejected. I'm referring to changing Access-Reject to Access-Accept under certain circumstances only -- not globally for all logins. ...or am I misunderstanding what you're suggesting? Thanks Henry

5 13

Freeradius 2 , TTLS/PAP, multiples questions
by Jérôme BERTHIER 19 Jun '12

19 Jun '12

Hi, I'm trying to configure Freeradius 2 to implement EAP/TTLS-PAP authentication method on my Cisco AP1242. It works but I'd like some precisions to get configuration files as small as possible. What is the shortest way to configure it ? authorize { preprocess auth_log suffix eap { ok = return } files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } eap } Are the lines correct ? Moreover, I've got trouble to implement few functions. First, what's the right way to implement check for Simultaneous-Use ? For cisco nas type, Freeradius seems to use snmp check but where should I configure SNMP read community in order to make it possible ? Then, during EAP process, is it possible to check if inner identity equal outer identity and if not to reject request ? Finally, I've got problem with NetworkManager under Fedora 9 (not tested on other distribution). If Session resumption / fast reauthentication cache is not enabled, clients can't reassociate and ask for session resumption again. Is there a workaround ? Thanks -- Jérôme BERTHIER Network administrator INRIA Bordeaux - Sud-Ouest Service des Moyens Informatiques 05 24 57 40 50

4 8

EAP-TTLS-PAP-LDAP
by Rohaizam Abu Bakar 12 Jun '12

12 Jun '12

Trying to do EAP-TTLS-PAP with CRYPT passwd in LDAP.. The tunelling seems fine.. but up to comparing the password it will failed. Refer below logs & config Some says (http://felipe-alfaro.org/blog/category/radius/) PAP is tunneled inside EAP-TTLS through EAP-GTC... Tried that as well.. still same error.. gtc { auth_type = PAP [even trying to change to LDAP/OCE - still same error) } Error ==== auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [jaroce2(a)ocemy015.com] (from client localhost port 0) TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: leaving group authenticate (returns invalid) for request 9 auth: Failed to validate the user. Login incorrect: [jaroce2(a)ocemy015.com] (from client OCE_JARING port 241 cli 00-11-5b-2d-b2-8e) With setting:- a) radiusd.conf ldapOCE { --some setting } authorize { eap Autz-Type OCE { ldapOCE } } authenticate { Auth-Type OCE { ldapOCE } eap } b) eap.conf eap { default_eap_type = ttls tls { --some setting } ttls { default_eap_type = md5 } c) users:- DEFAULT Realm == "my015.com", Autz-Type := OCE

9 16

Multi-valued LDAP attribute
by Adam Track 02 May '12

02 May '12

Hi All, In a continuation to my previous issue about how to reference an LDAP attribute in post-auth, I am now wondering how to iterate through a multi-valued attribute in a perl script I call from post-auth. In the debug you can see all three values are returned: ... [ldap] looking for reply items in directory... [ldap] personType -> Person-Type = "employee" [ldap] personType -> Person-Type = "fulltime" [ldap] personType -> Person-Type = "it" ... The perl module currently has the following code because I can't seem to be able to get any result other than the first, ie "employee", and I really need the other two (possibly more) to do a proper VLAN assignment: while (($att,$val) = each(%RAD_REPLY)){ if ($att =~ 'Person-Type'){ $count++; if ($count == 1){ $one = $val; } else { $two = $val; } } } $RAD_REPLY{'Reply-Message'} = "Total: $count, first: $one, second: $two."; The results are: ... Reply-Message = "Total: 1, first: employee, second: ." ... I'm no perl expert, but shouldn't I be able to reference all three values with $RAD_REPLY{'Person-Type'}? If not, where are the other values being stored? I read from the archives that this can be done with 3.X and foreach using unlang, but I'm stuck with 2.1.10 at the moment. Or, do multi-valued attributes need to be defined another way? Thanks, A.

2 5

Issues with squid_radius_auth
by Ovi C 19 Mar '12

19 Mar '12

Hi. I'm using squid proxy server with freeradius authentication with postgresql backend running on Debian Squeeze and I get the following error from freeradius. ./squid_radius_auth -f /etc/squid3/squid_radius_auth.conf andrei tester Warning: Received invalid reply digest from server Warning: Received invalid reply digest from serverERR I'll post the files configuration and output from freeradius debug: cat /etc/squid3/squid_radius_auth.conf # squid_rad_auth configuration file # MvS: 28-10-1998 server 192.168.107.2 secret testing -------------------------------------------------------------------------------------------------------------------------------- freeradius -X stripped output: freeradius -X including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 User-Name = "andrei" User-Password = "WIdk\214\356\376G/\215X\367n\246h\224" NAS-Port = 111 NAS-Port-Type = Async NAS-IP-Address = 192.168.107.2 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.107.2/auth-detail-20100129 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.107.2/auth-detail-20100129 [auth_log] expand: %t -> Fri Jan 29 18:34:05 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "andrei", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> andrei [sql] sql_set_user escaped user --> 'andrei' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'andrei' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'andrei' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='andrei' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "WIdk?��G/?X�n�h?" [pap] Using clear text password "tester" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> andrei attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 Sending duplicate reply to client localhost port 48244 - ID: 1 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 Sending duplicate reply to client localhost port 48244 - ID: 1 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 Waking up in 3.9 seconds. rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 Sending duplicate reply to client localhost port 48244 - ID: 1 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 Sending duplicate reply to client localhost port 48244 - ID: 1 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 Waking up in 1.9 seconds. rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 Sending duplicate reply to client localhost port 48244 - ID: 1 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 Waking up in 0.9 seconds. Cleaning up request 0 ID 1 with timestamp +3 Ready to process requests. ---------------------------------------------------------------------------------------------------------------------------------- cat /etc/freeradius/clients.conf client localhost { ipaddr = 192.168.107.2 netmask = 32 secret = testing require_message_authenticator = no shortname = localhost nastype = other -------------------------------------------------------------------------------------------------------------------------- Somehow the client is not sending the cleartext password from database and this causes the error. The shared secret is correct as I use the same configuration for a PPPOE server and everything works as it should. Any hints ?

3 2

FreeRADIUS exiting with Signal 11 on FreeBSD
by Hugh Blandford 27 Feb '12

27 Feb '12

I am running FreeRADIUS 2.1.10 on 64bit FreeBSD 8.1-RELEASE-p1 with LDAP auth and accounting records being sent to file and MySQL. I get the following in radius.log: Sun Dec 5 05:14:57 2010 : Info: Exiting normally. and the following in messages: Dec 5 05:14:57 cat kernel: pid 68292 (radiusd), uid 133: exited on signal 11 This has also occurred on two other occasions. I found somone else in the list archives who had a similar sounding problem on FreeBSD but there didn't appear to be an issue. Any suggestions as to what I can do to avoid this problem? Thanks, Hugh Blandford -- Hugh Blandford Island Internet ph 1300 130 428 mb 0412 016 875

6 23

test suite simulating NAS for development?
by Mark McWiggins 14 Feb '12

14 Feb '12

Hi All, We're developing an application to capture log data from Radius, but we don't have a NAS to test with to generate the logs. Is there some test suite available to do this? Thanks much; if none is available we will probably develop one and I think our management will consent to share it. -- Mark McWiggins Client Integration Engineer mark.mcwiggins(a)messagesystems.com 443-656-3311 ext 344

6 9