December 2013 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

unlang vs suffix
by Rui Ribeiro 07 Nov '14

07 Nov '14

Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro

7 8

AVP EAP-KEY name support in FR
by Srinu Bandari 12 May '14

12 May '14

Hi, We are trying to bring up MACsec with Cisco and FR, and we are stuck because of Radius unable to send EAP-Key-Name AVP. Below is what is expected as per RFC4072 RFC4072 says "A home Diameter server receiving a Diameter-EAP-Request with a Key-Name AVP with non-empty data MUST silently discard the AVP. In addition, the home Diameter server SHOULD include this AVP in Diameter-EAP-Response only if an empty EAP-Key-Name AVP was present in Diameter-EAP-Request." But radius server is not sending EAP-Key-Name AVP (Radius Attribute Type 102) even invalid AVP present in the Diameter-EAP-Request". Below is the debug print of radius Sending Access-Accept of id 647 to 10.20.64.9 port 1645 MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Does anyone have clue on this. Thanks, Srinivas CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 19

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

configuration parameters for perl module in rlm_perl
by Cornelius Kölbel 28 Mar '14

28 Mar '14

Hi list, is there are recommended way to pass configuration parameter to a rlm_perl module? My rlm_perl module, would need to have additional configuration parameters. I would like to avoid having the perl module read an additional configuration file. Is there a possibility to add such paramters somewhere in the freeradius config like in /etc/freeradius/modules/perl and than have the perl module access these parameters? Thanks a lot and kind regards Cornelius

8 20

DHCP
by Laura Marzà Porcar 17 Jan '14

17 Jan '14

Hi, I have freeradius 2.1.10 running with static IP clients, configure it myself, but now I need a range of dynamic ips. I have read that to do this, I have to install with the - with-dhcp, but if you have already installed and do not have the installation package, as I can configure the dhcp? At moment, I don't want to use a database My system is Debian 2.6.32-38 I hope that you understand me, my English is not too good thanks LAURA MARZÀ PORCAR Administración de Sistemas Departamento UUTT 964.722.633 - ext. 741 MARINA D'OR - España laura.marza(a)servidir.es http://www.marinador.com Soporte: http://soporte.marinador.com

4 15

feature request: ldap enhancements
by Hachmer, Tobias 15 Jan '14

15 Jan '14

Hello Arran, you asked if I have any feature requests. So, here are two points I want to discuss: 1. reload all RADIUS clients stored in ldap on SIGHUP (bulk load) - 'radmin -e "hup ldap"' would be sufficient here 2. enhanced ldap support for storing and managing huntgroups Our goal is to restrict several users to one or more "NAS groups". It should be possible that the same NAS can be member of multiple huntgroups as well as to assign multiple huntgroups to a user. Example: huntgroup-1 NAS-IP-Address == 192.0.2.5 huntgroup-1 NAS-IP-Address == 192.0.2.6 huntgroup-1 NAS-IP-Address == 192.0.2.7 huntgroup-2 NAS-IP-Address == 192.0.2.7 huntgroup-2 NAS-IP-Address == 192.0.2.8 huntgroup-2 NAS-IP-Address == 192.0.2.9 user1 Cleartext-Password := "password1", Huntgroup-Name == "huntgroup-1" Service-Type = Administrative-User user2 Cleartext-Password := "password2", Huntgroup-Name == "huntgroup-2" Service-Type = Administrative-User user3 Cleartext-Password := "password3", Huntgroup-Name == "huntgroup-1", Huntgroup-Name == "huntgroup-2" Service-Type = Administrative-User Please pardon if the huntgroup assignment here is incorrect, I did not use huntgroups at all for now. To do this in ldap there have to be something like: a) new object class for huntgroups to distinct these from other RADIUS related objects like RADIUS clients and RADIUS profiles. I think this approach is better than adding a multi-valued attribute to the RADIUS clients object class for better clarity. b) The existing RADIUS profile object class should be extended for a multi-valued attribute to assign multiple huntgroups to a user profile. With this assumption radiusd could read all defined huntgroups on startup (reread on SIGHUP;-) ) and do the matching in authorize section after the user profile is read from ldap. Would be glad if you can give your thoughts on this or maybe some hints if this could be achieved already different. Hope this two points are not very far-fetched ;-) Regard, Tobias

3 9

control check_item := being overwritten by group check_item :=
by Jonathan 30 Dec '13

30 Dec '13

we are in the progress of migrating freeradius servers and encountering behavior changes 1.X: "check_item := takes precedence over group check_item :=" 2.X: "check_item := being overwritten by group check_item :=" current_release=1.1.8 target_release=2.2.3 (or any other stable) Some more detail: sqlcounter.conf configured with: sqlcounter limitvolume { counter-name = Octets-Total check-name = Max-Octets ... } behavior for: Max-Octets with operator ":=" ONLY groupcheck item set result in 1.1.8: groupcheck-item is taken, no issue result in 2.2.3: groupcheck-item is taken, no issue behavior for: Max-Octets with operator ":=" usercheck item set groupcheck item set result in 1.1.8: usercheck-item takes precende, no issue result in 2.2.3: groupcheck-item overwrites usercheck-item, user not able to increase his volume limit independent of the group he is a member off. I've validated as well in 2.1.12 which yields the same behavior as 2.2.3. So behavior has changed from 1.x to 2.x How can I make a user inherit group items while still overriding specific user check control items. The of "=" is not allowed, so i'm currently without direction in how to get this behavior back. Is this a bug or intended behavior, and how can I resolve this? Regards, Jonathan

1 0

Per realm different counters
by Marco Marino 28 Dec '13

28 Dec '13

Hi, how can i manage per-realm different Max-Daily-Session attributes? More precisely: i have a users table that correctly authenticate clients, but i'd like to use different Max-Daily-Session if the request have "User1@realm1" or "User1@realm2". Is this possible? Another solution: Can i istantiate multiple radius server (with multiple db??) but with the same users table and make a proxy only for accounting? I'm sorry if this is a stupid question. Thanks

1 0