September 2012 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

Huntgroup Checking
by simonm123 28 Feb '13

28 Feb '13

Am new to freeradius but have it mainly set up just fine. It's a fantastic tool and I'm enjoying using it :) Just one thing I'm struggling with is the huntgroups. I've followed the wiki to the letter and can see the server checking in the debug log. What I basically want to do is restrict users to certain networks, as per the wiki. If their huntgroup-name matches their huntgroup based on nasip, they can get online, otherwise they're rejected. I've put Huntgroup-Name = NetworkA in my radgroupcheck folder. In my radhuntgroup table, I have the nasip and groupname = NetworkA Then, in the authorize section of my default host, I put: update request { Huntgroup-Name := "%{sql:SELECT `groupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'}" } if (Huntgroup-Name == ''){ reject } All as per the tutorial In my debug log, if there is no match by IP, Huntgroup-Name is blank and the user is rejected. However, if the nasip address match but the name is different, the user is still allowed on. Do I need a more advanced query in the if section and if so,could you please advise what it should be Simon -- View this message in context: http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-tp4950385p495038… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Dialup Admin
by Shawky Skaff 25 Jan '13

25 Jan '13

I was wondering if you can point me in the right direction for a couple of issues that I'm having - When I view a session of a user, it says user "bla" has 0 open session, which it weird because the user is connected. Where does radius get this info from? Is there anything that I need to change to fix it? - Is radkill still used? Is there anywhere I can obtain this from, the ftp link in the wiki times out after a while

2 2

Kerberos - Radius does not get password
by Jörg Herzinger 28 Dec '12

28 Dec '12

Hi, Radius has been bugging me now for over a week and I just can't get it working with Kerberos over WLan. I have been trying around a lot but in the end I purged the freeradius packages and restarted from scratch with default config (on Debian squeeze). All I did was adding a client in clients.conf client 192.168.0.0/16 { secret = averysecretsecret } adding two entries in users.conf testing Cleartext-Password := "pass" DEFAULT Auth-Type = Kerberos and adding Kerberos to authenticate in default and inner-tunnel right after PAP: Auth-Type Kerberos { krb5 } and I configured the Kerberos module. Now when testing with radtest both (kerberos and testing from files) work fine root@donauauen42 ~ # radtest testing pass radius 1 averysecretsecret Sending Access-Request of id 166 to 192.168.43.118 port 1812 User-Name = "testing" User-Password = "pass" NAS-IP-Address = 192.168.42.42 NAS-Port = 1 rad_recv: Access-Accept packet from host 192.168.43.118 port 1812, id=166, length=20 root@donauauen42 ~ # radtest pink.funk-greene XXXXX radius 1 averysecretsecret Sending Access-Request of id 60 to 192.168.43.118 port 1812 User-Name = "pink.funk-greene" User-Password = "XXXXX" NAS-IP-Address = 192.168.42.42 NAS-Port = 1 rad_recv: Access-Accept packet from host 192.168.43.118 port 1812, id=60, length=20 But when testing via WiFi just my testing user works, while my Kerberos users won't work. Not working Kerberos debug log: http://pastie.org/3890159 Vs. working plain users file log: http://pastie.org/3890167 Any help is appreceated. Thanks a lot... -- Jörg Herzinger - EDV Team GLOBAL 2000 - Friends of the Earth Austria Neustiftgasse 36, A-1070 Wien tel +43-699-14200030 Dieses Mail wurde mit Oekostrom und Opensource Software erstellt.

4 3

rlm_python: no %RAD_REQUEST equivalent
by laurent.feron＠free.fr 05 Dec '12

05 Dec '12

Hello, I have a perl module that changes the username during the authorization phase (retrieve from a oracle database) by modifying the user-name attribute in the RAD_REQUEST dictionary. This update is global and can be used by the authentication phase (still handled by the perl script). I try to switch from perl to python as i'm more comfortable. Everything is ok except i don't know how to modify on the fly the user-name. in the 'authorize(p)' function, p is the read only tuple of the request. I cannot update the request here. The return of the function is (RLM_MODULE_something, tuple4reply, tuple4config). I still cannot change here. Moreover, if i change the tuple config in the authorize function , how i can retrieve it in the authentication function? Maybe i miss something as i'm a beginner on FR. Regards, Laurent

6 18

Re: rlm_perl authentication override
by Henry 20 Nov '12

20 Nov '12

Quoting tnt(a)kalik.net: >>>> Is there a way to change the reply from Access-Reject, to Access-Accept? >>>> > > Change freeradius.internal attribute Packet-Type in Post-Auth-Type Reject > section. Changing freeradius.internal Packet-Type from Access-Reject to Access-Accept would affect ALL logins - even logins which *should* be rejected. I'm referring to changing Access-Reject to Access-Accept under certain circumstances only -- not globally for all logins. ...or am I misunderstanding what you're suggesting? Thanks Henry

5 13

New attribute on old freeradius server
by Tiago 23 Oct '12

23 Oct '12

Hello everyone, I'm trying to implement an new radreply attribute on an old freeradius 1.x production server that should be replaced on the next days. I've set a user attribute on my mysql database - table radreply like: Shape = 1 I've added that new attribute on my dictionary file /etc/freeradius/dictionary (ubuntu server) like: ..... ...... ATTRIBUTE Shape 86 integer I'm doing some radtests and I'm getting this: Thu Aug 2 14:43:49 2012 : Error: rlm_sql: Failed to create the pair: Unknown attribute "Shape" Thu Aug 2 14:43:49 2012 : Error: rlm_sql (sql): Error getting data from database Thu Aug 2 14:43:49 2012 : Auth: Login OK: [user] (from client pppoe02 port 0) Where else should I look for? Kindly regards, Tiago

2 5

Freeradius as dhcp; parsing option82
by Ilya A. Masandilov 16 Oct '12

16 Oct '12

Hello! We are using freeradius as dhcp server about two years. Its working wery well, but. We have all the DHCP logic written in rlm_perl script. Now we have load ~900-1200 dhcp queries per sec, but 70% of them are ignored (dependents of a vlan in option 82 (part of DHCP-Relay-Circuit-Id)). I would like to parse circuit-id by unlang, to not to transfer most of the queries in Perl script. In Perl, I do it like this: my $hex = substr, $RAD_REQUEST{'DHCP-Relay-Circuit-Id'}, 6, 8; my $vlan = hex(hex); $hex = substr, $RAD_REQUEST{'DHCP-Relay-Circuit-Id'}, 10, 12; my $port = hex($hex); But i can't find suggestion in unlang... Is there a way to do this by unlang without using sql:unhex or any external modules? Thank you!

3 4