October 2013 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

AVP EAP-KEY name support in FR
by Srinu Bandari 12 May '14

12 May '14

Hi, We are trying to bring up MACsec with Cisco and FR, and we are stuck because of Radius unable to send EAP-Key-Name AVP. Below is what is expected as per RFC4072 RFC4072 says "A home Diameter server receiving a Diameter-EAP-Request with a Key-Name AVP with non-empty data MUST silently discard the AVP. In addition, the home Diameter server SHOULD include this AVP in Diameter-EAP-Response only if an empty EAP-Key-Name AVP was present in Diameter-EAP-Request." But radius server is not sending EAP-Key-Name AVP (Radius Attribute Type 102) even invalid AVP present in the Diameter-EAP-Request". Below is the debug print of radius Sending Access-Accept of id 647 to 10.20.64.9 port 1645 MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Does anyone have clue on this. Thanks, Srinivas CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 19

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

configuration parameters for perl module in rlm_perl
by Cornelius Kölbel 28 Mar '14

28 Mar '14

Hi list, is there are recommended way to pass configuration parameter to a rlm_perl module? My rlm_perl module, would need to have additional configuration parameters. I would like to avoid having the perl module read an additional configuration file. Is there a possibility to add such paramters somewhere in the freeradius config like in /etc/freeradius/modules/perl and than have the perl module access these parameters? Thanks a lot and kind regards Cornelius

8 20

how to change the radius default "testing123" password
by Clint Petty 10 Dec '13

10 Dec '13

I changed all instances of the password "testing123", to a random password on both the StrongSwan server and the Radius server, and restarted the strongswan and radiusd services. However, this broke the connection to authenticate to the LDAP server, so I had to put it back to "testing123" to get it to work again. How can I change the radius default "testing123" password? Is there a command I need to run to do this? Thanks for any help with this.

8 29

rlm_perl
by Russell Mike 14 Nov '13

14 Nov '13

Hi List, i have working rlm_sqlcounter but have limitation of 4GB. I found that rlm_perl is a solution for this problem but i cant find any example of perl data counter. someone please help Thanks RM --

2 1

Per nas simultaneous-use limit
by ST Wong (ITSC) 08 Nov '13

08 Nov '13

Hi all, We want to per user limit login to 4 for particular NAS. I added following in users: DEFAULT Huntgroup-Name == "broadband", Simultaneous-Use := 4 Fall-Through = Yes And in huntgroups: broadband NAS-IP-Address == 192.168.192.201 broadband NAS-IP-Address == 192.168.192.204 Is seems the limit of 4 is for all users in the same NAS instead of particular users. We're using 2.2.0. Would anyone advise? Thanks lot. Rgds, /st

2 2

Windows Workstation Authentication
by Dan Lietz 05 Nov '13

05 Nov '13

I have 802.11 authentication set up using an eDirectory backend and it all works except for one thing. When a user logs in to a Windows computer using a windows account that does not exist in eDirectory the authorization fails. Since the locally logged on user does not exist in eDirectory, authorization fails before the user is prompted when initially trying to connect to the wireless. Instead the workstation sends the user credentials that were used to log in locally to the radius server. Does anyone know if there is a way to configure the Windows wireless connection or the radius backend to force a prompt for authorization? Thanks for any assistance. Dan

7 7

DHCP reply not leaving machine
by Rok Kosir 05 Nov '13

05 Nov '13

Hi, after multiple recompilation of FR (both version 2.2 and 3.0.1) i was not able to configure DHCP server so that clients would get IPs. I am currently testing on ubuntu 12.04.3 server which has connected Ubuntu 12.04 desktop version laptop on eth1 trying to get IP. I see multiple requests comming to server but no reply reaches the client (nor ethernet card). FR is built from source and following this configuration http://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation (with exception of using mac2ip for IP filetable). Here is relevant info on server: eth1: inet addr:192.168.0.1 dhcp config: server dhcp { listen { ipaddr = 255.255.255.255 port = 67 type = dhcp interface = eth1 dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 192.168.0.1 DHCP-Domain-Name-Server = 193.2.1.66 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 192.168.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.0.1 } mac2ip ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 192.168.0.1 DHCP-Domain-Name-Server = 193.2.1.66 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 192.168.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.0.1 } mac2ip ok } dhcp { # send a DHCP NAK. reject } } radiusd -X output is here: http://pastebin.com/raw.php?i=yY1aNf6v i have used tcpdump to check port 67 and 68, but only requests come in, no reply is released to ethernet card. Any suggestions? Regards, Rok

3 14