October 2012 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

Radperf unavailable?
by Marius Booysen 30 Oct '13

30 Oct '13

Hi, I see that there is a problem downloading Radperf from networkradius.com. Does anybody know if it will become available once again at some point? Are there any other benchmarking utilities for Freeradius? Regards Kosie

5 4

Huntgroup Checking
by simonm123 28 Feb '13

28 Feb '13

Am new to freeradius but have it mainly set up just fine. It's a fantastic tool and I'm enjoying using it :) Just one thing I'm struggling with is the huntgroups. I've followed the wiki to the letter and can see the server checking in the debug log. What I basically want to do is restrict users to certain networks, as per the wiki. If their huntgroup-name matches their huntgroup based on nasip, they can get online, otherwise they're rejected. I've put Huntgroup-Name = NetworkA in my radgroupcheck folder. In my radhuntgroup table, I have the nasip and groupname = NetworkA Then, in the authorize section of my default host, I put: update request { Huntgroup-Name := "%{sql:SELECT `groupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'}" } if (Huntgroup-Name == ''){ reject } All as per the tutorial In my debug log, if there is no match by IP, Huntgroup-Name is blank and the user is rejected. However, if the nasip address match but the name is different, the user is still allowed on. Do I need a more advanced query in the if section and if so,could you please advise what it should be Simon -- View this message in context: http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-tp4950385p495038… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Dialup Admin
by Shawky Skaff 25 Jan '13

25 Jan '13

I was wondering if you can point me in the right direction for a couple of issues that I'm having - When I view a session of a user, it says user "bla" has 0 open session, which it weird because the user is connected. Where does radius get this info from? Is there anything that I need to change to fix it? - Is radkill still used? Is there anywhere I can obtain this from, the ftp link in the wiki times out after a while

2 2

Kerberos - Radius does not get password
by Jörg Herzinger 28 Dec '12

28 Dec '12

Hi, Radius has been bugging me now for over a week and I just can't get it working with Kerberos over WLan. I have been trying around a lot but in the end I purged the freeradius packages and restarted from scratch with default config (on Debian squeeze). All I did was adding a client in clients.conf client 192.168.0.0/16 { secret = averysecretsecret } adding two entries in users.conf testing Cleartext-Password := "pass" DEFAULT Auth-Type = Kerberos and adding Kerberos to authenticate in default and inner-tunnel right after PAP: Auth-Type Kerberos { krb5 } and I configured the Kerberos module. Now when testing with radtest both (kerberos and testing from files) work fine root@donauauen42 ~ # radtest testing pass radius 1 averysecretsecret Sending Access-Request of id 166 to 192.168.43.118 port 1812 User-Name = "testing" User-Password = "pass" NAS-IP-Address = 192.168.42.42 NAS-Port = 1 rad_recv: Access-Accept packet from host 192.168.43.118 port 1812, id=166, length=20 root@donauauen42 ~ # radtest pink.funk-greene XXXXX radius 1 averysecretsecret Sending Access-Request of id 60 to 192.168.43.118 port 1812 User-Name = "pink.funk-greene" User-Password = "XXXXX" NAS-IP-Address = 192.168.42.42 NAS-Port = 1 rad_recv: Access-Accept packet from host 192.168.43.118 port 1812, id=60, length=20 But when testing via WiFi just my testing user works, while my Kerberos users won't work. Not working Kerberos debug log: http://pastie.org/3890159 Vs. working plain users file log: http://pastie.org/3890167 Any help is appreceated. Thanks a lot... -- Jörg Herzinger - EDV Team GLOBAL 2000 - Friends of the Earth Austria Neustiftgasse 36, A-1070 Wien tel +43-699-14200030 Dieses Mail wurde mit Oekostrom und Opensource Software erstellt.

4 3

rlm_python: no %RAD_REQUEST equivalent
by laurent.feron＠free.fr 05 Dec '12

05 Dec '12

Hello, I have a perl module that changes the username during the authorization phase (retrieve from a oracle database) by modifying the user-name attribute in the RAD_REQUEST dictionary. This update is global and can be used by the authentication phase (still handled by the perl script). I try to switch from perl to python as i'm more comfortable. Everything is ok except i don't know how to modify on the fly the user-name. in the 'authorize(p)' function, p is the read only tuple of the request. I cannot update the request here. The return of the function is (RLM_MODULE_something, tuple4reply, tuple4config). I still cannot change here. Moreover, if i change the tuple config in the authorize function , how i can retrieve it in the authentication function? Maybe i miss something as i'm a beginner on FR. Regards, Laurent

6 18

Re: rlm_perl authentication override
by Henry 20 Nov '12

20 Nov '12

Quoting tnt(a)kalik.net: >>>> Is there a way to change the reply from Access-Reject, to Access-Accept? >>>> > > Change freeradius.internal attribute Packet-Type in Post-Auth-Type Reject > section. Changing freeradius.internal Packet-Type from Access-Reject to Access-Accept would affect ALL logins - even logins which *should* be rejected. I'm referring to changing Access-Reject to Access-Accept under certain circumstances only -- not globally for all logins. ...or am I misunderstanding what you're suggesting? Thanks Henry

5 13

EAP-TLS Machine-Auth Windows: difference between LAN and WiFi
by Alexandros Gougousoudis 09 Nov '12

09 Nov '12

Hi, we're using FR 2.0 for our machine authentication for XP to Win7 with EAP-TLS. Everything is working so far, but I noticed a difference between authenticating via WLAN and LAN, which starts to be a problem for us now. If I make a auth via LAN the provided username ist <hostname>, if I do it via WLAN it is host/<hostname>. While we use "host/" as a realm for our Radsecproxy, I'd like to change the behauviour for the authentication via LAN and add a string to the <hostname> (i.e. "host/" or something else) to unify the login for WLAN an LAN. So how or where can I change that? A hint will be really welcome. TIA Alex

6 20

Regarding pam_radius_auth to be integrated with busybox
by Deep Shah 09 Nov '12

09 Nov '12

Hi, I am trying to integrate linux-pam library and pam_radius_auth module to my busybox 1.17.3 version. I want to login through radius server on the host machine. I am using power pc as my board. I have configured the files of configuration as below. *client.conf* * (conf file)* client 192.168.100.26 { secret = testing123 } *user (conf file)* test Auth-Type := PAP, Cleartext-Password := "testpass" Reply-Message = "Hello, %{User-Name}, you have successfully authenticated your login" I am getting request on the server side but some error is coming on the server of password mismatch. Please find the below log for the same. rad_recv: Access-Request packet from host 192.168.100.26 port 2970, id=106, length=69 User-Name = "test" User-Password = "C\2758\330E\345RZ\3707\227\001\265[\202H" NAS-Identifier = "login" NAS-Port = 1945 NAS-Port-Type = Virtual Service-Type = Authenticate-Only # Executing section authorize from file /usr/local/etc/raddb//sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry test at line 54 [files] expand: Hello, %{User-Name}, you have successfully authenticated your login -> Hello, test, you have successfully authenticated your login ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /usr/local/etc/raddb//sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "C�8�E�RZ�7??�[?H" [pap] Using clear text password "testpass" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb//sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 106 to 192.168.100.26 port 2970 Reply-Message = "Hello, test, you have successfully authenticated your login" Waking up in 4.9 seconds. Cleaning up request 1 ID 106 with timestamp +37 Ready to process requests. Can you please suggest what might be the issue is? I am getting password as not readable string when I have used the correct password in radius client and radius server. Regards, Deep

5 14

Re: ntlm_auth child domain
by Alan Buxey 07 Nov '12

07 Nov '12

I'd say use ntlm_auth with 2 instances of MSCHAP module - using unlang and fail-through mechanism...so if MSCHAP instance 1 fails then it tries instance 2 We used this mechanism when migrating from one AD to another alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 3

rlm_eap_ttls: Cannot tunnel EAP-Type/ttls inside of TTLS
by Darren Shea 31 Oct '12

31 Oct '12

I'm trying to migrate a running FreeRADIUS server (on FreeBSD 7) to a virtualized system (on FreeBSD 9). I've got the MySQL database working, and I have copied over the raddb files from the old system to the new one. Unfortunately, radiusd drops out with the error in the subject. It looks like the working system has no problem with tunneling EAP/TTLS through the TTLS tunnel, but this new system is balking. I've read the documentation and examined the FAQ, but no luck. Google is shedding no light on this problem either. Any suggestions? Full radiusd -X output on non-working server ---------------------------------------------------- vBSD1# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "freeradius" main: group = "freeradius" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms listen: port = 1645 listen: type = "auth" listen: port = 1646 listen: type = "acct" radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/aaasvr_key.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/aaasvr_cert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/cacert_aaasvr.pem" tls: private_key_password = "password" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "ttls" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap_ttls: Cannot tunnel EAP-Type/ttls inside of TTLS rlm_eap: Failed to initialize type ttls radiusd.conf[17]: eap: Module instantiation failed. radiusd.conf[2037] Unknown module "eap". radiusd.conf[1984] Failed to parse authenticate section. Partial radiusd -X output on working server ---------------------------------------------------- Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/aaasvr_key.pem" certificate_file = "/usr/local/etc/raddb/certs/aaasvr_cert.pem" CA_file = "/usr/local/etc/raddb/certs/cacert_aaasvr.pem" private_key_password = "password" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "ttls" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Thank you, Darren ECPI Western Broadband

2 1

LDAP attribute mapping
by Arran Cudbard-Bell 31 Oct '12

31 Oct '12

Quick poll. For 3.0 the ldap module will be moving away from using the ldap.attrmap file and instead use a config based mapping. There are a few ways we are considering for organising the mapping. We can use something like the existing unlang: update control { Cleartext-Password := userpassword } update reply { User-Name = radiusUserName } update outer.reply { Reply-Message = radiusReplyMessage } Or something like rlm_rest and rlm_cache: update { control:Cleartext-Password := userpassword reply:User-Name = radiusUserName reply.outer:User-Name = radiusUserName } It really depends on whether people are actually using the full ldap.attrmap, or whether they're just pulling out one or two attributes. Each approach is as efficient as the other performance wise, so it comes down to which one people prefer. Any thoughts? -Arran

5 7

ntlm_auth child domain
by Menard, Yannick 31 Oct '12

31 Oct '12

Hi, I just recently installed an freeradius server , joined the domain and im currently able with ntlm_auth and radtest to authenticate user from our Active directory but I am unable to authenticate using our child domain. For exemple our domain is toto.prive, child domain child.toto.prive I need users from any of those 2 domain to authenticate to our radius. How would I do that in the ntlm_auth module, here is what I have right now: program = "/usr/bin/ntlm_auth --request-nt-key --domain=toto.prive --username=%{mschap:User-Name} --password=%{User-Password}" I am on centos 6.3, I use freeradius rpm from yum. With this config I am able to authenticate a toto.prive user but I am unable to authenticate a child.toto.prive user. Thank you, Yannick Ménard ---------------------------------------------------------------------------------------------------------- Ce courriel a été filtré par ModusGate et Webshield afin de le certifier comme légitime et exempt de virus.

1 0

mysql Connection error
by QASIM RAO 31 Oct '12

31 Oct '12

hi, i am having a problem in free radius, when i connect free radius with db by using ip of db server it is not connecting with db database is installed on localhost so when i give db sever="localhost" it connects with db... please help me in this why radius is doing this ??? regards,

5 7

CentOS 6.3 and FreeRadius - can't authenticate to Unix
by Jacobs, Joseph 30 Oct '12

30 Oct '12

Hello, I'm a new user to Linux and Freeradius. I'm trying to set up Freeradius to authenticate against the local Linux user accounts. I'm having issues getting the "radtest" tool to authenticate against local users in the unix system. I'm using CentOS 6.3 - 64bit (uname - a output Linux Joe2dot0-freeradius 2.6.32-279.el6.x86_64 #1 SMP Fri Jun 22 12:19:21 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux) (Contents of the "etc/redhat-release" file CentOS release 6.3 (Final)) I used YUM to install Freeradius2 (2.1.12-4.el6_3) Here's the output of the "yum list installed" command freeradius.x86_64 2.1.12-4.el6_3 @updates freeradius-utils.x86_64 2.1.12-4.el6_3 @updates I installed the packages as 'root' I'm running 'radtest' while logged in a root. The users file is configured as follows: joe2 Auth-Type := System (I've tried this with both := and =) bob Cleartext-Password := "hello" When I run "radtest bob hello localhost 0 testing1234" *********Successful*********** (I don't use quotes when I input to linux) Here is the debug output from the radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 54241, id=124, length=73 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x0333c5040a7f6b1a6051a1543e5bf4ea # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry bob at line 8 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "hello" [pap] Using clear text password "hello" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 124 to 127.0.0.1 port 54241 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 124 with timestamp +78 Ready to process requests. When I run "radtest joe2 secret localhost 0 testing1234" (I don't use quotes when I input to linux) *************Access-Reject from the server******************** Here is the debug output from the radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 40697, id=134, length=74 User-Name = "joe2" User-Password = "secret" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0xcf3011a6da2e12ec1e1a66746be3c6ad # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "joe2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry joe2 at line 6 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = System # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} ++[unix] returns notfound Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> joe2 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 134 to 127.0.0.1 port 40697 Waking up in 4.9 seconds. Cleaning up request 2 ID 134 with timestamp +212 Ready to process requests. I think I'm having an issue with freeradius reading the shadow file for the passwords, but then again, I'm not sure. One of the steps involved putting the group for freeradius to be "shadow" but there is no "shadow" group in the group file in CentOS 6.3. Here are the output for the ls - l in the etc directory for the password files -rw-r--r--. 1 root root 1579 Oct 29 15:26 passwd ----------. 1 root root 1110 Oct 29 15:26 shadow I also did confirm that I can log into my server using joe2 / secret password. Any help would be appreciated. Thanks, Joe This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

4 6

User authorize with Perl-Script
by Oliver Werner 30 Oct '12

30 Oct '12

Hello, I'm useing FreeRADIUS in Version 2.1.10. I would configure my Switch-Ports Mac-Based. When a Computer wired a Perl-Script should check the Username and gives VLAN back. For a simple Test i don't have some conditions in the Script only outputs: use strict; use warnings; use DBI; ### SwitchUser ### my $pass = $ARGV[0]; print 'Access-Accept'; print 'Cleartext-Password := "'.$pass.'"'; exit 0; my modules/exec looks here: exec { wait = yes program = "/usr/bin/perl /usr/local/test.pl %{User-Name}" input_pairs = request output = reply shell_escape = yes } and my sites-enabled/switch its this: authorize { exec expiration chap } authenticate { chap } post-auth { exec } When i wired with my PC Log Says following: # Executing section authorize from file /etc/freeradius/sites-enabled/switchport +- entering group authorize {...} [php] expand: %{User-Name} -> aa:bb:cc:dd:ee:ff Exec-Program output: Access-AcceptCleartext-Password := "aa:bb:cc:dd:ee:ff" Exec-Program-Wait: plaintext: Access-AcceptCleartext-Password := "aa:bb:cc:dd:ee:ff" Exec-Program: returned: 0 ++[php] returns ok ++[expiration] returns noop [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/switchport +- entering group authenticate {...} [chap] login attempt by "aa:bb:cc:dd:ee:ff" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. } # server switchport Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Anyone knows what is wrong in my Configuration?

3 3

Re: LDAP attribute mapping
by Bruce Nunn 30 Oct '12

30 Oct '12

I pull out only the attributes I need and change ldap.attrmap to match my schema. Personally, I can live with either config method. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> wrote: >Quick poll. > >For 3.0 the ldap module will be moving away from using the ldap.attrmap file and instead use a config based mapping. > >There are a few ways we are considering for organising the mapping. > >We can use something like the existing unlang: > >update control { > Cleartext-Password := userpassword >} > >update reply { > User-Name = radiusUserName >} > >update outer.reply { > Reply-Message = radiusReplyMessage >} > >Or something like rlm_rest and rlm_cache: > >update { > control:Cleartext-Password := userpassword > reply:User-Name = radiusUserName > reply.outer:User-Name = radiusUserName >} > >It really depends on whether people are actually using the full ldap.attrmap, or whether they're just pulling out one or two attributes. Each approach is as efficient as the other performance wise, so it comes down to which one people prefer. > >Any thoughts? > >-Arran > > > > > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Ideal SO and hardware for FreeRadius+MySQL
by fknet 30 Oct '12

30 Oct '12

Hello people! What's the ideal Hardware (processor+memory) to run FreeRadius+MySQL for authentication of 3000 PPPoE users? Thanks Fabrício F Kammer

5 10

Please ignore - unable to get common name from peer certificate
by Wegener, Norbert 28 Oct '12

28 Oct '12

Please ignore. There was a typo in my config. With best regards, ________________________________ Norbert Wegener

1 0

TLS: unable to get common name from peer certificate
by Wegener, Norbert 28 Oct '12

28 Oct '12

I can authenticate against a ldap server. That server also offers ldaps, which I would like to use. When trying ldaps connection I get: [ldap] expand: dc=dom,dc=MYCOMPANY,dc=NET -> dc=dom,dc=MYCOMPANY,dc=NET [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.0.2.13:636, authentication 0 [ldap] setting TLS mode to 1 [ldap] bind as acct(a)dom.mycompany.net/secret to 10.0.2.13:636 TLS: unable to get common name from peer certificate. [ldap] acct(a)dom.mycompany.net bind to 10.0.2.13:636 failed: Can't contact LDAP server [ldap] (re)connection attempt failed Is this a problem of freeradius (I am using 2.1.12) or something with the ldap server? With best regards, ________________________________ Norbert Wegener

1 0

rewrite User-Name in received Access-Request - tough question :)
by Bojan Pogacar 28 Oct '12

28 Oct '12

Hello! This is my first post on this mailing list. I hope someone can give me an advice over my problem that I am solving over a month. I even bought a book about freeradius and after reading it twice there is not an answer to my problem. I run a captive portal for wireless users with radius and all data stored in MySQL database. Majority of users type username and password in captive portal to get access and a few others are automatically authenticated by their MAC address (as username ) and predefined password (macauth feature in CoovaChilli) and those never see a captive portal, they immediately get access as they connect to the network. Those users don't have any bandwidth limits, all other useres do have. So far so good. Then they wanted me to change login procedure. All users would get free access for 30 minutes per day and they don't have to login through captive portal. After 30 minutes, captive portal would open and user would have to login with some coupone to connect to the internet. I've solved this by writing these two lines in file "hints" DEFAULT User-Name =~ "^[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9AF]{2}-[0-9A-F]{2}-[0-9A-F]{2}$" User-Name := "freeinternetfor30minutes" It worked very well except all users previously authenticated by MAC address didn't get theis own profiles, but they got logged in as "freeinternetfor30minutes" with bandwidth limitations. OK, that was logical, I deleted those two lines and wrote some unlung logic to the "sites-available/default" if(notfound){ #if user not in database update reply { Reply-Message := "Wrong username or password" } # if username was MAC address, try to login as "freeinternetfor30minutes" if (User-Name =~/^([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})$/i){ update reply { Reply-Message := "Hello Guest, I'will try to give you 30 minutes for free, if you didn't allready used it." } update request{ User-Name := "freeinternetfor30minutes" } update control { Auth-Type := "Accept" } } else { ok = reject } #rewrite_user } That is working fine, users can connect to the network, BUT accounting section logges their username in database as original MAC address, not rewritted username freeinternetfor30minutes . Also no bandwidth limitations arn't sent with Access-Accept, but I think that could be solved easyly. I've also tries to use module "attr_rewrite". I wrote those lines of code to "modules/attr_rewrite" attr_rewrite rewrite_user { attribute = User-Name # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet searchfor = "%{User-Name}" replacewith = "freeinternetfor30minutes" ignore_case = no new_attribute = no max_matches = 10 append = no } and unhashed rewrite_user in "sites-available/default". I see that rewriting does happen, BUT then update control { Auth-Type := "Accept" } seems to stop working even if I put rewrite_user before "update control" AND also in accounting section User-Name is still MAC address, not rewritten username. I am stuck now, without any idea. Can anyone tell me, is this even possible what I am trying to do and if so, what path should I take. Would it be possible to create new virtual server and pass rewritten username to that virtual server, which would try to login as "freeinternetfor30minutes" THANK YOU for your help! Best Regards, Bojan

3 6

Re: ChilliSpot-UAM-Allowed on witch mysql table ?
by Alan Buxey 27 Oct '12

27 Oct '12

If its to set something on the NAS, then its the reply table, if its to enforce a policy/verify then it's in the check table alan

1 0

explicit mode service creation with 4m
by larry tembu 27 Oct '12

27 Oct '12

________________________________ hi users, could you kindly guide me on how to make freeradius work with the explicit mode of service config on wimax 4m? explicit mode means that all the attributes and service configurations for a cpe are configured on the AAA and only downloaded to the ASN when the client makes a request. basically a L2 service using a vlan. for more clarity, the 4motion system isnthe modular version. thanks, regards, Larry.

2 1