October 2014 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

No Logon Servers error with FreeRADIUS + NTLM
by Stefan Paetow 19 Feb '16

19 Feb '16

Hi, I know this is not a problem with FreeRADIUS, however, there are several people on this list who run FreeRADIUS with Active Directory as a back end and I need their advice on this. I've run into the dreaded "No logon servers (0xc000005e)" error with NTLM. In the past I've found that the computer password for the server expired on AD and that it was either fixed by rejoining, or by tweaking the password's expiry. Do any AD folk on the list know what we can do to get this stable and that this does not occur again? Any ideas will be very useful. :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 1

ipaddr, ipv4addr ipv6addr
by Arran Cudbard-Bell 06 Mar '15

06 Mar '15

The behaviour of the ipaddr config item has changed slightly for 3.0.4. If the ipaddr value contains ':' or '[' or ']', it will be treated as an IPv6 address. If it fails to parse as an IPv6 address the server will refuse to start. If the ipaddr value does not contain any ipv6 chars the server will first check to see if it looks like an ipv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else if a AAAA record is available else the server will refuse to start. If instead of the ipaddr config item the ipv4addr config item is used the server will check if it looks like an IPv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else the server will refuse to start. If instead of the ipaddr config item the ipv6addr config item is used the server will check if it looks like an IPv6 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching AAAA record is available it will be used, else the server will refuse to start. The behaviour is similar for the client, home_server and listen sections. Though those config items in client sections may have an optional /[0-9]{1,3} suffix to map clients to ranges of IP addresses. This should also work with things like example.org/96 though i'm not entirely sure why you'd ever want to do that. 'netmask' is now deprecated but will still function as expected until 3.1.0. These changes should make it slightly easier to manage v4/v6 transitions. Wildcard clients 0.0.0.0 <ipaddr>/0 '*' are not supported. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 15

How to configure FreeRADIUS for Kerberos and LDAP
by Brendan Kearney 27 Jan '15

27 Jan '15

i have put together a doc to assist in the configuration of FreeRADIUS to use Kerberos for authentication (AuthN) and LDAP for authorization (AuthZ). I have modelled the configs after my environment, and taken into account the design and implementations choices i have made. others may have different needs, so some directives or values may need to be changed based on those needs. i make no guarantees that my configs will work in your environment. i have tried to use simple language, but be concise, precise and accurate. if points are ambiguous, lacking clarity or leave room for misinterpretation, please provide constructive feedback. if steps are sub-optimal, incorrect or contain typographical errors, please keep me honest, and indicate where the errors have occurred. i release this doc into the ether and lay no claim to its format, the data contained within it nor to the intellectual property rights of the rightful owners of any trademark, servicemark or copyright. thank you, brendan kearney

2 2

3.0.4: proxy-to-vserver and proxied post-auth?
by Stefan Winter 10 Dec '14

10 Dec '14

Hello, I've migrated almost all my virtual servers - but one - to 3.0.4. There's one thing which I had expected to work, but it doesn't, but I do recall some discussions around this on the list; but not what the final verdict was. My proxied-to vserver needs to do some stuff in post-auth. However it looks like post-auth is not actually called; instead, only the post-auth of the original vserver is. Is that desired/expected behaviour in 3.0.4? The symptoms of this boils down to these two lines: Debug: (55) modsingle[authenticate]: returned from pap (rlm_pap) for request 55 Debug: (55) [pap] = ok Debug: (55) } # Auth-Type PAP = ok Debug: (55) Empty post-proxy section. Using default return values. Debug: (55) Found Auth-Type = Accept Debug: (55) Auth-Type = Accept, accepting the user Debug: (55) # Executing section post-auth from file /usr/local/freeradius/config/raddb/sites-enabled/AAI The PAP instance there is the one from the proxied-to vserver; must be, as it knows my password and the retrieval of that password is unique to the vserver in question. The next line speaks about empty post-proxy; that looks like the initial vserver kicks in right after authenticate { } with its PAP is finished. It then executes post-auth from the initial vserver, not the one from proxied-to (the proxied-to vserver is called "staff", not "AAI"). That's not helpful for my setup :-( So... just wondering if this is a bug or if I'm going to need a majorish rethink of my post-auth logic here... Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 3

info: WARNING: Child is hung for request XXXX in component <core> module (2.2.5)
by Jonathan 22 Nov '14

22 Nov '14

Hi we regulary get these messages since we upgraded from 2.2.3 to 2.2.5 I have attached the GDB log as i'm no developper expert to find out what's going on... Hopefully someone can help us out with this <SOME INFO> We are running Debian 7.7 x64 Linux 3.2.0-4-amd64 (radius1) 10/22/2014 _x86_64_ (8 CPU) avg-cpu: %user %nice %system %iowait %steal %idle 0.24 0.00 0.11 0.10 0.00 99.56 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn cciss/c0d0 163.25 9.31 1491.34 3263611 522909360 <RADIUS LOGS> Wed Oct 22 16:35:35 2014 : Error: Discarding duplicate request from client telenet-81.82.0.0/15 port 3072 - ID: 226 due to unfinished request 2664227 Wed Oct 22 16:35:37 2014 : Error: WARNING: Unresponsive thread 2664227 for request 0, in component <core> module Wed Oct 22 16:35:38 2014 : Info: WARNING: Child is hung for request 2664227 in component <core> module . Attached a debug with command, "echo 'thread apply all bt full' > /tmp/gdb_cmd; gdb --pid `cat /var/run/freeradius/freeradius.pid` -batch -x /tmp/gdb_cmd > gdb_bt; gzip gdb_bt" Hopefully this brings something useful, as previous debug to devel list didnt show the reason.

4 11

Dailycounter not working
by Matej Žerovnik 07 Nov '14

07 Nov '14

Hello! I'm trying to use dailycounter on a LDAP authenticated user and it doesn't seem to work. I think I did all steps correctly, but then again, i have been wrong before:) In radcheck table I added: testuser Max-Daily-Session := 600 I enabled dailycounter in counters.conf: sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(`Acct-Session-Time` - \ GREATEST((%b - UNIX_TIMESTAMP(`Acct-Start-Time`)), 0)) \ FROM accounting WHERE `User-Name` = '%{${key}}' AND \ UNIX_TIMESTAMP(`Acct-Start-Time`) + `Acct-Session-Time` > '%b'" } In sites-available/default I have the following: authorize { if (User-Password) { update control { Auth-Type := ldap Ldap-UserDN := "eduPersonPrincipalName=%{User-Name},dc=example,dc=com" } } sql dailycounter } authenticate { Auth-Type LDAP { ldap } } Debug output: rad_recv: Access-Request packet from host 10.10.10.10 port 33651, id=75, length=202 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:24:D7:47:1C:XX" Called-Station-Id = "hs-kit-testing" NAS-Port-Id = "bridge-bralci" User-Name = "testuser" NAS-Port = 2151677975 Acct-Session-Id = "80400017" Framed-IP-Address = 192.168.81.198 Mikrotik-Host-IP = 192.168.81.198 User-Password = "password" Service-Type = Login-User WISPr-Logoff-URL = "http://192.168.81.1" NAS-Identifier = "kit-testing" NAS-IP-Address = 192.168.1.116 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++? if (User-Password) ? Evaluating (User-Password) -> TRUE ++? if (User-Password) -> TRUE ++- entering if (User-Password) {...} expand: eduPersonPrincipalName=%{User-Name},dc=example,dc=comsi -> eduPersonPrincipalName=testuser,dc=example,dc=com +++[control] returns notfound ++- if (User-Password) returns notfound [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User testuser not found ++[sql] returns notfound *rlm_sqlcounter: Entering module authorize code** **rlm_sqlcounter: Could not find Check item value pair** **++[dailycounter] returns noop* Found Auth-Type = LDAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "testuser" with password "password" [ldap] user DN: eduPersonPrincipalName=testuser,dc=example,dc=com [ldap] (re)connect to ldaps.example.com:636, authentication 1 [ldap] setting TLS mode to 1 [ldap] bind as eduPersonPrincipalName=testuser,dc=example,dc=com/password to ldaps.example.com:636 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user testuser authenticated succesfully ++[ldap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 75 to 10.10.10.10 port 33651 Why doesn't radius find Check item value pair? It does exists in radcheck table... Does it only work for local mysql users? Matej -- --- Matej Zerovnik

2 6

unlang vs suffix
by Rui Ribeiro 07 Nov '14

07 Nov '14

Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro

7 8