February 2014 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

unlang vs suffix
by Rui Ribeiro 07 Nov '14

07 Nov '14

Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro

7 8

AVP EAP-KEY name support in FR
by Srinu Bandari 12 May '14

12 May '14

Hi, We are trying to bring up MACsec with Cisco and FR, and we are stuck because of Radius unable to send EAP-Key-Name AVP. Below is what is expected as per RFC4072 RFC4072 says "A home Diameter server receiving a Diameter-EAP-Request with a Key-Name AVP with non-empty data MUST silently discard the AVP. In addition, the home Diameter server SHOULD include this AVP in Diameter-EAP-Response only if an empty EAP-Key-Name AVP was present in Diameter-EAP-Request." But radius server is not sending EAP-Key-Name AVP (Radius Attribute Type 102) even invalid AVP present in the Diameter-EAP-Request". Below is the debug print of radius Sending Access-Accept of id 647 to 10.20.64.9 port 1645 MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Does anyone have clue on this. Thanks, Srinivas CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 19

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

configuration parameters for perl module in rlm_perl
by Cornelius Kölbel 28 Mar '14

28 Mar '14

Hi list, is there are recommended way to pass configuration parameter to a rlm_perl module? My rlm_perl module, would need to have additional configuration parameters. I would like to avoid having the perl module read an additional configuration file. Is there a possibility to add such paramters somewhere in the freeradius config like in /etc/freeradius/modules/perl and than have the perl module access these parameters? Thanks a lot and kind regards Cornelius

8 20

User and group attributes
by Lorenzo Milesi 06 Mar '14

06 Mar '14

Hi. I know it's a stupid question but so far I couldn't manage to dig it out. I'm using FR2 with MySQL backend. All my users belong to one or more group. I usually set the Idle-Timeout attribute using the radgroupreply table, and it works great. For a minority of users I'd like to override this attribute to a different value, but I cannot have FR reply as I wish. Current situation: Radcheck: USERA MD5-Password := somemd5hash Radusergroup: USERA c_gvt 30 Radgroupreply c_gvt Idle-Timeout := 3800 This works fine and replies 3800. If I add USERA Idle-Timeout := 100 to radreply it will still reply 3800. Then I checked manpage of USERS [1] so I changed: Radreply: USERA Idle-Timeout := 100 Radgroupreply c_gvt Idle-Timeout = 3800 but the reply is always the same. What am I missing? thanks [1] http://freeradius.org/radiusd/man/users.html -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

3 5

FreeRADIUS 3.0: 3rd party module build structure?
by Julius Plenz 03 Mar '14

03 Mar '14

Hi, I'm currently trying to migrate a FreeRADIUS 2.x config to the new 3.0 version. I have a few custom rlm_* modules that I want to compile against the 3.0 sources. Previously, I had a Makefile similar to this: FR_SOURCE = $(HOME)/src/freeradius TARGET = rlm_omapi SRCS = rlm_omapi.c RLM_DIR = $(FR_SOURCE)/src/modules/rlm_example/ top_builddir = $(FR_SOURCE)/ include $(FR_SOURCE)/src/modules/rules.mak RLM_CFLAGS = -I/server/dhcp/server/include -I/server/dhcp/src/isc-dhcp/bind/include RLM_LDFLAGS = -L/server/dhcp/server/lib -ldhcpctl -lomapi -ldns -lisc This way I got "magically working" targets to build and install my module. However, now the build system was changed for good and I cannot really figure out how to achieve the same effect. (In particular, the "rules.mak" file is apparently "No longer needed" since 80f92e5aee, Feb 27 2013.) Is there an easy way so I don't have to write out all the long libtool command lines myself? Any help is appreciated! Julius

3 9

How many NAS kann radius take?
by Anja Ruckdaeschel 03 Mar '14

03 Mar '14

Hi there! Having some performance trouble at our campus site with lots of "Discarding Duplicate request" errors. Our setup is freeradius 2.2.0 with ldap and sql. ; Intel Xeon CPU E5630 2.53GHz 2CPUs with 8 Core (hyperthreading enabled), 24 GB RAM sql is only used to determine the replied VLAN-ID from a very small read only table by a local mysql instance, so no performance or connection issues here (we do not do accounting into the db or anything like that). ldap works fast. And there are no messages from rlm_ldap or rlm_sql which indicate trouble with sql or ldap connections So we kind of sorted out the "classic causes" for slowing down radius .... If our people move over the campus with ~3.000 smartphones with actvated wifi, request numbers increase when they enter new wi-fi cells and trouble begins: There is barely an auth ok or incorrect in the log but lots of discarding duplicates messages and cpu load is going up to 120 and a higher number of messages like Tue Feb 11 18:22:37 2014 : Error: rlm_eap: No EAP session matching the State variable. appears in the log. I can see that there are a few messages like Tue Feb 11 09:26:50 2014 : Info: WARNING: Module rlm_preprocess became unblocked for request 241193 and Tue Feb 11 09:26:51 2014 : Info: WARNING: Module rlm_eap became unblocked for request 241193 at the time when the problem appears. Can this point to the preprocess module where it gets "slow", with eap getting blocked as a consequence of a blocked preprocess module? We have a lot of NAS in our environment: there are over 2200 NAS in total in clients.conf, which are 350 heavily used WLAN access points (auth only, no acct) and switches which do a administrative login only every 5 min, and ~ 10 VPN controllers. As having so many NAS, preprocess has to do a max of 2200 expansion like Fri Feb 7 15:41:16 2014 : Debug: [preprocess] expand: %{Client-IP-Address} -> x.x.x.x in order to determine the allowed client. That are ~26.400 checks for preprocess in one peap/mschap request for example (~12 request-packtes x NAS). Is there some kind of "recommened maximum number of NAS" for one instance of freeradius? Here is our thread_pool and request config: max_request_time = 120 cleanup_delay = 5 #256 x NAS (By the way: "This should be 256 multiplied by the number of clients. # e.g. With 4 clients, this number should be 1024. " Is client in this contenxt supplicant or NAS?) max_requests = 563200 thread pool { start_servers = 5 max_servers = 128 min_spare_servers = 3 max_spare_servers = 128 # max_queue_size = 65536 max_requests_per_server = 0 } Thanks for your help Kind regards Anja

8 28