June 2012 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Huntgroup Checking
by simonm123 28 Feb '13

28 Feb '13

Am new to freeradius but have it mainly set up just fine. It's a fantastic tool and I'm enjoying using it :) Just one thing I'm struggling with is the huntgroups. I've followed the wiki to the letter and can see the server checking in the debug log. What I basically want to do is restrict users to certain networks, as per the wiki. If their huntgroup-name matches their huntgroup based on nasip, they can get online, otherwise they're rejected. I've put Huntgroup-Name = NetworkA in my radgroupcheck folder. In my radhuntgroup table, I have the nasip and groupname = NetworkA Then, in the authorize section of my default host, I put: update request { Huntgroup-Name := "%{sql:SELECT `groupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'}" } if (Huntgroup-Name == ''){ reject } All as per the tutorial In my debug log, if there is no match by IP, Huntgroup-Name is blank and the user is rejected. However, if the nasip address match but the name is different, the user is still allowed on. Do I need a more advanced query in the if section and if so,could you please advise what it should be Simon -- View this message in context: http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-tp4950385p495038… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Dialup Admin
by Shawky Skaff 24 Jan '13

24 Jan '13

I was wondering if you can point me in the right direction for a couple of issues that I'm having - When I view a session of a user, it says user "bla" has 0 open session, which it weird because the user is connected. Where does radius get this info from? Is there anything that I need to change to fix it? - Is radkill still used? Is there anywhere I can obtain this from, the ftp link in the wiki times out after a while

2 2

Kerberos - Radius does not get password
by Jörg Herzinger 28 Dec '12

28 Dec '12

Hi, Radius has been bugging me now for over a week and I just can't get it working with Kerberos over WLan. I have been trying around a lot but in the end I purged the freeradius packages and restarted from scratch with default config (on Debian squeeze). All I did was adding a client in clients.conf client 192.168.0.0/16 { secret = averysecretsecret } adding two entries in users.conf testing Cleartext-Password := "pass" DEFAULT Auth-Type = Kerberos and adding Kerberos to authenticate in default and inner-tunnel right after PAP: Auth-Type Kerberos { krb5 } and I configured the Kerberos module. Now when testing with radtest both (kerberos and testing from files) work fine root@donauauen42 ~ # radtest testing pass radius 1 averysecretsecret Sending Access-Request of id 166 to 192.168.43.118 port 1812 User-Name = "testing" User-Password = "pass" NAS-IP-Address = 192.168.42.42 NAS-Port = 1 rad_recv: Access-Accept packet from host 192.168.43.118 port 1812, id=166, length=20 root@donauauen42 ~ # radtest pink.funk-greene XXXXX radius 1 averysecretsecret Sending Access-Request of id 60 to 192.168.43.118 port 1812 User-Name = "pink.funk-greene" User-Password = "XXXXX" NAS-IP-Address = 192.168.42.42 NAS-Port = 1 rad_recv: Access-Accept packet from host 192.168.43.118 port 1812, id=60, length=20 But when testing via WiFi just my testing user works, while my Kerberos users won't work. Not working Kerberos debug log: http://pastie.org/3890159 Vs. working plain users file log: http://pastie.org/3890167 Any help is appreceated. Thanks a lot... -- Jörg Herzinger - EDV Team GLOBAL 2000 - Friends of the Earth Austria Neustiftgasse 36, A-1070 Wien tel +43-699-14200030 Dieses Mail wurde mit Oekostrom und Opensource Software erstellt.

4 3

Re: rlm_perl authentication override
by Henry 20 Nov '12

20 Nov '12

Quoting tnt(a)kalik.net: >>>> Is there a way to change the reply from Access-Reject, to Access-Accept? >>>> > > Change freeradius.internal attribute Packet-Type in Post-Auth-Type Reject > section. Changing freeradius.internal Packet-Type from Access-Reject to Access-Accept would affect ALL logins - even logins which *should* be rejected. I'm referring to changing Access-Reject to Access-Accept under certain circumstances only -- not globally for all logins. ...or am I misunderstanding what you're suggesting? Thanks Henry

5 13

RE: Wimax with Free radius
by Mulindwa 10 Aug '12

10 Aug '12

Hallo there, i have an issue with my wimax setup, am trying to have my users authenticate using the wonderful freeradius but still failing. Am suing WASN9970 and using freeradius 2.1.12, When i turn on radius using radius-X, this is what i get, and client never authenticates someone please come to my rescue istening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 196.0.4.18 port 1812, id=250, length=187 User-Name = "gulucdp@utmax" NAS-IP-Address = 192.168.224.70 Calling-Station-Id = "6416f00100e1" NAS-Identifier = "WASN9770" Event-Timestamp = "Mar 5 2012 09:14:53 EAT" EAP-Message = 0x020100120167756c756364704075746d6178 WiMAX-Release = "1.1" WiMAX-Accounting-Capabilities = Flow-Based WiMAX-BS-Id = 0x303030303038316235393030 WiMAX-GMT-Timezone-offset = 10800 NAS-Port-Type = Wireless-802.16 WiMAX-Available-In-Client = 3 Service-Type = Framed-User Message-Authenticator = 0x143b601c01eca1d4595511b0a81c0d78 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/196.0.4.18/auth-detail-20120305 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/196.0.4.18/auth-detail-20120305 [auth_log] expand: %t -> Mon Mar 5 08:59:56 2012 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop ++[wimax] returns ok [suffix] Looking up realm "utmax" for User-Name = "gulucdp@utmax" [suffix] Found realm "utmax" [suffix] Adding Realm = "utmax" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 125 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 250 to 196.0.4.18 port 1812 Service-Type = Framed-User Framed-Protocol = PPP Framed-Address = 255.255.255.254 Framed-Netmask = 255.255.255.255 EAP-Message = 0x0102001604101bd377e252fa3b4f59a9210cb6a3fdfb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0dc4c5bf0dc6c1ff885e3d68e8e55b4e Finished request 0. Eric M

7 34

FreeRADIUS SQl Ippool problem -
by Taz Manian 01 Jul '12

01 Jul '12

Hi Guys, Im having a problem with Ippools with freeradius2 and i cant seem to get any username to get an address from the pool.90% of the usernames will have static IP's but i want a few to be in a pool but i really am stumped - i tried putting username@realm Framed-Pool := EZPOOL into the radreply section and it gives me a reply when i test it # Standard Framed-Pool "EZPOOL" so i know is readying that - i then have a pool set up in radippool pool_name=EZPOOLFramedIPAddress=192.168.1.200 (i have more) and my radiusd -X reply is : # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "1111111" [pap] Using clear text password "1111111" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> user@realm [sql] sql_set_user escaped user --> 'username@realm' [sql] expand: %{User-Password} -> 1111111 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'username@realm', '1111111', 'Access-Accept', '2012-06-28 10:59:37') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'username@realm', '1111111', 'Access-Accept', '2012-06-28 10:59:37') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 51 to 192.168.1.100 port 52433 Framed-Pool := "EZPOOL" Cisco-AVPair := "lcp:interface-config=ip vrf forwarding BLAH" Cisco-AVPair += "lcp:interface-config=ip unnumbered Loopback1" Cisco-AVPair += "lcp:interface-config=mtu 1492" Service-Type := Framed-User Framed-Protocol := PPP Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 51 with timestamp +5 Ready to process requests.

5 18

Re: unlang syntax issue
by Alan Buxey 29 Jun '12

29 Jun '12

/match you want/i Alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

unlang syntax issue
by marco santantonio 29 Jun '12

29 Jun '12

Hi all, I'm using freeradius 2.1.12 and I have a problem that I would like to resolve with unlang but I can't for syntax error... I need to authorize users based on case insensitive regular expression, something like if User-Name match ".*-guest$" use LDAP-1 else use LDAP-2 I made several attempts such if ( User-Name =~ '.*-guest$' ) { ldap-1 } in authorize section, but debug says: Expected regular expression at: '.*-guest$' ) After various attempts at least i have resolved using "users" file as: DEFAULT User-Name =~ ".*-guest$", Autz-Type := LDAP-1, Auth-Type := PAP DEFAULT User-Name !~ ".*-guest$", Autz-Type := LDAP-2 but "users" file is case-sensitive....what's the correct unlang syntax to do this??? many thanks marco

1 0