April 2013 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

AVP EAP-KEY name support in FR
by Srinu Bandari 12 May '14

12 May '14

Hi, We are trying to bring up MACsec with Cisco and FR, and we are stuck because of Radius unable to send EAP-Key-Name AVP. Below is what is expected as per RFC4072 RFC4072 says "A home Diameter server receiving a Diameter-EAP-Request with a Key-Name AVP with non-empty data MUST silently discard the AVP. In addition, the home Diameter server SHOULD include this AVP in Diameter-EAP-Response only if an empty EAP-Key-Name AVP was present in Diameter-EAP-Request." But radius server is not sending EAP-Key-Name AVP (Radius Attribute Type 102) even invalid AVP present in the Diameter-EAP-Request". Below is the debug print of radius Sending Access-Accept of id 647 to 10.20.64.9 port 1645 MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Does anyone have clue on this. Thanks, Srinivas CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 19

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

Re: SSL V3 client certificate error
by Danny Kurniawan 05 Nov '13

05 Nov '13

thank you so much .. yes it only have issue intermitenly on some user .. so i have to set our client laptop manually for the root CA? I believe it should be there as we use Global Sign ... -- Best Regards, Danny

2 1

Radperf unavailable?
by Marius Booysen 30 Oct '13

30 Oct '13

Hi, I see that there is a problem downloading Radperf from networkradius.com. Does anybody know if it will become available once again at some point? Are there any other benchmarking utilities for Freeradius? Regards Kosie

5 4

ippool-dhcp and Oracle
by Бен Томпсон 09 Jun '13

09 Jun '13

Hello Everyone Could anyone advise me what would be required to us dhcp-ippool with Oracle? I had a quick look through the files in git and it seems to me that the only thing missing is queries.conf? If that is all that is required I am happy to do the work of porting the sql queries from the mysql version, but I just wanted the check that I am not missing something. Ben

3 16

multiply Cisco-AVPair request attribute process by regular expression
by Mehdi Ravanbakhsh 08 May '13

08 May '13

Hi All I have one Cisco 10000 NAS inmy network and this is the authenticate request : Packet-Type = Access-Request Cisco-AVPair = "client-mac-address=f43e.6166.dba0" Framed-Protocol = PPP User-Name = "7727221873" NAS-Port-Type = Ethernet NAS-Port = 71468299 NAS-Port-Id = "0/0/0/0" Cisco-AVPair = "circuit-id-tag=Kangan-1 atm 7/42:218:0.35" Service-Type = Framed-User NAS-IP-Address = 10.150.21.218 Acct-Session-Id = "0442850B" Calling-Station-Id = "f4:3e:61:66:db:a0" Called-Station-Id = "" SQL-User-Name = "7727221873" i have tow Cisco-AVPair attribute in request and i need to process one of them that being started by 'circuit-id-tag=' so i use this : if (Cisco-AVpair =~ /^circuit-id-tag=(.*)$/) { update request { Connect-Info := "%{1}" } } but it is not working ! in similar case that i use regular expression for updating request it work well for example : if (Cisco-AVpair =~ /^client-mac-address=([a-f0-9][a-f0-9])([a-f0-9][a-f0-9]).([a-f0-9][a-f0-9])([a-f0-9][a-f0-9]).([a-f0-9][a-f0-9])([a-f0-9][a-f0-9])$/) { if (!Calling-Station-Id) { update request { Calling-Station-Id := "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" Called-Station-Id := "%{NAS-Identifier}" } } } in last i think in this case because of multiply Cisco-AVPair attribute in request regular expression should be different but i can not find any source that can enplane this problem . Best regards.

4 11

redundant-load-balance for AD ntlmauth
by FreeRadius List 07 May '13

07 May '13

Hello I use redundant-load-balance for ldap user auth to authenticate users to a pool of active directory servers for one service. That seems to work well. I'm trying to think why I don't do that for ntlmauth (used inside mschap inner-tunnel) for another other service. I've knocked that up to test it with mschap modules like (with N being 1,2,3,4,5) mschap mschapadN { with_ntdomain_hack = yes ntlm_auth = "/usr/local/bin/mschap-ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --configfile=/etc/samba/smb-adN.conf" } where /etc/samba/smb-adN.conf is the same as the others except for "password server = adN.domain" and then in the inner-tunnel site I have authenticate { Auth-Type MS-CHAP { redundant-load-balance { mschapad1 mschapad2 .. mschapadN } } } Is this along the lines that others follow? if not how does ntlmauth handle the AD server being down. Does ntlmauth/winbind handle AD being down so freeradius does not have to? Thanks, Neil

4 7

segfault error
by Chris Taylor 02 May '13

02 May '13

I am running freeradius2-2.1.12-5.el5 on a CentOS server release 5.9 (Final). I was doing some testing on some new RADIUS servers that we want to put into production and I got the following error. /var/log/messages Apr 9 17:33:45 on-radius01 kernel: radiusd[8831]: segfault at 00002aae660ae000 rip 00002aae5b6215eb rsp 00002aae660ab7c8 error 4 What should I be looking for the RADIUS logs didn't turn up anything as it wasn't in debug mode. Thanks, Chris

4 16