February 2013 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

AVP EAP-KEY name support in FR
by Srinu Bandari 12 May '14

12 May '14

Hi, We are trying to bring up MACsec with Cisco and FR, and we are stuck because of Radius unable to send EAP-Key-Name AVP. Below is what is expected as per RFC4072 RFC4072 says "A home Diameter server receiving a Diameter-EAP-Request with a Key-Name AVP with non-empty data MUST silently discard the AVP. In addition, the home Diameter server SHOULD include this AVP in Diameter-EAP-Response only if an empty EAP-Key-Name AVP was present in Diameter-EAP-Request." But radius server is not sending EAP-Key-Name AVP (Radius Attribute Type 102) even invalid AVP present in the Diameter-EAP-Request". Below is the debug print of radius Sending Access-Accept of id 647 to 10.20.64.9 port 1645 MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Does anyone have clue on this. Thanks, Srinivas CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 19

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

Radperf unavailable?
by Marius Booysen 30 Oct '13

30 Oct '13

Hi, I see that there is a problem downloading Radperf from networkradius.com. Does anybody know if it will become available once again at some point? Are there any other benchmarking utilities for Freeradius? Regards Kosie

5 4

DHCP howto
by Igor Smitran 09 Apr '13

09 Apr '13

What would need to be done in dhcp setup in order to have radusergroup/radcheck/radreply/radacct-alike behavior? I am trying to make it work with cable equipment (CM,MTA,CPE) but i am not sure how to start. CM and MTA would have static IP addresses (sql prefered because of additional replies: boot-file,dns,gateway etc.) and CPE's would have dynamic IP address assigned. I am willing to do some serious tests and get back with results because if everything works ok i would switch to freeradius from standard ISC dhcpd. Thank you

10 31

Freeradius as DHCP server (static IP + some options)
by Leo Combes 05 Apr '13

05 Apr '13

Hello. I successfully run ISC-DHCP server for provisioning modems in an ISP's network, but what I wanted to try is something more modern and with database support. I want to try using Freeradius as DHCP server, but first I want to know if it is possible with these requirements: - Need to deliver fixed IP (or static) according to mac-address. - Need to provide, in addition to the IP, some DHCP options. Option 1 (Subnet mask), Option 3 (Routers), Option 6 (DNS server), Option 15 (Domainname), Option 18 (Extensions path), Option 66 (TFTP server name), Option120 (SIP Servers DHCP Option). - The IP and Options corresponding to each mac-address has to be stored in mysql. According dhcpdump, the dhcp client request looks like this: TIME: 2013-01-21 16:23:30.787 IP: 0.0.0.0 (0:13:96:0:f9:84) > 255.255.255.255 (ff:ff:ff:ff:ff:ff) OP: 1 (BOOTPREQUEST) HTYPE: 1 (Ethernet) HLEN: 6 HOPS: 0 XID: 8e22cb4d SECS: 0 FLAGS: 7f80 CIADDR: 0.0.0.0 YIADDR: 0.0.0.0 SIADDR: 0.0.0.0 GIADDR: 0.0.0.0 CHADDR: 00:13:96:00:f9:84:00:00:00:00:00:00:00:00:00:00 SNAME: . FNAME: . OPTION: 53 ( 1) DHCP message type 1 (DHCPDISCOVER) OPTION: 61 ( 8) Client-identifier 01:00:13:96:00:f9:84:00 OPTION: 51 ( 4) IP address leasetime -256 () OPTION: 51 ( 4) IP address leasetime -1 () OPTION: 55 ( 11) Parameter Request List 1 (Subnet mask) 3 (Routers) 6 (DNS server) 15 (Domainname) 18 (Extensions path) 66 (TFTP server name) 120 (SIP Servers DHCP Option) 135 (???) 213 (???) 214 (???) 215 (???) Freeradius 2.2.0 can provide this functionality just configuring it, or it would be necessary to use modules or developments that aren't available yet? Thanks in advance!

4 16

Trucation of octet attribute handled by rlm_perl
by Бен Томпсон 01 Mar '13

01 Mar '13

Hello everyone I am having a slight problem with rlm_perl and I would really appreciate any advice/help. I have a perl script which rlm_perl adds a value to the DHCP-Classless-Static-Route attribute something like this :- #### perl script snippets ############ ... my $route = pack('C7', split(/\,/, "16,172,16,10,0,0,2")); ... &radiusd::radlog(RADLOG_DEBUG, "packed data: " . unpack('H*', $route)); ... $RAD_REPLY{'DHCP-Classless-Static-Route'} = $route; ... ############################### ..but from the debug output I see that the attribute data is truncated at the first octet with value 00 :- ### freeradius -Xx snippets ######## ... Thu Feb 28 10:35:23 2013 : rlm_perl: packed data: 10ac100a000002 .... Thu Feb 28 10:35:23 2013 : Debug: rlm_perl: Added pair DHCP-Classless-Static-Route = ??? ... DHCP-Classless-Static-Route = 0x10ac100a .... ############################## Am I doing somthething daft, or is this a possible bug in rlm_perl? I am using freeradius 2.2.0.

2 2

DHCP sqlippool reply values
by Igor Smitran 28 Feb '13

28 Feb '13

I've added two new fields into radippool table that i am using for DHCP dynamic pools. `gateway` varchar(15) NOT NULL DEFAULT '', `netmask` varchar(15) NOT NULL DEFAULT '', in ippool-dhcp.conf i've added new fields: allocate-find = "SELECT framedipaddress,gateway,netmask FROM ${ippool_table} .... I am not able to figure out how to address new fields inside policy.conf. Is it even possible? I need to have two new fields, currently i have: update reply { DHCP-Your-IP-Address = "%{reply:Framed-IP-Address}" } I am trying to get two new fields: DHCP-Subnet-Mask DHCP-Gateway-IP-Address I can use perl module to add those two fields but that means that i need two more database queries. Any other way?

3 2

MAC Authentication with FreeRadius
by Bouchra Badri 28 Feb '13

28 Feb '13

Hi, 1 - I was wondering if going through the tuto in wiki.freeradius is necessary to be able to authenticate using the mac address ? For one, that rewrite_calling_station_id generates an error at the run of freeradius, plus I've seen some tutos that say that cisco Mac-auth-Bypass can do the trick... Can you confirm it please? Because it doesn't work either :( 2 - I can probably do it using the vmps and mac2vlan files supplied by FreeRad, but in mac2vlan they say that radiusd.conf shows how to use it in detail, but that's not the case ! So can you please provide a clear tutorial on how to use vmps with freeradius? Thank you !

3 7