January 2013 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

Radperf unavailable?
by Marius Booysen 30 Oct '13

30 Oct '13

Hi, I see that there is a problem downloading Radperf from networkradius.com. Does anybody know if it will become available once again at some point? Are there any other benchmarking utilities for Freeradius? Regards Kosie

5 4

Freeradius as DHCP server (static IP + some options)
by Leo Combes 05 Apr '13

05 Apr '13

Hello. I successfully run ISC-DHCP server for provisioning modems in an ISP's network, but what I wanted to try is something more modern and with database support. I want to try using Freeradius as DHCP server, but first I want to know if it is possible with these requirements: - Need to deliver fixed IP (or static) according to mac-address. - Need to provide, in addition to the IP, some DHCP options. Option 1 (Subnet mask), Option 3 (Routers), Option 6 (DNS server), Option 15 (Domainname), Option 18 (Extensions path), Option 66 (TFTP server name), Option120 (SIP Servers DHCP Option). - The IP and Options corresponding to each mac-address has to be stored in mysql. According dhcpdump, the dhcp client request looks like this: TIME: 2013-01-21 16:23:30.787 IP: 0.0.0.0 (0:13:96:0:f9:84) > 255.255.255.255 (ff:ff:ff:ff:ff:ff) OP: 1 (BOOTPREQUEST) HTYPE: 1 (Ethernet) HLEN: 6 HOPS: 0 XID: 8e22cb4d SECS: 0 FLAGS: 7f80 CIADDR: 0.0.0.0 YIADDR: 0.0.0.0 SIADDR: 0.0.0.0 GIADDR: 0.0.0.0 CHADDR: 00:13:96:00:f9:84:00:00:00:00:00:00:00:00:00:00 SNAME: . FNAME: . OPTION: 53 ( 1) DHCP message type 1 (DHCPDISCOVER) OPTION: 61 ( 8) Client-identifier 01:00:13:96:00:f9:84:00 OPTION: 51 ( 4) IP address leasetime -256 () OPTION: 51 ( 4) IP address leasetime -1 () OPTION: 55 ( 11) Parameter Request List 1 (Subnet mask) 3 (Routers) 6 (DNS server) 15 (Domainname) 18 (Extensions path) 66 (TFTP server name) 120 (SIP Servers DHCP Option) 135 (???) 213 (???) 214 (???) 215 (???) Freeradius 2.2.0 can provide this functionality just configuring it, or it would be necessary to use modules or developments that aren't available yet? Thanks in advance!

4 16

Huntgroup Checking
by simonm123 28 Feb '13

28 Feb '13

Am new to freeradius but have it mainly set up just fine. It's a fantastic tool and I'm enjoying using it :) Just one thing I'm struggling with is the huntgroups. I've followed the wiki to the letter and can see the server checking in the debug log. What I basically want to do is restrict users to certain networks, as per the wiki. If their huntgroup-name matches their huntgroup based on nasip, they can get online, otherwise they're rejected. I've put Huntgroup-Name = NetworkA in my radgroupcheck folder. In my radhuntgroup table, I have the nasip and groupname = NetworkA Then, in the authorize section of my default host, I put: update request { Huntgroup-Name := "%{sql:SELECT `groupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'}" } if (Huntgroup-Name == ''){ reject } All as per the tutorial In my debug log, if there is no match by IP, Huntgroup-Name is blank and the user is rejected. However, if the nasip address match but the name is different, the user is still allowed on. Do I need a more advanced query in the if section and if so,could you please advise what it should be Simon -- View this message in context: http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-tp4950385p495038… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Dialup Admin
by Shawky Skaff 13 Feb '13

13 Feb '13

In dialup admin if a select accounting and run an accounting query, I can see accounting data listed in the tables, uptime, downloads, uploads, etc, however if I edit the user, the connection status has no information and the open session shows no sessions. Doesn't the data for all locations come from the same place? Is there anything that I need to do?

3 3

Configuring accounting on Freeradius server
by Deepti kulkarni 08 Feb '13

08 Feb '13

Hello, I am running Freeradius Server version 2.1.10 on a debian machine (64 bit). I have a debian client (using pam_radius_auth) for authentication and accounting. My client can authenticate into the the radius server, however, I dont see any accounting being done. Attached is the radiusd -X output. Is there any configuration required for the pam_radius_auth.so? Also on the freeradius server, I uncommented a line from acct_users - root@debian:/etc/freeradius# cat acct_users # # $Id$ # # This is like the 'users' file, but it is processed only for # accounting packets. # # Select between different accounting methods based for example on the # Realm, the Huntgroup-Name or any combinaison of the attribute/value # pairs contained in an accounting packet. # #DEFAULT Realm == "foo.net", Acct-Type := sql_log.foo # #DEFAULT Huntgroup-Name == "wifi", Acct-Type := sql_log.wifi # #DEFAULT Client-IP-Address == 10.0.0.1, Acct-Type := sql_log.other # #DEFAULT Acct-Status-Type == Start, Acct-Type := sql_log.start # Replace the User-Name with the Stripped-User-Name, if it exists. # DEFAULT User-Name := "%{Stripped-User-Name:-%{User-Name}}" root@debian:/etc/freeradius# Thanks in advance.

3 11

Help Needed !!! FreeRADIUS Integration with MS AD
by pradyumna dash 03 Feb '13

03 Feb '13

Hi Team, I need a help, am new to RADIUS and i need the below to be configured. I. FreeRADIUS integration with Microsoft AD II. Cisco switches needs to be the client II. The accounting information should also contain the commands executed in the Switch as well, Example If a used called "test" login to the switch and exexuted a command "Show config" that should be captured in the accounting information. What i have done till now is configured FreeRADIUS and created some local users and getting the switch to authenticated against the local user, Its working fine and getting the value-pair but i can see the commands which are executed in the switch console. Please help how i can do so. As i never integrated Micosoft 2008 AD with FreeRADIUS i need a how-to may be a step-by-step which can help me in integrating the same. Do i need a DB like MySQL for accounting or AD LDAP DB will help in doing so? Thanks for all your help. Regards, /Neo

5 13

Fw: [mschap] No Cleartext-Password configured. Cannot createLM-Password.
by Grzegorz Cimochowski 31 Jan '13

31 Jan '13

> Waking up in 3.4 seconds. > rad_recv: Access-Request packet from host 192.168.30.15 port 46844, > id=161, length=192 > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 138584 > NAS-Port-Type = Ethernet > User-Name = "chmielewska_d" > Calling-Station-Id = "54:E6:FC:E7:EA:E7" > Called-Station-Id = "witosa3" > NAS-Port-Id = "ether1" > MS-CHAP-Challenge = 0x28c98da9117ed73968677b477bfe0adf > MS-CHAP2-Response = > 0x01000de14d8d5551d54ac1898b1baffc011300000000000000003372483474e6d9ef5302fdc1e3bb081e0f47a844c8258da7 > NAS-Identifier = "witosa3" > NAS-IP-Address = 192.168.30.15 > # Executing section authorize from file > /usr/local/etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' > ++[mschap] returns ok > [suffix] No '@' in User-Name = "chmielewska_d", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > [sql] expand: %{User-Name} -> chmielewska_d > [sql] sql_set_user escaped user --> 'chmielewska_d' > rlm_sql (sql): Reserving sql socket id: 4 > [sql] expand: SELECT id, username, attribute, value, op FROM > radcheck WHERE username = '%{SQL-User-Name}' AND status = '1' > ORDER BY id -> SELECT id, username, attribute, value, op FROM > radcheck WHERE username = 'chmielewska_d' AND status = '1' ORDER > BY id > [sql] expand: SELECT groupname FROM radusergroup > WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT > groupname FROM radusergroup WHERE username = > 'chmielewska_d' ORDER BY priority > [sql] expand: SELECT id, groupname, attribute, Value, op FROM > radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> > SELECT id, groupname, attribute, Value, op FROM radgroupcheck > WHERE groupname = 'DaNET 1280' ORDER BY id > [sql] User found in group DaNET 1280 > [sql] expand: SELECT id, groupname, attribute, value, op FROM > radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> > SELECT id, groupname, attribute, value, op FROM radgroupreply > WHERE groupname = 'DaNET 1280' ORDER BY id > rlm_sql (sql): Released sql socket id: 4 > ++[sql] returns ok > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this. > ++[pap] returns noop > Found Auth-Type = MSCHAP > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > +- entering group MS-CHAP {...} > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > [mschap] Creating challenge hash with username: chmielewska_d > [mschap] Client is using MS-CHAPv2 for chmielewska_d, we need NT-Password > [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. > [mschap] FAILED: MS-CHAP2-Response is incorrect > ++[mschap] returns reject > Failed to authenticate the user. > Using Post-Auth-Type REJECT > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > +- entering group REJECT {...} > [sql] expand: %{User-Name} -> chmielewska_d > [sql] sql_set_user escaped user --> 'chmielewska_d' > [sql] expand: %{User-Password} -> > [sql] ... expanding second conditional > [sql] expand: %{Chap-Password} -> > [sql] expand: INSERT INTO radpostauth > (username, pass, reply, authdate) VALUES > ( '%{User-Name}', > '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> > INSERT INTO radpostauth (username, pass, reply, authdate) > VALUES ( 'chmielewska_d', > '', 'Access-Reject', '2013-01-31 14:34:55') > rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, > pass, reply, authdate) VALUES > ( 'chmielewska_d', '', > 'Access-Reject', '2013-01-31 14:34:55') > rlm_sql (sql): Reserving sql socket id: 3 > rlm_sql (sql): Released > > > this log interesed me > chmielewska_d is in database add > why: > +- entering group MS-CHAP {...} > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > [mschap] Creating challenge hash with username: chmielewska_d > [mschap] Client is using MS-CHAPv2 for chmielewska_d, we need NT-Password > [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. > [mschap] FAILED: MS-CHAP2-Response is incorrect > ++[mschap] returns reject > ?

1 0